The Death Of The Traditional Compliance Function

In five years, the traditional compliance department as it exists in most UK financial institutions will be unrecognisable. Not because regulators demanded it. Because the economics finally broke.

Before I go further, let me be precise about what I mean. The FCA, PRA, and Bank of England are not going away. SM&CR is not being repealed. Regulatory oversight is intensifying, not retreating. What I am arguing is that the operating model most firms use to meet their obligations - the one built on manual attestations, annual reviews, second-line committees, and papering over gaps - is structurally incompatible with what is now being asked of it.

And if you are the Head of AI at a UK financial institution, this is not someone else's problem. Under SM&CR, it is yours personally.

Here is the math most compliance leaders do not say out loud.

A mid-sized UK bank operating across multiple jurisdictions - FCA conduct, PRA prudential, EU AI Act, DORA, GDPR - is now managing six or more regulatory regimes simultaneously, each updating at different cadences, each with its own accountability mapping, each capable of generating a supervisory request at 48 hours' notice. The compliance team responsible for that landscape is typically structured for a world of annual reviews, point-in-time attestations, and quarterly committee packs.

The gap between those two realities is not a staffing problem. It is a model problem.

Add AI to this picture and the pressure compounds. Every AI system deployed - in credit decisioning, in customer communications, in fraud detection - creates a new category of regulatory obligation. The EU AI Act classifies most of these as high-risk. The FCA's Consumer Duty requires explainability. DORA demands operational resilience testing. SM&CR requires a named senior manager to own each one personally.

Your compliance function was not built for that. Most weren't. The ones that say otherwise are papering over it.

The compliance department was designed to document what happened. It was never designed to govern what is happening right now, in real time, across every AI system in the estate.

For many with ADHD, a simple "no" can feel like a world-ending nightmare. This is Rejection Sensitive Dysphoria (RSD), and it makes navigating daily life painfully hard.

Developed by clinical psychologists, Inflow helps you understand and navigate RSD triggers using science-backed strategies.

In just 5 minutes a day, you can learn to prevent unhelpful thoughts and build deep emotional resilience. Stop spiraling and start reframing your thinking with a custom learning plan designed for your brain.

Take the free assessment today

Most compliance functions today are built around three assumptions that no longer hold.

The first assumption: compliance is a 2LoD function. The second line reviews. The first line owns. In practice, this means the compliance team is permanently reactive, producing oversight after the fact, writing reports on decisions that have already moved markets, approved loans, or denied customers. AI systems operate at microsecond cadence. A 2LoD review cycle measured in weeks is not oversight. It is archaeology.

The second assumption: documentation equals control. The policy exists. The procedure exists. The training was completed. The box is ticked. This is the paper-based model, and it dominated regulatory compliance for thirty years because regulators, for most of that time, could only examine what was written down. That is changing. The FCA's data strategy, supervisory technology investment, and real-time data collection pilots signal a regulator moving toward continuous, machine-readable oversight. Firms whose compliance function is fundamentally a documentation exercise are about to be exposed.

The third assumption: human judgment scales. It does not. The volume of decisions, interactions, model outputs, and cross-border data flows that a modern financial institution generates cannot be reviewed by a compliance team of any realistic size. The firms that recognise this are embedding compliance logic into their systems. The firms that don't are hiring more people to review more documents to catch fewer problems.

There is a useful historical parallel here that most compliance professionals have not yet applied to themselves.

Quantitative hedge funds went from niche curiosity to managing roughly $1 to $1.5 trillion, around 25 to 30% of total hedge fund AUM. Algorithmic strategies now account for 60 to 73% of all US equity trading volume. Traditional discretionary managers did not disappear. But the ones who insisted that markets were too nuanced, too relationship-driven, too human to be systematised found themselves running smaller books with worse returns.

The argument that compliance is too nuanced, too judgment-dependent, too relationship-driven to be systematised is the same argument. It was wrong then. It is wrong now.

What AI cannot replace in compliance is exactly what it cannot replace in investment management: genuine expert judgment on ambiguous edge cases, relationship management with regulators, and the accountability that comes with a named individual on a regulatory filing. What AI can replace is everything else. The monitoring. The flagging. The document generation. The horizon scanning. The gap analysis. The evidence compilation.

In venture capital, two-person deal teams now manage 500-plus introductions annually with AI assistance. VC is arguably more relationship-driven than compliance monitoring. If AI is reshaping that, the argument that it will not reshape compliance oversight is weaker, not stronger.

Let me be specific about what this looks like in practice, because there is already significant confusion in the market.

AI-embedded compliance does not mean replacing your compliance officers. It means ending the model where your compliance officers spend 70% of their time on work that should never have required a human: compiling evidence packs, formatting board reports, cross-referencing regulatory text against policy libraries, and tracking attestation deadlines across business lines.

What the AI handles: continuous monitoring of AI system outputs against regulatory thresholds, real-time horizon scanning across FCA, PRA, and EU regulatory feeds, gap analysis against SM&CR accountability maps, automated evidence compilation for supervisory requests, and draft board reporting with version control and audit trail.

What the human handles: the regulatory relationship, the judgment call on ambiguous risk, the SM&CR attestation with full understanding of what is being signed, and the escalation decisions that carry personal liability.

The distinction matters because SM&CR does not care whether your compliance function is AI-assisted or not. It cares whether the named senior manager understood the risk and made a documented decision. Human accountability is not being automated away. It is being given better information so it can be exercised properly, rather than exercised on incomplete evidence under time pressure.

