The Compliance Trap: Why RegTech Is Quietly Becoming Banking’s Highest-ROI AI Bet

The institutions still treating compliance as overhead are about to discover what competitive disadvantage feels like.

Picture a compliance analyst at a large European bank on a Tuesday morning. She has 847 unreviewed AML alerts in her queue. She’ll close her day having worked through perhaps 60 of them — methodically, carefully, professionally. Of those 60, maybe two will escalate to genuine investigation. The other 58 were noise. Sophisticated, expensive, well-documented noise. And tomorrow morning, the queue resets somewhere above 800 again.

This is not a failure of effort. It is not even a failure of process, exactly. It is a structural mismatch between the volume and complexity of modern regulatory obligations and the fundamentally human-scaled systems built to manage them. Banks have poured capital into compliance technology for two decades, and yet the operating model underneath that technology has barely moved. More screens, faster data feeds, better dashboards — but still an analyst, still a queue, still a Tuesday morning that looks identical to the one before it.

What’s changing now is not that AI has arrived. AI has been arriving in banking for years, mostly as a pilot program, mostly in innovation labs, mostly announced at conferences and quietly shelved. What’s different today is that a specific category of AI application — RegTech — has crossed from interesting to operational. And the institutions that have recognized this shift are not talking about it loudly. They are compounding the advantage in silence.

The System Is Optimized to Look Compliant. Not to Be Compliant.

Most banking executives frame compliance as a cost management challenge. How do we do this more efficiently? How do we reduce headcount without increasing risk? How do we meet regulatory expectations without expanding the compliance budget faster than revenue? That framing is understandable. It is also precisely wrong.

The actual problem is not that compliance costs too much. The problem is that compliance produces almost no strategic signal. Billions of dollars flow into AML systems, regulatory change management, reporting infrastructure, and policy governance — and the output is largely defensive. You spend to avoid the fine. You spend to pass the examination. You spend to demonstrate, on a given day, that your controls exist. The system is optimized for the appearance of compliance rather than the substance of it, and regulators — who are increasingly sophisticated — have begun to notice the difference. The conversation in supervisory examinations has shifted from “show me your controls” to “demonstrate that your controls are effective.” That is a fundamentally harder question to answer with a spreadsheet.

What that shift reveals is a compliance operating model built for a different regulatory era. One where the volume of regulatory updates was manageable by a team of lawyers. One where AML monitoring was a matter of rule-based thresholds. One where cross-border operations could maintain parallel, largely independent compliance functions without those redundancies creating fatal inconsistency. That era ended some years ago. Most banks are still running its infrastructure.

The Banks Winning This Quietly Are Running a Different Model

RegTech powered by modern AI is not an incremental improvement to the existing compliance model. It is the architecture for a different model entirely — one where compliance generates operational intelligence rather than just operational overhead.

Consider what Large Language Models can now do with regulatory documents. A material regulatory update — a new EBA guideline, a revised FATF recommendation, a domestic supervisory expectation that affects eight business lines — previously required a team of compliance professionals to read, interpret, assess for applicability, map to existing policy, and generate implementation recommendations. That cycle measured in weeks. An AI system with genuine regulatory-grade capability compresses it to hours, with greater consistency and a documented audit trail. The speed alone changes the economics. But the real shift is what institutions can do with that speed — enter markets faster, adapt controls more precisely, demonstrate regulatory responsiveness that becomes a relationship asset with supervisors.

The ROI case has also matured past the theoretical stage. Early AI adoption in compliance was justified largely on experimentation grounds — innovation budget, proof of concept, “we need to understand the technology.” The implementations that are producing measurable returns today are not experiments. They are production systems being evaluated on false positive reduction, investigation efficiency, time from regulatory update to implementation, and cost per suspicious activity report. These are the metrics boards should be asking compliance leaders to report. Most aren’t asking yet. The institutions whose boards are asking are building a compounding advantage.

There is also a trust dimension that tends to get undercounted in ROI.

Most ROI discussions focus on cost reduction, productivity gains, or operational efficiency. Those metrics matter. But the institutions creating the greatest value from RegTech are generating something far more difficult to measure and far more valuable over time: trust.

Trust with regulators. Trust with auditors. Trust with investors. Trust with counterparties.

When compliance becomes demonstrably effective rather than merely documented, the relationship between an institution and its stakeholders changes. Regulatory examinations become less about defending decisions and more about explaining them. Supervisory conversations become more constructive. Internal governance becomes more transparent. Confidence compounds.

This is why I increasingly believe the most important outcome of AI-powered RegTech is not lower compliance cost. It is higher institutional credibility.

And credibility has always been one of banking’s most valuable assets.

The institutions that understand this are not treating RegTech as another technology initiative. They are treating it as infrastructure for a more adaptive, intelligent, and trusted operating model.

The strategic question for banking leaders is no longer whether AI can improve compliance.

The evidence increasingly suggests that it can.

The real question is whether compliance will remain a cost centre in your institution — or evolve into a capability that creates competitive advantage.

Because the banks that make that transition first may discover something their competitors miss:

The greatest return on compliance investment was never the cost they saved. It was the trust they earned.

And here is what keeps the most forward-thinking compliance leaders up at night — not the risk of falling behind regulators. That risk is visible, manageable, priced in. What keeps them up is a quieter fear: that a competitor has already turned their compliance function into a machine that learns, adapts, and signals trustworthiness faster than any human team can manufacture it. That by the time the gap becomes visible in examination outcomes or supervisory relationships or counterparty confidence, it will already be structural.

Compliance has always been a lagging indicator of institutional health.

The institutions building it with AI are making it a leading one.

This piece is part of The Should Theory — a publication exploring what organisations should do, not just what they currently do. Follow the conversation on LinkedIn. Social Media Handle: @TheShouldTheory