As AI reshapes financial services, compliance is moving beyond interpreting rules and managing controls. The challenge is increasingly one of engineering: translating regulatory obligations into systems that can adapt, act and demonstrate accountability.
Compliance has traditionally relied on people interpreting rules, managing controls and keeping pace with regulatory change. But as financial institutions grow more complex and AI becomes embedded in their operations, the limits of this approach are becoming harder to ignore. The challenge is no longer just understanding what the rules demand, but building the systems and processes to put them into practice consistently.
This is bringing compliance closer to engineering, where controls must be designed, tested and maintained rather than simply documented. For the RegTech industry, the question is whether this shift will fundamentally change how financial institutions build and manage their compliance functions.
In a new four-part RegTech Analyst Series, the focus shifts onto The Architecture of Compliance: Rebuilding RegTech for the AI era. This series examines compliance in the AI age, and what firms need to be paying attention to.
In the first part of a two-part series of part one we speak to key industry thought leaders to gauge their views.
Compliance: becoming a tech function?
Is compliance becoming a technology function? In the view of Areg Nzsdejan, CEO of Cardamon, increasingly, this is true.
“Turning a regulatory obligation into something a business can consistently execute requires structured data, workflows, controls and testing. Those are engineering problems, and compliance teams need to be involved in how they are solved,” he said.
The judgement, in his view, still matters hugely, as someone must decide what an obligation means for the firm and whether the resulting control is appropriate.
He added, “If that interpretation lives in one person’s inbox, every team ends up reconstructing it. Good infrastructure lets the business apply it consistently and revisit it when things change.”
Meanwhile, Zurab Kotaria, CEO of Identomat, sees that compliance is becoming increasingly tech-enabled but wouldn’t say it’s becoming purely a tech function.
“What is changing is the way compliance is delivered,” he said. “As businesses operate across more markets, regulations become more complex, and fraud becomes increasingly sophisticated, manual compliance processes simply cannot provide the speed and scale organisations need.”
He believes we can already see this in areas like identity verification, KYC, AML screening, fraud detection, and transaction monitoring.
Kotaria quipped, “AI and automation can analyse large volumes of data, identify patterns, verify identities, and flag potential risks in seconds. This allows compliance teams to move away from repetitive checks and focus more of their attention on complex cases and higher-risk decisions.”
The Identomat head sees this shift directly through the adoption of AI-powered identity verification and KYC.
He added, “The objective is not simply to make verification faster; it is to build compliance into the customer journey as an intelligent, continuous process.
The future of compliance will therefore sit at the intersection of regulation, technology, and risk management. Technology provides the infrastructure and scale, while compliance expertise defines the rules, context, and accountability.”
Tim Khamzin, CEO of Vivox AI, stressed that compliance is increasingly an engineering discipline.
“When software carries out compliance checks, firms need to define how it should handle missing evidence, conflicting information and cases that require human judgement. Compliance professionals need to help design and test that behaviour.
“At Vivox AI, we face these questions when building AI agents for business and customer due diligence. If a company registry identifies one beneficial owner and the customer’s documents identify another, the agent should flag the discrepancy, preserve both sources and follow a defined process for further investigation. It should never quietly choose whichever answer looks more plausible.”
Emil Kongelys, CTO of RegTech firm Muinmos, gave an example outside of finance to answer this question.
He remarked, “Surgeons today can perform operations remotely, using robotic surgery equipment. That doesn’t make surgery a tech function; but it does mean surgeons now have to master new technologies to stay on top of their practice, as the operation is performed by technological proxies of the surgeon.”
In the compliance field, similarly, the function itself, the judgement, the accountability – all remain with the human, but the execution is increasingly technology-driven.
“And it has to be – the number of compliance controls and requirements has evolved significantly over recent decades, as well as the data availability and rate of changes involved,” said Kongelys.
The Muinmos CTO detailed that the initial response to this increase in complexity was to introduce specialist tools for individual areas and hire teams to manage them.
