Continuous compliance monitoring means checking every transaction, customer, conversation, control and model as it runs instead of testing a sample each quarter, and bank compliance officers want more of it than they have. In KPMG's August 2026 survey of 725 chief compliance officers, data analytics and predictive modelling for compliance monitoring was the second-biggest challenge for the next two years, named by 31%. BCG's June 2025 benchmark found that all G-SIBs and 75% of large and regional banks had AI pilots in compliance but only 25% had scaled them, and only 50% maintained ongoing monitoring of their AI models. Deloitte's 2025 survey of 87 EMEA banks found only 44% had brought AML, fraud and KYC models into model risk management. Supervisors are moving to continuous monitoring in their own words: Australia's APRA said in April 2026 that sample-based assurance is ill suited to models that learn and degrade, the European supervisors called for a move from periodic to continuous monitoring in July 2026, and US model risk guidance (SR 26-2, April 2026) keeps ongoing monitoring as a core element but excludes generative and agentic AI.
PROFILES AND DOCUMENTS ON THIS SITE: Citi · Customers Bank · BNY · Citizens · Bread Financial · Scotiabank · ComplyAdvantage · Hawk · Unit21 · NICE Actimize · nCino · ValidMind · Monitaur · Credo AI · SR 26-2 · SR 23-4 · 2026 FINRA Annual Regulatory Oversight Report · APRA AI Letter to Industry (April 2026) · ESA Statement on ICT risks from frontier AI models (JC 2026 25) · HKMA "ART" Framework / AI supervisory guidance · IOSCO FR06/2021 · Division of Examinations FY2027 Priorities
What is continuous compliance monitoring at a bank?
Continuous compliance monitoring means checking every transaction, customer, conversation and control as it happens, or on a short fixed cycle, instead of testing a sample once a quarter or once a year. In a bank it runs on three layers. The first is the oldest: transaction monitoring and customer screening for anti-money-laundering and sanctions, where rule-based detection is universal (BCG found in 2025 that 100% of banks use it) and machine learning and generative AI are being layered on top to cut false positives. The second is conduct surveillance: trade, voice and communications surveillance in markets businesses, and the review of customer calls and complaints in retail. The third is the newest and the one supervisors write most about in 2026: monitoring the controls and the models themselves, including AI, so that a model that drifts or a control that stops working is noticed in days rather than at the next audit.
The difference from traditional compliance testing is coverage and timing. A sample-based test reviews, say, 5% of calls or a few dozen files and extrapolates; a continuous monitor reviews all of them and raises an exception when something crosses a threshold. Citizens Financial Group describes the gap in its own call centres: generative AI was being piloted in 2026 to review 100% of call transcripts for tone and accuracy, against 5% reviewed by people. Customers Bancorp's 2026 shareholder letter sets the same goal for all three lines of defence, moving risk, compliance and audit from sample-based to continuous monitoring with AI tools. Neither has published results yet; both are on the bank records below.
What it is not: a system that settles compliance questions without a person accountable for the result. The monitor raises the exception; the supervisory texts on this page keep the accountability with named people. Hong Kong's October 2026 guidance describes the shift as one from "human-in-the-loop" to "human-on-the-loop" oversight, with continuous monitoring as the condition, not as a replacement for accountability (HKMA ART framework). For the wider governance picture, see AI governance in banking; for the model side, model risk management.
What do bank compliance officers say about continuous monitoring?
No published survey asks compliance officers the literal question "do you favour continuous monitoring?". Five surveys published between June 2025 and August 2026 ask the questions around it, and they agree on three things: compliance leaders want more automated, data-driven monitoring, most banks have not scaled it beyond pilots, and the monitoring of AI itself lags the use of AI. The table quotes each as published.
