Oct 30, 2026
AI, AML and the future of human judgement in financial services
Do you remember November 2022, when ChatGPT launched and we were all queuing to get a slot to try this new chatbot that could answer questions, without quite knowing what to expect? After four years, it’s hard to picture a working week or even day, without some form of AI in it. And financial services firms are not the exception. The Bank of England and FCA’s 2026 survey found that 86% of UK financial services firms now use AI, up from 75% in 2024.1
AI is changing it all and for financial services firms is changing how they identify risk, process information and make decisions. From transaction monitoring and customer due diligence to regulatory reporting and investigation summaries, AI offers the potential to improve efficiency, reduce manual workloads and help compliance teams focus on the risks that matter most.
When discussing AI with colleagues there are quite a few questions that always pop, but there’s one that’s at the heart of the conversation and that brings different opinions. As firms lean on AI to interpret risk, are they making better compliance decisions, or just making them faster?
What the FCA’s October 2026 AI guidance actually says
On 19 October 2026, Jessica Rusu, the FCA’s chief data, information and intelligence officer, gave a speech at Bloomberg’s UK Policy Series titled Building the future of finance in the age of AI, and alongside it, the FCA published an guide on AI in financial services: good practice and areas for improvement.
What does this means? The FCA wants firms to embrace innovation, but not at the expense of governance, accountability and oversight. The publication doesn’t create new rules, it shows how the existing framework applies when firms build, buy or use AI, and that arguably makes it more useful, not less. It’s the clearest picture yet of what supervisors expect to see.2
On another note, it’s also worth noticing where the FCA itself is heading. Jessica Rusu said the FCA is building AI tools to oversee the 60,000 AML firms coming into its remit in 20283. If the they are using AI to scrutinise firms, all firms should expect hard questions about how they use it themselves.
Efficiency is not the same as effectiveness
AI can process information at a scale that would be difficult for a human team to replicate manually, or at least without taking months. It can help identify unusual transaction patterns, summarise customer information, connect relevant documents and draft investigation reports. These capabilities can make compliance workflows more efficient, and analysts may spend less time collecting information and more time assessing risk.
However, efficiency and effectiveness are not things that can be substituted for one another. A transaction monitoring system may reduce the time needed to review an alert, but that does not necessarily mean it has improved the quality of the investigation. An AI-generated report may be delivered in seconds, but the speed of its production tells us nothing about whether the evidence is complete, the findings true or the conclusion is justified.
The danger is that firms measure the success of AI by what is easiest to quantify: processing times, reduced workloads and cost savings. These metrics matter, but they tell only one part of the story. In a regulated environment, the real question is whether the technology strengthens the control and improves the outcome.
In straightforward terms, if a firm clears twice as many alerts but gets worse at catching genuine financial crime, it hasn’t improved its compliance function. It has made an ineffective process faster.
AI in AML compliance: when a convincing report isn’t enough
Anti-money laundering is one area where the distinction between efficiency and judgement becomes particularly important. An AML investigation is rarely just about spotting a transaction that looks odd. It needs an understanding of the customer, their expected activity, their transaction history, their counterparties and the wider circumstances.
Now a days, AI can pull all of that together, highlight anomalies and turn it into a tidy report. But identifying a pattern isn’t the same as knowing what it means. Each stage of the AML process carries a different risk, so here’s how we would split the work between AI and a human:
| AML use case | What AI can help with | What a human must challenge |
| Transaction monitoring | Identify unusual patterns and prioritise alerts | Whether the activity makes sense in the customer’s wider context |
| Client due diligence | Summarise customer information and flag missing evidence | Whether the information is reliable and sufficient |
| Adverse media screening | Find relevant articles and summarise potential concerns | Whether the subject is correctly identified and the information is material |
| Sanctions screening | Match names and identify potential connections | Whether a match is genuine, a false positive or needs further work |
| Investigation reports | Organise evidence and draft narratives | Whether conclusions are supported by the evidence and nothing important is missing |
| Suspicious activity assessments | Structure the analysis and highlight red flags | Whether escalation or a SAR is justified under the applicable requirements |
Now picture what would happen if we don’t add the human factor to an AI search. AI flags a series of transactions as potentially suspicious and generates an investigation report. The report is well written, the key transactions are summarised, and a plausible explanation is provided. Yet the system has overlooked a material piece of client information that changes the interpretation of the activity. The report will still look complete and the conclusion sound reasonable, therefore the report could be legit and correct, and when you are busy and under pressure to clear a backlog, you may be tempted to approve it without examining the underlying evidence in sufficient detail, and this is where the risk lies.