This approach, he said, worked for many years, but it also caused compliance teams to become siloed by function, resulting in a fragmented operation – and that fragmentation brought with it additional errors.
He remarked, “Today, we see the technological response to this, which is end-to-end orchestration – but that does not mean compliance is becoming a tech function. It just means that technology is again applied to solve a compliance issue (fragmentation).”
Sarah French, CRO of RegTech firm TaxTec, believes compliance is increasingly becoming a tech function, but wouldn’t describe compliance as becoming purely a technology function.
She said, “What is changing is the architecture required to deliver compliance effectively. In complex financial services, regulation increasingly has to be translated into data requirements, rules, workflows, controls, exceptions, evidence and reporting. That makes technology fundamental to how compliance is operationalised.”
Therefore, for French the strongest model is therefore not compliance handing responsibility to technology, but compliance, product, technology and the business working from a common control framework.
“Compliance defines the regulatory intent and risk appetite; technology makes those requirements repeatable, traceable and scalable; and the business provides the operational context needed to make the controls effective,” she said.
TaxTec sees this clearly in withholding tax. A regulatory outcome can depend on the quality and completeness of data moving through multiple parties, systems and processes. “Technology can create the control layer that reconciles, validates and evidences that journey rather than relying on fragmented manual checks,” she said.
In the view of Victor Chauhan, co-founder and partner at Argus Pro, compliance is becoming a strategy function first.
He said, “Leaders are starting to bake compliance in from the start rather than append it later. The work of tracking obligations, linking them to controls and holding the evidence together is now too large for spreadsheets and institutional memory. Firms that approach that as an engineering problem tend to end up with something better than firms that treat it as an administrative one.”
The risk is in where they start, believes Chauhan. He said it is tempting to start at the end that produces a dashboard, because that is the part you can show a board.
“But telemetry tells you what happened, not what the regulator meant. Before anything can be counted, somebody has to read the instrument, work out what obligations it creates, and decide what would count as proof that the firm meets them,” he said.
Such a sequence is the engineering part, and it often runs in one direction. “Read for intent. Derive the control objective. Design the evidence that would demonstrate it is met. Only then build the thing that measures it. That is compliance by design.”
Firms that invert this, Chauhan says, end up with a well-instrumented system that measures the wrong thing, precisely. “Technology carries the load. It does not decide what the load is,”
Therefore, the Argus Pro co-founder believes compliance is becoming a technology function in the same way that safety engineering is. Strategy sets the requirement, and the technology carries it.
The compliance balancing act
How much compliance can be automated without losing human judgement? This is a key balancing act, and it’s important to understand.
From the stance of Kotaria, a large part of compliance can be automated, particularly processes that are repetitive, data-intensive, and rules-based.
He gave the example of areas such as identity verification, document validation, biometric checks, sanctions screening, and risk-based monitoring as areas where AI and automation can significantly improve speed, consistency, and scalability.
“The important distinction is between automating compliance processes and automating compliance judgment. AI can collect and analyse evidence, identify anomalies, assess risk indicators, and determine when a case requires further attention,” he said. Despite this, it should not remove human accountability from decisions where context, interpretation or material risk is involved.
The most effective model for Kotaria is automation with intelligent human oversight.
He commented, “Technology should handle the volume and complexity that machines are better equipped to manage, while compliance professionals focus on exceptions, ambiguous cases, and decisions that require contextual judgment. The objective is not to automate 100% of compliance. It is to automate the right 80-90% of operational work so that human expertise can be concentrated where it matters most.”
Nzsdejan stressed that quite a lot of the work around a decision can be automated. This includes gathering evidence, comparing documents, identifying possible gaps and routing issues to the right person.
However, the boundary depends on the consequences that can be found from getting something wrong.
