Outsource Back-Office Document Work to a BPO Provider or Automate It With AI on Your Own Servers: How a COO Decides

When claims, support tickets or KYC files pile up, a COO can hire more staff, hand the work to a BPO provider or automate it with AI on the company's own servers. KYC (know your customer) files are the identity documents and other records a financial firm collects before it takes on a client. BPO, business process outsourcing, means another company's staff do the work, sometimes from another country. With automation, software on servers your company controls reads the documents and passes the files it cannot handle to people. A BPO provider suits work where most files need a person's judgement and outside staff are allowed to see the documents. Document types that repeat suit automation, and so do documents that must stay inside the company. Some companies combine the two.

What are our options for back-office document work?

Growing the in-house team keeps the documents and the know-how inside the company. Each rise in volume then means hiring and training people who need time to reach full pace.

A BPO provider takes over a whole process, such as checking claims or sorting support tickets, under a contract with service levels. Service levels are the targets the provider commits to, for example how quickly each file must be handled. Finding and training the people becomes the provider's job. Its staff may sit in another country and work either in the provider's own systems or in yours, through a login you give them.

Automation with AI on your own servers means software that reads each document with a large language model (LLM), the kind of AI behind ChatGPT. The software checks the fields it extracts against your rules and writes the ones that pass into your systems. Files that fail the checks go to a person.

The routes can be combined. Software can take routine fields, such as names, dates and amounts on a standard form, and leave the rest to people.

Who sees our documents when a BPO provider does the work?

The provider's staff see them, because reading the documents is the job, and claims and KYC files are full of personal data. Under the EU's General Data Protection Regulation (GDPR), a company that processes personal data on your behalf is a processor. Your company remains the controller, the one that decides why and how the data is used.

Article 28 of the GDPR, read on 19 October 2026 on EUR-Lex, the EU's official website for its laws, says the controller “shall use only processors providing sufficient guarantees”. It also requires a contract or another binding legal act with each processor. Under that contract, the processor must ensure that “persons authorised to process the personal data” are bound to confidentiality, by their own commitment or by law. The provider also needs your written authorisation before it brings in another processor, such as a subcontractor that takes over part of the work.

Letting the provider's staff log in to your systems, without copying files to the provider, still makes the data available to them. The European Data Protection Board (EDPB), made up of the EU's data protection authorities, covers this case in its Guidelines 05/2021, version 2.0 of 14 February 2023, read the same day.

Under the EDPB guidelines, remote access from a third country, meaning a country outside the European Economic Area (EEA), “is also considered to be a transfer” when three criteria are met. That applies “even if it takes place only by means of displaying personal data on a screen”. One of the criteria is that the company receiving access, here the BPO provider, is in a third country. The EDPB adds that such a transfer “can only take place under certain conditions”, set out in Chapter V of the GDPR.

Do the documents stay with us if AI runs on our own servers?

The documents stay with you if every part of the system, the language model included, runs on servers your company controls. No outside staff read the documents as part of the daily work, and the text of each document does not go to OpenAI or any other model provider. If the system uses a model hosted by an outside provider, the documents go to that provider.

On your own servers, you still have to decide which staff may open which files and what the system may write to its logs, the records of what it did. The people who build and run the system may need to see real documents. An engineering firm doing that work for you is then usually a processor under the GDPR, as a BPO provider is. The article on outsourcing AI development without your data leaving, linked above, covers how outside engineers can work on such a system.

In a mixed setup, a BPO provider's staff may work your system's review queue, the list of files the software has sent to a person. The provider's staff then see only those files, and the GDPR rules on processor contracts and on remote access from outside the EEA still apply to them.

Who is responsible if the outsourced work goes wrong?

Your company keeps the duties the law places on it, and the provider takes on duties of its own under the contract. The EU's Anti-Money Laundering Regulation, numbered (EU) 2024/1624 and read on EUR-Lex the same day, shows how that works for KYC. Once the regulation applies, its Article 18 lets the companies it covers, banks and other financial institutions among them, outsource tasks the regulation requires of them to service providers.

A company that outsources such tasks must notify its supervisor, the authority that oversees it, before the provider starts. The company “shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks”. Article 18 also names tasks that “shall not be outsourced under any circumstances”. Among them:

• The decision on which risk profile a client is given
• The decision to take a client on or carry out an occasional transaction with them
• Approval of the company's internal policies, procedures and controls against money laundering and terrorist financing
• Approval of the criteria for spotting suspicious or unusual transactions and activities

The same article bars outsourcing such tasks to providers based in third countries that the EU lists for money laundering risks. The exception is a provider in the same group, under further conditions. Article 90 says the regulation “shall apply from 10 July 2027”, later for two kinds of companies, so check the national rules that apply to you today.

