As financial institutions lean more heavily on AI to support compliance decisions, a pressing question is emerging: can they prove how those decisions were made? According to Duna, many firms may struggle to answer convincingly when supervisors come knocking.
When a supervisor reviews an AI-assisted decision, they expect to see a clear record of how the outcome was reached. Yet Duna notes that analysts are often left piecing together audit files from sprawling change logs, making it difficult to separate what matters from what does not.
Regulatory expectations are also sharpening. The European Union’s Anti-Money Laundering Authority (AMLA), in its draft guidelines on ongoing monitoring, states that firms should be able to explain how AI is used and what it produces, enabling supervisors to understand and challenge its use. For compliance teams, Duna argues, meeting that standard begins with knowing what an effective audit file contains.
Beyond core business details such as ownership and activities, Duna identifies six essential components. The first is the AI model itself, including the provider, family and exact version. If a supervisor finds that an outdated model was used, the original assessment could be called into question, potentially forcing a bank to revisit affected cases.
The second is the prompt. This shows what the AI was asked to investigate and how it was directed to weigh evidence. For judgement-based tasks, such as assessing whether a company address is plausible when it sits in a residential area, the prompt reveals how that judgement was framed.
Third is the evidence considered. Duna’s evidence model allows outdated evidence to be dismissed rather than deleted, preserving history without cluttering the current view. This also limits remediation. If a prompt proves unreliable after use across thousands of cases, retained evidence lets teams identify affected results, rerun evaluations and pinpoint which cases need fixing.
Fourth is provenance. The same data point may appear in a company registry, a customer declaration or an identity document, and these sources do not carry equal weight. Where a customer claims an individual owns 40% of a company but the registry shows 30%, provenance clarifies where each figure originated. Duna attaches provenance to individual pieces of evidence so findings can be traced to their source.
Fifth is the raw AI response, retained before the system processes it. The AI might correctly extract a registration number, only for the application to misinterpret it and flag a mismatch. Keeping the original shows whether the error lay with the model or the application logic.
Finally, human judgement must be clearly recorded. If AI flags a mismatch between “Duna BV” and “Duna”, an analyst may recognise the missing legal form and dismiss the finding. The audit file should capture that decision and its rationale, as well as any instance where an analyst accepts an AI result.
Duna recommends building the audit record as work happens, tying each action to evidence and policy. It also advises separating case history from the decision record, with the latter stored as structured data and rendered into a report on demand. This avoids manual compilation, a practice Duna found still common at some institutions, and keeps historical data available for rerunning cases against new policies.
The result, says Duna, is a focused audit file that gives supervisors what they need without burying it in case history.
For more, read the full story here.
Copyright © 2026 FinTech Global