| Survey | Who was asked | What they said | Published |
|---|---|---|---|
| BCG compliance benchmark | Bank compliance functions on five continents (sample size not published) | All G-SIBs and 75% of large and regional banks have started AI and GenAI pilots in compliance, but only 25% have scaled them into production; only 50% maintain ongoing AI and GenAI model monitoring. | Jun 5, 2025 |
| KPMG Global Chief Ethics and Compliance Officer Survey | 725 chief compliance officers in 8 countries and 6 sectors | 68% feel 'mixed, leaning positive' about AI; AI is used most for compliance risk assessment (50%) and data visualisation and predictive analytics (44%); the second-biggest challenge for the next two years is data analytics and predictive modelling for compliance monitoring, named by 31%. | Aug 5, 2026 |
| PwC Global Compliance Survey, financial-services lens | Compliance leaders at financial-services firms | FS firms are more likely than other industries to be using, and investing more in, technology for compliance and transaction monitoring (84%); 90% say their compliance landscape has become more complex over three years. | Jun 10, 2025 |
| Deloitte EMEA model risk management survey (financial crime) | 87 banks in Europe, the Middle East and South Africa, July–September 2025 | 56% of banks use transaction-monitoring models, up from 42% in 2023, but only 44% have brought AML, fraud and KYC models into their model risk framework; 57% cite difficulty measuring performance or effectiveness. | May 8, 2026 |
| Wolters Kluwer US Banking AI Risk and Governance Index, H1 2026 (reported by American Banker) | 230 US banking professionals at community, midsize and large institutions | Asked where their bank was least prepared on AI risk, 72% chose model kill-switch protocols (34%) or regulatory reporting of AI failures (38%). | Jun 10, 2026 |
The most direct number is KPMG's. In its August 2026 survey of 725 chief compliance officers, the second-biggest compliance challenge for the next two years, after new regulatory requirements (33%), was "data analytics and predictive modeling for compliance monitoring and risk management", named by 31% of respondents and by 36% outside the US. The same CCOs already use AI most for compliance risk assessment and management (50%) and for data visualisation and predictive analytics (44%), and 68% describe their view of AI as "mixed, leaning positive". The KPMG sample spans six sectors, so it is a view of compliance officers in general, not bankers alone.
The bank-specific numbers come from BCG and Deloitte. BCG's June 2025 benchmark of bank compliance functions found that every global systemically important bank and 75% of large and regional banks had started AI and GenAI pilots in compliance, but only 25% had scaled them into production, and that only 50% maintained ongoing monitoring of their AI and GenAI models, which BCG called "a critical gap". Where banks had scaled, the gains were in exactly the monitoring work: early adopters had sped up Level 1 transaction-monitoring alert handling by a factor of three and doubled the speed of Level 2. Deloitte's survey of 87 EMEA banks (July to September 2025) found transaction-monitoring models at 56% of banks, up from 42% in 2023, but only 44% had brought their AML, fraud and KYC models into the scope of model risk management, and 57% said measuring the performance or effectiveness of those models was a frequent difficulty.
Readiness for something going wrong is the weakest point. Wolters Kluwer's index for the first half of 2026, which surveyed 230 US banking professionals and was reported by American Banker on June 10, 2026, found that 72% chose either model kill-switch protocols (34%) or regulatory reporting of AI failures (38%) as the area where their bank was least prepared. Sultan Meghji, a former chief innovation officer at the FDIC, told American Banker that the risk is "a drifting model making thousands of slightly-wrong, discriminatory or non-compliant decisions per day for months, invisible because nobody instrumented it", and that this is "not a kill-switch failure, but a monitoring failure".
One chief compliance officer's results are on the public record. American Banker reported on October 2, 2025 that Jennifer Taylor, chief compliance officer of Citibank, led the rollout of compliance surveillance and monitoring technology including a semantic model for collusion that reduced false positive alerts by 11% and increased escalations by 52%, and that by September 2024 Citi had a 0% year-to-date rate of aged surveillance alerts. PwC's 2025 financial-services lens adds the investment side: FS firms are more likely than other industries to be using, and investing more in, technology for compliance and transaction monitoring (84%), while only one in four respondents consider AI skills important in effective compliance today.
What do regulators expect from continuous compliance monitoring?
