All Posts

Generative AI can help financial institutions analyze information, support employees, and improve customer service. But when an AI application handles confidential business information or customer records, a simple prompt, overly broad data connection, or poorly controlled output can expose informat...

What happens when an AI system’s model, prompt, or data changes, but the approval process doesn’t clearly identify who decides whether it can proceed? This is the practical challenge behind AI change governance in financial services: connecting decision rights and evidence to the workflows where cha...

A control environment can look complete on paper and still fail where it matters: in the hands of the people who operate it, in the data that feeds it, and in the oversight that is supposed to catch problems early. Recent enforcement actions by FinCEN , the OCC , and OFAC against Bank of America inv...

Human review is often presented as an important safeguard for AI-supported decisions, but the presence of a reviewer does not necessarily make a process safer. If reviewers lack relevant information, sufficient time, appropriate expertise, or authority to challenge a recommendation, human oversight...

Two banking use cases built on the same generative AI model may warrant very different oversight. An internal tool that summarizes approved policies presents a different exposure from a system that drafts customer advice or informs a credit decision. That is the central question in generative AI ris...

An AI system can continue operating as designed while the decisions it influences change in ways that introduce new or unexpected risks. Shifts in customer populations, input data, business policies, workflows, or human reliance on AI-generated recommendations can alter real-world outcomes even when...

A critical vendor exit strategy is not simply a termination clause, a list of alternative providers, or an annual discussion about what might happen after a service failure. It is the institution's demonstrated ability to preserve important services while changing, reducing, or ending a dependency....

Executive leadership teams and boards of directors frequently encounter a fundamental operational disconnect: the risk appetite approved in the boardroom bears little practical resemblance to the daily transactional decisions executed across business lines. Boards routinely approve qualitative decla...

Table of Contents Understanding Self-Identified vs. Examiner-Identified Issues Interpreting Issue-Identification Patterns Beyond the Raw Ratio Diagnostic Decision Framework: Evaluating Issue Discovery & Response Building an Escalation and Governance Framework Across Control Functions ## Und...

Financial institutions frequently dedicate substantial capital, executive attention, and operational effort to remediating supervisory findings, only to encounter skepticism when presenting their completed work to regulators. This friction typically does not stem from bad faith or lack of effort. Ra...

Evaluating mortgage loss mitigation applications requires balancing intricate regulatory timelines with rigid investor guidelines. When borrowers experience financial distress, servicing compliance functions face a clear operational challenge: verifying that similarly situated borrowers undergo fair...

Table of Contents Regulatory Foundation: Aligning Regulation B and FCRA Mandates Decision-to-Notice Mapping: Bridging Underwriting Logic and Reason Codes Testing and Governance: Constructing Risk-Based Validation Controls Exception Handling and Control Improvements ## Regulatory Foundation: Ali...

Financial institutions frequently alter products, fee structures, customer communication channels, and underwriting algorithms to adjust to commercial requirements and market developments. However, operational change management protocols in financial services are traditionally calibrated to evaluate...

New products can change an institution's financial crime risk profile in ways that are difficult to identify after a product has been designed and launched. Changes in customer segments, transaction flows, delivery channels, geographic exposure, counterparties, or technology can create risks that ex...

Bank-fintech relationships can expand access to financial products and technology while also creating a challenge for bank risk and compliance leaders: how do you know that a partner's AML controls are actually working? A contract, questionnaire, certification, or third-party assessment can provide...

OFAC screening effectiveness cannot be measured by alert volume or false-positive rates alone. A screening system can generate fewer alerts without necessarily improving sanctions risk detection, particularly when matching thresholds, exclusions, data quality, or system changes reduce the likelihood...

Closed alerts and decisions not to file a Suspicious Activity Report (SAR) can provide important insight into the effectiveness of an institution's suspicious activity monitoring and decision-making processes. The objective, however, is not to eliminate judgment or require identical outcomes for sim...

For financial institutions, the conversation around AI governance documentation is often framed as a compliance exercise. This approach, however, misses the strategic purpose of documentation: to create credible, durable evidence that governance processes were not just designed but were actually per...

Agentic AI is changing the risk profile of artificial intelligence in financial services by moving beyond systems that generate information or predictions toward systems that can use tools, make decisions, and execute actions with limited human intervention. The resulting risks are not limited to th...

When an automated decision causes consumer harm, the most important governance question is not whether the algorithm made the decision. It is whether the financial institution had clearly defined who was responsible for the system, how its risks were assessed, what controls governed its use, and how...