SentinelKYC

• 

• 

Inspiration

KYC and AML checks are often treated as one-time reports. In reality, a customer’s ownership, country exposure, sanctions status, and adverse-media profile can change after onboarding.

I wanted to build a system that keeps monitoring customers in the background and shows compliance teams exactly what changed, why the risk changed, and which evidence supports the decision.

What it does

SentinelKYC is an autonomous agent fleet for continuous KYC and AML monitoring.

It:

• builds a structured customer profile;
• researches the customer and related entities;
• evaluates country exposure;
• screens names against sanctions sources;
• calculates a deterministic risk score;
• stores immutable assessments and evidence;
• schedules future re-screening;
• detects risk changes;
• creates an alert when a customer moves from LOW to MEDIUM or HIGH risk;
• provides audit events and agent execution traces.

The demo includes a reproducible scenario where a customer starts as LOW risk and becomes HIGH risk after a scheduled re-screening detects new sanctions-like evidence.

How we built it

The project is written in Python and uses Streamlit for the operations interface.

The system contains five specialist agents:

• Profile Agent
• Research Agent
• Country Risk Agent
• Sanctions Agent
• Risk Assessment Agent

Google ADK and the Google GenAI SDK provide the agent framework and Gemini integration. Gemini is used for grounded research and evidence summarization. Identity matching and risk scoring remain deterministic so that the compliance decision is explainable and reproducible.

The application stores customers, assessments, evidence, sanctions screenings, alerts, agent traces, and audit events. The architecture is designed for Google Cloud deployment with Cloud Run, Cloud SQL or Firestore, Cloud Storage, Cloud Scheduler, Pub/Sub, and Vertex AI.

Challenges we ran into

The main challenge was balancing useful agent behavior with compliance safety.

An LLM should not independently declare that two people are the same sanctioned person. We therefore separated generative research from deterministic identity matching and risk scoring.

We also had to handle incomplete external sources. If a sanctions or country-risk provider fails, the system records a PARTIAL result and requires analyst review instead of silently returning a clean result.

Another challenge was preserving evidence. Every screening produces a structured receipt and keeps the original source artifact when available.

Accomplishments that we're proud of

We are proud that SentinelKYC is more than a chatbot or a single prompt.

The project has:

• five specialized agents coordinated by an orchestrator;
• a versioned agent registry;
• an ADK runtime boundary;
• immutable assessment history;
• deterministic LOW → HIGH risk-change detection;
• sanctions and country-risk evidence artifacts;
• audit logs and execution traces;
• failure handling that does not convert provider errors into false NO_MATCH results;
• a working Streamlit command center;
• automated tests covering the complete monitoring lifecycle.

What we learned

We learned that enterprise agents need strong boundaries around their autonomy.

The most important design decision was to let agents collect, organize, and explain evidence while keeping sensitive compliance decisions deterministic and auditable.

We also learned that persistent state, provenance, failure handling, and observability are just as important as the model itself. A useful enterprise agent must be able to explain what it did, what data it used, and what still needs human review.

What's next for SentinelKYC

The next step is to deploy the worker and UI on Google Cloud and connect the persistent state to managed services.

We also plan to add stronger identity and access controls, human approval workflows, tenant isolation, encrypted long-term memory, OpenTelemetry integration, and versioned sanctions-list governance.

SentinelKYC is a prototype for assisted compliance operations, not an automated legal decision-maker. Potential matches always require qualified human review.

Built With

• cloud-run
• cloud-sql
• cloud-storage
• gemini-3.5-flash
• google-adk
• google-cloud
• google-genai-sdk
• pub/sub
• python
• sqlite
• streamlit