He said, “An ambiguous interpretation with material customer impact needs more oversight than a routine document comparison. Human review has to be practical: access to evidence, time to challenge the answer and authority to intervene. Asking someone to approve hundreds of outputs they cannot realistically inspect creates very little assurance.”
Evidence gathering, document comparison and preparing cases for review can be automated, said Khamzin. However, how much autonomy an agent receives should depend on the consequences of an error and evidence that it can perform the task reliably. Faster processing is useful only if the quality of the checks holds up.
He said, “Human oversight requires more than a sign-off button. Reviewers need to see the source material, understand what remains unresolved and have the time and authority to challenge a recommendation. An explanation generated by the same model is not, by itself, evidence that the conclusion is sound.”
French echoed a similar point, stating that a substantial proportion of compliance execution can be automated, but judgement should not be designed out of the operating model.
“The right question is not how much human involvement can be removed; it is where human judgement genuinely adds value,” she said.
French continued, “Rules-based validation, data reconciliation, calculation, workflow routing, evidence capture, deadline monitoring, exception identification and reporting are all strong candidates for automation. Human expertise remains critical where regulation is ambiguous, facts are unusual, risk is material, an exception requires interpretation, or a decision needs accountability.”
The best architecture, the TaxTec CRO stresses, uses automation to remove repetitive processing and surface the cases that require expert attention. That can strengthen human judgement because specialists spend less time finding problems and more time deciding what those problems mean and what should happen next.
Chauhan’s response on this is that more than most firms currently automate, and less than most vendors imply.
He detailed, “Detection, triage and proposal automate well. A system can watch the sources that matter, notice when something changes, work out which obligations that change affects, and put a draft assessment in front of a person. That is a large amount of work. Humans do it slowly and inconsistently, because it depends on remembering which rule sits behind which control.”
Interpretation and decision-making do not automate. What a clause requires of this firm, with this business model, in this jurisdiction, is a judgement, claims Chauhan.
“So is the decision to accept a control as effective. Those stay with people who can be held to account for them, which in the UK means named individuals under the senior managers regime,” he said. His next comment is succinct: remove the human from the hamster wheel, not the loop.
“The harder point is what automation does to the person left in the loop,” Chauhan continued. “Automation bias has been studied for thirty years, beginning in aviation and now well documented in medicine. People accept a machine’s recommendation more readily than they should. The effect worsens under exactly the conditions compliance teams work in: high workload, ambiguous cases, time pressure.”
The human in the loop is now a control, and controls have to be tested, in the view of the Argus Pro co-founder.
He said, “The practical rule we apply ourselves is simple. Automation may detect, triage and draft. A person decides, and the decision is recorded as theirs. The release button stays human.”
The last view on this question comes to Kongelys, who stressed that human judgement comes from assessing the relevant facts, understanding their context and deciding what they mean.
He said, “It doesn’t come from manually collecting every document or piece of data. Automation can bring all the information together, highlight gaps and flag issues requiring attention, giving the reviewer a stronger foundation to exercise their judgement. This way automation actually helps compliance professionals to focus on the cases that genuinely require human judgement.”
The modern compliance professional
What skills will define the modern compliance professional? Cardamon’s Nzsdejan said that simply, regulatory judgement remains the foundation.
“Alongside it, compliance professionals will need to understand how data moves through the business, how controls operate and where an automated process can fail,” he added. “They should be able to take a requirement and explain what evidence would demonstrate that it has been met. They should also be comfortable challenging a vendor: which sources informed this output, how was it tested, and what happens when it is wrong?”
He believes that you don’t need every compliance officer to become a software engineer, but you do need people who can work closely with engineers and ask precise questions.
Kotaria thinks the modern compliance professional will need to go beyond understanding regulations, and will need to be comfortable working with technology, data and AI, and understand how these tools can be applied to real compliance challenges.
He quipped, “Being able to translate regulatory requirements into practical, technology-enabled processes will become an increasingly important skill. At the same time, human judgment will remain critical. Professionals will need strong analytical and critical-thinking skills to understand risk, recognise exceptions, and make informed decisions when the situation is not straightforward.”
