AI Agents Zurich — KYC/AML, Claims Automation & Crypto Valley

#AI Agents in Zurich: Local Market Context

Zurich occupies a singular position in the European B2B technology landscape. As Switzerland's financial capital, the city hosts the headquarters of UBS, Julius Baer, Swiss Re, and Zurich Insurance Group, alongside ETH Zurich — one of the world's top-ranked institutions for AI and machine learning research. The proximity to Crypto Valley in Zug, barely 30 minutes south, adds a concentrated cluster of DLT-native companies operating under FINMA crypto licences. For companies operating here, the demand for AI agents is shaped by three forces: the stringent regulatory environment (FINMA, nFADP, AMLA), the expectation of Swiss data residency, and the need to integrate with legacy financial infrastructure that runs on Avaloq, Temenos T24, or Finnova.

The word "agent" has been stretched to cover everything from a chatbot with a search box to a fully autonomous system that moves money. In the engagements we actually run in the Greater Zurich Area, an agent is something narrower and more useful: a process that decomposes a task into steps, calls tools — a commercial register lookup, a sanctions screening service, a core banking read API, a document store — reasons over what comes back, and either completes the step or escalates. What separates it from classic robotic process automation is tolerance for messy input: a scanned articles of association in German, a claim described in three sentences of dialect-inflected free text, a counterparty name spelled four different ways across four systems.

That tolerance is exactly what makes agents attractive in Zurich and exactly what makes supervisors nervous. Swiss financial institutions do not have a workflow-automation problem — they have spent twenty years and considerable money on BPM platforms. What they have is a judgement bottleneck: thousands of small determinations a day that require reading unstructured evidence and applying a policy, made by expensive people whose time is the scarcest resource in the building. Zurich salary levels change the arithmetic of automation entirely. A queue that would never justify an engineering project in a lower-cost market pays for itself here at a fraction of the volume.

The third force is integration, and it is the one that quietly decides whether a project ships. Avaloq, headquartered in the Zurich area, runs the back office of a large share of the city's private banks; Temenos T24 and Finnova cover much of the rest, with Finnova particularly strong among cantonal institutions. These platforms are heavily parametrised, often carrying two decades of client-specific scripting. An agent that must read a position, a fee schedule or a client relationship hierarchy from one of them is not blocked by model capability. It is blocked by the question of which of four tables holds the authoritative value and who is allowed to answer that question. We budget for this explicitly rather than discovering it in week five.

#Autonomy is a design parameter, not an ambition

The productive conversation in a regulated Zurich institution is never "how autonomous can this be" but "what is this agent permitted to do without a human, and how is that boundary enforced technically rather than by policy". We express it as a permission surface: read-only tools, write tools that create drafts, write tools that commit state, and tools that communicate with a client or an authority. Each tier moves the risk classification, and the last two almost never go to an agent in the first release.

The revised Federal Act on Data Protection sets a hard edge here. Article 21 gives an individual the right to be informed of a decision taken exclusively by automated means that has a legal effect or significantly affects them, and to demand that a human reviews it. In practice this means an agent may assemble the file, weigh the evidence, rank the alternatives and write the rationale — but the moment the output determines whether someone is onboarded, indemnified or exited, a named person must be able to disagree with it and the record must show that they could. Designing for this from the start costs nothing. Retrofitting it after the workflow is built costs a quarter.

#Agent Patterns That Earn Their Keep in Swiss Financial Operations

We deploy against processes with a specific shape: high volume, unstructured evidence, a written policy that already exists, and a measurable queue. Six patterns account for most of the value we have seen in this market.

#Client onboarding and periodic KYC review

A corporate onboarding file in a Zurich bank is a small research project: articles of association and commercial register extracts pulled from Zefix against the UID number, ownership structure unwound to the beneficial owners required under the banks' due diligence convention, sanctions screening against the SECO lists as well as EU, UN and OFAC, politically exposed person checks, source-of-wealth narrative, and the documentation package the AMLA regime expects. The agent's job is to assemble and reconcile — reading the German-language register extract, resolving the entity across name variants, flagging where the declared structure and the register disagree, and drafting the risk rationale with every assertion linked to the document it came from. The compliance officer arrives at a file that is already argued rather than a folder of PDFs.

