Is compliance entering its engineering era?
As financial institutions adopt AI, the pressure on compliance teams is shifting from interpreting regulation to ensuring it works in practice. Meeting that challenge requires more than updated policies and stronger controls. It demands a rethink of how compliance is built into the technology, processes and decisions that underpin financial services.
Regulatory obligations have traditionally been managed through a combination of human judgement, established procedures and periodic reviews. Yet these methods face growing pressure as financial services become more interconnected and automated. Firms must find ways to embed regulatory requirements into day-to-day operations, respond to change without losing control and provide evidence that their systems are working as intended.
In a new four-part RegTech Analyst Series, the focus shifts onto The Architecture of Compliance: Rebuilding RegTech for the AI era. This series examines compliance in the AI age, and what firms need to be paying attention to.
In the second part of a two-part series of part one we speak to leading industry individuals to gauge their views.
Is compliance becoming a technology function?
A key question standing out for many in the financial world is whether compliance is becoming a tech function.
In the view of Karavel CEO Pedro Sousa, something has definitely changed in compliance team meetings.
He elaborated, “For most of the profession’s history, the job asked for a well-understood set of skills: knowledge of regulation, the ability to deal with regulatory ambiguity, sound judgement, the ability to measure risk, and the communication skills to explain all of it to the business. Those still matter.
“But today, when compliance professionals are assigned work, often they’re hearing words like “automation”, “efficiency” and “AI agents”. Management is pushing teams to play around with AI agents and to build internally.”
Whilst build used to be reserved for software, Sousa stresses the term is now often heard in compliance team meetings.
On whether compliance is becoming an engineering discipline, he doesn’t believe it is just yet.
“Finance didn’t become an IT function when spreadsheets arrived, but nobody today would hire a finance analyst who couldn’t use one,” he said. “Compliance is heading the same way. It is strangely now using some engineering lingo. “Build”, “test”, “versioning”, “explainability”, “shipping” are words increasingly being used by compliance managers looking to create new processes in the age of AI.”
In the view of Sousa, the best compliance teams have always had an automation mindset, however, their hands were mostly tied by the constraints of the technology at the time. What’s new, he quipped, is that AI making automation so much more accessible to everyone that it’s becoming the default rather than the exception.
Bhavin Shah, CEO of Sherlocq, took another direction on this question. He asked readers to consider what a large institution asks of its compliance function on any given day.
He explained, “Millions of transactions move through the bank. Onboarding requests and screening alerts arrive in volume. Internal teams, the board, and regulators all send queries that need considered answers. And underneath it all, the rules themselves keep changing — not in one market, but across every jurisdiction the firm touches, and faster than they used to.”
No individual, he said, regardless of experience, can hold all of that at once. Shah outlined that the volume of work and the velocity of regulatory change have both risen at the same time, and human effort alone cannot keep pace with either. Some of this work has to be carried by systems.
“But carrying the work is not the same as making the decisions,” he said. “Compliance is not becoming a technology function. It is becoming a function that makes better and faster judgment calls because technology handles the volume beneath them. The role of the compliance officer does not shrink in this picture; it moves up — away from manual processing and towards the decisions that actually require a person. That is a meaningful shift, but it is not the same as compliance becoming engineering.”
He concluded on this argument suggesting that the system carries the load, and the judgment stays with the professional. “That distinction is the whole argument,” he said.
Stacey English, Director of Regulatory Intelligence at Theta Lake, added her view on this, stating that compliance isn’t just adopting technology – it’s being fundamentally redefined by it.
She said, “The sheer volume, speed, and complexity of modern workplace communications and AI interactions make manual oversight impossible. Compliance teams face the same mandate as business lines and regulators to be effective and efficient, which simply cannot happen without technology.”
English raised how capabilities like Theta Lake’s risk indicator analytics summary are able to condense weeks or months of multi-platform conversations into concise summaries, pinpointing where potential conduct or compliance violations exist so teams can immediately grasp the essence of an interaction.
“With 99% of organizations planning to expand AI usage and 88% already citing governance challenges, technology has become the core infrastructure of modern compliance and governance,” said English.
New technology is enabling compliance teams to be more efficient and to identify and remediate risks more effectively, but it is not becoming a technology function, said Jamie Hoyle, SVP of Product at Red Oak.
He added that the back office of regulated organizations has undergone massive transformation in the past 10 years, and AI is accelerating that – but the hallmarks of good compliance programs are the same as they always were, at least for now.
Glenn Espinoza, CEO of RegTech firm Luthor, said that while compliance is not becoming an IT function, technology is becoming part of the core compliance operating model.
He remarked, “As compliance becomes more complex, teams start to think in systems and this is where leveraging technology becomes mandatory.”
Kelvin Dickenson, CPO at StarCompliance, meanwhile, remarked, “Technology is becoming a much bigger part of compliance, but it is not replacing the function itself. The shift is toward compliance teams using technology to automate lower-risk work, surface insights, and strengthen oversight while keeping human expertise at the center of decision-making.”