No US rule requires a bank to monitor compliance continuously. The expectation arrives through three doors: model risk guidance, which makes ongoing monitoring one of its core elements; third-party guidance, which makes it a stage of every vendor relationship; and, since 2025, AI-specific statements from supervisors that say plainly that periodic, sample-based assurance does not fit models that change after deployment. The clearest is Australia's: APRA's April 30, 2026 letter to all regulated entities says point-in-time and sample-based methods are ill suited to probabilistic models that learn, adapt and degrade, and expects continuous monitoring proportionate to criticality.
| Document | Issued by | What it expects | Date |
|---|---|---|---|
| SR 26-2 / OCC 2026-13 | Federal Reserve, OCC, FDIC | Model risk management covers development and use, validation and ongoing monitoring, governance and controls, with materiality driving the intensity of validation and monitoring; generative and agentic AI are outside its scope. | Apr 17, 2026 |
| SR 23-4 / OCC 2023-17 | Federal Reserve, OCC, FDIC | Ongoing monitoring is one of five stages in the third-party lifecycle, so a vendor's monitoring tool, and the vendor itself, is monitored in turn. | Jun 7, 2023 |
| FINRA 2026 oversight report | FINRA | For generative AI, ongoing monitoring of prompts, responses and outputs, which may include storing prompt and output logs, tracking which model version was used and when, and human-in-the-loop review. | Dec 9, 2025 |
| APRA letter on AI | APRA (Australia) | Point-in-time and sample-based assurance is ill suited to models that learn, adapt and degrade; APRA expects continuous monitoring proportionate to criticality. | Apr 30, 2026 |
| ESAs JC 2026 25 | EBA, EIOPA, ESMA | For ICT risk from frontier AI, financial entities should move from periodic to continuous monitoring. | Jul 31, 2026 |
| HKMA ART framework | HKMA | Recognises a shift from 'human-in-the-loop' to 'human-on-the-loop' oversight, still with clear accountability and continuous monitoring. | Oct 15, 2026 |
| IOSCO FR06/2021 | IOSCO | Measure 2: regulators should require firms to test and monitor algorithms continuously, in an environment segregated from live deployment. | Sep 7, 2021 |
| SEC FY2027 exam priorities | SEC Division of Examinations | Will examine policies and procedures for monitoring AI ('super intelligence'), including its use in fraud prevention, AML and Reg BI compliance, and notes registrants use it for compliance monitoring. | Oct 23, 2026 |
In the United States the model risk guidance is the anchor. SR 26-2, issued by the Federal Reserve, OCC and FDIC on April 17, 2026, keeps ongoing monitoring as a core element and scales it to a model's materiality, but excludes generative and agentic AI, so a bank's monitoring of those systems sits in its wider risk management, not in the model risk policy. The Fed's Vice Chair for Supervision, Michelle Bowman, said on May 1, 2026 that "for nearly a decade, our supervisors have been engaging with banks to monitor their use of AI", and that the agencies had amended the model risk guidance to clarify that it does not apply to generative or agentic AI. FINRA, for broker-dealers including banks' securities arms, is the most specific on generative AI: its 2026 oversight report lists ongoing monitoring of prompts, responses and outputs, with logs and model-version tracking, among what firms may consider.
The UK's Financial Conduct Authority published its good-practice review of AI in financial services on October 20, 2026. Among the good practice it observed: firms that "monitor live outcomes so they can spot and deal with issues quickly", and that set thresholds, which it defines as "pre-agreed limits or trigger points that help firms decide when an AI issue needs more monitoring, escalation, intervention or stopping". Supervisors are also moving the same way in their own work: a BIS Financial Stability Institute brief of June 2025, based on a survey of the Informal Suptech Network, found many authorities experimenting with, developing or using generative AI for supervision. Every document in the table is tracked, with its status and deadlines, in the regulation tracker; the compliance officers' view groups them by obligation.
How do vendors sell continuous compliance monitoring to banks?