The same machinery is worth more on periodic review than on new onboarding, and almost nobody starts there. Most institutions carry a backlog of overdue reviews on existing relationships, each requiring the same evidence refresh. An agent that re-runs the checks, diffs the result against the file as it stood at last review, and surfaces only what changed converts a full re-examination into an exception queue.

#Transaction monitoring alert triage

Rule-based monitoring systems generate alerts at a rate calibrated to avoid missing anything, which means most of what reaches an analyst is noise. The triage agent does the work a junior analyst does in the first fifteen minutes: pull the customer profile and expected activity pattern, retrieve the transaction context and counterparty history, check whether the same pattern was investigated and cleared three months ago, and draft either a closure rationale or a structured escalation. Where the file genuinely warrants a report to MROS, the agent prepares the narrative from the evidence already gathered rather than leaving an analyst to reconstruct it. The design rule we insist on: the agent may close nothing. It may recommend closure with a complete rationale, and the throughput gain comes from the analyst reviewing a written argument instead of building one.

#Claims intake, classification and routing

Swiss personal-lines claims arrive on mobile phones — a few lines of free text, photographs taken in bad light, and a PDF scanned at an angle. A multimodal intake agent classifies the claim type, extracts the fields the case management system requires, reads the policy wording to check whether the described event is plausibly covered, notes the deductible and any sub-limits, flags anomaly signals for the fraud unit, and routes to an adjuster with the right authority level. The economic gain is not in the decision, which stays human under both the insurance supervisory regime and Article 21; it is in eliminating the transcription hour that sits between the customer's submission and anyone competent looking at it.

#Regulatory watch and policy impact mapping

FINMA circulars, guidance notes and FAQ updates, SECO sanctions amendments, Basel Committee consultations and cantonal supervisory publications arrive continuously and in three languages. A watch agent ingests the sources, identifies material changes, and — the part that matters — maps each change onto the internal artefacts it affects: the specific policy paragraph, the control description, the model documentation, the training material. It then drafts the redline. The non-negotiable design property is provenance: every proposed edit cites the source paragraph that motivates it. Without that, a compliance officer verifies the agent's work from scratch and the exercise has cost time rather than saved it.

#VASP due diligence and Travel Rule handling in Crypto Valley

Companies operating under the Swiss DLT Act framework and FINMA fintech, banking or DLT trading facility licences face a due diligence problem with no analogue in traditional banking. An onboarding file combines conventional corporate KYC with on-chain evidence: address attribution and risk scoring through blockchain analytics, exposure to mixers and sanctioned addresses, and the originator and beneficiary data exchange that FATF Recommendation 16 requires, implemented in Switzerland through the anti-money laundering ordinance with its own threshold for occasional virtual-asset transactions. Unhosted wallet transfers need a documented exception path — proof of control, and a written rationale that survives an audit. Agents suit this well because the evidence is heterogeneous and the policy is explicit; the constraint is that on-chain data is public while the off-chain client file is not, and the architecture has to keep that boundary visible.

#Reconciliation and exception handling

Every bank in the city carries a daily population of breaks: nostro and vostro mismatches, corporate action discrepancies, settlement failures, fee calculation disputes. Each one is investigated by someone reading two or three systems and a counterparty message, then writing a short explanation. Agents are unusually good at this because the reasoning is bounded and the evidence is machine-readable — and because the ground truth is unambiguous, the evaluation set almost builds itself. It is the least glamorous pattern on this list and frequently the one with the shortest payback.

#The Architecture Decisions That Decide the Outcome

Orchestration and state. An agent that must survive a two-day human review step is a workflow, not a chat session. We build on durable state with explicit checkpoints, so a run can pause for a compliance decision, resume, and be replayed for audit. Systems built as long conversations fail the first time someone goes on holiday mid-file.

Tool boundaries and least privilege. Every tool the agent can call is a permission grant, scoped and logged. Read access to a core banking API is not a licence to write; a screening service is not a licence to export. We define this surface with the security function before the first prompt is written, because it is also the answer to the outsourcing questions FINMA's circular on outsourcing raises about audit and inspection rights across subcontractors.

Prompt injection is a live threat here. Agents that read client-supplied documents will eventually read a document containing instructions. In a KYC or claims context the attacker has a direct incentive. Mitigation is architectural — untrusted content never occupies the same channel as instructions, tool calls are validated against an allow-list, and any state-changing action passes a check that does not depend on the model's judgement.