An equally interesting response on this topic came from Chaitanya Sarda, co-CEO of AiPrise. He pushed back on the framing of compliance as an engineering discipline, and said that compliance is becoming a specification discipline, which is a different thing and a harder one.
He said, “For twenty years compliance teams executed policy. Someone wrote the standard, and analysts applied it case by case, which meant a lot of the actual policy lived in people’s heads. “
Sarda explained how two analysts reading the same standard reached different conclusions and nobody noticed, because nobody could see across the whole queue.
“When the work moves into a system, that stops being possible. The policy has to be written down precisely enough for a machine to run it. Most firms find the hard part isn’t the technology. It’s discovering how much of their policy was never actually written down,” he added.
Whilst compliance sits closer to a tech function than it did, the skill it demands isn’t engineering – instead it sits closer to product management. Sarda explained, “ Deciding what the system should do, in what order, with what tolerance, and then supervising whether it does.”
How much compliance can be automated
How much can be automated without losing human judgment? Here, for Shah, the honest boundary runs up to the point of decision. Work, he said, can be automated as far as the facts are clear and stable – but should stop where experience and context take over, and where a system cannot be safely relied upon.
He added, “Customer due diligence illustrates it well. Much of the fact-gathering can be automated — collecting, structuring, and checking information against defined criteria. But the decision of whether to onboard a client who carries a particular risk profile is not a matter of fact alone. It varies from jurisdiction to jurisdiction, and from institution to institution, according to risk appetite that no system holds. That call belongs to a person.”
Going further, Shah explained how screening shows the same line from a different angle.
Shah said, “A screening system will raise an alert on a name; that is exactly what it is built to do, and it does it tirelessly. But whether the alert is a genuine match or a false positive is a matter of human judgment and experience. A system may correctly flag an entity, yet still need a person to recognise that a prefix such as “PAO” or “OAO” is a corporate-form marker rather than a distinct name — the kind of distinction that determines whether a transaction with a sanctioned entity is stopped or waved through. The system surfaces the possibility. The human resolves it.”
This is why judgment in the view of the Sherlocq CEO cannot be fully automated out of compliance. For FIs globally, removing the human from the loop would be a huge risk.
“The value of automation is precisely that it clears the ground so the human judgment can be applied where it matters, rather than exhausted on volume before it gets there,” he said.
Hoyle stressed that the goal for compliance tech automation should always be to eliminate unnecessary manual processes and false positives, and to ensure that compliance professionals have all the information they need to make fewer, more meaningful decisions.
He said, “Firms should not be trying to automate human judgement, but they should be using automation to ensure that the things that they put in front of humans are the things that actually require it.”
Espinoza was succinct on this question, “A lot of compliance activity can be automated. Accountability cannot. The goal should be to automate repetitive work so people can spend more time on the decisions that actually require judgement.”
Whilst human judgment remains irreplicable, automation is what in the view of English makes that judgment scalable.
She said, “The main hurdle today is unifying and normalizing massive streams of fragmented data across communication channels and AI interactions so compliance teams have clear context and a complete audit trail.”
She explained that automation provides the risk-based filter so that human judgment can make the final call.
Automation is best suited to repetitive, lower-risk activities where it can reduce manual workload and improve efficiency, stressed StarCompliance. However, more complex decisions still require contextual understanding, output validation, judgement, and clear human accountability.
On how much can be automated, Sarda stated that a percentage isn’t the right unit. The line falls, he believes, between decisions that are knowable and decisions that are preferences.
He said, “Whether a document is authentic, whether a name matches a sanctions entry, whether an ownership chain resolves: those have answers, and a machine finds them faster and more consistently than a person. Whether a customer’s risk is acceptable given a firm’s appetite isn’t a fact. It’s an institutional choice, and it should stay with people who can be held to it. Most firms find that line by running both in parallel and comparing, which is slower than the vendor pitch suggests and the right way to do it.”
The final point on this question went to Sousa, who stressed an answer to this question – more than most people think, and less than most vendors claim.
He said, “Most firms are answering this by drawing a line: they start by automating the routine work and make sure to keep a human in the loop for the decisions. This ensures that judgement is protected. It’s a sensible design, and it reassures boards and regulators. But I don’t think the biggest risk is that human judgement gets automated away. The bigger risk is that it erodes quietly while the human is still in the chair, and that the human in the loop turns out to be a far weaker control than firms believe.”
As AI takes on more of the work, Sousa quips that the remit shrinks of the compliance officer. This starts first from doing the review to checking it, then from checking every case to checking only the ones the tool escalates.
He said, “Decision-makers are morphing into approvers, and eventually into just a signature. In some cases, the AI isn’t only recommending an answer, either. It’s deciding what the human gets to look at in the first place.”