And what if it was the other way around? If AI generates excessive false positives, compliance teams may spend more time reviewing low-risk activity and less time focusing on cases that require genuine investigation.
The objective should not be to eliminate human involvement; it should be to use technology to help investigators make better-informed decisions.
Which AI output do you trust?
Here’s something that should make every compliance officer pause, think and challenge. Ask a generative AI tool to rewrite that same investigation report and you may not get the same result. This time it might not flag the suspicious transactions at all. Or it might find new ones.
So what now? Was the first version right and the second wrong? Did it re-analyse the data and catch something it had missed? Which one do you trust, and can you trust either?
To be fair, not every variation is an error as two reports can use different words and reach the same evidence-based conclusion, and identical wording doesn’t guarantee a report is right. What matters is whether the differences change the substance of the analysis.
Imagine two AI systems reviewing the same AML case, one sees a significant risk indicator and the other sees activity consistent with the customer’s expected behavior. Both provide a plausible explanation. Which assessment should the firm trust?
The tiebreaker can’t be the system with the most confident tone, the newest model or the most persuasive write-up. Firms need to understand the evidence behind each assessment, the limits of each system and the reason for any material disagreement, and they need a process for deciding when to dig deeper or escalate.
This is why AI training matters and why firms need to ensure that their teams know how to use AI and where the firm draws the line on its use. And firms should test whether a system supports the intended compliance outcome, not just whether its outputs look reasonable. The FCA points to firms assessing their models’ performance against human-led processes as good practice.4
The goal is not to force AI to produce identical reports. It is to establish a defensible standard for the quality, completeness and consistency of the decisions those reports support.
Accountability and human oversight
AI may contribute to a compliance decision, but it doesn’t take on the firm’s regulatory responsibilities. Accountability can’t float somewhere between compliance, technology, senior management and an external AI provider. Responsibilities need to be clear and written into policy and process, and the firm needs to understand how the technology sits within its control framework. The FCA’s good practice includes assigning clear senior manager (SMF) ownership for AI risks5. That doesn’t mean every senior manager has to become a technical specialist. It means responsibility can’t be delegated so completely that the people accountable no longer understand the controls.
Third-party tools deserve the same scrutiny. A vendor may describe its system as accurate, reliable or built for financial services, but that doesn’t make it right for your data, your clients or your risk profile. As the FCA reminds firms, you can outsource an AI service but you remain responsible for it6. Proportionate due diligence, a clear view of the tool’s limitations and a plan for monitoring performance aren’t optional.
There is a temptation to treat human involvement as a universal solution to AI risk, if a person checks it, the firm is in control. The FCA isn’t so sure about this as it lists excessive reliance on human review as an area for improvement, warning that it can mask model weaknesses and turn oversight into a box-ticking exercise7.
We’ve all felt the pull of automation bias. After the tenth accurate-looking output, the eleventh gets a little less scrutiny. And here’s the contradiction: AI is brought in to make people more productive, but the productivity pressure leaves them less time to examine the very outputs they’re responsible for validating. A compliance officer who approves an AI recommendation without examining its basis isn’t providing oversight. They’re handing their judgement to a system they’re meant to challenge.
So meaningful oversight has to be designed into the workflow. Reviewers need the underlying evidence, an understanding of what the tool is for and where it falls short, and the authority to challenge it, escalate or decline to rely on it. That takes proper training, not just a “how to use AI safely” guide. And managers need to accept that validation still takes time.
