Hiding in Plain Sight - Catching prohibited business activities

Agentic AI helps you go deeper, not just faster

When banks and fintechs onboard new businesses, they face a fundamental challenge: understanding what the customer actually does.

Getting it wrong isn’t a small thing — it can mean onboarding a merchant operating in a prohibited or high-risk industry, exposing the institution to financial crime, reputational damage, and regulatory breaches.

Traditionally, compliance teams rely on self-declared data — things like industry codes (SICs) or business descriptions from registries such as Companies House. But those codes are broad, static, and ambiguous. A business listed as a “retail store” could be selling anything from clothes to cannabis.

Here's a story of how our business due diligence agent of the UK regulated bank spotted the gate of business engaging in a prohibited activity.

‍

The Blind Spot: Declared Industries vs. Reality

On paper, this business looked completely normal.

Registered in the UK as a “retail store with food and drinks”, it passed all the usual checks. The SIC code matched, the documentation looked clean, and nothing raised a flag. But in reality, it wasn’t just a shop. It was selling cannabis products — a prohibited activity under UK onboarding rules.

Without deeper analysis, it would have slipped right through.

‍

‍

Take “retail store.”

Is it a clothing boutique? A vape shop? A cannabis paraphernalia vendor? The label doesn’t tell you — and in high-risk verticals, that lack of detail can make all the difference. In this case, the business wasn’t just any retail shop. It was selling cannabis products — a prohibited activity under UK onboarding rules. And without intervention, it would have slipped through.

How did we catch it? Glad you asked...

The Fix: Agentic AI That Digs Deeper

Our AI agent stepped in. But rather than relying on what the merchant said they did, it went looking for what they actually do.

Here’s how:

1. Identifying the business identity

‍

The agent started with official records — Companies House filings, business directories, and public listings — to establish a baseline profile. It cross-checked name, address, phone number, and company number to ensure it looked at the right entity, not a namesake or duplicate.

‍

2. Finding the business on the web

‍

Next, it hunted for the company online — mapping potential matches across Google Maps, social media, and websites. Using advanced entity matching logic, it linked the registry identity to the verified digital footprint of the merchant. This step matters: many small businesses lack clean websites or use inconsistent names, and false positives can be costly.

Once the match was confident, the agent geolocated the business using the registered address and identifies the actual storefront. It parsed Street View imagery and customer-uploaded photos, which often reveal far more than official websites — signage, branding, even interior details.

‍

3. Industry and risk classification via image analysis

‍

Finally, using computer vision trained on high-risk visual cues (from cannabis leaves and paraphernalia to restricted-goods symbols) the agent classified the merchant’s true activity. It then assigns a corrected MCC (Merchant Category Code), rewrites the business description in standardized compliance language, and flagged any prohibited or high-risk category for escalation.

‍

‍

Finally, the agent distilled all of this into a clean, auditable output. It assigned a corrected MCC based on actual activity, not just declared intent. It rewrote the business description using standardised terms aligned with risk frameworks. And it flagged the merchant for cannabis-related sales (a prohibited category under the bank’s onboarding rules) triggering a hard stop in the flow and escalation to compliance. Crucially, all this happened before a human ever had to get involved.

This enabled our client to block a risky merchant before onboarding, without any human manually combing through websites or storefront photos.

‍

Why This Matters: From Speed to Precision

Agentic AI isn’t just about speed or efficiency. It’s about depth.

It brings a new level of precision to compliance, surfacing hidden risk that’s been hiding in plain sight, because the old tools were too blunt to spot the nuance.

We’re helping clients deploy AI agents that see the whole picture, not just what’s on the application form. That means fewer blind spots, better decisions, and smarter ways to protect your business.

Because in this new world, risk doesn’t hide in the shadows.

It hides in plain sight, and you need tools that know where to look.

‍