Sousa said that there’s then the problem of trust that is built over time. When an AI tool is correct 99%+ of the time, he said, disagreeing with it starts to feel like the risky option. “If you override the AI and you’re wrong, you have to explain yourself. If you follow it and you’re wrong, you can at least point the finger at the tool,” he said.
Over time, the Karavel CEO said that over time, there is a risk that people start trusting the machine’s judgement more than their own, and that is the real point that companies should consider. Yet under the Senior Managers and Certification Regime, accountability still sits with named individuals. He said we risk creating roles where people carry full accountability for decisions they are, in practice, no longer really making.
He finished, “That might sound odd coming from someone who builds AI for compliance teams. But a tool is only as safe as the oversight around it, and oversight that exists on paper but not in practice is arguably worse than none at all, because it gives everyone false comfort.”
The modern compliance professional
What skills will define the modern compliance professional? English said that the modern compliance professional needs a strong appreciation for technology, as AI is fundamentally transforming both how employees work and how they are supervised.
She said, “Moving forward, a defining trait of top compliance leaders will be cross-functional collaboration—the ability to work hand-in-hand with IT, risk, and security teams. The goal is to help the business capture the productivity benefits of AI while maintaining the visibility required to satisfy regulatory obligations.”
She finished by stating that companies that fail to establish the oversight of AI and ability to investigate it, don’t just limit their ability to leverage AI safely; they inadvertently push employees toward Shadow IT operating entirely outside enterprise control.
StarCompliance, meanwhile, said that the strongest compliance professionals will be able to bridge regulation and technology.
The firm said, “Regulatory knowledge will remain essential, but data literacy, AI fluency, and the ability to translate rules into operational and technical requirements will become increasingly important. Compliance is moving from simply interpreting rules to helping design systems that make compliance measurable, testable, and sustainable.”
The answer from Hoyle on this final question was that broadly, they are the same skills that already define them today.
He said, “Compliance officers need to be diligent and strong communicators, with a keen eye for detail. They also need to be exceptionally good at assessing and triaging complex situations quickly. Technology makes those skills more important, not less, and allows the compliance professional to focus on more impactful work.”
The skills that follow aren’t technical in the way people assume, said Sarda. He said that firms don’t need compliance officers who can code. They need people who can write a rule that means exactly one thing, test a system’s output hard enough to find where it’s wrong, and say no to an answer that arrives with confidence attached. Precision, scepticism, and a willingness to overrule the machine.
“Compliance isn’t becoming engineering. It’s becoming precise enough to be engineered,” finished Sarda.
On the other hand, Shah remarked that if technology carries the load and people make the calls, the defining skill becomes the ability to hold both correctly.
He said, “The modern compliance professional uses systems as support and assistance rather than depending on them completely — and, just as importantly, knows the difference between the moments to trust the system and the moments to trust their own judgment.”
Part of that is data literacy in a practical sense, said the Sherlocq CEO, and being able to interrogate what a system produces, and to recognise when an output should be questioned rather than accepted.
Shah added, “A professional who cannot tell a reliable answer from a plausible-looking wrong one is not in control of the tool, however powerful it is.”
The other part, Shah went on, is a shift in where the professional spends their time. As manual research falls away, he emphasised, the compliance officer is freed to be more involved in business decisions — bringing hard-won understanding of the risks and rewards of operating across jurisdictions to the table where those decisions are actually made.
He finished, “That is the real promise of the shift. Business exists to expand and to generate returns. Compliance is the function that keeps the business from going bust in the process, making the cautious, precautionary calls that protect it. Technology does not change that relationship. It simply gives the people responsible for it more room to do the part only they can do.”
The final point on this argument came from Sousa, who stated, “For most of the profession’s history, compliance professional’s took pride in how much they knew and how they applied that knowledge: the rulebook, the right provision, how the regulator had treated a similar case. That is starting to take a back seat to how well you understand the tools you’ll need to do the job.”
He remarked that there’s an analogy on this point that works here, saying, “When search engines first popped up, people genuinely asked what the point was of school making you memorise dates, events and facts, if Google already knew all of it and could recall it far better than you ever would.”
The point behind made here by Sousa is that knowing facts became far less significant than knowing how to use the tools that held them. “Critical thinking plus experience was the best combination, and they came to be valued well above whatever you had memorised,” he said.
AI is doing the something similar to compliance,he believes, making those with the skills to build processes in this space, understand the inner workings of agentic AI and being able to implement it a valuable asset to any modern compliance team.
The last word on this from Sousa is that knowing the limits of these tools will be important.
He concluded, “AI tools can cite rules that don’t exist, or make nonsensical jumps in logic and do so with complete confidence. They may not reflect the latest regulatory changes. And they tend to answer a question the way it was framed, so a leading question gets a leading answer. A compliance professional who understands these limitations, as well as the steps that tools are using to reach outputs, is all the more valuable to a business.
“If you’e the person in your compliance team that everyone’s heads turn to when there is any question around AI, you know you’re headed in the right direction.”
