How Banks Are Using AI to Meet Compliance Requirements

SOX controls testing, AML alert triage, and regulatory reporting still largely run on spreadsheets, disconnected systems, and periodic manual reviews in many midsize banks, according to BizTech and IDC research from March 2026. The scale problem is significant: as user counts, system access entitlements, and non-human identities multiply, manual oversight simply cannot keep pace — a dynamic RSA's Jim Taylor has described directly. Regulatory volume is also accelerating, with SR 26-2 replacing SR 11-7 in April 2026, the EU AI Act expanding Article 50 transparency obligations from August 2, 2026 (with high-risk AI system obligations deferred to December 2, 2027 under the Digital Omnibus), and agentic AI use cases arriving faster than governance frameworks can absorb them.

The gap between deployment and readiness is already measurable. According to Wolters Kluwer's Q1 2026 survey of 148 financial institutions, 31.8% have deployed AI and ML into production, but only 12.2% describe their strategy as well-defined and adequately resourced. This gap should be understood not as a failure of ambition but as a predictable consequence of deploying before governance catches up — and the rest of this piece offers practical correction, not criticism. The manual baseline is the problem AI is being asked to solve, and understanding which workflows it addresses first is the core value of this analysis.

The regulatory stack banks must now navigate simultaneously

Four frameworks form the core compliance stack in the United States. SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026, supersedes SR 11-7 and represents the biggest U.S. model risk update in over a decade. The EU AI Act reached an enforcement milestone on August 2, 2026, expanding obligations for banks using high-risk AI systems, with penalties reaching up to €35 million or 7% of global annual turnover. CFPB adverse-action rules under ECOA and Reg B require that AI-assisted credit decisions be accompanied by explainable adverse-action notices. The GLBA Safeguards Rule extends vendor and data security obligations to third-party AI providers.

For broker-dealers and banks with investment-management arms, SEC and FINRA expectations layer on top of these requirements, encompassing fiduciary duty applied to AI-assisted advice, books-and-records requirements for AI-generated client communications, and supervision obligations for AI agents acting on behalf of registered persons.

Several SR 26-2 specifics are worth flagging for practitioners. The guidance replaces the fixed annual review cycle with a risk-based cadence, meaning higher-risk and faster-changing models are reviewed more frequently. It explicitly states that generative and agentic AI are "novel and rapidly evolving" and outside its formal scope — but the agencies affirmed that existing risk principles, including materiality, ongoing monitoring, and effective challenge, still apply. The agencies have also signaled plans to issue a request for information on banks' AI use, indicating that formal scope expansion is coming.

On the EU AI Act side, the high-risk classification applies to creditworthiness assessment and credit scoring under Annex III 5(b), and to remote biometric identification systems under the biometrics category of Annex III 1(a). Loan approval AI is covered under the creditworthiness umbrella, but customer identity verification and AI embedded in critical compliance workflows are not explicitly named as high-risk categories in Annex III. Requirements for high-risk systems include risk management throughout the AI lifecycle, high-quality training and validation datasets to mitigate bias, detailed technical documentation, robust human oversight, transparency to users, and accuracy and cybersecurity controls. Banks must also align AI governance with DORA operational resilience programs rather than treating it as a separate workstream.

A key tension worth surfacing is that SR 26-2 deliberately excludes generative and agentic AI from formal scope while making clear that existing principles apply. This is the governance gap that makes the "we are still piloting" defense untenable by the second examination, per ibl.ai's 90-day framework analysis. It is also worth noting the OCC's position on marketing AI: generative AI tools used in content generation, segmentation, and offer personalization are currently excluded from the OCC's model-risk framework under OCC Bulletin 2026-13, which explicitly carves out generative and agentic AI as novel and rapidly evolving. No confirmed OCC MRA findings for failure to inventory marketing AI have been publicly documented. Despite all of this regulatory activity, only 26.4% of institutions surveyed expressed confidence in their AI initiatives' alignment with regulatory requirements, while 48% said they were only somewhat confident, per Wolters Kluwer's Q1 2026 survey.

AML transaction monitoring: where AI is making the clearest measurable difference

The scale of the AML problem is substantial. Fraud losses globally exceed $190 billion annually, and compliance teams spend up to 42% of their budgets processing false positives, according to 2026 research. Rule-based systems routinely miss complex, multi-entity transaction patterns and emerging typologies that do not fit predefined rules. AI's core advantage in this context is pattern recognition across the full transaction population rather than relying on sampling.

