- You spent years building credit risk and regulatory reporting platforms before agentic AI arrived. What did that background teach you about where AI belongs in a bank’s workflow, and where it doesn’t?
Working in credit risk and regulatory environments taught me that the first question shouldn’t be, “Can AI do this?” It should be, “What happens if AI gets this wrong?”
That distinction determines where AI belongs in the workflow.
There are areas where AI is incredibly valuable, collecting evidence, comparing documents, identifying inconsistencies and bringing relevant information to an analyst. These are activities where people often spend hours doing investigative work before they can actually exercise judgment.
A good example is a KYC or KYB refresh journey. Financial institutions periodically need to perform additional due diligence on customers, particularly when their risk profile requires information to be refreshed. You obviously need to meet those regulatory obligations, but you also don’t want to create unnecessary customer friction by repeatedly asking customers or businesses for information they’ve already provided.
AI can help identify relevant information from documents and data the customer has previously provided and use it to prefill portions of the refresh journey. The customer can then review, confirm or correct that information. That’s very different from allowing AI to automatically change a critical customer or legal-entity attribute without confirmation. The underlying AI capability may be similar, but the downstream action—and therefore the risk—is very different.
The same principle applies to credit risk and regulatory reporting. A low-risk task with strong evidence may be highly automated, while a decision that affects how exposures are aggregated or reported may require additional controls or human approval.
So my experience before agentic AI shaped how I think about it today: automate the investigation aggressively, use AI to reduce unnecessary operational and customer friction, but be much more deliberate about automating judgment and consequential decisions.
- Your team automated evidence collection from SEC filings and news sources to validate counterparty hierarchies, cutting manual review effort by about half. Walk us through how that works in practice.
The use case was about understanding relationships between legal entities and identifying the ultimate parent based on factors such as majority ownership and voting rights. A financial institution may have separate relationships with several companies that ultimately belong to the same corporate group, so we needed to construct that hierarchy to understand the relationship and exposure at the group level.
The first step was establishing the hierarchy using external ownership information and matching those entities back to our internal legal-entity records. That’s where data quality becomes critical. Company names, addresses and identifiers aren’t always represented consistently across systems. Before determining that Company A owns Company B, you first need confidence that the Company A you’ve identified externally is actually the same Company A represented internally.
From there, agentic AI helped with evidence collection and validation. We designed specialized agents to investigate SEC and EDGAR filings, official company disclosures, government and corporate registries, news sources and other external information.
But before we could automate that process, we had to classify which sources could be treated as trusted and which were supporting or untrusted sources. A regulatory filing or official government registry, for example, would generally carry more evidentiary weight than a news article or an unverified third-party source. At the same time, we couldn’t simply ignore those secondary sources because they can surface recent acquisitions, restructurings or ownership changes before all authoritative sources have been updated.
That’s where Compliance and Legal became important to the design. We needed their input to establish the source hierarchy, what constituted sufficient evidence, the confidence thresholds for accepting a relationship, and the conditions that required escalation. If a trusted source contradicted an older or less reliable source, the workflow could generally give greater weight to the trusted evidence. But if two trusted sources disagreed on ownership or control, that crossed the threshold for human review because it could indicate a timing difference, restructuring or genuine ambiguity.
So the roughly 50% reduction in manual effort didn’t come from removing people from the process. It came from automating much of the searching, matching and evidence collection, while using source trust, confidence thresholds and risk-based escalation rules—defined with Compliance and Legal—to determine exactly where automation should stop and human judgment should begin.
- Human-in-the-loop gets treated as a design principle in most AI coverage. What does it look like as an operational reality, with auditors and regulators reviewing the output?
Operationally, human-in-the-loop doesn’t mean a person has to review every decision the AI makes. If that’s the design, you lose much of the benefit of automation. It means defining very clearly when the AI can proceed and when human judgment is required.
For example, when identifying relationships between legal entities and determining an ultimate parent, a straightforward case where multiple trusted sources corroborate the same ownership structure and the evidence meets our defined confidence threshold doesn’t necessarily require additional manual investigation.
Human review becomes important when there is ambiguity. Two trusted sources might report different ownership percentages because of a recent acquisition. A company might own less than 50% but have enhanced voting rights that create effective control. A joint venture may not have an obvious controlling parent, or a recent restructuring may leave conflicting information about the ultimate parent. Those are cases where the AI should recognize that the evidence isn’t conclusive and escalate rather than make an assumption.
We can also deliberately require human validation based on materiality. For relationships involving particularly significant exposure, for example, human review can remain mandatory even when the AI has high confidence because the consequence of getting the relationship wrong is greater.
