AI for compliance in banking: earning trust one citation at a time

AI for compliance in banking is permitted, encouraged in principle and governed mostly by the bank itself. The banking agencies told banks in 2018 that a failed pilot is not, by itself, grounds for criticism; FinCEN's April 2026 proposal would add that responsible experiments carry no added enforcement risk; and the April 2026 model risk guidance places generative and agentic AI outside its scope. What fills the gap is voluntary: Treasury's Financial Services AI Risk Management Framework of February 2026 and NIST's Generative AI Profile. For a chief compliance officer, the practical question is how officers and analysts come to trust an AI answer enough to act on it, and the answer is the same as for a new hire: by showing the source, saying when it does not know and leaving decisions to people. Botminds' BSA/AML Manual Search is built on that pattern, with every sentence cited and dated and every filing, SAR decision and procedure change left to a named person.

The product examples come from a fictional sample credit union, Norrell Federal Credit Union, and its five fictional staff. Regulatory statements are quoted from the agencies and linked where they appear.

How can compliance officers use AI in a bank today?

Compliance teams use AI in two families of work. Detection, the older one, scores transactions and customers. Language work, the newer one, reads, summarises, drafts and answers. Treasury's 2024 report recorded both: respondents said AI is widely used for AML/CFT and sanctions work, from analysing large data sets and spotting anomalies to flagging suspicious activity and verifying identities, and that generative AI already helps investigation platforms gather and summarise case data and draft and file reports (Treasury, AI in Financial Services, December 2024). Those are respondents' statements, not Treasury findings.

For a compliance officer, the language work is where the daily hours are: answering staff questions, keeping procedures in step with new guidance, drafting referrals and memos, and building the evidence an examiner asks for. It is also where generative AI's characteristic failure, a confident wrong answer, does the most damage, which is why the design of the tool matters more than the model inside it.

Do regulators allow AI in BSA/AML compliance?

Yes, and they have said so repeatedly without writing a rule for it. The 2018 joint statement by the Federal Reserve, FDIC, FinCEN, NCUA and OCC is still the clearest word, and FinCEN's 2026 proposal cites it as current. It says a pilot that fails does not, by itself, invite supervisory criticism (the guide to piloting AI on SARs shows how a bank uses that room).

The same statement cuts both ways: a bank whose program is effective and sized to its risks will not be penalised or criticised for choosing not to innovate. AI is allowed, not expected.

FinCEN's April 2026 proposal to rewrite the program rule goes further. It lists machine learning, generative AI, digital identity, blockchain analytics and APIs as possible innovative approaches, and says responsible experimentation will not, on that ground alone, raise an institution's risk of a significant supervisory or enforcement action (91 FR 18704; the guide to the proposal covers the rest). Comments closed on June 9, 2026; it is a proposal, not a rule.

What the agencies have not done is set governance standards for generative AI. The revised model risk guidance of April 17, 2026 says plainly that generative and agentic AI, as new and fast-changing, fall outside its scope (OCC Bulletin 2026-13). The agencies said they plan a request for information on AI, including generative and agentic AI; we found none published by late October 2026.

Can compliance officers trust AI answers? Only the ones they can check

A compliance officer can trust an AI answer to the extent it can be checked quickly and is right when checked. Fluency is not evidence. NIST names the core risk of generative systems confabulation, and counts invented citations among its forms (NIST AI 600-1); what peer-reviewed studies measured on legal questions is set out in ChatGPT for AML compliance.

Generative AI can produce outputs that are false but convincing, known as hallucinations.

GAO, Artificial Intelligence: Use and Oversight in Financial Services, GAO-25-107197, May 2025

GAO put the same point in supervisory language, and noted, citing Treasury, that financial institutions "currently limit generative AI use to activities where the institution deems lower levels of explainability to be sufficient" (GAO-25-107197, May 2025). Answering staff questions about the BSA is not a low-explainability task. It needs an answer whose basis is visible.

The threat side is moving too. Treasury's 2026 national money laundering risk assessment reports that FinCEN has seen accounts opened with fake identities that appear to have been made with generative AI (2026 NMLRA). Compliance teams will meet generative AI whether or not they adopt it, which is one more reason to understand its failure modes first hand.

What is the Treasury AI risk management framework?

The Financial Services AI Risk Management Framework, released by Treasury on February 19, 2026 with a shared AI Lexicon, adapts NIST's framework to banking. Treasury described it as fitting the NIST framework to the operational, regulatory and consumer protection conditions of financial services, with tools "to help institutions evaluate AI use cases, manage risks across the AI lifecycle, and embed accountability, transparency, and resilience into AI deployment decisions" (Treasury press release sb0401).

It is voluntary, and Treasury says it is "designed to be scalable and flexible, supporting adoption by institutions of varying size and complexity." For a community bank or credit union, that makes it the most relevant map available: it speaks the language of financial services and does not assume a model risk function sized for a bank over $30 billion, which is where the 2026 model guidance says it is most relevant.

What is the NIST AI RMF generative AI profile?

