The Compliance Obligation Every Card Program Carries

Every consumer card program operating in the United States carries a non-negotiable obligation: Know Your Customer. KYC isn't a checkbox. It's a living requirement that governs who is permitted to access the financial system and who isn't. For card issuers and the fintechs that build interfaces on top of them, that means screening every account holder against sanctions lists and Politically Exposed Persons (PEP) databases, and conducting adverse media checks to surface negative press tied to financial crimes, fraud, or other disqualifying conduct. While the verification process is tied to account opening, it doesn't end there. Monitoring runs continuously to ensure fintechs and FIs are informed of any suspicious activities from customers throughout their lifecycle.

The Longheld Challenge: Hitting the Ceiling of Human Capacity

When an applicant doesn’t pass identity verification for a variety of reasons, like incorrectly typing their SSN or more serious instances like the cardholder’s name tied to a financial crime, a case is created. Our partner, Persona, an identity platform that helps fintechs scale identity operations, fight fraud, and meet KYC, KYB, and AML requirements, creates more context by searching for the consumer against negative news and adverse media.  From there, every case needed to be manually reviewed to be approved, denied, or needing further information based on a compliance analyst’s analysis of the news and media report. That escalation often included a batch of 1- 10+ adverse media articles per flagged account, each requiring individual review by a compliance analyst.

A skilled analyst, working at full capacity, could process roughly 500 cases per month. We were seeing thousands of monthly cases that needed review. The math didn't work.

At 500 cases per analyst per month, you either accept linear growth, or accept risk. None of those options work for a scaling fintech.

This asymmetry between case load and capacity forces growing fintechs into a familiar workaround: business process outsourcing (BPO) to offshore teams in the Philippines and Malaysia. Outsourcing adds overhead, introduces coordination friction, and creates latency in decisions that need to be fast. It also meant that judgment calls about nuanced adverse media, distinguishing a past DUI from a money laundering conviction, are made by teams several time zones away, without the same context or training as in-house compliance staff.

This is why we’re so bullish about the future of quality program services and competitive pricing at Lithic; where legacy companies have successfully scaled support through outsourcing labor and passing through costs, our nimble size allows us to promise businesses exceptionally consistent quality for support, compliance, services at competitive prices when we give experts like more leverage through AI-enabled tools. The quality and capacity constraints weren't a people problem. They were a process design problem. Our compliance experts recognized we needed a new approach.

Agents as the First Line of Defense

Instead of following the trodden path of outsourcing to meet the needs of growing case reviews, Compliance Lead, Darius Griffin, built an adverse media screening agent designed to handle the first-pass review that had previously consumed so much analyst time.

The agent scans the negative media linked to a case provided by Persona, searching for financial crimes, money laundering, and fraud. It runs continuously, screening clients on a daily basis so that new flags surface in near real-time rather than at the next manual review cycle.

The agent's logic is calibrated to reflect the nuance that compliance decisions require. Not all adverse media is equal. A hit tied to drug trafficking or financial crimes is treated as actionable and escalated for human review with a recommendation to decline. A hit tied to a past DUI or a minor offense gets flagged and then typically dismissed. The agent makes a recommendation. A human makes the final call.

That last point is deliberate. The agent does not deny accounts. It surfaces risk signals, contextualizes them, and hands off the high-stakes decisions to people who are accountable for them. The goal was never to remove human judgment from compliance. It was to stop wasting human judgment on cases that don't require it.

89–90% of cases are now resolved through automated review. Only 10% require a human to weigh in — down from 100%.

The accuracy gains have been meaningful in their own right. Human reviewers experience fatigue over the course of a shift. An agent doesn't. The consistency of automated screening has improved decision quality, not just throughput.

How We Built It: Adverse Media Agents 

The initial flow was built using n8n, an open-source workflow automation tool that let the team move quickly and iterate without heavy engineering lift so the subject-matter expert could lead the design with full context. With a proven flow we teamed up with our Head of Support to  create a lightweight internal app. Compliance then took that foundation and improved the functionality, fine-tuning the agent's decision logic based on his subject matter expertise in compliance.

Once the prototype proved its value, the team moved the agent off n8n and onto a locally hosted internal application. The reason was straightforward: client data should not travel through third-party servers. Running the agent locally kept sensitive identity information inside our own infrastructure, a design choice that reflects the kind of privacy-by-default thinking that defines the company's broader product philosophy.

Persona remained the system of record throughout. The agent operates downstream of Persona's initial checks, handling the escalation cases that require deeper investigation. The two systems complement each other. Persona handles the structured, rules-based initial pass. The AI agent handles the judgment-intensive adverse media review so that expert human reviewers stay fresh. At our current volume we saw the capacity for human reviewers increase by 3x when leveraging the agent.

A New Financial System Enabled by AI

What we built is an example of a broader shift happening across regulated industries. The most valuable compliance professionals have always been the ones who can apply judgment, not just process volume. The problem is that for most of the history of modern compliance, those two things were bundled together. You couldn't apply judgment at scale without also processing enormous volume.

AI agents disaggregate that bundle. When an agent handles the high-volume, lower-stakes screening work, experienced compliance analysts can redirect their time toward the cases that actually benefit from their expertise. The 10% of cases that require human review are the cases where human review genuinely matters.

This kind of leverage is part of what makes aspects of the traditional financial system worth preserving and extending. The power of regulated finance has always rested on a few pillars: the reversibility of payments, the monitoring of fraud and financial crime, and the assurance that the ability to transact doesn't fall into the wrong hands. Maintaining those assurances at scale requires better tooling, not more headcount.

We're moving toward a world where good actors can be verified faster and bad actors identified more reliably — at a fraction of the current cost.

Our bet is that this kind of careful, privacy-preserving AI deployment is also a path toward a more efficient financial system. A global ecosystem where legitimate participants aren’t delayed services because of human review constraints, where compliance costs don't price out smaller programs, and where fiat and digital currencies work alongside each other to guarantee competitive money movement prices requires the kind of efficient, high-quality infrastructure that tools like this make possible.

The agent we built is one piece of that picture. It's a practical demonstration that compliance and scalable quality are no longer in tension with the right tools at our disposal.

Ready to build a compliant card program without sacrificing scale or quality? Talk to the Lithic team.