AI for
Compliance Teams
Compliance teams spend valuable time collecting evidence, comparing policy and preparing routine analysis. We automate the defined research and document work while keeping interpretation, escalation and approval with the accountable person.
Gather the evidence
Flag unusual cases
A person signs off
Your team spends less time chasing information.
Sourced
FINDINGS LINKED TO EVIDENCE
Reviewed
INTERPRETATION AND APPROVAL
Recorded
DECISIONS AND MODEL CHANGES
Frameworks are mapped to the firm's activities, regulatory status and the workflow in scope.
Compliance teams spend too much time moving information
Reading the FCA, PRA and ICO output. Mapping a new rule to the policies it touches. Drafting control narratives. Disposing the first line of an AML alert. Reviewing a financial promotion against COBS and the Consumer Duty. It all chews up the same kind of hour.
Preparing that information can consume time before an analyst reaches the judgement itself. We identify which preparation steps can be measured and checked.
The accountable person retains interpretation, escalation and approval. The system provides a draft and the evidence needed to review it.
WITHOUT THE AI
- Analyst reads every PS, CP and Dear CEO letter
- Control narratives copied between audits
- High-volume AML alerts queued for review
- KYC packs typed from PDFs by hand
- Promotions reviewed against a printed checklist
WITH IT
- Daily brief: what changed, who it touches, what to do
- Narratives drafted from the evidence, you sign off
- Alerts pre-summarised with the reasoning attached
- KYC data extracted, flagged, ready for review
- Promotions pre-checked, citations next to each finding
Compliance work worth automating
We focus on defined review steps where retrieval, a human decision and a retained audit record can reduce handling time without changing accountability.
Horizon scanning
Watch the FCA, PRA, ICO, NCA, JMLSG, HMT and OFSI feeds. Every morning, your team gets a brief: what's new, who it affects, which policy or control it touches, what to read in full.
Policy & control mapping
Drop in a new policy statement. The system finds the policies, procedures and controls it changes, drafts the updates, and flags the gaps your second line needs to decide on.
AML & sanctions triage
Alerts arrive with a draft disposition: customer history, transaction context, sanctions match strength, the policy clause that triggered it. Your analyst confirms or escalates instead of starting from scratch.
KYC & DPIA drafting
Onboarding packs read and structured. Adverse media checked. DPIAs and vendor questionnaires drafted from your templates. Reviewer sees a half-finished pack, not a blank form.
Promotions & audit prep
Financial promotions pre-checked against COBS, CONC and the Consumer Duty. Audit packs assembled from the evidence already in your systems. Findings include source references for review.
Controls for regulated AI work
In regulated work, you may need to show how an answer was produced. A consumer chat session may lack the retention, access, logging and contractual controls your firm needs. Suitability depends on the product plan, configuration and use case.
The workflow links outputs to retrieved sources and records the reviewer decision. Access, logging and retention are agreed against the firm's requirements.
Hallucinated citations
A plausible citation can be wrong or irrelevant. We keep source paragraphs available and test citation accuracy, while reviewers check whether the source supports the finding.
No audit trail
Your governance may need the prompt, sources, model version and reviewer decision kept together. Where SS1/23 applies, we map the workflow to its model-risk expectations. Other firms can use the same principles as voluntary good practice.
Automated decision safeguards
UK GDPR Articles 22A to 22D cover significant decisions made solely through automated processing. Where they apply, people need information, a route to challenge and access to human intervention.
Data residency
Provider terms, retention, training settings and access must suit the KYC material involved. The data-flow plan records processing outside your own tenancy as well as internal storage.
Prompt injection in documents
Onboarding docs and contracts can carry instructions that hijack a naive pipeline. We treat document content as untrusted input, not as a system prompt.
How we start
A short scoping, then the first workflow live. The audit and governance records are written as we go, including an SS1/23 mapping where it applies.
We assess the existing GRC platform before adding custom work. Supported native features may already cover part of the reading, drafting or review process.
BOOK A SCOPING CALLScoping
We sit with your MLRO, DPO and second line. We watch the work that's eating the team. We come back with two or three candidate workflows, scoped and priced, with a written view of the firm policies and regulations each one engages.
Connect your sources
FCA, PRA, ICO and HMT feeds. Your policies, procedures and control library. Your AML platform, KYC system, ticketing and shared drives. Indexed into a private vector store inside your tenancy, with permissions that match the source systems.
