AI in Compliance needs Forensic Thinking, not just faster screening
By
Most conversations about AI in compliance start with speed: how many alerts a model can clear, how many records it can screen, how much faster it can map a regulatory position. Speed matters. It's just not what an examiner asks about.
A regulator writes the rules. An examiner is the one who comes in and checks whether your institution actually followed them and, more and more, whether anyone on your team can explain a conclusion that a system reached first.
That is where forensic thinking comes in.
What forensic thinking means for your institution
Forensic accounting is work done for a dispute: litigation, testimony, evidence that has to hold up under cross-examination. That's not what a bank or financial institution needs from its compliance program day to day.
What an institution needs is forensic thinking: tracing a relationship back to whoever actually controls it, not taking a label at face value, and documenting the reasoning behind each conclusion so it can be defended later. AI doesn't replace that discipline. It amplifies whatever is already there gaps included.
Three places AI is already testing forensic thinking in compliance
1. Beneficial ownership: when the name changes but the control doesn't.
On October 8, the UK sanctioned Cryptomus, Heleket, and TokenSpot for helping Russia evade Western sanctions. Cryptomus and Heleket are the same company, with the same owner, operating under two brands. When one was flagged, the other simply kept going under a different name.A name-based screen wouldn't have caught that in time. And this is a real problem for banks, not just newer players: in our experience, many institutions not all aren't fully prepared for a counterparty that clears the screen while the people controlling it haven't changed at all. AI can map ownership relationships across large, messy datasets far faster than any team. But someone still has to ask the question the data can't answer on its own: who does this counterparty really answer to?
A screen tells you who a counterparty says it is. Forensic thinking asks who it really is.
2. FATCA/CRS reconciliation: when the numbers match but the story doesn't.
Reconciling accounts, entities, and beneficial owners across jurisdictions for an annual FATCA/CRS filing is exactly the kind of large-scale matching AI handles well. The hard part comes after. When reconciliation turns up a relationship that was never properly documented an account opened years ago, an entity that's been restructured since — the model has done its job. Deciding what that gap means for your reporting position is still a human call.
AI can reconcile the records. It cannot explain why they never matched in the first place.
3. Scaling AI on a program no one measured.
This year Nubank, which has more than 140 million customers, rolled out an AI compliance platform from regtech startup Cardamon in every country where it operates. Cardamon says its agents map a company's regulatory position up to 20 times faster than legacy systems. That's the vendor's number, not an independent audit's.
The lesson isn't the multiplier. It's the order of operations. AI speeds up a process someone was already measuring. Put it on top of a process nobody measured and it won't fix the weakness; it'll just get you to the breaking point sooner. German neobank N26 is the cautionary tale: regulator BaFin ordered it to stop onboarding new customers over control deficiencies. For a growing institution, a compliance failure isn't just a fine. It's a ceiling on growth.
Before AI goes into production at your institution
Any AI compliance tool should be able to answer three questions before it touches your program:
- What specific case was it tested on?
- How broad was that test, really?
- Who independently verified its speed and accuracy claims?
The institutions that insist on those answers before rolling AI out are, time and again, the ones that find their gaps in an internal review instead of during an exam.
Where forensic accounting comes in
Forensic accounting, strictly speaking, lives somewhere else: with law firms and family offices dealing with litigation, contested estates, partnership disputes, or fraud recovery. There, AI is changing how evidence gets gathered, e-discovery review that used to take months now takes days. A litigation attorney recently told Stanley: "AI got us through 500,000 documents in a week. Now I need someone who can testify to how we did it."
That's the real bottleneck in a dispute. AI can process volume. It can't take an oath, walk a judge through a methodology, or stand behind a finding when opposing counsel goes after it. That takes a credentialed forensic accountant.
Two settings, two kinds of work, same conclusion. AI changes how much an institution or a legal team can get through. It doesn't change who has to stand behind the result.
When an examiner asks how your program reached a conclusion, will the answer be "the system flagged it" or will someone be able to explain why?
If you're not sure, let's talk about what a review of your program would look like.
This article is for general informational purposes only and does not constitute legal, tax, or investment advice.
Sources
- TRM Labs, "UK Sanctions Cryptomus, Heleket, and TokenSpot in New Russia Package Targeting Crypto and Payment Channels," October 2026. https://www.trmlabs.com/resources/blog/uk-sanctions-cryptomus-heleket-and-tokenspot-in-new-russia-package-targeting-crypto-and-payment-channels
- Merca2, "Escalar compliance con IA: el caso Nubank y Cardamon," October 3, 2026. https://www.merca2.es/2026/10/03/escalar-compliance-ia-nubank-cardamon-2466884/
- Banking Dive, "German regulator BaFin caps neobank N26's European growth." https://www.bankingdive.com/news/german-regulator-bafin-caps-neobank-n26s-european-growth/608482/