Vendors split by what they watch. Customer and transaction monitors re-screen every customer and score every payment in real time or in batch; conduct-surveillance suites watch trades, communications and sales practices; and a newer group of AI-governance platforms watches the models and agents themselves, testing them before release, logging their behaviour and applying runtime controls. The table lists the products in this site's AI tools directory that are sold as continuous or ongoing monitoring, with the status each vendor gives them. Prices are on the vendor pages where published; most are not.
| What it watches | Vendor | Product | What the product does | Status |
|---|---|---|---|---|
| Customers | ComplyAdvantage | Ongoing Monitoring | Continuous re-screening of existing customers and companies that alerts when their risk status changes. | Generally available |
| Transactions | Hawk | Transaction Monitoring and Customer Risk Rating | AML transaction monitoring combining rules with explainable machine learning, and customer risk scoring, in real time or batch. | Generally available |
| Transactions | Unit21 | AML Transaction Monitoring | Configurable rules plus built-in detection models, AI rule recommendations (October 2025), and backtesting and shadow mode to test rule changes before deployment. | Generally available |
| Conduct | NICE Actimize | Financial Markets Compliance | Trade surveillance, communication surveillance and archiving, and sales-practice monitoring for broker-dealers and banks' markets businesses. | Generally available |
| Credit portfolio | nCino | Continuous Credit Monitoring | Portfolio early-warning and credit-risk monitoring powered by nIQ and Rich Data Co's explainable-AI platform, alongside automated spreading and commercial pricing tools in nCino's commercial banking suite. | Generally available |
| Models | ValidMind | ValidMind Validation Automation | Automated testing and validation documentation for independent review, with human-in-the-loop AI assistance; works alongside an existing inventory. | Generally available |
| Models | Monitaur | Automate FlightSim | Black-box pre-deployment testing of AI systems with synthetic scenarios, producing letter-grade scorecards across reliability, performance, bias and security; standalone since September 2026. | Generally available |
| AI agents | Credo AI | Credo AI Agent Governor | Runtime controls applied at the agent harness that turn an organisation's policies and risk appetite into rules that guide and block agent actions; launched as a research preview in July 2026. | Beta |
Three questions separate them for a compliance buyer. Does the product monitor every item, or sample? Can a rule or model change be tested in shadow mode before it decides anything (Unit21 lists backtesting and shadow mode for rule changes; ValidMind automates model testing and validation documentation; Monitaur sells black-box pre-deployment testing of AI systems)? And whose risk is the monitor itself: under the interagency third-party guidance the bank remains responsible, so the vendor's monitoring tool is a third-party relationship with its own due diligence and ongoing monitoring (SR 23-4). The category pages compare the vendors in more depth: AML compliance software and model risk and AI governance software.
Which banks describe continuous compliance monitoring with AI?
Few banks use the phrase, but several describe the practice: every call reviewed instead of a sample, every restricted-party payment screened with AI, every communication channel under surveillance. The table is computed from the bank profiles on this site; each claim is sourced on the bank's page and the status is the one recorded there. Customers Bancorp is the only bank on the record that states continuous monitoring across all three lines of defence as a goal, and it is announced, not live.
