Reconciliation and fraud at 3 AM: what an AI agent does in fintech operations — and what it is forbidden from

Financial operations are night work by nature: reconciling what the gateway collected against what the system recorded, matching cash-on-delivery collections with couriers, and spotting the transaction that “does not look like” its owner. Boring, precise, and expensive when late — the perfect place for an AI agent with restricted permissions. We built these agents for an earnings-and-contests platform (Arpahak), a multi-level network sales system (Retail Sys), and COD collection in shipping (Massafat). Here is what we let it do and what we do not.

What the agent does

1. Daily reconciliation: pulls gateway, wallet, BNPL and bank reports, matches them against the order ledger, and outputs a list of differences with a proposed cause: “refund fee not recorded”, “duplicate order with a different key”, “provider settlement delayed”.
2. Field collection matching: in Massafat every courier hands in the day’s cash; the agent matches delivered COD shipments against deposits and flags gaps before they become a month.
3. Anomaly detection: in Arpahak, an account winning a contest every 40 seconds in one pattern; in Retail Sys, an agent tree growing with accounts on the same device. The agent describes the pattern in a sentence and proposes an action.
4. Reports people read: “Reconciliation 12 Sep: 4,120 transactions, 3 differences worth 1,880 SAR, two explained, one needs a decision”.

What it is forbidden from — by permissions, not promises

• It moves no money: no refunds, no transfers, no balance edits. It proposes; a human clicks.
• It closes no account: it can temporarily hold for review in defined cases, with a written reason and a user notification with an appeal path.
• It sees only what it needs: works on pseudonymised data where possible; full name and ID number appear to the human, not the model.
• It never works without a log: every inference and action is recorded and can be replayed on yesterday’s data for verification.

The golden rule: the agent writes the list, the human signs. The difference between the two designs is the difference between “we saved hours” and “we lost the licence”.

The architecture

A language model orchestrates precisely defined tools over MCP: fetch_gateway_report, match_transactions, flag_case, draft_summary. There is no “run SQL” tool. Deterministic detection rules (thresholds, repetition, velocity) run before the model; the model explains, ranks and writes — it does not decide alone.

The numbers after one quarter

• Daily reconciliation from 3 human hours to 25 minutes of review.
• Gaps caught the same day instead of month end: 92%.
• False fraud alerts down 40%, because the agent explains context instead of just alarming.

For anyone starting

Start with reconciliation, not fraud; it is clearer, lower risk, and shows value within a week. Then add detection with explicit rules, then let the model explain. And build the permissions before the intelligence.