How AI will affect compliance organizations

Historically, compliance professionals have treated technological innovation with skepticism. The financial, legal and reputational risks of punitive regulatory actions incentivize compliance departments to take a “fear-based approach” to risk management, prioritizing the avoidance of regulatory scrutiny over considerations of operational efficiency or optimization. When organizations have devoted resources to enhancing their compliance models, their focus is still on the basics: improving data quality, reducing case backlogs, managing employee turnover, etc. Deploying new technologies to streamline functions falls by the wayside, resulting in high-touch, resource- and labor-intensive processes.

In recent years, however, industry leaders have recognized the shortcomings of manual operations and begun to experiment with advanced technologies such as machine learning and intelligent automation in an attempt to improve risk outcomes while controlling costs. Common examples include automated negative news screening and analysis, automated data retrieval through robotic process automation (RPA) and application programming interfaces (APIs), automated template-based narrative generation, and leveraging predictive models to enhance or accelerate decisioning (e.g., risk scoring for transaction monitoring, and list screening alerts). As even stronger AI tools enter the industry in coming years, they will augment core components of the compliance program model, including the following:

False positive dispositioning

Financial institutions currently rely on simplistic models for processes like transaction monitoring, adverse media screening, and sanctions screening to identify illicit customer activity. Without highly tuned parameters, these models produce a high volume of false positives, which must be investigated and discounted. AI tools will help resolve false positive issues in two ways: First, improved model tuning logic will better identify potential true matches. Screening for “David Johnson” might produce 1,000 low-quality hits; screening for “David Johnson” in combination with other inputs (e.g., age, address, contact information, citizenship, work history, vehicle registrations, relationship history, known associates) pulled from open and closed sources might produce, say, 11 high-quality results that better optimize the reviewer’s time. Second, language models will capture and highlight the most pertinent information to an investigation, reducing overall handling time and improving material risk identification.

SAR writing

When financial institutions identify potentially suspicious activity, they are required to investigate and, if deemed material, file a suspicious activity report (SAR) with regulators. SARs generally range from one to 10 pages and are composed by investigators who combine transactional analysis and risk expertise to demonstrate potentially criminal activity to government authorities. These reports are among the most important components of a strong Bank Secrecy Act/Anti-Money Laundering (BSA/AML) compliance program, and the composition process will retain an element of human touch for the foreseeable future given the variability in risk appetite and decisioning methodology between institutions. That said, AI models today can produce standardized reports of all kinds if trained on sufficient sample data, and soon these solutions will be employed by banks to meaningfully accelerate the SAR writing process. Instead of relying on a team of investigators to draft reports or customize SAR templates with transaction analysis, AI will be used to identify the suspicious customer activity, determine the corresponding risk typology, perform open- and closed-source searches to form a coherent customer profile, and compose a report outlining customer background, suspicious activity, and rationale for filing a SAR. As opposed to manually composing a handful of reports per day, investigators will assume a quality control role enabling them to review and file SARs at scale. In turn, institutions will experience fewer alert backlogs (and resulting regulatory actions) while lowering operational costs.

Ongoing monitoring

As discussed above, financial institutions are required to monitor their customers on an ongoing basis to identify potentially fraudulent or criminal activity between normal customer review cycles. AI-based solutions will be able to revamp the detection logic undergirding screening and monitoring tools, leveraging additional data sources to create holistic customer profiles that better define suspicious activity for a specific customer and track risk across multiple domains (AML, fraud, sanctions, etc.). These shifts will help reduce false-positive alerts and better identify compliance risks, allowing institutions to migrate away from rigid periodic risk review schedules in favor of more agile ongoing due diligence models.

Despite their promise, AI tools are in the early stages of the technology adoption curve. Training remains costly and demands a large number of data points to enable continuous learning; model outputs may require validation or third-party verification. AI solutions have not yet demonstrated a level of dependability necessary to permanently enhance human decision-making, much less displace it. Moreover, the indeterminant nature of compliance risk management — how often does a SAR truly prevent criminal activity? — impedes the ability to refine model outcomes via reinforcement learning methodologies.

Over the next decade, technologists will need to coordinate with public and private sector stakeholders to remove bias, reduce costs and improve reliability. In turn, compliance professionals should approach AI with hopeful skepticism and take a few key actions:

Challenge existing models

As AI tools start to become viable from a cost and value perspective, compliance professionals should perform top- down and bottom-up assessments of their operating model to proactively identify areas for potential enhancement. Designing a future-state compliance framework with key operational objectives — risk outcomes, cost reduction, process improvement — can help govern the implementation journey.

Prioritize customer data

In a process and control environment operated by AI, customer data is paramount. Although standardization of AI solutions is a few years away, compliance leaders should begin enhancing their customer data now. Data remediations are complex and lengthy, frequently spanning multiple years. Taking steps in the near future to improve the availability and quality of customer data down the line will pay dividends, not only in the feasibility of long-term technology integrations, but in the short term through improved customer insights and risk management.

Focus on process augmentation

The concept of AI in the workplace inevitably inspires concerns over staffing changes. While a day may come when human intelligence becomes obsolete, we don’t have to worry about crossing that bridge for quite some time. In the near to medium term, AI tools will only succeed in augmenting certain processes, almost all of which will still require review and/or validation by a human. Even the most advanced AI models — the tools that can investigate, analyze, report, compose and manipulate data — can frequently be wrong. The most popular and innovative AI training methodology currently in use, deep-learning, quickly struggles when faced with an input outside its original parameters. The result is a very powerful tool that can be relied upon to automate certain components of a process (e.g., drafting documentation, scouring the internet to disprove false-positive alerts), but cannot yet be trusted to perform that process from end to end (e.g., compliance policy design, customer risk decisioning). While automation may displace some roles, its efficiencies at scale will create others. In the coming years, compliance professionals should prioritize ways in which AI can improve, rather than supplant, processes and controls.

Pursue relevant skill sets

AI-enabled automation will create a demand for people who understand the logic utilized by AI tools and can craft effective inputs to yield the most meaningful responses. Similar to the proliferation of “search engine optimization” jobs in the early 2000s, the deployment of AI in compliance organizations will necessitate a new type of technological fluency that is able to maximize the utility and quality of AI model outputs — including the ability to decipher when an outcome may be incorrect. Compliance leaders should ensure they are fostering the relevant skill sets and attracting the requisite talent to optimize the efficacy of AI tools.

Conclusion

As the world reacts over the latest advancements in AI, regulators and business leaders must consider the practical opportunities and risks of its implementation. When coupled with a robust regulatory regime and thoughtful application, AI technology has the potential to revolutionize almost all areas of the financial services industry. Those in the compliance seat should embrace its potential and remain creative as they guide its adoption.