Launch the first workflow
Live for the team. Citations in every output. Reviewer attestation captured. Prompt, retrieval set, model version and decision logged for every run. We sit with the analysts using it and tune it weekly.
Hand over the governance pack
Model card, applicable governance mapping, DPIA where needed, prompt-injection and bias test results, monitoring dashboards and named ownership. It gives the regulator or internal auditor a clear account of how the workflow works.
Frameworks that apply to compliance AI
The relevant frameworks depend on the firm's regulated activities and the purpose of the AI. We record applicability rather than apply every standard to every workflow.
Model risk management
PRA SS1/23 sets expectations for specified UK-incorporated banks, building societies and PRA-designated investment firms with internal-model approval for regulatory capital. We assess whether the firm and workflow are in scope.
SYSC, SM&CR, Consumer Duty
Existing FCA requirements may apply through systems and controls, individual accountability and customer outcomes. Your compliance owner determines which rules affect the firm's activities and the proposed workflow.
ICO guidance & Articles 22A to 22D
We record lawful basis, prepare a DPIA where required and design the safeguards needed for significant solely automated decisions. That includes information, a route to challenge and human intervention where the provisions apply.
AI management system
ISO/IEC 42001 specifies requirements for an AI management system. The workflow can contribute evidence, but certification covers the wider system and requires separate assessment.
Third-party & ICT risk
DORA applies to specified EU financial entities and addresses ICT third-party risk. PRA outsourcing expectations have their own scope. We document provider access, contracts and dependencies for your legal and compliance owners to assess.
Annex III high-risk
Creditworthiness and life and health insurance pricing are on the Annex III high-risk list. Following Regulation (EU) 2026/1744, those requirements apply from 2 December 2027. Territorial scope and your role as provider or deployer still need checking.
Crystal and ClimateEQ keep people in control
Crystal runs agreed compliance checks and keeps evidence with each deal. ClimateEQ scores carbon-literacy pledges and drafts feedback, while reviewers retain the final decision.
When this is worth discussing
We work best when there is a real operating problem, enough volume to measure and people from the affected teams who can make decisions.
Usually a good fit
- An established UK business, usually with annual revenue above £10m
- A repeated process with a known cost, delay, error rate or capacity problem
- A senior sponsor and a day-to-day owner who understand the work
- Access to the relevant staff, systems, sample records and security requirements
We may point you elsewhere
- A standard product already covers the process well
- The requirement is a one-off small build with no wider operating case
- There is no owner or access to the people and data needed to test the result
- The plan relies on AI making high-impact decisions with nobody responsible for review
Questions the buying team will ask
Will the regulator have a problem with this?
No supplier can promise a regulator's response. We identify the rules that apply to your firm and use case, then design the access, review, logging and evidence around them. For firms within SS1/23 scope, that includes its model-risk expectations. These controls make it easier to show how an output was produced and who approved its use.
What about hallucinations?
Retrieval and citation checks help, but a model can still misread a source or draw the wrong conclusion. We retain the relevant passages, flag missing evidence and require review of findings before use.
Where does our data go?
We document internal storage, model providers, processing locations, retention and access. Zero-retention and no-training claims must be checked against the exact service and contract. Your third-party risk process reviews the resulting data flow.
Does this replace the team?
The workflow can reduce defined reading, copying and data-entry steps. Judgement, escalation, regulator engagement and SMF sign-off remain with people. The value case should measure queue time, review capacity and error rates without assuming a staffing outcome.
We already have a GRC platform. Do we rip it out?
We assess the platform's existing capabilities and supported interfaces. Custom work fills an agreed gap and keeps the appropriate system of record authoritative.
How long until we see it working?
We define one controlled workflow, its sources, accountable owner and review evidence. It runs alongside the existing process until the compliance team has enough results to approve wider use.
What about the EU AI Act?
If a workflow touches Annex III categories such as creditworthiness or life and health insurance pricing, we assess its territorial scope and likely classification from the start. Following Regulation (EU) 2026/1744, those requirements apply from 2 December 2027. Documentation, logging and human review are useful controls now.
How much does it cost?
Scoping and the first build have agreed prices. The proposal lists model usage, storage, integration, support and any third-party licence costs separately.
Talk to us about your compliance workflow
Tell us which compliance workflow has the most volume, the source material and the accountable owner. We will identify the first controlled use case and the evidence its oversight process needs.