Blogs
>
Workforce Gives AI Agents the Authority to Own a Risk Operation End to End 

Workforce Gives AI Agents the Authority to Own a Risk Operation End to End 

Nitzan Guy
Sep 24, 2026
Share:

Index

Last updated: 
Oct 1, 2026

Most compliance teams have already tried the first generation of AI agents for compliance: We have seen solutions like a copilot that drafts a summary, a bot that pulls a sanctions list, a script that flags a mismatched address. Each tool speeds up one step. None of them can run a case from start to finish, and none of them can carry a queue.

‍

That gap is the actual bottleneck. Underwriting and monitoring teams at acquirers, banks, payment service providers (PSPs), and marketplaces are not waiting on one slow task. Onboarding a merchant or resolving an alert runs through a sequence of judgment calls, evidence gathering, and escalation decisions, and today a person has to own that sequence from start to finish because no automation can be trusted to hold it together.

‍

Workforce is an agentic risk operations service that converts an institution's own policies, standard operating procedures, and analyst instructions into an operating model agents can execute. Instead of automating a task, we automate the entire process the task belongs to, and trigger alerts that require a human to get a decision or be involved in the process.

‍

‍

‍

The problem: task automation hits a ceiling

‍

We've watched teams add a copilot to the underwriting desk and hit the same wall six months later. The copilot drafts a faster summary. A workflow tool pulls a report or runs one check without anyone touching a keyboard. Both save real time. But someone still has to decide what to check next, weigh evidence that points two different ways, and call when a case needs to go up the chain, and that person doesn't disappear just because the tools got faster.

‍

That's the part that actually decides whether a portfolio can grow without the roster growing with it. A new point tool rarely takes anyone out of the loop. Usually it just hands the same person a quicker way to click through the same decisions.

‍

‍

Automate Your Risk Operation With Workforce

‍

‍

The insight: risk operations are a process

‍

Most risk teams already have this written down, they just don't think of it that way. Underwriting policy, monitoring SOPs, and escalation matrices already spell out what a good analyst checks, in what order, and what evidence justifies which call. That's basically a blueprint for the whole operation. It just hasn't been something software could actually run, until now. Ballerine calls this policy-as-north-star: the customer's own policy drives the work. Workforce takes all individual checks and processes and applies it across a full workflow instead of a single check.

‍

Here's how that plays out. Workforce runs on what we call a workflow compiler. It reads a policy or SOP the way it's actually written, in plain language, and turns it into something an agent can act on: what to check, what evidence counts, who's allowed to do what, when to escalate, and what the output should look like. From there, a merchant risk skills library does the legwork an analyst would normally do by hand: pulling business identity, web presence, site content, ownership and related entities, and any risk signals worth flagging. Put together, that's an agent that can carry an entire investigation end to end.

‍

‍

‍

‍

End to End Risk Operation Processes

‍

‍

‍

How Workforce applies to the day-to-day queue

‍

The two examples below show what that shift looks like today, from onboarding a new merchant through resolving an alert in a live queue.

‍

Merchant onboarding, including registry checks: a full underwriting review means working through company registries, ownership records, web presence, policy documents, and internal risk criteria in sequence, and no single check on its own is enough to make a decision defensible.

Workforce agents apply Know Your Business (KYB) automation across that full sequence, pulling and interpreting government and business registry data as part of underwriting, cross-referencing it against the institution's own policy, and assembling the evidence trail an underwriter would otherwise build by hand. Underwriting teams get a case that arrives assembled, with the registry work done and reasoned through against policy, instead of a stack of raw data they still have to interpret themselves.

‍

Alert resolution and alert triage: sanction screening hits, monitoring alerts, and web presence signals generate a high volume of cases, and a meaningful share turn out to be false positives once someone actually investigates, which today still falls to an analyst working one alert at a time.

Workforce agents handle that alert triage by applying the same research and reasoning a trained analyst would: checking whether a sanctions name match is a true hit or a common-name collision, checking it against the blocklist of known bad actors, whether a monitoring alert reflects a real policy violation or a benign business change, and whether a web presence signal holds up under closer review.

Cases an agent can resolve with confidence get closed with a documented rationale, while cases that don't meet that bar go to a human with the evidence already assembled, leaving monitoring teams with a queue where a human is in the loop only for the alerts that actually require judgment.

‍

‍

‍

Automate any process and decide when a risk expert should be notified

‍

‍

‍

An earned expansion of authority

‍

Workforce does not launch by handing agents full autonomy. Every workflow is backtested against the customer's own merchant portfolio before it goes live, and runtime controls define what data an agent can access and what it can recommend, execute, or escalate on its own.

Agents start in recommendation mode. As performance holds up, a customer can expand what an agent is trusted to do, moving from a single task, to a full investigation, to an entire queue. Complete evidence trails and ongoing analyst feedback let institutions raise that ceiling deliberately, on their own timeline, without giving up governance along the way. This is a model built to earn expanded authority over time, not a claim of day-one full autonomy.

‍

Ballerine builds AI agents for financial crime and merchant risk that operate like experienced underwriters and fraud analysts. The platform analyzes KYB, web, and transaction data across the merchant lifecycle: underwriting before go-live, ongoing monitoring, ad hoc checks such as enhanced due diligence and sanctions screening, and portfolio-wide oversight for independent sales organization (ISO) and payment facilitator (PayFac) partners.

Workforce is the layer of the platform that converts an institution's own policies and procedures into agentic workflows that run under governed, audit-ready controls, with a human in the loop wherever judgment is required.