Kotaria’s final point on this is that the most effective compliance professionals will be those who understand both the rules and the tech used to enforce them.
From French’s vantage point, regulatory expertise will remain critical, but it will increasingly need to sit alongside data literacy, systems thinking and an understanding of technology-enabled controls.
She said, “Modern compliance professionals need to understand not only what a rule says, but how that rule becomes a requirement, how the relevant data is sourced and validated, where exceptions can occur, and what evidence demonstrates that the control has operated.”
Additionally, AI literacy will also become important. Professionals do not need to become engineers, but they do need to understand what AI can and cannot reliably do, how outputs should be validated, and where governance and human accountability must remain, she said.
She concluded, “The differentiating skill will be the ability to connect regulation, data, technology, risk and the commercial reality of the business.”
In the view of Khamzin, compliance professionals will increasingly need to translate regulatory obligations into controls that engineers can build and teams can test.
He said, “They do not all need to become programmers. But they do need to ask precise questions about data, examine failures and recognise when a convincing answer is unsupported. Investigative judgement becomes more valuable as routine work is automated”.
Kongelys added that although compliance operations are becoming increasingly technology-driven, the function still depends on strong legal and regulatory expertise. Technology is only effective if it is kept aligned with current rules and requirements.
He said, “When investigating cases, compliance professionals must also know how to gather, assess, and document reliable evidence and sources. This is particularly important when using generative AI, which can produce convincing but inaccurate information even with a well-designed prompt.
“Modern compliance professionals therefore need methodical and analytical skills, sound judgement about what constitutes credible evidence, and the ability to separate useful insight from AI-generated noise.”
The final comment on what makes a compliance professional came from Chauhan, who said that two are emerging, and neither is being sought often enough.
The first one is evidence design. “The valuable skill is no longer writing the policy. It is being able to say what would prove that the control described in the policy actually works, and then testing it. That is a different mindset. Start from the question a regulator or a board would ask, and work backwards to the artefact that answers it.”
This is also where the profession’s most common weakness sits, said Chauhan.
He explained, “A supplier attestation is evidence that a claim was made. It is not evidence that a control operates. The distinction sounds pedantic until a firm has to demonstrate resilience and discovers that its entire evidence base is other people’s assertions.”
The second part is knowing when to challenge the machine. This, Chauhan says, is newer, and almost no one is measuring it.
He said, “When a system proposes an interpretation, someone has to decide whether to accept it. Doing that well requires enough understanding of the underlying obligation to notice when the proposal is wrong, and enough confidence to say so when the system sounds certain.”
Where does this leave the architecture? For Chauhan, if compliance really is becoming an engineering discipline, it needs what every engineering discipline has, and compliance mostly lacks: a way to test the whole loop rather than one part of it.
He said, “The loop has three stages, and they only work in sequence. Something changes in the rulebook, and the firm has to know which of its obligations that change actually touches, at the clause level, rather than simply that something has moved.
“The firm then has to know whether the control sitting behind that obligation is well designed, and whether it is working in practice. Those are two separate questions that firms have traditionally collapsed into one. That is why controls which look sound on paper keep surprising people.”
The first two stages are buildable today, said the Argus Pro co-founder, and many firms are building them. What tends to get lost is the ordering. A clause-level record of the obligations has to come first, because no amount of downstream cleverness survives an out-of-date view of the rulebook.
The third stage, says Chauhan, is where the industry has barely started. “Once you know what changed and whether the control is sound, you still have to know whether the people operating it can apply it. We can test systems. We are getting better at testing controls. We have almost no way of testing whether the judgements made inside those controls are good ones, and that gap widens every time another decision becomes machine-assisted,” he said.
He concluded, “Compliance as an engineering discipline is the right ambition. It just has to include the part of the system made up of people.”
Copyright © 2026 RegTech Analyst
