AI-Powered Compliance Investigation Agents for Enhanced Due Diligence

stripe · Finance · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Financial-crime compliance operations

Stripe needed to scale enhanced due diligence reviews across jurisdictions without replacing human compliance judgment or weakening auditability.

Constraints:

Regulatory compliance requires human oversight
Jurisdiction-specific rules create cognitive overload
Agent work must be auditable and safe enough for reviewers to trust

Architecture

Stripe embeds ReAct investigation agents inside a compliance-review DAG. Review tooling orchestrates the rails, starts pre-review research, and triggers deeper investigations as reviewer context evolves; ReAct agents call MCP/Python/internal tools through a dedicated agent service, use Bedrock via Stripe proxying for LLM access, and leave humans in the loop for QA, approval, and auditability.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  review-tooling-orchestrator["review-tooling-orchestrator"]
  dag-investigation-rails["dag-investigation-rails"]
  react-investigation-agents["react-investigation-agents"]
  agent-service["agent-service"]
  llm-proxy-and-bedrock["llm-proxy-and-bedrock"]
  mcp-and-python-tools["mcp-and-python-tools"]
  human-review-and-qa["human-review-and-qa"]
  audit-trail["audit-trail"]
  review-tooling-orchestrator --> dag-investigation-rails
  review-tooling-orchestrator --> react-investigation-agents
  review-tooling-orchestrator --> human-review-and-qa
  dag-investigation-rails --> react-investigation-agents
  react-investigation-agents --> agent-service
  react-investigation-agents --> mcp-and-python-tools
  agent-service --> llm-proxy-and-bedrock
  mcp-and-python-tools --> audit-trail
  human-review-and-qa --> audit-trail

Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component	Role	Interacts with
`review-tooling-orchestrator`	Compliance UI and workflow controller that orchestrates the DAG, starts pre-review research, and triggers deeper agent tasks as reviewers progress.	`dag-investigation-rails`, `react-investigation-agents`, `human-review-and-qa`
`dag-investigation-rails`	Decomposes enhanced-due-diligence reviews into required bite-sized investigation tasks so agents do not wander off into irrelevant rabbit holes.	`review-tooling-orchestrator`, `react-investigation-agents`
`react-investigation-agents`	Reason/act agents that loop through thoughts, tool calls, observations, and final answers for compliance research questions.	`dag-investigation-rails`, `agent-service`, `mcp-and-python-tools`
`agent-service`	Network-bound execution service for long-running agent calls, timeouts, tracing, evaluations, no-code agent creation, and later stateful streaming APIs.	`react-investigation-agents`, `llm-proxy-and-bedrock`
`llm-proxy-and-bedrock`	LLM access layer that standardizes model vendors through Bedrock while Stripe services manage bandwidth, authorization, routing, and provider fallback.	`agent-service`
`mcp-and-python-tools`	Internal compliance data tools and possible MCP clients used by agents to gather evidence for investigations.	`react-investigation-agents`, `audit-trail`
`human-review-and-qa`	Expert reviewers and QA owners judge quality, approve compliance outcomes, and supply helpfulness telemetry.	`review-tooling-orchestrator`, `audit-trail`
`audit-trail`	Compliance record of what the agent found, how it found it, what tool calls it made, and the returned results.	`mcp-and-python-tools`, `human-review-and-qa`

Data flow

A review case enters Stripe review tooling, which orchestrates the DAG and can front-run research before the reviewer opens the case. Each bite-sized investigation task runs through a ReAct loop: query, thought, tool call, observation, and final answer. The agent service waits on vendor LLMs and long-running tools, while reviewers inspect results, provide helpfulness telemetry, and make the final compliance decision with complete tool-call audit trails.

“that review tooling is effectively the orchestrator of this entire DAG flow, and so you can imagine that maybe before the review even begins, we know we can kick off a lot of these agents”transcript, stated

“Well, that's where the react agent comes in. It's able to call tools. That could be an MCP client. I know that's been a big thing. Could be Python tools, whatever works really.”transcript, stated

Why this architecture

Stripe rejected full autonomous review in favor of DAG rails plus human decision authority because compliance agents must cover required areas, fit tasks into working memory, and remain auditable to regulators. A separate agent service was needed because agent workloads wait on network calls and long tool timeouts, unlike deterministic ML inference.

“we effectively were able to decompose this really complicated workflow into effectively a DAG, and the DAG is effectively these rails that we can use for these agents.”transcript, stated

“with really traditional ML, you're really compute bound. If you think about it, you know, let's say you're running an LM, you're gonna need a GPU or maybe at least one GPU.”transcript, stated

Models used: LLMs through Amazon Bedrock · ReAct agents

Scale

Stripe processed $1.4 trillion in annual payment volume, up 38% year over year.
“Last year alone, we processed 1.4 trillion in volume, with a big letter T, and that is 38% up year over year.”transcript, stated
Some agent/tool calls can require minute-scale timeouts because investigations may wait on databases and vendor LLM responses.
“You can expect very long timeouts in some case. You can imagine like what if a tool call needs to call a database? Could be minutes.”transcript, stated
Stripe had over 100 agents across the company by the time of the talk.
“we have I believe like over a hundred agents at Stripe. I did a recent change. They're all over the place.”transcript, stated
Reviewer telemetry reported about 96% helpfulness for the initial agent assistance.
“what we're seeing is they're finding it about 96% helpful. So remember I talked a little bit before about people need to trust”transcript, stated
Initial front-run research questions reduced average handling time by 26%.
“a human reviewer can spend 26% less time on average on these reviews as a result.”transcript, stated

Alternatives considered (roads not taken)

Throwing one unconstrained agent at the entire EDD workflow

Rejected because: It would spend time on low-value or irrelevant work, so Stripe decomposed the workflow into DAG rails.