For higher-risk decisions, try asking reviewers to form their own view before they see the AI’s recommendation. It’s a simple way to find out whether people are exercising judgement or just agreeing with the machine. Not every task needs that. Drafting an internal meeting summary is a world away from supporting a SAR decision, and oversight should scale with the impact of the decision, the reliability of the system and the cost of getting it wrong.
Fines, enforcement and the cost of misplaced confidence
We already know that a fine isn’t an automatic consequence of an AI error, the outcomes depend on the circumstances, the applicable requirements and how the firm responds. But using AI doesn’t exempt anyone from existing obligations, and everyone who adopts AI to cut costs can hit its operational targets while building risks that never show up on a dashboard.
If something goes wrong, the regulator won’t be asking whether AI was involved, it will ask whether you had appropriate controls, understood the risks and took reasonable steps to manage them. In practice, that means being ready to answer these three questions:
- If suspicious activity was missed, can you show your monitoring arrangements were appropriate?
- If an investigation is challenged, can you explain the evidence considered, the limitations identified and the rationale for the decision?
- If a model changed, can you show the change was assessed and its performance monitored?
The use of AI for AML, or to support surveillance, conduct monitoring, due diligence, risk assessments and regulatory reporting, it all falls under the same three questions: What could go wrong, how would you spot it, and who steps in?
Where to start
The answer isn’t to slow every AI project down or have someone manually check every output. Set clear boundaries for what AI can do, test the quality of the outcome rather than the speed of the process, name an owner, give reviewers the time and authority to challenge, and keep a record you can stand behind. None of that needs a heavyweight governance structure, smaller firms can adapt the processes they already have, and the FCA’s publication includes a smaller-firm focus for that reason8.
Deciding where AI belongs in each control is a question in its own right. Our companion piece, The AI Continuum in Compliance: Finding the Strategic Middle, sets out a practical way to work out which controls can safely move towards automation and which should stay firmly in human hands.
The future of compliance isn’t human versus AI
AI has a genuine role to play in our day to day, and rejecting it would mean passing up a real chance to improve how your team works. That’s the thinking behind Eva, the AI compliance assistant built into the Leo platform. It helps teams get to regulatory answers faster, while the judgement, and the accountability, stays with the compliance team.
So, when did your team last disagree with the AI?
Sources
- IBS Intelligence, AI adoption in UK finance reaches 86%, study shows: https://ibsintelligence.com/ibsi-news/ai-adoption-in-uk-finance-reaches-86-study-shows/ ↩︎
- Regulation Tomorrow (Norton Rose Fulbright), FCA good and poor practice on AI: https://www.regulationtomorrow.com/2026/10/fca-good-and-poor-practice-ai-in-financial-services-good-practice-and-areas-for-improvement/ ↩︎
- FCA, AI in financial services: good practice and areas for improvement (19 October 2026): https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services ↩︎
- Addleshaw Goddard, FCA paper on AI in financial services: https://www.addleshawgoddard.com/en/insights/insights-briefings/2026/financial-services/fca-paper-ai-financial-services-good-practice-areas-improvement/ ↩︎
- A&O Shearman, UK FCA good practice and areas for improvement in AI: https://finreg.aoshearman.com/uk-fca-good-practice-and-areas-for-improvement-in-ai-in-financial-services ↩︎
- CMS, FCA review of AI in financial services: https://cms.law/en/gbr/legal-updates/fca-review-of-ai-in-financial-services-good-practice-and-areas-for-improvement ↩︎
- PwC, FCA sets out responsible AI practice: https://www.pwc.co.uk/industries/financial-services/understanding-regulatory-developments/fca-sets-out-responsible-ai-practice.html ↩︎
- A&O Shearman, UK FCA good practice and areas for improvement in AI: https://finreg.aoshearman.com/uk-fca-good-practice-and-areas-for-improvement-in-ai-in-financial-services ↩︎
