The biggest, worst-built operating system in financial services has been hiding in the cost line — and it has exactly the shape that gets rewritten first.

There's a thing you notice once you've spent enough time inside a bank's actual operations rather than its org chart. The function everyone treats as a footnote — compliance — is, by head-count and by floor space, one of the largest businesses the bank runs. It just doesn't get called a business. It gets called a cost line. And the cost line nobody wanted to fund turns out to be the biggest, most under-engineered piece of software-shaped work in the entire institution.

Let me define what I actually mean, because "compliance" is one of those words that has been hollowed out by overuse. I mean the machinery of financial-crime prevention: knowing your customer and your business customer (KYC and KYB), screening names against sanctions lists, monitoring transactions for suspicious patterns, filing suspicious-activity and suspicious-transaction reports, doing perpetual due diligence rather than a one-off check, tracing source of funds, scanning adverse media, and keeping an audit trail clean enough that a supervisor can reconstruct any decision two years later. And then the army of people who run all of it. At a large institution this sits in the order of a low-double-digit percentage of operating cost, and it has been growing for fifteen years without pause. The cumulative financial-crime fines the industry has absorbed since 2008 are widely reported in the hundreds of billions of dollars. So this is not a small or quiet thing. It is enormous, expensive, and — this is the part that matters — it does its job badly.

Why a function this large does its job this poorly

It does its job badly in three structural ways, and once you see the three you can't unsee them.

The first is false positives. Transaction monitoring is famous internally for the fact that, by the time an alert reaches a human, well above ninety per cent of what gets flagged is noise. That isn't incompetence. It's incentive design. The systems are tuned conservatively on purpose, because the asymmetry is brutal: a missed true positive becomes a fine and a regulatory finding that lands on the institution, while a false positive is simply borne — quietly, invisibly — by the analyst who has to clear it. So the rational move is to flag everything and let the humans sort it out. The result is that hundreds of thousands of human-hours go into triaging alerts that were never going anywhere. You have very expensive, very trained people reading the equivalent of spam, all day, because the machine was built to cry wolf and the org chart was built to absorb the wolf-crying.

The second is onboarding friction. KYC is, structurally, the first impression a customer has of an institution, and it is reliably the worst process the institution operates. Anyone who has tried to open a business account at a major bank knows the texture of this: the same incorporation document uploaded three times because the portal didn't keep it, a compliance officer making a risk call off a screenshot emailed across a desk, an institutional onboarding that takes days and not infrequently weeks. I've watched a perfectly clean, well-papered company sit in onboarding limbo for the better part of a month, not because anything was wrong, but because the process is a relay race between systems that were never designed to talk to each other and people who are each individually doing their job correctly.

The third is reporting and audit. The reports that go up to a supervisor are assembled by hand, by humans, from systems that don't share a common language — pulling a field from here, a flag from there, stitching it into a narrative. The supervisor, in turn, receives a fire-hose of low-signal filings, because everyone upstream is filing defensively. The output of the whole apparatus is neither timely nor high-signal. It's a lot of paper produced slowly to demonstrate that paper was produced.

Now stand back and look at the common shape of all three. It is mostly text and pattern-matching. It is bottlenecked by human throughput. And the output is poor on the two axes that matter, speed and signal. That is, almost to the letter, the description of the kind of work that machine intelligence has become genuinely good at — and the fact that this description applies to a low-double-digit slice of a bank's cost base is the whole story.

The autopilot move, applied to the back office

The investor consensus this year — Sequoia have been the clearest on it, with "services as software," and the same instinct runs through a16z and the YC cohort — is that the value is moving from selling the tool to selling the finished outcome. A copilot helps a professional do the work; an autopilot does the work and hands back the result. Compliance is, I'd argue, the single most literal place that thesis applies inside a bank, because the work here is so textual, so rule-bound, and so universally hated that nobody is sentimental about who or what does it. Credit where due: the framing is right. The interesting question is the order of operations.

