Multi-Agent Compliance Review

Overview

Compliance review in banking is inherently multi-faceted. When a bank launches a new product, enters a new market, or modifies an existing process, the compliance team must evaluate the change against dozens of regulatory frameworks: BSA/AML, fair lending, consumer protection, privacy regulations, safety and soundness standards, and state-specific requirements. No single analyst -- and no single AI model -- has comprehensive expertise across all these domains.

A multi-agent architecture mirrors how compliance departments actually work: specialized experts each review their area, then findings are consolidated into a comprehensive assessment. Instead of one monolithic AI model trying to be an expert in everything, multiple specialized agentsAgentsAI systems that can autonomously plan and execute multi-step tasks by calling tools, querying data sources, and making decisions without human intervention at each step -- typically within defined permissions and human approval checkpoints.See glossary each focus on what they do best, coordinated by an orchestration layerOrchestration FrameworkSoftware that coordinates LLMs, tools, and data sources into complex workflows. Frameworks like LangGraph, CrewAI, and vendor toolkits such as the OpenAI Agents SDK and Microsoft Agent Framework manage prompt chains, memory, and tool calling for multi-step AI tasks.See glossary that manages the workflow.

This architecture is more complex than a single-model approach, but it produces significantly better results for compliance review because each agent can be tuned, tested, and validated independently against its specific regulatory domain.

In May 2026 FIS and Anthropic announced a Financial Crimes AI Agent that assembles anti-money-laundering evidence across bank systems and checks it against known typologies, with BMO and Amalgamated Bank as early adopters. The design principle matches this unit: in Anthropic's words, "every decision stays with the investigator."

Architecture Components

Orchestrator Agent

The orchestrator is the compliance coordinator of the system. It receives the review request, determines which specialist agents need to be involved based on the type of change being reviewed, sequences their work (some agents need outputs from others), and consolidates findings into a unified assessment.

The orchestrator manages workflow, resolves conflicts between findings, and ensures completeness; it does not perform substantive analysis. Tools like LangGraph and Microsoft Agent Framework, or managed agent platforms such as Amazon Bedrock AgentCore and Google's Gemini Enterprise Agent Platform, provide the workflow management that orchestration requires.

Document Analysis Agent

This agent processes the input materials -- product proposals, policy changes, marketing materials, process documentation -- and extracts structured information: what is changing, who is affected, what data is collected, what decisions are automated, and what customer interactions are involved.

The document analysis agent produces a structured "change summary" that other agents use as their input. This normalization step ensures all specialist agents work from the same factual understanding of the proposed change.

Regulation Matching Agent

Given the structured change summary, this agent identifies which regulatory frameworks are implicated. A new digital lending product might trigger: Reg B (Equal Credit Opportunity), Reg Z (Truth in Lending), BSA/AML requirements, state-specific lending laws, UDAP/UDAAP considerations, and third-party risk management guidelines if external vendors are involved.

This agent maintains a curated index of regulatory triggers (e.g., "any change affecting consumer credit decisions triggers Reg B review") rather than the full text of every regulation. RAGRetrieval-Augmented Generation (RAG)A pattern that combines document retrieval with LLM generation. The system searches a knowledge base for relevant context, then feeds it to the model to produce grounded, accurate answers.See glossary against the full regulatory text is used when deeper analysis is needed.

Gap Identification Agent

For each triggered regulation, this agent compares the proposed change against specific regulatory requirements and identifies gaps -- areas where the proposal does not adequately address a regulatory requirement. This is the most analytically demanding agent, requiring the ability to reason about regulatory intent, not just match keywords.

The gap identification agent produces structured findings: what requirement is at risk, what evidence supports the finding, what severity level (critical gap vs. advisory observation), and what remediation options exist.

Report Generation Agent

The final agent consolidates all findings into a structured compliance review report. It synthesizes findings from multiple specialist agents, resolves duplicates, establishes overall risk ratings, and generates the document that the compliance committee will review.

The report follows the institution's standard template: executive summary, regulatory framework mapping, findings with severity ratings, recommended remediation, and a draft opinion (approve, conditional approve, or reject for remediation).