‍

Automate Your Risk Operation With Workforce

‍

About the Author
Nitzan Guy
CPO & Co-Founder
@
Ballerine
Nitzan Guy is Co-Founder and Chief Product Officer at Ballerine, the AI-native platform financial institutions, payment providers and fintechs use to underwrite and monitor merchants across the full lifecycle. He has more than a decade of experience in product management and user experience, and before founding Ballerine he led the team responsible for customer onboarding, fraud and AML at a digital bank.

Reeza Hendricks

Most compliance teams have already tried the first generation of AI agents for compliance: We have seen solutions like a copilot that drafts a summary, a bot that pulls a sanctions list, a script that flags a mismatched address. Each tool speeds up one step. None of them can run a case from start to finish, and none of them can carry a queue.

‍

That gap is the actual bottleneck. Underwriting and monitoring teams at acquirers, banks, payment service providers (PSPs), and marketplaces are not waiting on one slow task. Onboarding a merchant or resolving an alert runs through a sequence of judgment calls, evidence gathering, and escalation decisions, and today a person has to own that sequence from start to finish because no automation can be trusted to hold it together.

‍

Workforce is an agentic risk operations service that converts an institution's own policies, standard operating procedures, and analyst instructions into an operating model agents can execute. Instead of automating a task, we automate the entire process the task belongs to, and trigger alerts that require a human to get a decision or be involved in the process.

‍

‍

‍

The problem: task automation hits a ceiling

‍

We've watched teams add a copilot to the underwriting desk and hit the same wall six months later. The copilot drafts a faster summary. A workflow tool pulls a report or runs one check without anyone touching a keyboard. Both save real time. But someone still has to decide what to check next, weigh evidence that points two different ways, and call when a case needs to go up the chain, and that person doesn't disappear just because the tools got faster.

‍

That's the part that actually decides whether a portfolio can grow without the roster growing with it. A new point tool rarely takes anyone out of the loop. Usually it just hands the same person a quicker way to click through the same decisions.

‍

‍

Automate Your Risk Operation With Workforce

‍

‍

The insight: risk operations are a process

‍

Most risk teams already have this written down, they just don't think of it that way. Underwriting policy, monitoring SOPs, and escalation matrices already spell out what a good analyst checks, in what order, and what evidence justifies which call. That's basically a blueprint for the whole operation. It just hasn't been something software could actually run, until now. Ballerine calls this policy-as-north-star: the customer's own policy drives the work. Workforce takes all individual checks and processes and applies it across a full workflow instead of a single check.

‍

Here's how that plays out. Workforce runs on what we call a workflow compiler. It reads a policy or SOP the way it's actually written, in plain language, and turns it into something an agent can act on: what to check, what evidence counts, who's allowed to do what, when to escalate, and what the output should look like. From there, a merchant risk skills library does the legwork an analyst would normally do by hand: pulling business identity, web presence, site content, ownership and related entities, and any risk signals worth flagging. Put together, that's an agent that can carry an entire investigation end to end.

‍

‍

‍

‍

End to End Risk Operation Processes

‍

‍

‍

How Workforce applies to the day-to-day queue

‍

The two examples below show what that shift looks like today, from onboarding a new merchant through resolving an alert in a live queue.

‍

Merchant onboarding, including registry checks: a full underwriting review means working through company registries, ownership records, web presence, policy documents, and internal risk criteria in sequence, and no single check on its own is enough to make a decision defensible.

Workforce agents apply Know Your Business (KYB) automation across that full sequence, pulling and interpreting government and business registry data as part of underwriting, cross-referencing it against the institution's own policy, and assembling the evidence trail an underwriter would otherwise build by hand. Underwriting teams get a case that arrives assembled, with the registry work done and reasoned through against policy, instead of a stack of raw data they still have to interpret themselves.

‍

Alert resolution and alert triage: sanction screening hits, monitoring alerts, and web presence signals generate a high volume of cases, and a meaningful share turn out to be false positives once someone actually investigates, which today still falls to an analyst working one alert at a time.

Workforce agents handle that alert triage by applying the same research and reasoning a trained analyst would: checking whether a sanctions name match is a true hit or a common-name collision, checking it against the blocklist of known bad actors, whether a monitoring alert reflects a real policy violation or a benign business change, and whether a web presence signal holds up under closer review.

Cases an agent can resolve with confidence get closed with a documented rationale, while cases that don't meet that bar go to a human with the evidence already assembled, leaving monitoring teams with a queue where a human is in the loop only for the alerts that actually require judgment.

‍

‍

‍

Automate any process and decide when a risk expert should be notified

‍

‍

‍

An earned expansion of authority

‍

Workforce does not launch by handing agents full autonomy. Every workflow is backtested against the customer's own merchant portfolio before it goes live, and runtime controls define what data an agent can access and what it can recommend, execute, or escalate on its own.

Agents start in recommendation mode. As performance holds up, a customer can expand what an agent is trusted to do, moving from a single task, to a full investigation, to an entire queue. Complete evidence trails and ongoing analyst feedback let institutions raise that ceiling deliberately, on their own timeline, without giving up governance along the way. This is a model built to earn expanded authority over time, not a claim of day-one full autonomy.

‍

Ballerine builds AI agents for financial crime and merchant risk that operate like experienced underwriters and fraud analysts. The platform analyzes KYB, web, and transaction data across the merchant lifecycle: underwriting before go-live, ongoing monitoring, ad hoc checks such as enhanced due diligence and sanctions screening, and portfolio-wide oversight for independent sales organization (ISO) and payment facilitator (PayFac) partners.

Workforce is the layer of the platform that converts an institution's own policies and procedures into agentic workflows that run under governed, audit-ready controls, with a human in the loop wherever judgment is required.

‍

Automate Your Risk Operation With Workforce

‍