NIST AI 600-1, the Generative Artificial Intelligence Profile, released July 26, 2024, applies NIST's voluntary AI Risk Management Framework to generative systems. It names twelve risks that generative AI creates or worsens, from confabulation and information integrity to data privacy and third-party components, and lists actions under the framework's four functions, govern, map, measure and manage. NIST says the underlying framework is "being revised as part of the White House AI Action Plan" (NIST AI RMF).

For an answering tool, a handful of the profile's actions carry most of the weight. The one that matters most, measure MS-2.5-003, is to review and verify the sources and citations in a system's outputs, both before deployment and in ongoing monitoring. A tool that verifies its own citations before showing an answer, and lets a person verify them after, puts that action into the product instead of leaving it to every user.

Five behaviours that earn trust: how BSA/AML Manual Search answers

Trust in an assistant grows the way trust in an analyst does: from answers that are checkable, honest about doubt and consistent with the institution's own rules. BSA/AML Manual Search builds five behaviours into every answer. It cites each sentence to a passage with its date, and a citation checker reads every sentence back against its passage and removes what the source does not say. It asks back the deciding fact instead of assuming it. It puts the rule beside the institution's procedure, never blended into one sentence. It stops below a confidence of 0.85 and sends the question to the BSA team. And it keeps every answer with the sources as they stood that day.

Just as important is what it does not do. The agents never file, never decide a SAR, never change a member record and never publish a procedure. A member service representative submits each referral and a BSA analyst accepts it; the BSA officer edits each procedure update and the compliance committee approves it. Anyone can disagree with an answer and give a reason code, and the disagreements go into the export for the examiner.

Maker and checker on every referral in BSA/AML Manual Search: the agent drafts, people decide

How do you roll out AI in a compliance team?

Roll it out the way the 2018 statement anticipates: as a pilot run beside the existing process, judged on evidence, with the old process intact until the new one has earned its place. A pilot that fails is not, on the agencies' own statement, a supervisory problem; a pilot nobody measured is a wasted one.

A workable sequence has four steps. Load the institution's own procedures and a sample of the questions staff actually asked, and run the tool in shadow, its answers compared with the BSA team's. Measure what matters: citations that hold up, answers the team would have changed, questions the tool correctly declined. Then open it to one branch, with the BSA team answering everything below the threshold. Widen only when the disagreement rate and the declines look like a careful colleague's.

Two rollout details decide adoption. Staff have to know who is accountable for an answer, so the tool should say plainly which parts are the rule, which are the procedure and which need a person. And the BSA officer has to own the settings, from the confidence threshold to which sources are loaded, with every change on the audit trail. The cost case behind a rollout is priced in BSA compliance software and the cost of one regulatory question.

A procedure change in BSA/AML Manual Search, approved by the committee from the agent's draft

Will AI replace compliance officers?

The public projections say no. O*NET, using BLS data, puts compliance officer employment at 436,400 in 2025 with average projected growth of 3% to 4% through 2035 (O*NET 13-1041), and BLS projects financial examiners, an occupation whose reported titles include BSA/AML officer, to grow 9% over the same decade (BLS Occupational Outlook Handbook).

The more useful question is which work moves. Finding the passage, checking for newer guidance and drafting the first version of a referral or a procedure update are the parts an agent can do and a person can check. Deciding whether activity is suspicious, approving a procedure and answering to an examiner are the parts the rules and the institution assign to people. The shift is from searching to judging, and it is set out seat by seat in BSA training requirements by role.

Questions people ask

What are AI tools for compliance officers?

They fall into detection tools, which score transactions and customers, and language tools, which answer questions, summarise documents and draft referrals, memos and procedure updates. Treasury's 2024 report recorded respondents using generative AI to collate and summarise data and automate report drafting. For any language tool, the test is whether each answer shows its source.

Is generative AI covered by the 2026 model risk guidance?

No. The revised guidance issued April 17, 2026 by the Federal Reserve, OCC and FDIC states that generative and agentic AI are not within its scope and that it is most relevant to banks over $30 billion in assets. Institutions govern those tools under their own risk management, for which Treasury's FS AI RMF and NIST AI 600-1 are the main voluntary references.

Does using AI change what examiners expect?

The 2018 joint statement says adopting new approaches does not, of itself, raise what regulators expect, and that AI finding activity the old process missed does not by itself mean the old process was deficient. Examiners still assess the program as a whole, so an AI tool's answers need the same evidence trail as a person's.

Should AI answers be shown to members or customers?

Not for BSA questions. Answers may involve suspicious activity and referrals, and 31 CFR 1020.320(e) bars revealing a SAR's existence. In the sample design, member-linked questions are kept in restricted history and only the procedure's approved words reach the member, while a guard checks that nothing appears on statements, online banking or the contact center's view.

How long should an AI pilot in compliance run?

No regulation sets a length. A sensible pilot runs long enough to see the questions that matter, ideally through the institution's busiest weeks and at least one change in the rules, so the tool is tested on stale procedures as well as easy questions. The agencies' 2018 statement treats pilots as a normal way to test innovative approaches alongside existing processes.