Compliance teams across banks and payment firms are being squeezed from both directions.
Boards and executive committees are pushing for rapid AI adoption to slash operational costs, while the volume and cross-border complexity of regulatory change continues to surge, and personal liability for failures remains firmly on the shoulders of named individuals.
The tension was laid bare in a recent Vixio webinar, where payments and banking industry lead Luke Baker was joined by Nilesh Khatri, head of technology, regulated FinTech and financial services, and Andrew Dawson, chief risk and compliance officer / MLRO at Yeepay UK, to examine how firms are deploying AI in practice without surrendering human judgement.
Vixio payments and banking industry lead Luke Baker said, “Most teams are caught in a bit of a vice. On one side, you have boards demanding immediate AI adoption. On the other, you have the sheer volume of regulatory change—and 85% of compliance leaders say managing cross-border complexity is their biggest headache.”
While consumer-grade large language models are impressive, their hallucination rates make them unsuitable for high-stakes regulatory work. The panel’s answer is to strip out the machine’s creativity entirely. Dawson pointed to a proprietary LLM built during his time at LHV to support analysts drafting suspicious activity reports.
Yeepay UK chief risk and compliance officer / MLRO Andrew Dawson said, “We placed this model in a proprietary environment so the data wasn’t used to train public models, anonymized the customer data, and – most importantly – turned the ‘heat settings’ down to the absolute minimum. You don’t want any sort of creativity or imagination when you’re writing a SAR.”
The outcome was striking: an analytical process that once took five hours became near-instant, freeing analysts to focus on high-value verification rather than repetitive formatting.
A second obstacle is messy legacy data. Many firms believe they must complete a multi-year, multi-million-pound data transformation before piloting AI. Khatri argued this “utopian” data lake is a trap, proposing instead a 60-25-15 budgeting framework: 60% of pilot spend on data hygiene for a narrow, targeted domain; 25% on governance, audit logging and human oversight; and just 15% on the AI tooling itself.
Head of technology, regulated FinTech and financial services Nilesh Khatri said, “In many failed pilots, this ratio is completely inverted. Teams spend all their budget on the shiny new AI tool, and squeeze the data and governance pieces. To show momentum, pick a single jurisdiction or a specific product taxomony, get it right, and replicate that success.”
The panel agreed that agentic AI excels at “bookending” the compliance lifecycle, from horizon scanning to populating repetitive KYC questionnaires, but the interpretive middle must stay human. When the UK introduced new safeguarding rules for EMIs, understanding their interaction with a firm’s localised treasury systems demanded contextual knowledge and organisational navigation no machine possesses. Khatri also warned that compressing scanning timelines without expanding human interpretation capacity simply builds a larger backlog.
On explainability, the consensus was to design for failure rather than the happy path: keep AI recommendations separate from human decisions, log prompts, inputs and model versions at runtime, and force vendors to abandon black-box systems so a non-technical officer can trace why an alert was flagged or dismissed.
With personal liability regimes such as the UK’s SMCR expanding, the verdict was unambiguous. Baker said, “You can outsource the execution of a system, but you can never outsource the accountability.”
Watch the full Vixio webinar here.
Copyright © 2026 RegTech Analyst
Copyright © 2018 RegTech Analyst
