Core advisory
AI-Enabled Compliance
AI-literate, not AI-hyped. We test, tune, document and govern AI-based KYC and monitoring tools for explainability and model-risk governance — anchored in FCA SYSC, JMLSG and FATF.
The problem
AI is being deployed across KYC, screening and monitoring faster than it is being governed. The risk is not that the models are bad — it is that they are unexplainable, untested against bias and drift, and undocumented for model-risk governance. When the regulator asks why a customer was cleared or escalated, 'the model decided' is not an answer.
There are two ways to be wrong about AI in compliance. One is to dismiss it — to treat manual review as inherently safer when it is often slower, less consistent and no more explainable. The other is to over-trust it — to deploy AI-based screening, risk re-scoring and document verification faster than you can govern them, and to discover under regulatory challenge that you cannot explain a single decision the model made.
CCL occupies the position between the two: AI-literate, not AI-hyped. We are not a regtech vendor and we do not sell models. We are the independent practitioners who make sure the AI tools an institution adopts are tested, tuned, documented and governed to a standard the FCA will accept.
The governance gap, not the technology gap
The models available today are, broadly, capable. The gap is governance. An AI-based control that cannot show its data lineage, has not been validated, is not monitored for drift or bias, and has no documented human-in-the-loop override is not a compliance asset — it is an unexamined liability that happens to be fast. Bringing these tools under a genuine model-risk governance framework is the work, and it is the work most institutions skip in the rush to adopt.
Explainability is non-negotiable
When a regulator or a customer asks why a decision was made, “the model decided” fails. Every automated decision in the KYC and monitoring chain must be explainable — to a supervisor, to a court, to the affected customer. We assess and document how each model reaches its outputs and where human judgement governs it, anchored in FCA SYSC and JMLSG expectations. This is the discipline explored in AI-literate vs AI-hyped model governance.
Perpetual KYC is architecture, not automation
The clearest example of the AI-hype trap is perpetual KYC. Sold as an automation upgrade, it is really an architecture problem: unless the triggers, data and escalation logic are designed and governed correctly, automation simply generates noise faster. We design the architecture first, then let the automation do what it is good at.
The CCL approach
- 01
Govern the model, not just the tool
We bring AI-based compliance tools under a model-risk governance framework: documented purpose, data lineage, validation, monitoring for drift, and human-in-the-loop controls.
- 02
Test for explainability
Every automated decision must be explainable to a regulator and a customer. We assess and document how the model reaches its outputs and where human judgement overrides it.
- 03
Tune against real risk
Automated risk re-scoring, document verification and perpetual-KYC triggers are calibrated to the institution's actual risk profile and tested against false positives and missed risk.
- 04
Anchor in the regulatory framework
All of it mapped to FCA SYSC, JMLSG guidance and FATF expectations — so adoption of AI strengthens the regulatory position rather than creating a new exposure.
Frequently asked questions
Is CCL a regtech vendor?
No — and that is the point. We are not selling a model. We are the independent specialists who test, tune, document and govern the AI-based tools you adopt, so they are explainable and defensible under model-risk governance. We are AI-literate, not AI-hyped: experts who make AI adoption safe, not advocates for any particular technology.
Our vendor says their model is a black box. Is that acceptable to the regulator?
Not on its own. The FCA's expectations around governance and the senior-manager regime mean an institution remains accountable for decisions made by tools it deploys. 'The model is proprietary' does not discharge that. We help establish the explainability, validation and human oversight needed to deploy the tool defensibly — or to conclude that it cannot be.
What is perpetual KYC and is it an AI problem?
Perpetual KYC means replacing periodic review cycles with event-driven, continuous monitoring of customer risk. It is often sold as an automation problem, but it is really an architecture and governance problem: the triggers, data and escalation logic have to be designed and governed correctly. Automation without that architecture just produces faster noise.
How does AI governance map to FCA SYSC and JMLSG?
SYSC sets expectations for systems, controls and senior-management responsibility; JMLSG provides the AML/CTF guidance against which automated AML decisions are judged. We map each AI-enabled control to these so the model's purpose, validation and oversight are evidenced against the standards a regulator will actually apply.
Related case studies
See it in practice
Large-Scale KYC Remediation — A Major Post-Merger Backlog
Tier 1 Retail Bank
A large post-merger backlog of unresolved records, no internal capacity. Programme design in 30 days, risk-tiered delivery, weekly MI — 94% completion in 8 months, 0 enforcement actions.
Read the caseSilent Misclassification at Scale
Tier 1 Retail & Private Bank
A six-year-old risk model silently scored high-risk customers as standard. Retrospective analysis, reweighting and 340 EDD escalations closed the exposure with zero regulatory findings.
Read the caseRelated insights
Read the thinking
AI-Literate, Not AI-Hyped: Model Governance for AI in Financial Crime
The gap in AI-enabled compliance is not the technology — it is governance. An automated control that cannot be explained, validated or overseen is not an asset. It is an unexamined liability that happens to be fast.
Perpetual KYC Is Not an Automation Problem. It's an Architecture Problem.
Perpetual KYC is sold as an automation upgrade. Automate a broken review model and you get faster noise. The real work is architecture: triggers, data and escalation logic designed before any tool is bought.
Speak to the practice
Before it becomes a regulatory finding, make it a closed action.
A short, confidential advisory call to pressure-test where your KYC, AML, sanctions or risk-classification framework is exposed — and what a defensible fix looks like.