Key points
What the report says
Five chapters, one argument: in a bank the controls are the process, so the process has to be visible with its controls before anything is changed, outsourced or automated. Fictional examples, no client data.
The controls are the process
Identification, screening, risk classification, creditworthiness, collateral, the second vote: in onboarding and credit approval the control steps carry the process, and each one needs an owner and evidence.
The guideline and the routine drift apart
Organisational guidelines describe the intended checks. The routine knows the exceptions: the hit in the screening, the incomplete file, the case above the competence level. The gap is where audit findings come from.
The frameworks expect traceability
MaRisk, the GwG with its customer due diligence, and DORA, described in general terms, expect documented processes, functional separation, controls a knowledgeable third party can follow, and a view of outsourced and ICT-dependent functions.
AI agents need lanes and limits
An agent can assemble a file, pre-sort cases and draft a vote inside a visible process; it cannot replace the identification, the screening decision or the second vote. The guardrails are a lane, a control step and a person who decides.
Contents
What the report covers
The full report has five chapters. It opens with the processes as they typically run, with lane sketches, moves to where the knowledge about them gets lost, then describes the regulatory context as general orientation on public frameworks, not as legal advice. The fourth chapter is about AI agents and their guardrails, and the last one about the first step.
Contents of the full report
Typical core processes
KYC/AML customer onboarding, credit approval, account servicing, complaints
Where process knowledge gets lost
guideline, heads, systems; hand-overs; exceptions
Regulatory and audit context
MaRisk, GwG and AML, KYC, DORA, in general terms
Where AI agents can help, and the guardrails they need
How to start
one process, captured from the people who run it; the patchley Pilot
The picture
Three places where a process lives
The report's second chapter compares the organisational guideline, people's heads and a BPMN model as places where process knowledge lives. The table below is the short version; the diagram is one of the fictional example models used in the report.
| In the guideline | In people's heads | In a BPMN model | |
|---|---|---|---|
| What it describes | The intended checks at the time it was written. | The actual routine, including the exceptions, as each person sees their part. | The agreed actual process with lanes, systems, documents and every check as a control step. |
| Who can read it | Anyone, but few do. | Only the person, and only when asked. | People and software: a diagram for the team, a structure for the AI. |
| What happens at a change | Nothing, until the next revision. | The routine changes quietly. | The change is shown, decided and versioned. |
| What an auditor sees | A document that may not match the routine. | An interview. | Control steps with owner and evidence, per step. |
Request
The full report by email
Enter your email address and we'll send you the report as a PDF. We use the address to send the document and to answer a question you add; nothing else.