AI Agents for investment banking: How to Automate compliance automation (single-agent with LangGraph)

Investment banking compliance teams spend too much time triaging alerts, reviewing communications, and assembling evidence for audits. The problem is not a lack of policy; it is the manual work needed to map trades, communications, surveillance events, and control evidence back to regulatory obligations like SEC/FINRA rules, MiFID II, GDPR, and internal control frameworks.

A single-agent setup with LangGraph fits this problem because the workflow is structured, repeatable, and auditable. You want one agent that can inspect a case, pull evidence from approved systems, apply policy logic, draft a recommendation, and hand off to a human reviewer with a full trace.

The Business Case

• •

  Reduce analyst review time by 40-60%

  • •A typical compliance operations team may spend 15-30 minutes per alert on first-pass triage.
  • •With an agent handling retrieval, classification, and evidence assembly, that drops to 6-12 minutes for straightforward cases.
• •

  Cut manual evidence collection by 50-70%

  • •Audit prep for surveillance controls, communications monitoring, and KYC/AML exceptions often requires pulling data from email archives, trade blotters, ticketing systems, and GRC tools.
  • •An agent can pre-package artifacts in under 2 minutes instead of a human spending 10-20 minutes across systems.
• •

  Lower false-positive handling cost

  • •In investment banking surveillance queues, false positives can dominate workload.
  • •If the agent filters out low-risk cases with a conservative threshold and routes only ambiguous items to analysts, teams often see a 20-35% reduction in wasted review effort.
• •

  Improve error rates on repetitive checks

  • •Manual checklist work around GDPR retention requests, SOC 2 evidence mapping, or Basel III control attestations is prone to missed fields and inconsistent notes.
  • •A well-scoped agent can reduce documentation errors from roughly 5-8% to below 2%, provided outputs are constrained to approved templates.

Architecture

A production-ready single-agent design should be boring on purpose. One agent owns the workflow; LangGraph manages state transitions so every decision is traceable.

• •

  Agent orchestration: LangGraph

  • •Use LangGraph to define the compliance workflow as a state machine: intake -> retrieve evidence -> classify obligation -> draft response -> human approval.
  • •This matters in regulated environments because you need deterministic paths for escalation and exception handling.
• •

  Reasoning and tool use: LangChain

  • •Use LangChain for tool wrappers around internal systems like SharePoint, ServiceNow, Outlook archives, trade surveillance platforms, and policy repositories.
  • •Keep tools narrow: search policy docs, fetch case history, retrieve relevant communications, generate summary.
• •

  Knowledge layer: pgvector + Postgres

  • •Store policy manuals, control descriptions, prior case resolutions, and regulatory guidance in Postgres with pgvector.
  • •This supports semantic retrieval for things like “market abuse escalation threshold” or “record retention under MiFID II.”
• •

  Control plane: audit logging + human-in-the-loop

  • •Every prompt, retrieved document ID, tool call, and model output should be logged immutably.
  • •Route any high-risk action — external filing draft, client-facing communication, SAR/STR-related recommendation — to a compliance officer before finalization.

For model choice, most banks should start with a hosted enterprise LLM behind private networking or a controlled on-prem deployment if data residency is strict. If GDPR or local bank secrecy rules constrain data movement, keep sensitive content tokenized or redacted before model invocation.

What Can Go Wrong

• •

  Regulatory risk: incorrect interpretation of obligations

  • •Example: the agent misclassifies record-retention requirements under MiFID II or mishandles GDPR subject-access workflows.
  • •Mitigation: hard-code policy sources of truth, require citations in every recommendation format response as “policy clause + evidence + rationale,” and enforce human approval for final decisions.
• •

  Reputation risk: overconfident outputs in client-sensitive workflows

  • •Example: an agent drafts an external response that sounds definitive when the underlying case is still ambiguous.
  • •Mitigation: use constrained templates with confidence labels like “draft,” “needs review,” or “insufficient evidence,” and block direct outbound communication from the agent.
• •

  Operational risk: bad retrieval or stale policy content

  • •Example: the agent pulls an outdated AML procedure or misses a recent change in sanctions screening guidance.
  • •Mitigation: version all policy documents, set freshness checks on retrieval sources, and run nightly validation jobs against approved repositories only.

You also need governance around adjacent standards even if they are not your primary regime. Banks often borrow controls from SOC 2 for access logging and change management; Basel III-style operational resilience expectations matter when you automate critical control workflows; HIPAA may matter if your institution has healthcare lending or benefits-related data flows; GDPR always matters if EU personal data is involved.

Getting Started

1. •

   Pick one narrow use case

   • •Start with something repetitive and bounded: surveillance alert triage for restricted lists, email archiving exceptions, or audit evidence collection for one control family.
   • •Avoid broad “compliance copilot” scope. That usually fails because the policy surface area is too large.
2. •

   Assemble a small cross-functional team

   • •You need:
     • •1 engineering lead
     • •1 compliance SME
     • •1 data engineer
     • •1 platform/security engineer
     • •part-time legal/risk reviewer
   • •That is enough for an initial pilot without creating a committee-driven project.
3. •

   Build a six-to-eight week pilot

   • •Week 1-2: define workflow boundaries, allowed tools, approval gates
   • •Week 3-4: integrate document retrieval and case systems
   • •Week 5-6: implement LangGraph state machine and audit logging
   • •Week 7-8: run parallel testing against live-but-shadow cases
4. •

   Measure against operational KPIs

   • •Track:
     • •average handling time per case
     • •false-positive reduction
     • •analyst override rate
     • •citation accuracy
     • •time-to-audit-pack completion
   • •If the agent cannot beat baseline performance on these metrics in shadow mode after eight weeks, do not expand scope.

The right pilot does not try to replace compliance judgment. It removes repetitive work so senior staff spend time on escalation decisions, control design gaps, and regulator-facing issues where human expertise actually matters.

Keep learning

• •The complete AI Agents Roadmap — my full 8-step breakdown
• •Free: The AI Agent Starter Kit — PDF checklist + starter code
• •Work with me — I build AI for banks and insurance companies

By Cyprian Aarons, AI Consultant at Topiax.