Model placement and data class. Not every step needs the same model, and not every step may leave Switzerland. We classify the data first — public, internal, confidential, client identifying — then place the workload. Article 47 of the Banking Act makes disclosure of client data a criminal matter, and Article 271 of the Criminal Code complicates anything that looks like acting for a foreign authority on Swiss soil. Open-weight models self-hosted on Swiss infrastructure, or pseudonymisation before an external call, are the practical answers. A data processing addendum is not.

Evaluation before scale. A golden set built with the actual reviewers — a few hundred real cases with known correct outcomes, kept current — is the cheapest component of the programme and the only one that tells you whether last week's change helped. Agents that ship without it are demos with good luck.

#Getting to Supervised Production

We move an agent through three gates rather than launching it. In shadow mode, it processes live cases in parallel with the human team and its output is compared, never used; this is where the evaluation set gets honest and where the process owner finds the edge cases nobody documented. In suggest mode, its output reaches the reviewer as a pre-filled draft with rationale, and the measurement shifts to acceptance rate and edit distance — how often the human keeps what it wrote. Bounded autonomy comes last and only for the case classes where accuracy has been demonstrated, with a defined confidence threshold below which the file goes to a person regardless. Typical timelines from framing to a live, supervised service run 8 to 12 weeks, with monitoring against a 99.5% availability commitment thereafter.

#Where These Projects Go Wrong

The failure we see most often is transferring alert fatigue rather than removing it. If the agent produces a recommendation the reviewer cannot verify quickly, the reviewer redoes the work and the queue gets longer. Everything depends on the output being auditable in under a minute.

The second is autonomy granted for its own sake. Agents that commit state early acquire an incident history that costs more political capital than the automation saves. Start where the cost of being wrong is a wasted minute.

The third is missing idempotency. Agents retry. Without idempotency keys on every write, a retried run creates the duplicate case, the duplicate screening request, the duplicate notification — and the first production incident is an embarrassing one.

The fourth is the pilot without a process owner. If the person whose team runs the queue is not in the framing workshop, the objections that should have been requirements arrive as resistance after go-live.

The fifth is building governance documentation retroactively. Model inventory, risk classification, data lineage, testing evidence and human oversight design produced alongside the build cost a fraction of the same pack assembled under audit pressure, and internal audit can tell the difference on sight.

#What Changes When Agents Are Live

Across our production deployments the pattern is consistent: roughly 40% lower operating cost on the processes actually automated, and around 55% more productive time on the high-value work people move to instead — with an average return on investment of 340% over twelve months. Those are portfolio averages, not a forecast for your queue, which is why we fix the baseline before anything is built. In Zurich the number that persuades a management board is usually cycle time: hours from client instruction to executed onboarding, from claim notification to first coverage decision, from a FINMA publication to an updated internal policy.

#Why Nehos for Agent Work in Zurich

• 47 specialists in AI, data and cloud and 200+ projects in production since 2014 — an engineering firm, not a strategy practice that subcontracts delivery.
• Sovereignty by data class, not by slogan. Classification drives placement, and regulated workloads run on Swiss infrastructure with documented residency.
• Supervisory evidence delivered with the system, mapped to your existing risk taxonomy and to FINMA's expectations on outsourcing, operational resilience and AI governance.
• Integration experience with the platforms that actually run this city — Avaloq, Temenos T24, Finnova — including the unglamorous data lineage work that precedes any agent.
• English and German working languages, with documentation your internal audit function can read without a translator.
• A free 30-minute audit to test whether a specific queue is worth automating — and to tell you when it is not.

Related areas we cover: AI agents for KYC and AML in Zurich, FINMA compliance monitoring agents, insurance and reinsurance claims automation, AI automation for Crypto Valley and DLT Act companies in Zug, and sovereign agent deployment with Swiss data residency.

For the broader picture, see the AI agency Zurich — full service overview and the Nehos Zurich hub overview. Our methodology is documented on the Nehos AI agents service — detailed page and our sector work on the Banking, Insurance, Finance vertical. For Romandy, see AI agents Geneva — French-speaking Switzerland.

The questions below are the ones Zurich compliance and operations teams raise most often before a first engagement.