“If you just took an agent and you threw it at this workflow, it'll probably spend a lot of time on things you really don't even need it to spend on. It'll kinda rabbit hole”transcript, stated

Replacing compliance reviewers with agents

Rejected because: Regulatory outcomes carry weight, so agents assist and reviewers keep final decision authority.

“we actually keep humans in the driver's seat in this case. They're making all the decisions. Agents are just there to effectively inform our reviewers to make the best possible decision.”transcript, stated

Running agents inside the existing ML inference system

Rejected because: Agent workloads have long network-bound waits, non-deterministic control flow, and lightweight concurrency needs that differ from traditional inference.

“we could not have done this probably without the agent service we had. It just was not gonna be hacked into. This ML inference system”transcript, stated

Relying only on LLM judges for production compliance quality

Rejected because: Stripe kept humans in QA because the system must pass a human quality bar before reviewers depend on it.

“everything needs to pass the human quality bar and that means we need to have humans basically in the QA phase as well.”transcript, stated

Patterns

`multi-agent-orchestration` (agent-architecture)

Stripe's review tooling orchestrates a DAG of bounded agent tasks so investigations cover required compliance areas without letting agents wander.

“we effectively were able to decompose this really complicated workflow into effectively a DAG, and the DAG is effectively these rails that we can use for these agents.”transcript, stated

`tool-use-orchestration` (agent-architecture)

ReAct agents call tools such as MCP clients and Python tools to gather compliance signals for investigations.

`human-in-the-loop-gate` (governance)

Agents gather and summarize evidence, while expert reviewers remain the decision makers and quality bar.

“the agents are there to assist and the humans makes the final call.”transcript, stated

`observability-tracing` (compliance)

Stripe records agent findings, tool calls, results, and rationale so regulators and reviewers can inspect what happened.

“we can show a regulator exactly what the agent has found, how it found it, what tool calls it decided to make, what the result of those tool calls were.”transcript, stated

`cost-aware-routing` (model-operations)

Bedrock prompt caching and an internal proxy mitigate token growth and provider noisy-neighbor risks.

“we can effectively solve this noisy neighbor problem to constrain basically those neighbors from hogging all the bandwidth I might need, you know, for this project”transcript, stated

`context-compaction` (context-engineering)

The DAG breaks complex reviews into tasks small enough for agent working memory and human evaluation.

“the tasks become effectively bite-sized enough to actually fit in the agent's kind of working memory.”transcript, stated

Tradeoffs

How far to automate regulated EDD reviews.

Chose agents as reviewer-assistance tools with human final authority over full end-to-end automated decision-making.

Rationale: The reviews carry regulatory weight and need sound human decisions.

“agents are not doing the work, they're not making the decisions, they're not automating really anything, but they're still able to see these massive efficiencies”transcript, stated

How to gain value from long compliance workflows.

Chose incrementally attacking bite-sized tasks over trying to automate the entire process immediately.

Rationale: Small tasks are easier to judge, fit memory, and can be orchestrated into larger reviews.

“don't try to like, automate everything right away. I think that's like a natural instinct. Everyone thinks agents are just gonna like, completely replace everything everywhere tomorrow and that's just not how it's gonna work.”transcript, stated

Gotchas (what bit them)

Unrailed agents can spend time on irrelevant branches and miss required compliance checks.

Root cause: Deep investigations can rabbit-hole unless the workflow encodes which regulatory areas must be covered.

Resolution: Stripe decomposed the review into DAG rails around bite-sized tasks.

“If you just took an agent and you threw it at this workflow, it'll probably spend a lot of time on things you really don't even need it to spend on. It'll kinda rabbit hole”transcript, stated

Iterative agents can create quadratic prompt costs as context accumulates.

Root cause: Each thought/action/observation turn lengthens the next prompt and repeats input-token charges.

Resolution: Stripe uses Bedrock prompt caching to avoid rereading the entire accumulated prompt on every turn.

“as the agent needs to dig deeper and deeper and deeper to answer a question, it's effectively getting a longer and longer prompt that you effectively are paying for every single time”transcript, stated

Classic ML inference infrastructure did not fit agent workloads.

Root cause: Agents are network-bound, long-running, non-deterministic, and mostly wait on external calls rather than local compute.

Resolution: Stripe stood up a dedicated agent service with many lightweight lanes and long timeouts.

“Agents are kind of the opposite in all those aspects. So agents, particularly if you're using a vendor model, you're just waiting for it to come back. You're waiting for the LM to respond to you”transcript, stated

Evaluation

Stripe uses human QA, reviewer telemetry, and ops-team feedback rather than relying on LLM judges for production compliance quality.

Metrics: reviewer helpfulness · average handling time · human QA pass/fail · auditability

“For this project though, we really wanna keep, everything needs to pass the human quality bar and that means we need to have humans basically in the QA phase as well.”transcript, stated

“one nice thing we have is we do have a little telemetry from the reviewer so they can tell us if it's helpful or not, and what we're seeing is they're finding it about 96% helpful.”transcript, stated

Outcomes

Reviewer telemetry reported about 96% helpfulness.
Initial questions reduced average handling time by 26%.
Agents front-run research while reviewers keep decision authority.

The system operates within Stripe's compliance environment, which handles very large payment volume and jurisdiction-specific risk reviews.

“a human reviewer can spend 26% less time on average on these reviews as a result.”transcript, stated

“Last year alone, we processed 1.4 trillion in volume, with a big letter T, and that is 38% up year over year.”transcript, stated