Compliance Gate

The ComplianceGateWorkflow child — Document Review followed by BSA/AML attestation. Both are mandatory human steps. Neither can be automated.

---

Table of Contents

1. 11.2 Compliance Gate Workflow
2. Document Review Step
   1. AI Pre-Assessment
   2. Human Review
   3. Revision Loop
3. BSA/AML Attestation Step
   1. Compliance Boundary
   2. AI Pre-Fill
   3. Attestation Signal

---

11.2 Compliance Gate Workflow

%%{init: {'theme': 'base'}}%%
flowchart TD
    classDef startEnd  fill:#2d6a4f,stroke:#1b4332,color:#ffffff,font-weight:bold
    classDef aiStep    fill:#5c4a8a,stroke:#c77dff,color:#ffffff
    classDef humanTask fill:#e76f51,stroke:#bc4749,color:#ffffff,font-weight:bold
    classDef gateway   fill:#457b9d,stroke:#1d3557,color:#ffffff
    classDef revision  fill:#6c757d,stroke:#495057,color:#ffffff

    CStart(["▶  ComplianceGateWorkflow"]):::startEnd

    DocTask["Document Review\n🤖 DocumentReviewAgent\nPre-populates assessment\nAssigns → Document Review queue"]:::aiStep

    DocWait["⏳ Signal: submitDocumentReview\nOperator confirms or overrides\nAI assessment"]:::humanTask

    DocDecision{"Decision?"}:::gateway

    DocRevise["Revision Loop\nRevisionTask → case originator\n⏳ Signal: resubmission\nRestarts Document Review"]:::revision

    BSATask["BSA / AML Review\n🤖 CompliancePreFillAgent\nPre-fills questionnaire fields\nAssigns → Compliance Officer queue"]:::aiStep

    BSAWait["⏳ Signal: submitBSAAttestation\nBSA Officer MUST attest\nCannot be automated — 31 USC 5318(g)"]:::humanTask

    CEnd(["■  Return to parent workflow"]):::startEnd

    CStart --> DocTask --> DocWait --> DocDecision
    DocDecision -- "Approved" --> BSATask --> BSAWait --> CEnd
    DocDecision -- "Rejected" --> DocRevise --> DocTask

Node key

🟪 AI agent step  ·  🟧 Human task — Temporal signal required  ·  🔷 Decision gateway  ·  ⬜ Revision / loop path

---

Document Review Step

AI Pre-Assessment

When the Compliance Gate begins, the DocumentReviewAgent is invoked immediately. It runs the full OCR + classification + completeness check chain and writes its assessment to Aurora before the task appears in the Document Review Analyst’s queue:

DocumentReviewAgent output (written to human_tasks.ai_assessment):
{
  "status": "INCOMPLETE",
  "confidence": 0.91,
  "missing_items": ["board-resolution", "signature-card"],
  "flags": ["aml-form-date-expired"],
  "auto_approvable": false
}

If confidence > 0.85 and missing_items is empty and no flags are set, the agent sends the submitDocumentReview(APPROVED, auto_approved=true) signal directly — the human task is skipped entirely for this case.

Target: 70–80% auto-approval rate. For the remaining cases, the analyst receives a pre-populated checklist — reducing review time from 30–60 minutes to 5–10 minutes.

Human Review

The Document Review Analyst receives the task in their React workspace queue. They see the AI assessment, can review the documents inline, and submit one of:

• Approved → workflow advances to BSA/AML Review
• Rejected → revision loop activated

Revision Loop

On rejection, a revision task is sent back to the case originator (Banker or Implementation Team). The originator re-submits corrected documents. When documents are re-uploaded, the DocumentReviewAgent re-runs automatically. The loop repeats until the analyst approves.

---

BSA/AML Attestation Step

Compliance Boundary

31 USC 5318(g) — Bank Secrecy Act. A BSA Officer must personally attest to the AML review. This requirement cannot be satisfied by an automated system. The submitBSAAttestation signal in ClientServicingWorkflow requires a userId of a human actor with the BSA_OFFICER role. The ai_auto_approved flag is blocked for this task type at the workflow level — not by configuration, but by code.

AI Pre-Fill

While the Compliance Officer is the mandatory decision-maker, the CompliancePreFillAgent pre-fills the questionnaire to minimise their time burden:

• Extracts entity names, beneficial owners, business description, transaction volumes from uploaded documents via OCR + NLP
• Screens against sanctions lists
• Flags PEP indicators and high-risk jurisdictions
• Writes confidence scores per field to ai_suggestions table
• The React BSA Review Panel displays the pre-filled form with confidence indicators (blue = high confidence, yellow = medium, empty = low)

Target: ~50% of fields pre-filled at ≥ 0.70 confidence. The Compliance Officer reviews a pre-populated form and focuses attention on unfilled or flagged fields.

Attestation Signal

// Compliance Officer submits attestation via React UI → GraphQL mutation → workflow signal
@SignalMethod
void submitBSAAttestation(AttestationRecord record);

// AttestationRecord includes:
// - attestingOfficerId (validated against BSA_OFFICER role)
// - attestationDate
// - certificationText (the officer's attestation statement)
// - riskRating (LOW | MEDIUM | HIGH)
// - overrides[] (any AI suggestion the officer overrode, with reason)

All overrides are captured in the audit trail. The compliance team can see every field the AI suggested and every field the officer changed, with the reason for each change.