What compliance and financial crime leaders told us about governing AI
Few compliance and financial crime leaders still ask whether AI works. The harder question now is whether they can prove it does, and who answers for it when it doesn’t.
Over the past few months, we at Shape Finance have spoken to more than 30 senior compliance and financial crime leaders, from tier-one banks to payments firms, fintechs and insurers. These conversations are a qualitative snapshot rather than a survey of the whole market. Almost none denied that AI has a role in their function. What dominated was something harder: once AI is in the workflow, how do you show it is doing the right thing, and who is held accountable when it isn’t?
A financial crime leader at a UK tier-one bank put it simply. The big question, which “hasn’t really changed from beginning of the year,” is “how do you validate your AI, how do you prove it’s consistent.” The shift from experimenting with AI towards production is exactly what brings this topic to the surface: “how do I check that my AI is telling me the truth.”
For compliance and financial crime teams, that question lands twice. They are using AI in their own operations, in alert handling, investigations and screening, so they have to prove it works. And in many firms they are also the function expected to govern AI more broadly, because AI strategy and oversight often sit within risk, compliance and GRC teams. Both jobs need an answer.
What are compliance and financial crime teams actually worried about?
Four concerns came up again and again:
Validation
Proving that outputs are accurate and remain consistent was the most-cited problem throughout these conversations. A compliance leader at a large money transfer business noted the double edge. A model is easier to test than the work of dozens of analysts, but “you can tweak a model and it will impact 100,000 cases as opposed to training 50 people who manage 100,000 cases.”
Explainability and audit trail
“You can’t just say, well, it was the AI,” a compliance leader at a payments firm said. Regulators will expect the full picture: what prompts were used, what the outcomes were and how errors were remediated.
A compliance professional at a mortgage lender wanted the opposite of a “black box binary response”. A fraud flag that doesn’t say why leaves the team with nothing to act on.
Decision rights
Whether AI can close a case on its own is “a very big discussion”, according to a former financial crime leader at a cross-border payments firm. Some firms are letting AI disposition alerts it judges to be non-issues with only QA review, though “not in the big ones.”
Removing human checks entirely is another matter. Even human-led investigations carry a QA sample, they noted, and “no one is going to dare introduce that thing without QA.”
Accountability
Responsibility cannot be handed to a model. As a board adviser to several UK banks put it, regulators are clear that “the AI is never accountable, it’s always the SMF.”
The financial crime leader at the tier-one bank warned that as anyone can now build AI tools, teams risk outputs that “we both call the same thing,” but “actually you’ve calculated it differently.”
Beneath all four sits an uncertainty about the rules. As a compliance lead at a small insurer put it, the regulator “has not strictly given us rules. It’s very much guidance and off you go, but within reason.”
Compliance teams sit on both sides of AI governance
As users, compliance and financial crime teams apply AI to alert handling, investigations and screening, so the validation, explainability and QA questions above are theirs to answer. As owners, they are often asked to set the rules for how the rest of the business builds and uses AI.
The same insurer wants governance controls so that people aren’t “just making AI agents without consulting with the relevant parties” and so that “only signed off projects happen.” The function that has to evidence its own AI also has to make sure everyone else can evidence theirs.
Governance is becoming an operational capability
The clearest pattern across our conversations is that AI governance is no longer a policy exercise completed before go-live. It is becoming a capability that runs alongside the technology: testing, monitoring, periodic review, QA sampling, documentation and training.
That mirrors the direction of UK regulation. Rather than writing a separate AI rulebook, regulators are applying existing frameworks, from model risk management to senior manager accountability. The PRA’s model risk management principles (SS1/23), in force since May 2024, apply directly to banks with internal model approval and explicitly cover AI and machine learning as part of general model risk, rather than as a separate regime. Firms outside that scope are not bound by them, but they are a useful reference point. In our view, the direction is the same throughout: continuous evidence, not a one-off sign-off.
A compliance leader at a payments firm repeated a line they had heard recently: “see AI [as] a colleague who needs to have regular refreshments or like annual updates and reviews.” A fintech compliance leader described good practice as “very clear accountability at all levels… supported by a board-level MI that is simple, risk-focused.” Their overall summary for AI: “trust, but verify.”
Good governance also takes effort. The tier-one bank leader pointed out that getting reliable outputs from AI takes “quite comprehensive documentation and characterization of your business”, something they felt had barely been discussed. That is the tension teams must now manage: governance creates the confidence to put AI into production, and it takes time and effort. The answer is not less governance, but governance that is proportionate and built around how teams already work.
Human judgement stays in the loop, by design
Most firms are using AI to support decisions, not to make them. The tier-one bank leader said most institutions are probably not using AI for decision-making as such, but as tools to support it.
But a person in the loop is only a real control if that person actually checks the output and makes the final decision. The former payments leader recalled regulators’ concern that reviewers would not really check what the AI did and would be “just going to let it pass through.” A compliance manager at a payments firm shares the worry:
“I don’t want them to become lazy… I still need them to do the manual reviews.”
Human review needs to be designed and tested like any other control. A reviewer without the time, information or authority to change the outcome offers little real assurance.
The capacity to govern is uneven
Large banks have built guardrails, from internal versions of AI tools to controls that stop sensitive data leaving the firm. The tier-one bank leader was less sure smaller firms have “the capability to set up all the guardrails in the right way.”
As AI becomes easier to buy, the gap in governance capacity may matter more than the gap in technology, especially for smaller firms.
Key takeaways: what this means for compliance and financial crime leaders
- Agree where your function sits. Be clear whether compliance owns AI governance, contributes to it or is governed by it, and who the accountable executive is.
- Design validation before you scale. Decide how accuracy and consistency will be tested, and how often.
- Build the audit trail as you go. Record prompts, model versions, outputs and overrides from day one.
- Set decision rights per use case. Tie what AI can decide alone to your documented risk appetite.
- Govern who can build, not just what gets deployed. Keep a register of AI tools and one source of truth for key metrics.
- Make human review real. Give reviewers the time, information and authority to overrule the model.
- Plan for governance as ongoing work. Budget for it in delivery time, not just headcount.
In our view, the teams best placed to move quickly with AI will be those that can explain to their board and their regulator, end to end, what their AI did and why.
Continue the conversation
How are compliance teams proving their AI does the right thing, and who answers for it when it doesn’t?
Senior compliance and financial crime leaders will be taking these questions on at FinTech Compliance Leaders on 9 March 2027, Shape Finance’s invitation-only forum.
