Financial crime volumes are outgrowing what hiring alone can fix, pushing compliance teams past the limits of traditional staffing models. We asked Patrick Kirwin, Silent Eight’s Head of Product Management a few questions to unpack what this change means on the ground, from the pressures reshaping day-to-day operations to the skills analysts will need next.

To start us off, how has the day-to-day of compliance operations changed over the past few years?

I think the reality is, depending on the institution, some are actually changing with the times and adopting new technology, while others are still doing things the way they used to. Adoption in certain customer segments and markets is still slow to change.

There's one change happening across the board, though. Expectations. Even compared to five or ten years ago, the amount of risk that needs reviewing is growing. Banks are bringing on new customers, entering new markets, and launching new products, all of which increases the risk they have to manage. 

Regulatory expectations are rising too, and cases are becoming more complex. There are far more payment channels now, with instant and peer-to-peer payments much more common than before. So the work is growing in both volume and complexity, and banks are struggling to scale their teams using the methods that used to work.

Banks have historically managed rising volume by hiring more analysts, or, starting around ten years ago, offshoring work to cut costs and expand capacity. That helped for a while, but continued global growth is making it unsustainable. In the past five years or so, there's been a rise in ‘managed services’, banks bringing in consulting firms because they can't hire enough people themselves. We're stretching the limits of what hiring alone can do.

Moving on to the topic of AI, what do you think the ground-level view is on how AI is changing compliance in general?

If we take the growing volume and complexity of cases as the real issue, AI's entry point for most institutions is helping them cope with it. Automating the routine work, the grunt work, to free up space for the complex stuff.

That's the low-hanging fruit right now. Using AI to remove the repetitive data collection, analysis, and documentation work analysts do today. Take a transaction monitoring case that might take an hour end to end. Before, analysts were spending 60 to 70% of that time just building Excel pivots and pulling in transaction data, before they could even start making decisions. AI takes care of that, so analysts can focus on decision-making and risk analysis instead.

How does this AI shift change a team's structure and workflow?

I think we're genuinely going to see, partially happening now, more in future, a collapse of the three-tiered model that's been standard in the industry for decades, L1, L2, and L3 teams. Today, L1 churns through cases doing quick decisioning, collecting initial information, making a snap judgment on whether something looks suspicious, and passing it up the chain or closing it if it's clearly false. 

I think we'll see L1 entirely handled by AI, and increasingly L2’s additional data collection and decisioning handled by AI agents too, leaving the human analyst as the tip of the spear, with L3 focusing only on the very complex, ambiguous cases AI isn't equipped to handle.

For people in L1 today, we want to upskill them into L2 and L3, shifting their focus onto decision-making and risk analysis, the things only humans can do. Teams may get smaller, but what they do see will be the genuinely complex cases, so these become highly specialised teams with a deep investigative skill set.

One more change worth adding: L3 analysts will spend a lot of their time quality-checking the AI, validating that the agents’ decisions are correct, and there may even be a training relationship, where the analyst trains the agents, effectively managing a team of them the way they'd manage people.

What are the main stalls that prevent AI implementation moving from proof of concept to production? And is that more a human or a technical problem?

The first issue is a lack of AI governance. A bank might have a really good model with a great use case and strong proof-of-concept outcomes, but the governance around it is often treated as an afterthought, a real challenge once they try to make it work in production. 

That means, how do you make sure the model's decisions are correct? What quality assurance do you have in place? What human-in-the-loop approval exists for anything the model learns, so it isn't biased? If governance is bolted on at the end instead of built in up front, it delays implementation, and can derail it entirely.

On the human-versus-technical split, it's a real litmus test depending on who you talk to. At the top of the house, there's a lot more push for this. More understanding of the benefits, more willingness to experiment. The closer you get to the people actually doing the work, the more hesitation you find, understandably, since it's their own expertise being partly automated. 

Setting explainability aside, the actual outcomes are hard to argue with. They keep getting better. So it's less about the outcomes and more about an organization's willingness to take this on. Some are fine letting AI decide within guardrails and QA sampling, others insist every decision has to be reviewed by a human.

How has the analyst's job changed as more decisioning is automated, and what new skills do they need?

Even years ago, some analysts, especially at L1 and L2, held onto skills like building transaction pivots or public-domain research as their core competencies. The people who will struggle most going forward are the ones who hold onto these as their identity, since they're the things most easily replicated by AI, at a speed and scale humans can't match.

The skills that will be non-negotiable going forward are around moving up the chain into risk decisions, acting under ambiguity, managing signals that don't point to a clear outcome, and coming to a conclusion anyway.

A healthy scepticism about AI outcomes matters too, not rubber-stamping what you're given. Critical thinking about the potential gaps or blind spots in AI is what makes someone a better manager of it, and ultimately what delivers value: knowing where things are falling down, and feeding that back to the agents so they improve.

Finally, is there a piece of advice you'd give to a Chief Compliance Officer (CCO) entering the role today?

There's been a reliance over time, especially among people in the policy space, financial crime professionals, myself included a few years ago, on believing that tools and technology are good assistance, but that the true risk decisioning and power of identifying risk sits with humans, and the knowledge they've built up over their careers.

The people who are risk managers making decisions are still, by far, the most critical part of the financial crime compliance ecosystem. I want to be clear about that. But I was in a position where I wasn't as trusting that AI could play a significant role beyond being a helper. If a new CCO is coming in now, I think they should be open to the idea that AI can play a genuinely pivotal role, take on more of the ecosystem of their programme, and help identify net-new risks. 

Not just small efficiencies, but better risk detection and decisioning, freeing up human resources to do more than they ever could before. It would be a mistake not to at least keep an open mind about what role AI should play in your financial crime programme.