Regulators publish documents, while financial institutions must identify and manage the obligations within them. That gap is where much of the cost and risk in regulatory change management sits. A consultation, speech, rule or enforcement notice may contain many separate requirements. Some are new, some amend an existing position and some have no practical effect on a particular firm. A document-level alert does not resolve any of those questions.

In this series, we document our research interviews with vendors tackling significant risk and compliance challenges. Each blog looks at how a specific product addresses a live industry problem. Most AI governance sits above the level of an individual decision. Firms write policies, classify use cases, maintain model inventories and approve systems. These controls are necessary but not sufficient.

In this series, we document our research interviews with vendors tackling significant risk and compliance challenges. Each blog looks at how a specific product addresses a live industry problem. On this occasion, we feature Riskonnect, whose Integrated Risk Platform connects technology assets, controls, incidents, policies and regulatory requirements across the enterprise.

Customer-facing AI is moving from answering simple questions to influencing decisions and completing tasks. This shift is changing the assurance problem. Our AI in Risk & Compliance 2026 research finds that 65.6% of reported AI activity has reached production or beyond, while 69.3% of institutions say deployment is ahead of the measured control environment. Firms now need evidence that customer-facing AI continues to behave appropriately before, during and after release.

Regulatory change is usually presented as a volume problem. Often, the harder problem is relevance. A new publication may affect only one product, legal entity, jurisdiction or control. Another may repeat an existing position without changing the firm's obligations. A third may look minor at document level but alter a requirement that touches multiple policies and business processes. In our 2026 research, 57% of respondents rated the AI-related risk in compliance management

Enhanced due diligence has always been a trade-off between speed and rigour. Anti-money laundering obligations require organisations to untangle complex ownership structures, verify sources of wealth, investigate adverse media and litigation, and assess vast quantities of information, all while avoiding unnecessary friction for legitimate customers.

Regulatory change management is a perpetual challenge, but access to information is no longer the bottleneck. Regulatory updates are publicly available and increasingly digital. The real difficulty is knowing which updates are material to the firm, what they demand in practice, who owns the response, and how the organisation demonstrates that it acted. That challenge is intensifying. Firms are operating across more jurisdictions, products and licence types.

Client onboarding has always been a high-friction compliance process. It is now becoming a strategic growth issue. Financial institutions want to expand into new markets, launch new products and serve more client segments. Each of those moves depends on the same underlying question: can this client be onboarded for this product, in this jurisdiction, under the firm’s risk appetite and applicable regulation?

Traditional maturity assessments can show that a control exists, that a process has been defined, that a policy has been recorded. They are less reliable at showing whether any of it is working in practice. For senior managers with prescribed responsibilities under accountability regimes, that carries personal risk. If a control fails and scrutiny follows, the question will not be whether the framework was documented. It will be whether reasonable steps were taken to ensure

Historically, many institutions treated AML monitoring as a distinct control. Scenarios generated alerts. Analysts reviewed them. Cases were escalated where required. That operating model still exists, but the surrounding context has changed. Instant payments compress the time available for detection and intervention. Cross-border activity creates more complex data. Financial crime typologies are more networked. Fraud, sanctions, KYC and AML signals increasingly overlap.