Daily cash reconciliation is the most boring control in a bank, and one of the oldest. Someone pulls the bank statement, lines it up against the general ledger, and confirms that what the institution thinks it holds is what the custodian actually holds. Most days everything ties out. The job exists for the days it does not.
When the two sides disagree, the difference is a break — an exception that has to be explained and cleared. A payment hit the statement but never posted to the ledger. A figure was keyed as 5,400 when it should have been 4,500. A fee landed twice. The reconciliation analyst tracks each break to its cause, drafts the correcting entry, and a second person signs off before that entry posts. That second pair of eyes is not bureaucratic friction. It is the control.
This is exactly the work an AI agent does well: high-volume, rules-bound, and repetitive to the point of error. It is also exactly the work where letting the machine clear its own exceptions quietly defeats the only control that mattered.
What the agent is good at
Reconciliation has a clean shape. There is a source of truth on each side, a matching step, and a queue of things that did not match. An agent can run the whole front of that pipeline faster and more consistently than a tired human at month-end.
It can ingest the statement and the ledger, normalise the formats, and match the transactions that obviously correspond — same amount, same date, same reference. It can chase the partial matches: a payment that cleared a day late, a single ledger line that nets against two statement entries. And it can classify the residue into the break types an analyst recognises on sight.
- Timing differences — the entry exists on both sides, on different dates.
- Missing entries — present on one side, absent on the other.
- Transposition errors — two digits swapped, a tell-tale difference divisible by nine.
- Duplicates — the same charge posted twice.
- Unidentified — a difference the agent cannot yet attribute.
For each break, the agent can assemble the evidence, propose a cause, and draft the journal entry that would clear it. By the time a human looks at the queue, the noise is gone and every remaining item arrives with its supporting work attached. That is a genuine reduction in toil, and it is the right reason to put an agent here.
Where it must stop
The break that resolves a discrepancy is also the break that can hide one. The correcting entry that ties out a missing payment is indistinguishable, on its face, from a correcting entry that papers over a misappropriation. This is why reconciliation has always been a maker-checker control: the person who prepares the adjustment is never the person who approves it.
The principle is the four-eyes standard the Wolfsberg Group names as the reference for financial-crime and operational controls, and it is the segregation of duties that already sits in every bank's reconciliation procedure. The preparer proposes; a separate, qualified reviewer signs; the reviewer owns the call. When the preparer was a person, an org chart and a sign-off form enforced the split.
An agent breaks that arrangement quietly. Drop it into the queue and it typically inherits a service account with broad permissions and no place in the reporting line. The "agent" that drafts the correcting entry and the "agent" that posts it are often the same process, separated by nothing but a sentence in a prompt. That is not a separation a reviewer can rely on, and it is not a separation an examiner recognises. It exists only as long as the model behaves.
Why the prompt does not hold the line
The obvious fix is to instruct the agent: draft the entries, but never post a correcting entry without a human sign-off. This reads like a control. It is a request.
A prompt instruction carries no record of who set the boundary, no version history when it changes, and no proof — months later, when the question arrives — that the agent actually stopped where it was told. An agent that is re-prompted, upgraded, or jailbroken can start posting the entries it was meant to escalate, and nothing in the file would show the boundary ever existed. "It was in the system prompt" is not an answer a reviewer wants to give.
A control plane moves the boundary out of the agent and into enforced, versioned policy — a layer between what the agent wants to do and what it is allowed to do. The authority to post a ledger entry is a grant attached to the reconciliation role, denied by default, and that grant simply does not include it. The agent can draft the correcting entry. It structurally cannot post one.
The preparer cannot approve its own break
Here is the rule that does the real work. When the agent drafts an entry to clear a break, it is the preparer. The control plane parks the run at an approval gate and requires a signature from a named reviewer — and the actor who signs cannot be the agent that prepared the entry. The same actor provably cannot be both maker and checker on one break.
This matters more with an agent than it ever did with a person, because an agent can prepare and self-approve thousands of adjustments before anyone notices the pattern. Structural segregation of duties removes the possibility rather than auditing for it after the fact. The agent that proposed the fix is barred from clearing it, full stop, and every attempt — including the refusals — lands in the record. An approval gate can require a quorum of named reviewers for the larger or unusual adjustments, and it bars the requester from signing its own request.
What the reviewer signs is captured with its meaning intact: the decision, the signer's identity, and the reason in their own words, linked to the exact version of the break dossier they reviewed. The sign-off carries its substance, not just a timestamp.
| Reconciliation step | Agent does | Human still signs |
|---|---|---|
| Match statement to ledger | Auto-match, chase partials | — |
| Classify the breaks | Timing, missing, transposition | — |
| Draft the correcting entry | Propose cause and journal | — |
| Post the correcting entry | Hold at the gate | Approve and post |
What survives the question later
Reconciliation evidence is read long after the fact — in an audit, an internal investigation, or discovery. The reviewer who certifies that controls operated needs to answer one thing without flinching: prove the agent could not clear its own break, and prove the record of who decided what is intact.
A control plane answers it directly. Every match, every classification, every drafted entry, every escalation, and every human signature lands in an append-only, hash-chained, cryptographically signed ledger. Change one record and the chain visibly breaks. The export verifies offline, against a published spec, by someone who does not trust the vendor — which is the only kind of evidence worth having when the question comes years later.
This sits underneath a banking landscape that has gone quiet on agents, not permissive. In April 2026 the Federal Reserve issued SR 26-2, which replaced the old model-risk guidance and scoped agentic AI out. There is no supervisory template for agent controls yet — and no template means no safe harbor. The segregation-of-duties expectation underneath reconciliation did not move. Examiners and auditors still demand the evidence, with or without a rulebook written for machines.
Done this way, the oldest control in the back office holds at machine speed. The agent does the matching and the drafting; a named person still owns the adjustment that touches the ledger. The maker-checker split stops being a policy hope and becomes a structural fact the audit trail can demonstrate to anyone who asks. For where this fits alongside AML triage and sanctions screening, see the bank middle office.
See how it works, or book a demo to see an agent barred from clearing its own break.