AI/ML engineering · Banking
AI document processing for banks
We build AI document processing for banks: extraction of data from identity and corporate documents, bank statements and financial statements, with confidence scores, validation against rules and a review screen where a person confirms what the system is unsure about. It feeds onboarding, credit and compliance systems without rekeying, and you own the code and the models.
Checklist · Financial crime
AML, KYC and fraud system requirements checklist
A requirements checklist for transaction monitoring, fraud detection and document-based KYC systems: data, scenarios and models, alert and case handling, reporting, governance and security.- 01Eight requirement areas written as testable statements.
- 02What to ask for on data quality, lineage and model governance.
- 03Where real-time and batch monitoring each fit.
- 04Seven questions to put to any vendor or development partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Document intake and classification
Documents received by upload, email or API are classified by type and split into pages and sections, whatever the format or scan quality. - 02
Identity document reading
Extraction from passports and identity cards, including the machine-readable zone, with checks for consistency between the zone and the visible text. - 03
Corporate document extraction
Registration certificates, ownership charts, board resolutions and constitutional documents turned into structured company, director and owner data. - 04
Bank statement parsing
Transactions, balances and periods extracted from statements in many layouts, reconciled so opening and closing balances add up. - 05
Financial statement spreading
Balance sheets and income statements mapped to the bank's standard template, with notes and adjustments flagged for an analyst. - 06
Validation and cross-checks
Arithmetic, date and cross-document checks, such as matching the name and address across documents, with failures routed to review. - 07
Tamper and fraud signals
Detection of edited, duplicated or inconsistent documents, with signals recorded for the onboarding and fraud teams. - 08
Human review and learning
A review screen showing the source and the extracted value, where corrections feed back into the extraction models. - 09
Integration and audit
Structured results delivered to onboarding, credit and case systems, with the source document, the model version and every correction stored.
Reference architecture.
Standards and interfaces
What we design against.
- ICAO 9303
- The standard for machine-readable travel documents, used to read and verify the zone on passports and many identity cards.
- ISO/IEC 30107
- Presentation attack detection for liveness and document capture where selfies and live capture are part of the flow.
- OWASP Top 10 for LLM Applications
- Controls for prompt injection, data leakage and unsafe output when language models read untrusted documents.
- Know-your-customer and due diligence rules
- What a bank must verify and keep for each customer type, which the extracted fields and evidence must support.
- ISO/IEC 27001 and data protection law
- Controls on storage, access and retention for identity documents and financial records.
- Model risk management
- Validation, monitoring and change control for extraction models used in regulated decisions.
Data model
The core entities.
- Document
- Source file, type, pages, received channel, hash and retention class.
- Extracted field
- Name, value, confidence, location on the page and the model that produced it.
- Validation result
- Rule applied, outcome and the fields involved.
- Spread statement
- Template lines, periods, adjustments and analyst notes.
- Review task
- Fields flagged, reviewer, corrections and time taken.
- Tamper signal
- Type of anomaly, evidence and the decision taken.
- Model version
- Models used, evaluation results and release date.
When custom development is the right call.
Controls designed in, not added later.
Data stays in your environment
Documents are processed in your own cloud account or data centre, with models hosted privately where required.Safe handling of untrusted content
Documents are treated as hostile input: malware scanning, isolation, and defences against instructions hidden in content for language models.Access and retention
Role-based access to documents, masking in review screens where possible and automatic deletion on schedule.Human accountability
Fields below a confidence threshold, and any identity or fraud decision, are confirmed by a person.Audit trail
The source, the extracted value, the corrections and the model version are kept for every field.
From discovery to a system you run.
- 01
Document and workflow review
We collect representative documents and trace how they are read and rekeyed today by onboarding, credit and compliance. - 02
Extraction and validation design
Fields, templates and validation rules are specified, and candidate models are tested on your documents. - 03
Build and tune
The pipeline and review screen are built and tuned on real documents, with accuracy reported per field and document type. - 04
Assisted mode
Staff use the review screen on every document, so extraction can be compared with their own work. - 05
Selective automation
Fields and document types that meet the agreed accuracy skip review, and the rest stay with people.
Relevant work
Where to see our work.
Common questions.
- How accurate is the extraction?
- Accuracy depends on the document type and quality, so we measure it on your own documents per field and agree thresholds before any field skips review. Uncertain fields always go to a person.
- Can it read documents in several languages and scripts?
- Yes. Language and script support is tested on your document set, including documents that mix languages and scripts.
- Does a language model send our documents to an external service?
- Not unless you choose that. Models can be hosted in your own environment, and external services are used only where policy allows and with the controls that apply.
- Does the system decide whether a document is genuine?
- It provides signals, such as edits and inconsistencies. A person decides on identity and fraud, and the decision and reasons are recorded.
- Who owns the code and the models?
- You do. The code, the models trained on your documents and the data stay yours.