Performance benchmarks from production deployments illustrate the difference. AI detects 70 to 90% more suspicious activity than traditional systems, and false positives are reduced by 80 to 90% in pure AI deployments. Hybrid AML solutions combining AI with rules-based detection reduce false positives by 30 to 60% while preserving the explainability that examination teams require. Institutions have reported up to 60% faster investigations, 50% fewer false alerts, and SAR filing times compressed from days to hours within the first year of deployment.

The explainability tradeoff is a practical deployment decision, not a theoretical one. Pure AI AML systems achieve the highest detection rates but can struggle to satisfy regulatory explainability requirements, while hybrid models trade some detection ceiling for auditability. Several named production deployments are worth noting. FIS, in partnership with Anthropic, launched its Financial Crimes AI Agent in 2026, naming BMO and Amalgamated Bank among the first institutions to deploy it, with broader availability planned for H2 2026. Fiserv launched agentOS, an operating system for agentic AI in banking, with third-party partners supporting financial crimes compliance use cases.

At the enterprise scale, banks have reported 40 to 60% reductions in alert volume through better initial scoring that filters low-risk activity, freeing analyst time for genuine risk cases. Importantly, AI does not "solve" AML. The more accurate framing is that it restructures where human judgment is applied — shifting it from alert processing toward case investigation and SAR decision-making.

KYC onboarding automation: the ROI case that justifies the governance investment

A standard manual KYC onboarding process takes 7 to 10 business days per corporate client, per FluxForce AI analysis. With AI-assisted onboarding — incorporating automated document verification, sanctions screening, and biometric liveness checks — that timeline compresses to 4 to 6 hours per corporate client. Scaled to a bank onboarding 2,000 corporate clients per year, the result is roughly 18,000 analyst-hours saved annually. This figure should be treated as a planning benchmark rather than a universal claim.

The financial returns are significant. For a $50 billion asset bank, KYC and AML automation typically generates $12 million to $20 million in annual savings against platform costs of $2 million to $4 million per year. Practitioners should track a specific set of performance metrics to validate these outcomes. For KYC, the key indicators are time-to-yes, auto-approval rate, and manual review rate. For AML, they are alert volume, false positive rate, alert-to-SAR conversion, and case cycle time. For model health, practitioners should monitor precision, recall, and population stability index to catch drift before it becomes an audit finding.

There is also a direct governance link worth making explicit. These operational metrics are the same evidence model risk managers need for ongoing monitoring under SR 26-2's risk-based review cadence, meaning the operational dashboard and the compliance record are the same artifact. The ROI argument connects directly to the regulatory cost of inaction: institutions spending 42% of compliance budgets on false-positive processing are funding a problem that AI directly addresses.

SOX controls testing and real-time regulatory monitoring: AI's next compliance frontier

The SOX problem AI is solving is structural. Controls testing, documentation, and audit preparation still run on disconnected spreadsheets and point-in-time sampling — the same baseline weakness described earlier in this piece, now applied specifically to SOX. According to Sam Abadir, IDC research director for risk, financial crime and compliance, quoted in BizTech in March 2026, AI changes this in several concrete ways. It continuously assembles evidence from source systems rather than requiring teams to manually assemble audit packages at review time. It maps artifacts to specific control requirements automatically. And it identifies gaps before testing cycles begin, shifting the institutional posture from reactive to anticipatory. Abadir put it directly: "The future SOX auditor works from risk signals across entire data sets rather than from static samples assembled for a point-in-time review."

This represents a structural shift from periodic control validation to continuous assurance based on full-population risk signals — not an incremental improvement but a fundamentally different operating model. Real-time regulatory change monitoring follows a similar logic. AI agents can continuously monitor regulatory publications, enforcement actions, and supervisory updates, mapping changes directly to internal control inventories and policy frameworks and compressing response cycles from months to days, per RSA's Jim Taylor.

