FIS has launched an AI banking agent built with Anthropic to accelerate financial crime investigations. This is, on the surface, exactly what the FCA expects: firms using technology to strengthen financial crime controls under the Consumer Duty PS22/9 and PRA SS1/23 expectations. But the timing is instructive. The same week, Ripjar published research showing 84% of senior compliance leaders are worried about AI-enabled financial crime — not the old kind, but crimes that exploit AI systems themselves. This reveals the real tension UK financial services firms face right now: regulators want you to move faster on AI adoption, but the moment you do, you become a vector for a new class of risks you don't yet fully understand.

The pattern here is becoming unmistakable. We're seeing a two-speed compliance world emerge. Large institutions like FIS's clients can afford to co-invest in custom AI agents with tier-one providers and absorb the governance cost. Mid-market banks, insurers and fintechs are instead caught in the gap: too small to build bespoke solutions, too exposed to skip AI altogether, and under real pressure from regulators and market competition to move now. The result is that many are deploying off-the-shelf AI tools — Microsoft Copilot in financial services, general-purpose LLM-based assistants, or bolt-on compliance platforms — without the governance layer that separates responsible implementation from regulatory liability. This is not a technology problem. It's a governance problem.

Here's what we believe: a banking agent is only valuable if you can audit it. FIS's agent may be faster at pattern-matching financial crime signals, but can FIS prove to its clients — and can those clients prove to regulators — that the agent's decisions are traceable, that it isn't hallucinating, that it isn't biased against certain customer profiles, and that it hasn't been poisoned by adversarial prompts designed to evade controls? These aren't optional questions under the FCA's expectations or the EU AI Act's compliance obligations. They're the baseline. This is why we built Trovix Audit not as an AI tool, but as an auditable framework around AI tools. The compliance leaders in Ripjar's survey aren't worried because they're Luddites. They're worried because they know the difference between a fast system and a defensible system — and they're being asked to deliver both at once.

If you're a mid-market law firm, insurer or financial services firm reading this: do not let speed become your compliance strategy. Right now, the work is not to implement an AI agent. The work is to decide which decisions in your compliance workflow actually belong in an AI system, which require human judgment, and which require both — working in series, not parallel. Then you need to document that decision tree, test it against your data, and be able to show an FCA examiner exactly why you made that choice. That's table stakes. Only after that foundation is in place should you ask whether FIS's agent, or Luminance's document intelligence, or Harvey's legal automation, or any other AI product, actually fits your specific control environment. Speed second. Governance first. Always.

Source: Forbes