Elliptic has pointed out that recent discussions at the Point Zero Forum in Zurich have brought renewed attention to the practical difficulties of integrating artificial intelligence into financial compliance programs. In a detailed reflection released shortly after the session, Mark Aruliah—former regulator at the UK’s Financial Conduct Authority and current Head of EMEA Policy & Regulatory Affairs at Elliptic—outlined the core tensions that remain unresolved despite rapid technological progress.
The international regulatory environment for AI remains deeply fragmented.
Jurisdictions hold fundamentally different views on how such systems should be overseen, and meaningful global alignment appears unlikely in the short term.
International standard-setting bodies operate through consensus and advance cautiously, meaning any future guidance may arrive too late or lack the specificity organizations need.
Aruliah cautions firms against postponing AI adoption while waiting for harmonization, arguing that local rules will continue to shape day-to-day requirements and that early movers can still capture meaningful efficiency gains.
Accountability presents one of the most immediate frictions. Legal responsibility for compliance outcomes continues to rest with the regulated entity and its senior officers.
Yet many chief compliance officers and money laundering reporting officers lack detailed visibility into how AI models reach decisions or how those models evolve over time.
This creates a gap between formal accountability and practical control.
The challenge manifests differently across institutions: traditional banks often possess mature risk frameworks but move more deliberately due to layered internal governance, while more agile entities such as hedge funds, accustomed to frequent updates in trading algorithms, tend to adapt faster to shifting AI capabilities.
Regulators increasingly favor principles-based expectations over rigid prescriptions.
Firms are asked to explain their AI usage, document governance arrangements, and demonstrate that outcomes remain consistent with established risk tolerances.
Elliptic further noted that authorities are unlikely to grant formal approval to opaque systems, as this could expose them to criticism if failures occur or create perceptions of regulatory capture.
As a result, the burden of proof falls squarely on organizations to justify their chosen approaches—an expectation for which many institutions are still preparing.
Workforce considerations add another layer of complexity. AI currently delivers the greatest value by augmenting human analysts rather than replacing them outright.
Commercial pressures, however, frequently translate into aggressive efficiency targets, including substantial headcount reductions soon after deployment.
Aruliah advises against trimming compliance teams before systems have been rigorously tested and proven reliable.
Premature cuts risk removing precisely the human expertise required to detect model drift, errors, or unintended consequences at the moment they matter most.
Two fundamental questions continue to lack clear answers. First, what happens when individuals legally responsible for compliance lack meaningful oversight of the very systems they must vouch for?
Second, if a regulator conducted an examination of an organization’s AI governance framework tomorrow, what would the review actually reveal about documentation quality and real-world effectiveness in preventing harmful outcomes?
According to the insights from blockchain intelligence firm Elliptic, these issues are fundamentally questions of governance and risk management, not merely technical implementation.
Treating AI deployment as a distinct regulatory risk—rather than a standard technology project—is essential before granting greater autonomy to such systems. Blockchain analytics firm Elliptic concluded in a blog post that organizations that begin addressing these gaps now will be better positioned as the technology continues to advance.