Taylor's framing on where the value actually sits is worth quoting directly: "The advantage is not simply faster awareness of violations but earlier visibility into emerging risk conditions and control gaps." In BSA/AML and sanctions programs, remediating exposure before it surfaces in an examination is where AI earns its place. Among agentic AI use cases in 2026, regulatory-change triage, financial-crime detection, and controls monitoring drew the most deployment attention because each pairs high volume with a containable cost of error, per a 360factors roundup. Documented enterprise outcomes cited as benchmarks include 75% faster compliance reporting, 60% reduction in fraud detection false positives, and 90% faster workflow processing — though these are vendor-reported figures from early deployments rather than independent audits.

Where governance gaps persist & what regulators are watching most closely

The confidence gap among financial institutions is significant. Only 26.4% of institutions surveyed expressed full confidence in their AI initiatives' alignment with regulatory requirements, while 48% said they were only somewhat confident, per Wolters Kluwer's Q1 2026 survey. The ethical AI policy gap compounds this problem: only 35.8% of institutions have established internal policies for ethical AI use, and 33.8% have policies in development, meaning roughly a third are operating deployed AI without a completed policy framework.

The top regulatory concerns practitioners cited in the same survey are illuminating. Explainability and transparency topped the list at 28.4%, representing the most acute concern across the field. Bias and discrimination clustered closely behind explainability. Data privacy was cited by 21.6% of respondents, and fair lending concerns by 18.2%. Data infrastructure emerged as an overlooked bottleneck: only 9.5% of respondents report being very prepared to support AI with their existing data infrastructure, a reminder that AI governance is only as good as the data pipelines feeding it.

The SR 26-2 and generative AI gap has real practical consequences. The guidance explicitly excludes generative and agentic AI from formal scope, but regulators have affirmed that existing risk principles still apply. Institutions using "novel tools, outside scope" as a governance bypass are exposed, and the "we are still piloting" defense does not survive the second examination, per ibl.ai's 90-day framework analysis. Third-party AI governance is another area where institutions frequently underestimate their obligations. When a bank uses a vendor's AI, the vendor's SOC 2 report is not sufficient to satisfy model risk management requirements — the bank owns the inventory, validation, and monitoring responsibility regardless of where the model lives.

The EU AI Act also functions as a cybersecurity obligation, not just a compliance checklist. An AI system encompasses code, data, decision logic, prompts, APIs, connectors, credentials, logs, and pipelines, and each layer introduces attack surface. The Act may treat AI systems as ICT assets supporting critical banking functions, per ATM Marketplace reporting from July 2026. Marketing AI represents a hidden MRA risk as well. OCC guidance makes clear that generative AI tools used in marketing — content generation, segmentation, and offer personalization — fall under model-risk frameworks when outputs influence consumer decisions or touch credit and eligibility logic. Banks that omitted marketing AI from their model inventory have already drawn MRA findings.

Finally, 58.8% of institutions surveyed said that regulatory guidance would most help advance their AI strategy — more than technical training or industry benchmarks — per Wolters Kluwer Q1 2026. Any honest assessment of the current landscape must acknowledge that guidance is still being written for the most novel use cases.

A practical governance framework for AI compliance programs that survive examination

This framework is best understood as a phased approach rather than a checklist. Sam Abadir, IDC research director quoted in BizTech, frames the standard for success clearly: a ninety-day program succeeds only when the output "can withstand audit and regulatory scrutiny and begins reducing manual workload within a defined control area."

Phase 1 covers inventory and risk tiering and runs from days 1 through 14. Most banks underestimate the AI already in production through SaaS tools, embedded features, and shadow usage. A thorough inventory must include every AI model and agent in production — including third-party SaaS and CRM tools — every large language model the institution calls, and every workflow touching consumer or client data. Each model should be risk-tiered as high for consumer-facing or advisory functions, medium for operations-impacting functions, or low for internal productivity tools. Marketing AI tools must appear in this inventory, as the OCC has flagged MRA findings for omissions in this category.

Phase 2 covers model risk management policy updates and runs from days 15 through 30. The institution should extend its existing MRM policy to explicitly cover AI and large language models, defining validation requirements by risk tier, performance monitoring thresholds and drift triggers, third-party AI governance obligations that go beyond SOC 2 reliance, and clear roles and accountability structures covering the model owner, validator, business owner, and model risk committee.

Phase 3 follows from this foundation and continues the build-out of a governance program capable of surviving examination scrutiny on an ongoing basis.