Banks and fintechs are buying AI compliance tools faster than they’re building the governance to manage them. That gap is becoming an exam issue.
The adoption curve is real. AI-assisted transaction monitoring, automated customer risk scoring, natural language processing for adverse media screening, machine learning models for fraud detection, these tools have moved from pilot projects at large institutions to practical options for community banks and growing fintechs. A 2024 OCC bulletin on AML/CFT program innovation explicitly encouraged banks to evaluate and implement technology solutions where appropriate. Regulators are not opposed to AI in compliance. But they’re asking questions about it, and the questions are getting more specific.
The core examiner concern is not whether a bank uses AI. It’s whether the bank understands what its AI is doing and can demonstrate that its outputs are reliable.
What the Existing Regulatory Framework Requires
The primary framework for AI and model risk in banking is not new. The Federal Reserve’s SR 11-7, issued in 2011 and still fully in force, established model risk management expectations that apply directly to AI-assisted compliance tools. SR 11-7 requires that models be validated, that their limitations and assumptions be documented, that performance be monitored on an ongoing basis, and that governance structures define who is responsible for model oversight.
When a compliance officer asks what model risk management has to do with a transaction monitoring system, the answer is: everything. A system that uses machine learning to set alert thresholds and identify suspicious patterns is a model under SR 11-7. If the bank purchased it from a vendor, the bank still owns the obligation to understand how it works, validate that it’s performing appropriately for the bank’s specific risk profile and transaction population, and document the rationale for any threshold settings. Examiners are testing these questions.
The FFIEC’s third-party risk management guidance adds another layer. AI compliance tools are typically vendor products, which means they carry third-party risk management obligations alongside the model risk requirements. Pre-procurement due diligence on the vendor’s model documentation, contractual rights to access validation data and performance reports, and ongoing monitoring of vendor performance against agreed standards are all required elements.
None of this is a reason not to use AI compliance tools. It’s a reason to use them with the governance the existing regulatory framework requires.
Where Institutions Are Getting Caught
The most common examiner finding in this area is not about the AI tool itself. It’s about the institution’s inability to explain its outputs.
Alert thresholds are the clearest example. Transaction monitoring systems require the institution to set or accept thresholds that determine when an alert fires. Those thresholds encode assumptions about what a suspicious transaction pattern looks like. If a bank accepted vendor default thresholds without documenting why those defaults are appropriate for its specific customer base, product mix, and risk profile, it cannot answer the examiner’s question about how the thresholds were set. The OCC’s BSA/AML examination procedures explicitly require that institutions demonstrate monitoring systems are calibrated to their actual risk profile and that the rationale for threshold settings is documented. Vendor defaults without documentation do not satisfy that requirement.
A similar issue arises with AI-based customer risk scoring. If the institution’s customer risk rating methodology is partially or fully automated, the bank needs to be able to explain what factors the model uses, how they’re weighted, and why the resulting risk ratings are appropriate for its population. For any AI model touching credit or account decisioning, fair lending risk adds further complexity: the model needs to have been tested for disparate impact, and that testing needs to be documented.
The transparency gap is where most AI governance work needs to happen. Banks that are buying capable tools without building the documentation and oversight infrastructure to support them are accumulating model risk that will surface in an examination.
Three Questions to Answer Before and After Implementation
Before implementing any AI compliance tool, three questions should have written answers. Can we explain how this model works in terms that examiners can evaluate? Do we have the contractual right to access the model documentation and performance data needed for ongoing validation? And who in the organization owns model oversight, and do they have the expertise to perform it?
After implementation, three ongoing questions matter: Is the model performing as expected against our actual transaction data? When did we last review and document the appropriateness of its thresholds or parameters? And does our third-party oversight program include this vendor’s compliance with agreed performance standards?
AI compliance tools genuinely improve efficiency and detection capability when implemented with sound governance. The governance infrastructure is not overhead on top of the tool. It is what makes the tool defensible in an examination.
Sources
SR 11-7: Guidance on Model Risk Management | Federal Reserve (2011)
OCC Bulletin 2024-19: AML/CFT Program Requirements and Innovation | OCC
Interagency Guidance on Third-Party Risk Management | OCC, FDIC, Federal Reserve (2023)