It arrives in three waves, and the deploy order matters because each one earns the trust for the next.

The first wave is triage and explanation. A model reads the alert, the counterparty's history, and the relevant policy, and produces a first-pass disposition with legible reasoning — not "suspicious: yes/no" but a paragraph a human reviewer can read, agree with, and sign. The economics here are the easy sell. Per-case review time drops from something in the order of twenty-five minutes to roughly three, which means the same team absorbs three-to-five times the volume without growing. The vendors doing this are real, though still early, and the reason this wave goes first is that it changes nothing about the institution's risk posture — a human still signs. It just removes the drudgery underneath the signature.

The second wave is adaptive monitoring. Here the rules give way to models that learn what normal looks like for each individual counterparty, and — this is the part that's new — reason in plain language about why a given deviation is suspicious rather than merely flagging that a threshold was crossed. The man with a £9,000 transfer every month isn't a flag; the man whose pattern just inverted is, and the system can say so in a sentence a supervisor reads. This is harder, because it touches the risk model itself, which is why it follows rather than leads.

The third wave is the one that actually fits the autopilot frame, and it's generative onboarding and KYB. An agent ingests the customer's documents, pulls the registry data itself, runs the sanctions and adverse-media checks, constructs the beneficial-ownership chain, drafts the risk assessment, and hands a finished file to a human approver — in minutes, not weeks. The thing being sold there is not a tool to onboard a customer. It is "the customer is onboarded." That is the difference, and it is the whole difference. The unit you charge for stops being seats and starts being completed cases.

The same logic on the other side of the wire

Security follows exactly this shape, and it's worth saying plainly that the adversary has the same tools you do. Phishing that reads perfectly, voice-clones of a CFO authorising a wire, synthetic identities papered well enough to clear a tired analyst — all of it is now cheap. And the structural asymmetry of defence is unforgiving: the attacker has to be right once, the defender has to be right every time. When both sides get a capability jump at once, that asymmetry doesn't cancel out. It widens the gap between the best-defended institutions and the worst, because a 2018 stack operating in 2026 isn't a slightly-dated stack — it's a standing disadvantage that compounds with every cycle.

This is where the emerging-market angle inverts the usual story, and it's the part I think people miss. The lazy read is that AI compliance is a rich-world labour-arbitrage play, and since head-count costs less in emerging markets, the prize is smaller there. The first half is true and the conclusion is wrong. The labour saving is smaller, yes — but the quality gap between a 2018 stack and a 2026 one is larger precisely where the baseline is weak. An institution running thin, manual, conservative compliance gets more from a leapfrog than one that was already decent. The adopters jump a generation. The laggards don't merely stand still — they widen the supervisory gap, and that gap is not academic. It's the thing that gets a correspondent-banking line cut, that loses an institution its access to dollar clearing, that quietly strands a whole market's FX access because nobody upstream trusts the screening anymore. Compliance quality is, increasingly, the licence to remain connected to the global system at all.

So here is where I land, and it's deliberately not the usual "own the rails." Compliance is the largest underbuilt operational layer in financial services, and AI is rewiring it from a head-count tax into something you sell as a finished outcome. The opening isn't in helping today's analysts go faster — that's a feature, and features get commoditised. The opening is in building the compliance-as-outcome plumbing before the category has a name, and the sharpest edge of it is the one almost nobody is provisioning for yet: when payments start being initiated by agents rather than people, every one of those agents needs to be known, screened, and monitored in real time, with a clean trail. Whoever builds that layer first owns a market that doesn't exist on any slide today. Which is usually where the good ones are.

— Anas Ben Mejdoub, CEO Ryad

Sources: Public, widely-reported industry figures only: compliance as a low-double-digit share of operating cost at large institutions; cumulative financial-crime fines since 2008 reported in the hundreds of billions; transaction-monitoring false-positive rates widely cited above 90%. Investor framing per Sequoia ("services as software"), a16z, YC.

Loading…