EPAM KYX AgentFlow — KYC/KYB Automation

Overview

EPAM KYX AgentFlow accelerates and automates the manually intensive KYC/KYB client-onboarding review. It ingests an onboarding case -- subject, jurisdiction, company number, and documents -- then runs a team of specialised AI agents on Amazon Bedrock AgentCore to gather evidence and computes an Approve or Refer recommendation with a deterministic, versioned policy-as-code engine. Agents gather evidence; rules and people decide.

Quantified Outcomes

• 60-80% increase in case-handling efficiency • 35-50% reduction in cost per case • Improved accuracy through policy-as-code guardrails

What It Does

Evidence Gathering by AI Agents: Six Bedrock AgentCore runtimes (orchestrator plus documents, registry, ownership/UBO, screening, and narrative agents) extract identity and corporate documents with Amazon Textract and Claude, fetch company registry and Legal Entity Identifier (GLEIF) records, walk the ownership chain to ultimate beneficial owners, and screen the subject, directors, and persons with significant control against sanctions, PEP, and adverse-media lists. Each agent returns a schema-validated evidence envelope citing its sources. No agent may return a decision.

Deterministic Decisioning: A policy-as-code engine adds risk points per factor, maps the total to a risk band, dispositions screening hits, and produces the Approve or Refer recommendation with a plain-English explanation. Policy packs are versioned JSON, editable as plain sentences in the admin plane, with rollback.

Human Review with Four-Eyes Control: A senior reviewer proposes a decision and a different reviewer confirms it. Control depth is risk-tiered and configurable to the client's policy. Restricted analysts see subject personal data masked.

Regulatory Decision Trail: Every agent run, policy result, proposal, confirmation, export, and administrative change is written to an S3 Object Lock (WORM) trail with model, prompt, and tool-call digests -- any case can be reproduced for a regulator. Cost telemetry records tokens and spend per case.

Third-Party Data Integration: An Integration Gateway provides a single access layer to every external provider. Per-environment provider profiles decide whether a call hits committed fixtures, a synthetic third-party sandbox, or the live provider.

Privacy Engineering: Machine-readable record of processing, role-based masking, PII access logging, data-subject access export, and right-to-erasure by crypto-shredding -- with a statutory AML retention override.

Business Benefits

• Improved process quality and accuracy through consistent, policy-driven decisions • Reduced customer friction and faster routes to revenue via accelerated onboarding • Substantial cost reduction -- model spend measured at approximately US $0.003 per case for extraction; the estate is largely volume-insensitive • Improved satisfaction for internal review teams and clients • Regulator-ready: immutable, reproducible decision trail on every case

How It Is Delivered

Deployed as single-tenant infrastructure-as-code (Terraform) into one AWS account and one region under the customer's control. A standard installation typically takes 1.5-2 hours end to end. EPAM delivers implementation, custom scenarios (existing landing zone/VPC, corporate IdP federation, live providers, alternative DR region), and ongoing support under a Statement of Work.

Built on AWS

Amazon Bedrock and Bedrock AgentCore (Claude Haiku 4.5 and Claude Sonnet 4.6 via EU inference profiles, with Bedrock Guardrails), Amazon Textract, Amazon ECS on AWS Fargate, Amazon CloudFront, AWS WAF, Elastic Load Balancing, Amazon Cognito, Amazon DynamoDB, Amazon S3 (Object Lock), AWS KMS, AWS Secrets Manager, AWS Systems Manager, Amazon CloudWatch, AWS CloudTrail, AWS Backup, Amazon ECR with AWS Signer and Amazon Inspector, Amazon API Gateway (private), AWS PrivateLink, Amazon Route 53, and AWS Certificate Manager.

Security and Compliance Posture

Passed the AWS Customer-Deployed Foundational Technical Review (FTR). Single public entry point (CloudFront plus WAF); everything else private (internal ALB, no NAT, no internet route, PrivateLink-only egress); least-privilege IAM; customer-managed KMS keys; WORM decision trail with 7-year Object Lock on test and production environments; cross-region DR (RPO of 15 minutes or less, RTO of 4 hours single-store).