Gustavo Lino, Head of Policy, Legal and Compliance at Cumbuca
Financial regulatory environments are necessarily complex, as they ultimately have to provide a fair and equitable ecosystem for consumers, businesses and providers.
They also need to keep pace with changes in the wider world: in recent years, we’ve seen Europe’s MiFID II, GDPR, and the Digital Operational Resilience Act (DORA) come into force, while in the US the Dodd-Frank Wall Street Reform and Consumer Protection Act strengthened consumer protections through a reorganisation of financial regulation in the wake of the 2008 financial crisis. In Brazil, new laws around innovation such as crypto and payments have each added new layers of documentation and reporting.
How regulatory complexity hits innovation and creates a compliance gap
Navigating these rules is expensive and slow, with these two factors making it largely inaccessible to anyone without a dedicated legal team.
This inaccessibility has two direct implications for financial services environments. First, if the route to compliance involves having the resources to navigate regulatory complexity, then necessarily a high number of potential new entrants are precluded. That can, in turn, negatively impact innovation and competition. It’s how we develop products that better serve customers, identify ways to make our own businesses run more effectively, enable the industry as a whole to move forward and deal with disruption.
Second, the challenges of navigating regulations creates a compliance gap. Those with the resources able to develop and launch products and services, and while those without are left to wade through complex regulatory documentation, restricted in what they can develop that meets compliance.
Why AI workarounds are not solutions
What happens when a barrier seems insurmountable? People come up with a workaround which today means asking AI. According to OpenAI, more than 200 million users ask ChatGPT financial questions every month, while 65% of people use AI chatbots for legal advice. It’s unlikely that either of those will be wholly focused on personal matters.
There are a number of drawbacks to this workaround. Many of the widely available models most people access are trained on publicly available data, and while AI understanding of context is improving, the result will be generic, without the appropriate tailoring to the prompter’s specific needs. This is a particular challenge when we consider that many of the businesses needing to navigate complex regulations are often developing innovative services and approaches, so will need specialist guidance and support.
There is also the issue of model output accuracy. Hallucinations are not just frustrating, or fodder for social posts on the failings of AI; nearly one third of respondents to a McKinsey survey reported negative consequences stemming from AI inaccuracy, while 54% of organisations are working to mitigate the risk.
So that creates a situation where companies without the resources to cut through regulatory complexity turn to widely available AI tools that lack domain specificity, with uneven outputs and no guarantees that they will help close the compliance gap.
Now, one argument might be that while that is a market problem, from a regulator perspective it’s less of an issue. Yet that fails to account for the fact that with an AI workaround, companies aren’t necessarily going to know they’re wrong or taking an incorrect approach until they’ve made contact with the regulator. So rather than be put off by the compliance gap, they’ll think they’ve bridged it. That then puts more demands on regulators to work through new tools and services which aren’t compliant, putting a strain on resources.
AI can still deliver a solution
Either way, generic AI tools don’t solve the problem, but this doesn’t mean they should be dismissed outright. Rather than general-purpose models trained on broad datasets, what if there was a tool that used official, regulator-approved documentation? One that is updated in line with the regulations themselves?
A model trained on such a dataset would operate at a completely different level to general-purpose AI. With a focus on financial services, it would understand context, be able to connect queries with the exact regulations, and, with the appropriate guardrails in place, provide the specific rules for a given product or service, with each answer appropriately referenced to its official source.
When even a single facet of financial services regulation can cover more than a thousand documents, the model would focus on specific areas to maintain a significantly higher quality of output, such as Open Finance or instant payments.
The result would be a trusted source of domain specific intelligence, which smaller innovators and disruptors could access without investing in a huge compliance function straight away. At the same time, regulators would avoid being overwhelmed by incorrect submissions or policing non-compliant services and products.
Such an approach is already happening. In Brazil, we have Regulus, a Whats App-based service which pulls data from the Central Bank’s Financial System Organization Manual (also known as Sisorf), Pix and Open Finance Brasil. Users can access regulatory questions, and Regulus answers with references to the original source material.
A regulatory ecosystem that has already embraced Open Finance would be best suited to the sharing of data such an approach would require. In fact, it is likely that such a jurisdiction has a great demand for this sort of model; we have seen in Brazil that even when Open Finance is a major part of financial services, adoption in certain segments can be uneven. Only three per cent of Brazilian companies are connected to the ecosystem, compared with 20% embracing it in the UK.
Away from generic AI tooling towards domain specific intelligence
We all benefit when innovative financial services products are available to as many customers, whether business or consumer, as possible. Those disruptive, new approaches can come from anywhere, but the necessarily complex regulations which provide the guardrails to protect customers can be a barrier to entry for companies without the appropriate resources. AI could be a solution, but not when it is a publicly available model lacking domain expertise. Drawing on a single jurisdiction’s official regulatory information, with live document indexing and mandatory source citation, could provide a solution that supports healthy competition and protects companies from being led astray. As financial regulators evolve in line with technological innovation, removing compliance gatekeeping could deliver significant gains for all.
