Picture two compliance functions at two comparable institutions. Both face the same regulatory expectations. Both have board approval to modernise. Both have access to the same AI capabilities. 

Eighteen months later, one has an AI-driven screening programme, governed, audited, and quietly doing the work of a small army of analysts. The other has a promising pilot, a steering committee, and a deck explaining why full deployment is planned for next year. Again.

The difference between those two institutions is never the technology at hand, but a series of decisions made, or not made, by a compliance leader. 

Most industry discussion around AI in financial crime compliance still focuses on accuracy, explainability, and regulatory acceptability. Far less attention is paid to the individual the transition actually depends on – and what it demands of them.

The case for change itself is by now well established – alert volumes are growing structurally faster than any institution can grow headcount – yet understanding the problem has proven far easier than leading the response.

Conversations with compliance leaders across the industry reveal a consistent pattern. The institutions that successfully embed AI share three defining characteristics: leadership conviction, governance readiness, and a willingness to trust a well-designed system.

Three pillars, none of them technical, and every one of them the compliance leader's to build.

Leadership Conviction: Taking Ownership

Of the three pillars, leadership conviction is the one that cannot be delegated. The institutions that make the shift have a compliance leader who has made a deliberate decision to own the change and to treat it as strategy, not procurement.

"Embedding AI into compliance is not an IT project; it's a fundamental redesign of how compliance work gets done. You need someone senior enough and courageous enough to own that."

Ben Rayner, Global Head of Account Management, Silent Eight

Ownership in this sense goes beyond sponsorship. Technology projects get sponsored; operating-model redesigns get owned. A leader with conviction thinks like an architect: they start from the operating model they want to be running in two years' time and work backwards, rather than asking which task in today's process could be automated first. 

Institutions that hand the question to a workstream, a proof-of-concept team or an innovation function tend to produce exactly what those structures are designed to produce – pilots. What they don't produce is change.

For compliance leaders, this means accepting a role change before the organisation does: from the person who runs today's process to the person accountable for designing its replacement. 

That accountability cannot be outsourced, not to a vendor, a consultancy, or a transformation programme, and every strategic decision that follows rests on it.

Governance Readiness: Where Institutions Stall

The second pillar, governance readiness, is where most institutions actually stall. In a 2026 survey of nearly 200 compliance, risk, and audit leaders, more than 83% reported that their organisations already use AI tools – yet only around 25% had implemented a strong governance framework to sit around them [1]. 

Adoption, in other words, is running well ahead of oversight: AI is present almost everywhere in the compliance function, but too often as individual, task-based usage rather than embedded, governed deployment.

That imbalance explains why so many initiatives lose momentum. You cannot embed AI into a compliance programme without knowing how you will oversee it, how exceptions will be handled, and how you will explain it to your regulator. 

In many organisations, Model Risk Management is still maturing. This becomes a source of friction, as institutions try to fit a new class of decisioning system into oversight frameworks built for statistical models.

Before any deployment conversation, compliance leaders need answers to a short list of unglamorous questions. Who owns the policy parameters the system operates within, and by what process do they change? What is the exception and escalation framework, and who staffs it? How is oversight evidenced, not asserted, when the supervisor asks? 

A leader who can answer those questions has done the hard part; the technology conversation that follows is comparatively simple.

The temptation is to wait for the technology to settle, for frameworks to standardise, for someone else to go first. But the regulatory clock is running in the other direction. 

In January 2026, European AML/CFT mandates formally transferred from the European Banking Authority to the European Union’s new authority, AMLA [2]. Its Single Rulebook will apply across all 27 member states from July 2027 [3], and from 2028 it will directly supervise the first 40 designated high-risk institutions [4] – backed by sanctioning powers of up to €10m or 10% of annual turnover [5].

Meanwhile in the US, the SEC's 2026 examination priorities explicitly name AI oversight, explainability, and governance as focus areas [6]. Supervisory convergence means the era of locally tolerated inconsistency is closing. 

Governance readiness is no longer preparation for AI adoption; it is becoming a supervisory expectation in its own right.

Cultural Trust: A Hidden Constraint

The third pillar is the least visible and, often, the most decisive.

"There are institutions where the culture says 'we trust the system if it's well-governed,' and there are institutions where the culture says 'a human needs to touch every decision.' Changing that second culture is hard, and it's often a hidden constraint."

Ben Rayner

Culture, ultimately, is a leadership problem, because it takes its cues from what leaders visibly trust. 

The uncomfortable truth is that at today's volumes, "a human touches every decision" is already more principle than practice: some cases get depth, most get whatever the queue allows. At scale, insisting that every decision is manually reviewed is not control – it is a constraint disguised as assurance.

A well-governed system, one whose policy boundaries the compliance team wrote, and whose reasoning trail is inspectable on every single case, offers more genuine control, not less.

But trust is not installed; it is earned. In practice that means staged deployment, parallel running, and the simple accumulating experience of analysts reading the system's reasoning and finding it sound. 

The institutions that move fastest are the ones whose leaders did that cultural work internally, before the technology conversation ever became urgent – treating scepticism as something to be answered with evidence, rather than overridden by mandate.

The Evolving Role of a Compliance Leader

If the three pillars define what the transition demands of compliance leaders, it is equally important to recognise what it offers them in return.

Under the current operating model, a substantial share of a compliance leader's capacity is absorbed by operational management: queues, headcount planning, and the logistics of delivering high-volume investigative work consistently at scale. It is demanding work, but it leaves limited room for the strategic and ethical dimensions of the role, and it means many of the profession's most capable people spend their energy running a pipeline, rather than shaping what the compliance function is for.

Deployed efficiently, AI decisioning shifts that balance. The compliance leader's focus moves from supervising a manual process to defining policy intent, governing execution, and owning institutional accountability for outcomes: determining what ‘right’ looks like, and overseeing a system that applies it consistently across every case.

That elevated role carries new requirements, with a core shift from operational fluency to systems thinking. 

This requires the ability to translate policy intent into precise system parameters, sufficient AI-governance literacy to challenge vendors and internal teams effectively, and the institutional confidence to be accountable for decisions they’ve not personally reviewed. 

None of this displaces what compliance leaders already bring — regulatory expertise, people leadership and process management remain the baseline. The challenge is building the new capabilities that sit on top of it.

"The good news is that these are all learnable skills. The compliance leaders I find most impressive right now are the ones actively investing in developing them – not waiting for the technology to mature before they do."

Ben Rayner

It is an instinct worth following, because the regulatory timeline is no longer theoretical. The technology required for accountable AI decisioning already exists, and supervisory expectations are converging around it. 

What determines whether an institution captures its value is built much closer to home: the conviction to own the redesign, the governance to make it defensible, and the culture to trust it. 

All three are within the compliance leader's control, and prioritising them may prove to be the defining act of this generation of compliance leadership.

To explore why control effectiveness is now threatened less by AI than by the overstretched model it would replace, read Ben Rayner’s full article here.