Solutions / Transformation
Stop building a Big Bank compliance department.
For small and mid-size financial businesses that cannot spend millions on compliance operations and should not have to: the manual work found, the automation designed, the AI governed, in ninety days rather than nine months.
Who it’s for
For teams drowning in alerts, reviews and spreadsheets.
- A compliance team spending its senior people’s time on work a well-configured system should do.
- A firm adopting AI in operations or customer processes and needing governance a regulator will recognise.
- A financial-crime function asking which parts of AML, fraud and sanctions can safely use AI, and which must not.
What you get
The Studio, in three sprints.
Each package stands alone and each feeds the next.
30-day Automation Scan
Process assessment across onboarding, KYC/CDD, alert handling, case management, regulatory change, QA and management information. Output: where the manual work is, what it costs, and what could be automated safely.
60-day Design
Workflow redesign, vendor selection, the target operating model and the business case, with controls and human oversight designed in rather than bolted on.
90-day Implementation Sprint
Implementation oversight of the first automations, with testing, documentation and the evidence an examiner will ask for.
Where to start
Three problems. Three starting points.
Pick the line that describes your firm today. Each package stands alone, and each feeds the next.
The manual work is the problem
Senior people spend their time on alerts, reviews and spreadsheets that a well-configured system should handle. Start with the 30-day Automation Scan.
AI is already in use
AI is running in operations or customer processes, and the firm needs governance around it. Start with AI Governance-in-a-Box.
Financial crime wants to use AI
The team running AML, fraud monitoring or sanctions screening is asking where AI can help and where it must stay out of the decision. Start with Financial Crime AI Readiness, before the first model.
AI Governance-in-a-Box
Govern the AI you already use.
For regulated companies using AI anywhere in the business. A complete, proportionate governance framework, delivered as documents you can adopt and a structure you can run.
Inventory and classification
Every AI use case in the business, classified by risk and regulatory exposure.
Framework, roles and policies
Governance framework, RACI, policies and human-oversight requirements sized to the firm.
Testing, validation and monitoring
How models are tested before use, validated in use and monitored over time, with the documentation to prove it.
Vendor AI risk and board reporting
Third-party AI assessed the way any critical vendor is, and a board pack that says what is running and how it is controlled.
Financial Crime AI Readiness
Which processes can use AI. Which should not.
Specific to AML, fraud and sanctions. An honest assessment before the first model, so the gains are real and the risks are named.
Use-case selection
Where AI helps (triage, prioritisation, narrative drafting) and where it must stay out of the decision.
Regulatory risk, explainability and human-in-the-loop
What a regulator will ask about a model that touches an alert, and how the answer is designed in.
Data readiness, controls and testing
Whether the data can carry the model, and the controls and test approach that make it defensible.
Business case and roadmap
A sequenced plan from the first safe use to the ones that need more groundwork.
Illustrative example
One row of an AI use-case register, and the gate it passes.
Illustrative only. A fictional firm and a fictional tool, to show the shape of one entry and its approval gate. A real register follows the firm’s own framework and fields. Our guide at /resources/ai-governance-in-a-box-ten-documents-regulator-will-ask-for sets out the ten documents behind a framework like this.
Use case
Illustrative: a vendor tool drafts first-pass narratives for alerts in the transaction-monitoring queue of a fictional payments firm.
Owner
The fictional firm’s Head of Financial Crime Operations, named on the row and accountable for the use case.
Data and vendor
Alert data and customer profile fields, processed inside the vendor’s platform under the existing contract. Vendor AI review on file.
Risk rating
High on the fictional firm’s own scale, because the output feeds a decision with regulatory consequences.
Human decision point
An analyst reads, edits and signs off every narrative. The tool does not close an alert or decide whether to file a report.
Testing and monitoring
Drafts compared with analyst-written narratives before use. A sample re-checked in use, with error rates reported to the owner.
Approval gate
Approved for use only when every entry above is complete, the owner has signed the risk assessment and compliance has signed off. Approver and date recorded on the row.
Review
Under the fictional firm’s policy, re-approved at each material change to the model, the vendor or the process.
The human decision
AI can prepare a decision. An accountable person makes it.
This is the line the Studio designs to: decisions with regulatory consequences remain with accountable people. Where a rule or a regulator’s published statement speaks to it, the source is named, with the kind of document it is.
What stays with a person
Decisions with regulatory consequences, such as whether to close an alert, file a suspicious activity report, exit a customer or answer a regulator. AI may sort, summarise and draft for these decisions. It does not make them.
Where AI helps
Triage, prioritisation and narrative drafting, with the output reviewed by the person who owns the decision.
FINRA member firms
FINRA has reminded member firms that its rules, which are intended to be technology neutral, continue to apply when they use generative AI, including through features embedded in existing third-party products, and that a firm should evaluate such tools before deploying them. Under Rule 3110, a member firm must have a reasonably designed supervisory system tailored to its business. The Notice is guidance: it states that it does not create new legal or regulatory requirements or new interpretations of existing requirements. Source: FINRA Regulatory Notice 24-09 (June 27, 2024), https://www.finra.org/rules-guidance/notices/24-09
NIST AI Risk Management Framework
The ten-documents guide maps to the NIST AI Risk Management Framework. NIST states that the framework is intended for voluntary use. It is not a rule. Source: NIST, AI Risk Management Framework (read November 8, 2026), https://www.nist.gov/itl/ai-risk-management-framework
How it runs
How it runs.
Scan
Thirty days inside your processes, with the people who run them. A report with numbers, not adjectives.
Design
The target state, the vendors, the controls and the case for doing it, agreed with management.
Implement
Oversight of the build, testing and documentation for the first automations.
Hand over
Your team runs it; we stay available through the Expert Line.
Questions
Asked before, answered plainly.
- Which part of the Studio should we start with?
- Start where the problem is. Manual work points to the 30-day Automation Scan. AI already in use points to AI Governance-in-a-Box. A financial-crime team that wants AI in triage or drafting points to Financial Crime AI Readiness. Each package stands alone.
- Do FINRA rules apply to AI features inside tools we buy?
- FINRA has said its rules apply whether a member firm develops generative AI tools for its own use or uses a third party’s technology, including features embedded in existing third-party products, and that a firm should evaluate such tools before deploying them. The Notice is guidance and states that it creates no new legal or regulatory requirements. Source: FINRA Regulatory Notice 24-09 (June 27, 2024), https://www.finra.org/rules-guidance/notices/24-09
- Is the NIST AI Risk Management Framework mandatory?
- No. NIST states that the framework is intended for voluntary use. Source: NIST, AI Risk Management Framework (read November 8, 2026), https://www.nist.gov/itl/ai-risk-management-framework
- Can AI decide an AML alert on its own?
- Not in the frameworks we design. AI can sort, summarise and draft. The decision to close an alert or file a report stays with an accountable person, and the approval gate records who signed off.
Taft designs and governs automation; decisions with regulatory consequences remain with accountable people.