| Bank | What it monitors | What the record shows | Status | Latest source |
|---|---|---|---|---|
| Customers Bank | AI across the three lines of defence | The 2026 shareholder letter aims to move risk, compliance and audit from sample-based to continuous monitoring with AI tools; the Q1 deck sets 'Reduce Risk' beside revenue and productivity. | Announced | Apr 23, 2026 |
| BNY | AI review of restricted-party screening and communications surveillance | Roughly 70% of restricted-party payment screening reviewed by AI; Behavox Quantum AI covers BNY's communication channels across 16-plus languages for compliance and conduct. | In production | Jul 28, 2026 |
| Scotiabank | Customer-record validation and AML detection on Scotia Intelligence | The Q3 2026 investor deck lists validation of customer records, improved AML risk detection and scaled compliance monitoring under enhanced risk management; the CIO named the same three in June 2026. | In production | Aug 25, 2026 |
| Citizens | Complaint classification and automated call QC | Agentic AI classifies complaints and drafts responses; gen AI piloted to review 100% of call transcripts for tone and accuracy against 5% reviewed by people today. | Pilot | Jul 16, 2026 |
| Bread Financial | AI review of all customer calls | Andretta said AI lets Bread review all customer calls for complaint trends, which it can show regulators, and feed those trends into rep training. | In production | Sep 9, 2025 |
| NatWest | Agentic complaints investigation under FCA AI Live Testing | An agentic model investigates complaints across multiple data sources and presents a summary to a human complaint handler for approval; the bank plans to move from production-like testing to a live environment. | Pilot | May 5, 2026 |
| Deutsche Bank | Voice and trade surveillance | Google Speech-to-Text voice surveillance with over 90% transcription accuracy, about 10x wider lexicon and 65% lower cost; an LLM for order and trade anomalies is in development with Google Cloud. | In production | Oct 5, 2026 |
| Standard Chartered | GenAI mapping of regulatory obligations (SC Ventures with A*STAR IHPC) | A research engagement that used LLMs and retrieval-augmented generation to map regulatory obligations to regulated entities and analyse regulatory change; SC Ventures reports better response quality and accuracy and reduced bias. | Pilot | Apr 23, 2025 |
Outside the profiles, the Citi example in the previous section is the most specific public result from a chief compliance officer: an 11% cut in false positive surveillance alerts and a 52% rise in escalations from a semantic collusion model, reported in October 2025. The leaders ranking who leads in compliance AI ranks banks on the same records, and the AI in AML compliance hub covers the transaction-monitoring layer in depth.
What still limits continuous compliance monitoring at banks?
The surveys name four limits. Scale: BCG found three in four banks with AI pilots in compliance had not scaled them. Model coverage: Deloitte found that fewer than half of EMEA banks had brought their AML, fraud and KYC models into model risk management, and a majority struggle to measure whether those models work. Incident readiness: in the Wolters Kluwer index, 72% of US banking respondents picked kill switches or regulatory reporting of AI failures as their weakest area. Skills: only one in four respondents to PwC's survey consider AI skills important in compliance today.
A fifth limit is regulatory rather than technical: in the United States, the model risk guidance excludes generative and agentic AI, so the monitoring of the tools many banks now pilot for compliance review has no dedicated federal text. The agencies have said they plan a request for information on AI and model risk management (OCC Spring 2026 risk perspective). Until then, banks are applying the general expectations: monitoring in proportion to risk, documented thresholds, a person accountable for each alert, and evidence that the monitor itself works. The compliance checklist maps those expectations to documents.
What is continuous compliance monitoring?
It is the practice of checking every transaction, customer, communication, control and model as it runs, or on a short fixed cycle, and raising an exception when something crosses a threshold, instead of testing a sample periodically. At banks it covers AML transaction monitoring and screening, conduct surveillance, and the monitoring of controls and models, including AI.
Do bank compliance officers support continuous monitoring?
The surveys point that way without asking it directly. In KPMG's August 2026 survey of 725 chief compliance officers, 31% named data analytics and predictive modelling for compliance monitoring as a top challenge for the next two years, and 68% described their view of AI as mixed, leaning positive. BCG found in 2025 that most banks had AI compliance pilots but only 25% had scaled them.
Is continuous compliance monitoring required by US regulators?
No rule requires it by name. US model risk guidance (SR 26-2, April 2026) makes ongoing monitoring a core element scaled to materiality, and the 2023 interagency third-party guidance makes ongoing monitoring a stage of every vendor relationship. Generative and agentic AI are outside SR 26-2, so their monitoring falls to the bank's broader risk management.
Which regulators have asked for continuous rather than periodic monitoring?
Australia's APRA said on April 30, 2026 that point-in-time and sample-based assurance is ill suited to models that learn, adapt and degrade. The EBA, EIOPA and ESMA told financial entities on July 31, 2026 to move from periodic to continuous monitoring for frontier-AI ICT risk, and IOSCO's 2021 guidance says regulators should require continuous testing and monitoring of algorithms.