MISCONCEPTION 01

"AI in compliance creates more regulatory risk, not less."

This gets the causality backwards. Firms are already deploying AI across their operations. The regulatory risk exists the moment the first model goes into production. The question is whether your compliance function has visibility of it. An AI-embedded compliance approach does not create the risk. It makes it visible, documented, and manageable. Continuing to run a manual compliance function while your business operates AI systems is the high-risk position.

MISCONCEPTION 02

"The FCA hasn't told us to change our model."

They have, just not in those words. The Consumer Duty's requirement for ongoing monitoring of outcomes is a continuous compliance obligation, not an annual review task. DORA's operational resilience testing is a technical, ongoing requirement. The FCA's own AI and Digital Regulatory Sandbox signals where regulatory technology is moving. Waiting for explicit instruction is how firms get caught flatfooted when the guidance arrives with a 90-day implementation window.

MISCONCEPTION 03

"We already have a RegTech vendor. This is covered."

A RegTech subscription is not a compliance operating model. Most RegTech tools solve specific, narrow problems: transaction monitoring, sanctions screening, regulatory reporting. None of them address the operating model question — how your compliance function is structured, who owns what under SM&CR, and whether your evidence trail would survive a supervisory examination of your AI systems today. Tool adoption is not transformation.

MISCONCEPTION 04

"Our compliance team will resist this kind of change."

The compliance professionals who resist AI-embedded models are, in most cases, the ones doing the most manual, repetitive work. The ones who welcome it are the senior specialists whose judgment is currently buried under document management. Freeing the latter group to do the work they were actually hired for is not a threat to the compliance function. It is the compliance function finally working as designed.

01 Denial

Already in progress. Compliance leaders dismissing AI-embedded models as vendor hype, arguing that regulatory relationships cannot be automated. They are right about the relationship. They are wrong that this means the operating model survives unchanged.

02 Tool adoption

Firms begin buying AI tools for horizon scanning, policy gap analysis, and board reporting automation. This helps at the margins. It does not address the structural problem. Most will remain in this stage for two to three years before the evidence forces the next move.

03 Model redesign

A smaller number of firms recognise that point tools do not add up to a compliance operating model. They begin redesigning around continuous monitoring, AI-embedded accountability mapping, and human review concentrated at genuine judgment points. This is where the structural advantage compounds.

04 Outsourced compliance infrastructure

Mid-sized and specialist firms conclude that building this infrastructure internally is not their comparative advantage. They begin outsourcing the compliance operations layer - monitoring, evidence compilation, regulatory horizon scanning - while retaining the accountability and relationship functions in house. This is the managed service model, and it is already emerging in legal and accounting.

05 Regulatory pressure crystallises the choice

The FCA or PRA issues guidance that makes continuous AI system monitoring an explicit expectation rather than an implied one. Firms without the infrastructure scramble. Firms that moved early use their existing evidence trail as a competitive differentiator in supervisory engagement. The holdouts pay for their delay in enforcement costs and reputational exposure.

Here is the question I put to every Head of AI I meet in financial services.

If the FCA sent a supervisory request tomorrow asking for a complete evidence pack covering every AI system in your firm's estate - what it does, who approved it, what monitoring is in place, and how it maps to your SM&CR accountability structure - how long would it take you to produce it?

Most honest answers are somewhere between "weeks" and "I don't know." Some answers are "we would have to scope what's in scope first."

That gap - between what regulators will increasingly expect and what most firms can currently produce - is the compliance operating model problem in a single question. It is not a technology problem. It is a model problem that technology can solve, provided you redesign the model first.

The technology exists. The regulatory pressure is building. The personal liability under SM&CR is already live. The only variable is whether your firm treats this as a model redesign problem now, or an enforcement problem later.

The firms that move first will not just be compliant. They will be able to demonstrate compliance on demand. That is a different competitive position entirely.

IF YOU ARE A HEAD OF AI OR CHIEF AI OFFICER

Every AI system you deploy creates a compliance obligation with a named owner under SM&CR. If your compliance function cannot monitor those systems continuously and produce evidence on demand, your personal liability exposure grows with every deployment. This is not a compliance team problem to solve in isolation. It is yours to sponsor.

IF YOU ARE A CHIEF RISK OFFICER OR HEAD OF COMPLIANCE

The 2LoD review model is not being replaced - it is being given the infrastructure it needs to actually function. AI-embedded compliance does not reduce your authority. It ends the situation where your team's judgment is applied to incomplete information, compiled under time pressure, on systems they have limited visibility of.

IF YOU ARE A COO OR CHIEF OPERATING OFFICER

The compliance operating model is a cost structure question as much as a risk question. Manual compliance scales linearly with regulatory complexity. AI-embedded compliance does not. The firms that redesign now will carry a structural cost advantage into a regulatory environment that is only going to generate more obligations, not fewer.

BuildMoat is working with a small number of UK financial institutions on AI Compliance Co-Pilot pilots. Named human accountability. AI-embedded monitoring. SM&CR ready from day one.

BOOK A CONVERSATION

Building human infrastructure for AI adoption isn't theory for us. It's what we do: champion networks, behavioral pilots, AI Adoption Offices. The MOAT Framework applied to real enterprises.

Questions about scaling AI adoption in your organization? Book a call. We'll assess where you are and show you exactly what's missing.

Did someone forward this to you? Subscribe here for weekly insights on AI adoption that actually works.

Keep building,

BuildMoat
Human infrastructure for AI adoption