Recital 47, part of the regulation's preamble, adds that “the use or acquisition of third-party software” by the company is not outsourcing when no service provider performs the task.

Software can collect a KYC file and check its fields while a named person at your company approves the client. For claims, write down which decisions your own staff always make, whichever route prepares the file.

How does each route cope when volume jumps?

Month end or a regulatory deadline can bring a surge of files. A BPO provider meets a surge by moving staff from other work or hiring. Ask how much notice it needs and what happens to its service levels while new staff learn your rules.

Software can process more documents under the same rules once it has enough server capacity. The files it cannot handle still go to people, so a surge of poor scans or unusual cases makes the review queue grow. Decide in advance who works that queue on your busiest day, your own staff or a provider's staff on call.

Which does the work better on our documents, a provider's staff or the software?

The same measurement works for both. Take a sample of recent documents of each type and have your own staff write down the correct value of every field. The provider's staff and the software are then scored against that sample for each field of each document type.

A provider can work through the sample in a trial, if your compliance rules allow its staff to see those documents. The software is tested on the same sample, on servers where those documents may be processed. Compare accuracy for each field, the share of files sent to a person and the time from a document's arrival to a finished record.

Measure your own staff on the same sample. People make mistakes too, and your staff's score is the level both routes should reach. The articles linked above on questions for an automation firm and on buying or building document AI explain how to build the sample. The second of them calls it an acceptance set.

How do BPO providers and engineering firms price the work?

Pricing models differ, so ask each BPO provider and each engineering firm how it charges. A BPO provider may charge per person, per hour or per document handled. An engineering firm's quote may have two parts: building the system, then supporting it.

Write down your expected volumes by document type and by month for three years, including your busiest month, and get every quote against those same figures. Add your own costs: servers and review-queue staff for the software, or your managers' time spent overseeing a provider. Every quote should also show how the price changes when your volume falls or a form changes.

If we end the contract, what do we keep?

With a BPO provider, much of the know-how, such as how to treat unusual cases, sits in its staff's heads. That knowledge leaves with them at the end of the contract unless it was written down.

Ask the provider for written process rules from the start, and have them updated as the work changes. Keep the sample with correct answers in your own files. The written rules and the sample let you hand the work to a new provider or to software and check that the quality holds.

For the personal data in the documents, Article 28 of the GDPR requires the processor contract to say what happens when the work ends. At your company's choice, the processor “deletes or returns all the personal data to the controller after the end of the provision of services”. It also deletes its copies unless the law requires it to keep them. Agree before you sign which of the two you want and how the provider will confirm it.

On the automation route, you keep the code, the instructions given to the model and any model trained further on your data, if the contract transfers them to you. Read what the contract excludes, such as components the firm reuses across projects.

What should we ask a BPO provider and an engineering firm?

Send the same questions to every candidate on both routes:

• Where will the people who see our documents sit, and will they log in to our systems or copy files into yours?
• Which other companies would take part in the work, and in which countries?
• Will you work through our sample of documents before we sign, so that we can score the results field by field?
• What happens to a file you cannot handle, and who at our company sees it next?
• When the contract ends, which written rules, code and data come back to us, and in what form?

Rules on outsourcing, data transfers and checks on clients differ by country and by sector. This article uses EU texts as examples and is not legal advice, so check your route with a lawyer or your regulator.

Where does amBrain fit?

The one language model project amBrain describes in public is this: “We have taken an LLM integration to production inside a client's FinTech perimeter: extracting and normalising unstructured broker and venue notices — corporate actions, instrument and margin changes — into structured records the trading system consumes.”

This article is not a case study, and the client is not named. The quoted line does not say where the model ran in that project or which of the steps described above it included. Nothing here says that amBrain built systems for claims, support tickets, KYC files or any other back-office documents. Nor does it say that amBrain replaced a BPO provider, worked with one or ran a mixed setup of software and a provider's staff.

The GDPR and the Anti-Money Laundering Regulation appear in this article only as rules your company may have to follow. The article makes no claim about amBrain's own compliance status under these or any other rules. It gives no amBrain prices or timelines, and no terms for a prototype or pilot, including a trial on your sample before signing.

amBrain has been building software since 2019. It works in three formats: full delivery, a dedicated team, or engineers embedded in your team. Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” If amBrain is on your shortlist, give it the same sample and the same questions as any other engineering firm.