Which banks use AI for continuous compliance monitoring?
On the bank records on this site: BNY reviews roughly 70% of restricted-party payment screening with AI and runs communications surveillance across 16-plus languages; Bread Financial reviews all customer calls for complaint trends; Citizens is piloting AI review of 100% of call transcripts; Deutsche Bank runs AI voice and trade surveillance; Customers Bancorp has announced continuous monitoring across its three lines of defence.
What is the biggest gap in AI compliance monitoring at banks?
Monitoring the AI itself. BCG found only 50% of banks maintain ongoing monitoring of their AI and GenAI models, Deloitte found only 44% of EMEA banks have brought AML, fraud and KYC models into model risk management, and in Wolters Kluwer's H1 2026 index 72% of US banking respondents named kill switches or regulatory reporting of AI failures as their weakest area.
Which vendors sell continuous compliance monitoring to banks?
In this site's AI tools directory: ComplyAdvantage (ongoing re-screening of customers), Hawk and Unit21 (AML transaction monitoring), NICE Actimize (trade and communications surveillance), nCino (continuous credit monitoring), and ValidMind, Monitaur and Credo AI for testing, monitoring and runtime control of models and AI agents. Most do not publish prices.
- Risky Times and Cost Pressure Call for Innovation in Bank Compliance — Boston Consulting Group, Jun 5, 2025 (bcg.com)
- Feeling the pressure: 2026 KPMG Global Chief Ethics and Compliance Officer Survey — KPMG, Aug 5, 2026 (kpmg.com)
- PwC Global Compliance Survey 2025 – Industry Lens: Financial Services — PwC, Jun 10, 2025 (pwc.com)
- The State of Financial Crime Model Risk Management — Deloitte, May 8, 2026 (deloitte.com)
- 72% of banks lack AI model 'kill switches,' failure reporting — American Banker, Jun 10, 2026 (americanbanker.com)
- Citi and US Bank leaders drive tech-powered risk reform — American Banker, Oct 2, 2025 (americanbanker.com)
- AI in financial services: good practice and areas for improvement — Financial Conduct Authority, Oct 20, 2026 (fca.org.uk)
- Speech by Vice Chair for Supervision Bowman on artificial intelligence in the financial system — Federal Reserve Board, May 1, 2026 (federalreserve.gov)
- FSI Briefs No 26: Starting with the basics: a stocktake of gen AI applications in supervision — Bank for International Settlements, Financial Stability Institute, Jun 11, 2025 (bis.org)
- SR 26-2: Revised Guidance on Model Risk Management — Federal Reserve Board, Apr 17, 2026 (federalreserve.gov) · our page on SR 26-2
- SR 23-4: Interagency Guidance on Third-Party Relationships: Risk Management — Federal Reserve Board, Jun 7, 2023 (federalreserve.gov) · our page on SR 23-4
- 2026 FINRA Annual Regulatory Oversight Report: GenAI — FINRA, Dec 9, 2025 (finra.org) · our page on 2026 FINRA Annual Regulatory Oversight Report
- APRA letter to industry on artificial intelligence — Australian Prudential Regulation Authority, Apr 30, 2026 (apra.gov.au) · our page on APRA AI Letter to Industry (April 2026)
- EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI — European Banking Authority, Jul 31, 2026 (eba.europa.eu) · our page on ESA Statement on ICT risks from frontier AI models (JC 2026 25)
- HKMA ART Framework and updated guidance on responsible AI adoption — Hong Kong Monetary Authority, Oct 15, 2026 (hkma.gov.hk) · our page on HKMA "ART" Framework / AI supervisory guidance
- IOSCO Final Report FR06/2021: The use of artificial intelligence and machine learning by market intermediaries and asset managers — IOSCO, Sep 7, 2021 (iosco.org) · our page on IOSCO FR06/2021
- Fiscal Year 2027 Examination Priorities — SEC Division of Examinations, Oct 23, 2026 (sec.gov) · our page on Division of Examinations FY2027 Priorities
When a supervisor or a bank moves on AI governance, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning