Compliance work is mostly evidence gathering. That is the part a machine can carry, and the part firms most often do badly.
Key takeaways
Firms use AI in compliance to gather, organise and cross-check evidence: pulling the current version of a procedure, finding which files lack a completed step, drafting the narrative sections of a review, keeping a register current, and flagging where written procedure and observed practice have drifted apart. Every one of those is retrieval and comparison. None of them is a decision.
The decisions — whether a client is high risk, whether a report is filed, whether a control is effective — stay with the person accountable for them. That boundary is not cautious framing; it is what makes the rest of the automation usable, because a programme where a machine decided anything material is a programme you cannot defend in a review.
If your firm is a reporting entity, FINTRAC’s compliance programme requirements guidance is explicit about the elements: appoint a compliance officer responsible for implementing the programme; develop and apply written compliance policies and procedures that are kept up to date and, for an entity, approved by a senior officer; conduct and document a risk assessment; develop and maintain a written, ongoing compliance training programme for employees, agents or mandataries and other authorised persons; institute and document a plan for that training and deliver it; and institute and document a plan for a review testing the programme’s effectiveness, carried out at least every two years. The same guidance points to subsection 9.6(1) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and subsection 156(1) of its regulations.
Whether your firm is a reporting entity at all is a question to answer from that guidance and, if in doubt, from counsel — it turns on the activities you perform, not on your professional designation. Do not assume either way.
Evidence assembly. Most compliance failures found in a review are not failures of policy; they are failures of evidence. A retrieval tool pointed at your document store can produce, on demand, the current approved version of a procedure, its approval date and its approver — which is exactly the question a reviewer opens with.
Register upkeep. Tool registers, vendor registers, training records and complaint logs decay because updating them is nobody’s favourite hour. Extraction from the underlying systems keeps them current without a person retyping.
Gap-spotting. Give a model your written procedure and a sample of completed files and ask which documented steps are missing from which files. It will produce an exception list far faster than a person sampling by hand — and, importantly, it will look at every file rather than at a sample.
Drafting the narrative. Reviews, board papers and regulator responses contain a great deal of description that already exists elsewhere in the firm. Drafting that from your own documents is legitimate work for a model, with the compliance officer editing and owning the result.
A brokerage has done its last two reviews in a fortnight of evenings. The rebuild treats the review as four retrieval jobs and one judgment job.
Retrieval one: every policy and procedure in force during the period, with version and approval dates. Retrieval two: the training records — who was trained, on what, when, and who was missed. Retrieval three: the file sample, with the documented steps checked mechanically against each file. Retrieval four: the incident and complaint log for the period.
The judgment job is what remains: whether the programme was effective, what changes are needed, and what the firm will commit to. That takes a morning instead of a fortnight, and it takes it from the person whose judgment is being asked for rather than from an assistant assembling binders.
The unglamorous benefit is the one firms notice most: the mechanical file check finds the missing steps that sampling missed, months before a reviewer would have.
For insurance intermediaries, conduct standards are set provincially and harmonised through CISRO, a forum of Canadian regulatory authorities dedicated to consistent qualifications and conduct-of-business standards for intermediaries, which publishes a list of its members. In Ontario, FSRA regulates the life and health insurance sector, including accident and sickness. In British Columbia, the Insurance Council of BC publishes licensee requirements. Privacy obligations run in parallel: clause 4.1.4 of Schedule 1 to PIPEDA requires policies and practices including complaint procedures and staff training, and the OPC’s generative AI principles apply to your use of these tools. Firms without a named privacy owner should read the note on appointing a privacy officer.
Three things. A decision to file or not file a report. A client risk rating that drives enhanced measures. And the sign-off on the programme itself. A model may draft the rationale; a named person adopts it. Anti-money-laundering specifics for a small practice are covered separately in AI for AML compliance in a small firm, and identification work in AI for KYC at a professional firm.
Can AI monitor for suspicious activity?
It can surface patterns and rank files for attention. The determination and the reporting decision are the compliance officer’s, and the guidance is written on the assumption that a person holds that role.
Will a reviewer object to AI-drafted documents?
The objection is never to the drafting. It is to a document nobody senior adopted, or a control nobody can evidence. Keep the approval trail and the drafting method is unremarkable.
Where do we start?
The register nobody has updated in six months. It is low risk, immediately visible, and it tells you whether your document store is in a state where retrieval works at all.
A 30-minute call is enough to tell you whether AI pays for itself here.