And all of this needs to be traceable. If an auditor or regulator looks at a decision later, we should be able to show the evidence the AI considered, why it crossed—or didn’t cross—an escalation threshold, what decision was made and who made it.
That’s what human-in-the-loop means to me: not putting a human behind every AI decision, but designing the workflow so that human expertise is concentrated exactly where ambiguity or risk makes it valuable.
- You manage customer data platforms covering 248 million customers across 26 markets. How much of successful AI deployment comes down to the data foundation underneath it?
I’ve spent much of my career working on customer data, identity, master data and enterprise relationship platforms, and one lesson has consistently held true: AI amplifies whatever quality of data you give it.
The first piece is trusted and consistent data. At enterprise scale, information comes from many products, channels and systems, often built at different times for different purposes. You need clear ownership of critical data elements, consistent definitions, strong lineage and reliable identifiers. Otherwise, AI simply inherits the inconsistencies that already exist across the organization.
Entity resolution is a good example. Before AI can reason about a customer or business, you need confidence that records across different systems actually represent the same entity. A company may appear under its legal name in one system, a Doing Business As ( DBA ) name or brand in another, and have different addresses or identifiers associated with different relationships. Corporate identities also evolve—Facebook became Meta, Square became Block, and Google reorganized under Alphabet. If you can’t reliably connect those records, you don’t have a comprehensive view of the entity, which can ultimately affect KYC, credit exposure, risk assessment and regulatory reporting.
The second piece is context and relationships. Accurate individual data points aren’t enough. AI becomes much more valuable when it understands how customers connect to accounts and products, or how businesses connect to subsidiaries, owners and parent organizations. That’s what allows AI to reason with context rather than simply retrieve information.
And finally, data quality has to be continuous. Customers change addresses, businesses restructure, ownership changes and upstream systems evolve. You need ongoing monitoring, validation and feedback loops to keep that foundation current.
So I don’t really see data strategy and AI strategy as separate things. The more autonomy you want to give AI, the more confidence you need in the data, relationships and context underneath it.
- A lot of banks are stuck between pressure to adopt AI and fear of regulatory exposure. What would you tell a product leader trying to get their first agentic AI project approved?
I would start with a narrow, measurable business problem rather than trying to get “an agentic AI project” approved.
Look for a workflow where people spend significant time searching, comparing, validating or organizing information before making a decision. Those are often strong starting points because AI can create meaningful efficiency without immediately being given authority over a high-risk decision.
The next step is to define the boundaries of autonomy upfront. What can the agent do independently? What requires human review? Which internal and external sources can it access? What evidence needs to be retained? What happens when confidence is low or information conflicts?
And bring Risk, Compliance and Legal into those decisions early. When I was working on identifying relationships between legal entities and determining their ultimate parent, for example, their input helped us classify trusted versus supporting sources and establish confidence and escalation thresholds. If two trusted sources disagreed on ownership or control, the case required human review. If an authoritative, current source conflicted with an older or less reliable source, the workflow could give greater weight to the trusted evidence rather than escalating every disagreement.
That kind of control shouldn’t be added after the technology is built. It should influence how the workflow is designed from the beginning.
For a first deployment, I wouldn’t try to prove that AI can transform the entire bank. Solve a real problem, demonstrate measurable value, constrain the autonomy and show that the system can operate within a control framework people trust. Once you’ve established that foundation, expanding into more complex use cases becomes a much easier conversation.
- Where do you expect agentic AI in financial services to be in three years, and what will separate the deployments that survive audit scrutiny from the ones that get rolled back?
I think we’ll move from AI primarily assisting people with individual tasks to agents managing much larger portions of end-to-end workflows.
In areas like Financial Crimes, risk operations and regulatory processes, agents could continuously gather evidence, reconcile information across sources, monitor for meaningful changes and initiate workflows when something changes. For example, rather than discovering during a periodic KYC or KYB review that a business changed its legal structure or ownership months ago, agents could potentially identify those changes earlier and trigger the appropriate review. That moves us closer to event-driven risk management rather than relying primarily on periodic controls.
But I don’t think the successful deployments will necessarily be the ones with the greatest autonomy. I expect graduated autonomy to become much more important. An agent might independently perform lower-risk activities such as collecting evidence, reconciling information or identifying discrepancies, while consequential actions—changing critical customer information, resolving ambiguous ownership or making certain risk decisions—continue to require human review.
The deployments that survive audit scrutiny will also need strong traceability. An organization should be able to answer: What did the agent do? What information and sources did it use? Why did it take that action? What controls governed it? When did it escalate to a human? And can we reconstruct that decision months later?
So three years from now, I don’t think the differentiator will simply be who deployed the most agents. It will be who successfully combines greater automation with strong data foundations, explainability, traceability and clearly defined boundaries for human judgment.
