Context
KYC Copilot is my own product. I designed and built it as a commercial AML/KYC product, then open-sourced it. It is not a client engagement. The 14-minute figure is from the project’s test dossier, not a client production record.
KYC Copilot automates customer onboarding, document verification, and AML risk assessment. The domain punishes fluent improvisation: a wrong decision is not a bad demo, it is a regulatory event. The design goal was an agentic workflow that a compliance reviewer could audit, not a chatbot that sounded confident.
Constraint
Every step had to leave a trace, every irreversible action needed a human gate, and the data had to stay in the EU. The system runs as six LangGraph nodes with seven mechanically enforced invariants and a guardrail before human review.
What the method would test
| Axis | What is visible today | What is not yet proven |
|---|---|---|
| Reliability & Eval Coverage | Deterministic graph; retries; human gate | Throughput under concurrent onboarding |
| Cost-per-Success & Routing | Bounded model calls per dossier | Unit economics at 10k+ cases/month |
| Guardrails & Adversarial Safety | Seven invariants; guardrail before review | Red-team coverage across document fraud types |
| Observability & Drift | Step-level trace; reviewable evidence | Alerting and drift detection in production |
| Regulatory Control Readiness | EU-resident deployment; human review | Retention, DPIA, and regulator-facing audit pack |
Evidence
- 93% faster: 3.5 hours of manual document review reduced to 14 minutes in the project benchmark.
- Seven invariants: the workflow is constrained mechanically, not by prompt wording alone.
- EU-resident: deployed on Fly.io Amsterdam for GDPR-aligned data residency.
- Human review: the guardrail runs before a person sees the case; it does not replace the person.
Lesson
Agentic compliance systems fail at the boundaries: a malformed document, a missing field, a model that sounds certain. The invariants and the human gate matter more than the model choice.
What this means for a peer
If your compliance workflow has no invariant list, no trace, and no human gate, a model upgrade will not fix it. Start with the two checks that would stop a bad case from reaching a reviewer.
