Financial ServicesAI GovernanceCompliance
Adaptive AML and KYC tools change their own behavior over time. Before adopting one, compliance leaders should confirm they can show an examiner exactly why a customer was approved or an alert was cleared months earlier.
Finastra's outlook on AI in banking and financial services for 2026 predicts that AI for fraud detection will increasingly be embedded in anti-money laundering (AML), Know Your Customer (KYC) and Know Your Business (KYB) systems. According to Finastra, these tools are moving "from basic automation to adaptive, real-time intelligence," which should improve onboarding accuracy and strengthen risk management. For a BSA officer or compliance leader at a mid-market bank, credit union or lender, the word adaptive deserves close attention. A tool that adjusts its own scoring as it learns can give a different answer in March than it gave in October. An examiner reviewing an October onboarding decision will want to see the October answer and the reasoning behind it.
AML and KYC programs are judged after the fact. An examiner, auditor or internal reviewer pulls a sample of accounts opened and alerts closed during the review period and asks why each one went the way it did. With a rules-based system, the answer comes from the rule set in effect on that date, and change control should already document which rules were live. With an adaptive model, the answer depends on several things at once. These include the model version, the data it saw about that customer, the score it produced, the threshold applied, and what the analyst did with the result.
Banking supervisors already expect institutions to understand the models they rely on. The model risk management guidance the Federal Reserve and the OCC issued in 2011, commonly known as SR 11-7, covers how models are developed, validated and monitored once they are in use. It was written before most of today's AI tools existed, and its principles still apply when the model sits inside a vendor's onboarding platform. For many mid-market institutions, the more pressing gap is narrower and more ordinary. The question is whether the records exist to replay a single decision from start to finish.
The record of a decision should be written at the moment the decision is made. Piecing it together later from system logs, vendor release notes and an analyst's memory is slow and often incomplete. For each onboarding decision or alert disposition, the system should store the following:
If a vendor retrains its model, you also need the date each new version went live in your environment.
The same principle applies outside banking. Before Laminar built LeaseIQ for Healthpeak Properties, lease approvals, legal document review and tenant improvement workflows ran on email, spreadsheets and phone calls. The platform brought those steps into one workflow integrated with Documentum, Healthpeak's document management system. Approval processes that live in email are very hard to piece together when someone later asks who approved what, and on which version of a document. KYC onboarding with an adaptive model has the same weakness, with one more element that can change underneath a decision: the model itself.
Analysts need attention as well. An adaptive score is only as defensible as the human judgment recorded next to it, and a rationale field filled with "reviewed, OK" tells an examiner nothing. Staff who are skeptical of the tool may override it without explanation. Staff who trust it too much may accept every score without comment. Both habits leave the same hole in the record.
Most mid-market institutions will get these capabilities embedded in a core banking, onboarding or case management platform. That puts the important answers in the vendor's hands, so they belong in the contract. Ask these questions:
These questions add time to procurement, and some answers will be vague. A vendor may describe its model as continuously learning without offering a clear version history. That might be acceptable for a marketing analytics tool. For a system that decides who gets an account, it leaves the compliance officer unable to explain a decision the institution is accountable for. Expect some friction internally too. Procurement may see these questions as delay, and IT may not have a change control step for vendor model updates at all.
A few steps will show how exposed you are today and set the terms for any tool you add.
Dealing with a similar challenge?
We work with mid-market companies in regulated industries to build AI workflows that actually hold up.
Let's TalkSean Cummings
Founder of Laminar Consulting Services. Specializes in AI workflow automation for regulated industries — medical device, financial services, and complex logistics operations.