Tool Access (MCP)

Model Context Protocol (MCP) has become the cross-vendor standard plug between agents and the regulatory library, case files, and core systems they need, governed since December 2025 by the Linux Foundation's Agentic AI Foundation (members include AWS, Google, Microsoft, OpenAI, Anthropic, and Bloomberg). Think of it like SWIFT message formats: because every connection follows one standard, you control and log access at the connector rather than inside each agent.

Human Review Interface

Every multi-agent compliance system must include a human review layer. The LLMLarge Language Model (LLM)A neural network trained on vast amounts of text data that can understand and generate human language. LLMs power chatbots, document analysis, code generation, and many enterprise AI applications.See glossary-generated report is a draft for human compliance officers to review, modify, and approve -- not a final determination. The interface enables reviewers to accept or reject individual findings, add context the AI missed, adjust severity ratings, and record their professional judgment.

Data Flow

1. Review initiation: A business line submits a product proposal or process change for compliance review through the intake system, along with all supporting documentation

2. Document analysis: The document analysis agent processes all submitted materials and produces a structured change summary -- what is changing, who is affected, what data flows are involved

3. Regulatory scoping: The regulation matching agent evaluates the change summary against its regulatory trigger index and identifies all applicable regulatory frameworks (BSA/AML, fair lending, consumer protection, privacy, etc.)

4. Parallel gap analysis: The orchestrator dispatches gap identification tasks for each triggered regulatory framework. Where feasible, these run in parallel; where dependencies exist (e.g., fair lending analysis needs the data flow output from privacy analysis), the orchestrator sequences appropriately

5. Finding consolidation: The orchestrator collects findings from all gap identification runs, resolves duplicates (the same issue may be flagged by multiple regulatory frameworks), and resolves severity conflicts

6. Report generation: The report generation agent produces a structured compliance review document with executive summary, detailed findings, remediation recommendations, and a draft compliance opinion

7. Human review: Compliance officers review the AI-generated report through the review interface, accepting, modifying, or rejecting findings and recording their professional judgment

8. Final determination: The compliance committee reviews the human-validated report and issues the official compliance opinion. The AI's contribution and human modifications are both captured in the audit trail

Banking Use Case

Scenario: A mid-size bank is launching a new AI-powered small business lending product that uses alternative data sources (cash flow analysis from connected bank accounts) in the credit decision. The compliance team needs to assess regulatory implications before the product can proceed to pilot.

Multi-agent review flow: The document analysis agent processes the product proposal, vendor agreements, model documentation, and marketing materials. The regulation matching agent identifies 7 applicable frameworks: Reg B (equal credit opportunity -- alternative data and fair lending), Reg Z (truth in lending disclosures), BSA/AML (new product risk assessment), UDAP/UDAAP (marketing claims), model risk management guidance (for the AI credit model), third-party risk management (the data aggregation vendor), and state-specific lending requirements for the 12 launch states.

The gap identification agents flag three critical findings: (1) the alternative data model has not been validated for disparate impact under Reg B, (2) the vendor agreement lacks required third-party risk management provisions for model access to consumer financial data, and (3) the marketing materials contain performance claims that lack adequate substantiation under UDAAP. The report generation agent consolidates these into a structured compliance review recommending conditional approval pending remediation of the three critical gaps.

Note the model risk framework the agents cite. In April 2026 the Federal Reserve, OCC and FDIC replaced SR 11-7 (and OCC Bulletin 2011-12) with updated model risk management guidance -- SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026. The new guidance is aimed mainly at banks with over $30 billion in assets, and it explicitly places generative and agentic AI outside its scope while the agencies gather input on how banks use AI (the OCC said a request for information is coming). That is not a free pass: examiners can still act on unsafe or unsound practices or violations of law, and most banks continue to apply model-risk disciplines -- inventory, validation, monitoring, documentation -- to their AI systems. Here, the cash-flow credit model is non-generative, so it is in scope; the compliance-review agents themselves are not, and the bank governs them under its own AI policy and third-party risk rules.

Key Architectural Decisions