Episode 17 - AI, AML and Regulatory Defensibility

 In this episode of The AML Clinic Podcast, Michelle Clement is joined by Arik Oslerne to explore one of the biggest shifts currently shaping AML and client onboarding: the rise of AI. 

The episode explores:

•  where AI is currently adding practical value in AML and onboarding 
•  how automation is changing legal workflows and decision-making 
•  the risks of over-reliance, false confidence, and loss of context 
•  why AI outputs still require human challenge and interpretation 
•  what makes AI-supported decisions defensible under regulatory scrutiny 
•  how firms should think about oversight, audit trails, and accountability 
•  where the legal market is heading as firms increasingly embed AI into practice 

The conversation focuses on the reality that regulators will still expect firms to explain how decisions were reached, what information was considered, and whether the outcome made sense in context.

Designed for law firm leaders, MLROs, compliance professionals, and risk teams, this episode offers a practical and grounded discussion on how firms can integrate AI into AML processes in a way that is effective, proportionate, and defensible.

SRA | Compliance tips for solicitors regarding the use of AI and technology | Solicitors Regulation Authority

Transcript

Speaker 0:00

Hello and welcome to this episode of the AML Clinic Podcast. I'm your host, Michelle Clements, a former SRA AML regulatory manager, now working with firms to build a defensible framework grounded in how the SRA assesses risk and decision making in practice. In this episode, we're focusing on AI and specifically what it means for client onboarding and AML in practice. Over the past 15 to 20 years, legal services have moved from paper-based processes to digital systems and then into automation. AI represents a further shift, one that changes how information is processed, interpreted, and presented. And that shift is particularly visible in client onboarding. Tasks that once took hours, reviewing documents, extracting key information, forming an initial view can now be completed in minutes. And that introduces efficiency. It also introduces new questions. And to explore this further, I'm joined by Arik Oslerne. Arik is the chief executive officer at Steward. He leads the firm's commercial and operational teams, supporting global asset managers, professional services firms, and banks with the AML and KYC needs. Prior to founding Steward, Arik was part of the management team at Vaugbaun, during its acquisition by Carter in 2022, and then led Carter's EMEA fund services. Before that, Arik was CEO at Divisia Capital, head of legal at Alpari, and an associate at PWC. Arik is also a qualified solicitor of England and Wales and holds an MBA from London Business School. Arik, you are welcome to the AML Clinic.

Speaker 1 1:53

No, thank you. Thank you for the introduction as well. Great to be here.

The AI Impact On Client Onboarding

Speaker 1:57

Thank you for coming. So, Arik, as I mentioned in my intro, if we look at how technology has evolved in legal services or any services over the last 15 to 20 years, there's been quite a clear shift from digitalisation to automation and then now into AI. And from your perspective, I just wondered what feels different about this phase? And why does AI feel more fundamental than the previous shifts?

Speaker 1 2:25

No, it's a great question. And it's interesting, having built onboarding systems in multiple firms before, how things have changed. I mean, many, I mean, if we look back like 15 years ago, it was a lot about how do we uh move data in a digital format and how can we connect information and make decisions quicker. So I've been in industries where we we do STP onboarding. So it really means that um someone can be onboarded automatically without anyone in the loop. And that was an amazing innovation, and that really was important when you think about how like digital banking works today, firms like Revolute and other places like that. And that was always a very logic-based approach in terms of how onboarding worked. The big difference that's come forward, and I think it started not with AI, but let's go back even um, you know, five, seven years ago, was bringing machine learning into the process. So this was now not necessarily um rule-based, but it was based on looking at specific indicators and making decisions on those behaviours to reach results. And that was quite a shift, but it was still a, I'd say, a moderate shift in terms of decision making. Where things started getting really interesting is when AI came into um this world, suddenly there's a massive rethinking of actually what does decision making look like? Because now we're talking about shifting away, even the first line of defence in some instances, and making conscious decisions about whether or not someone should be on board or not onboarded. And it's it's a massive shift from the digital process and a very big shift from the uh machine learning process. It's now really kind of letting a new piece of technology really take the be at the forefront.

Speaker 4:02

But that's very interesting to watch. A great time to be alive. Um, so focusing specifically on AML, where do you see AI adding the most practical value today?

Speaker 1 4:15

So, what's what's interesting is that there are a lot of processes today which happen in a very manual way. So teams are manually reviewing documentation, they're filling out forms, there's a lot of human intervention, which isn't necessarily a high-value intervention. It's a very procedural intervention. It is really checking the box on many things. This is where I think AI can really drive a lot of value for teams. Because what they should be doing, they should be taking a risk-based approach, they should be spending their time on the high-value reviews and checks, and almost kind of doing what the firms were doing many years ago around STPing simple or low risk onboarding. I think those are the kind of the cases where AI is actually really good at saying, look, if you have this checklist, why don't I do that first review of that checklist, provide you analysis, review, real-time and quick um support for recommendations so teams can actually spend their time going, wait a second, let me have a think about this. Let me decide if this is a risk I should look more into or look less into, and become less of a doer and more of an operator and then an oversight function.

Speaker 5:25

Right. We're going to talk about being more of an operator and less of a doer and the risk that might come along with that. So just a quick follow-up question for me. Um, in practical terms, if AI allows a firm or a person to take something that would have taken them hours and compress it into minutes, how should they be thinking about what changes in their workflow now?

Speaker 1 5:50

Yeah. So I think the if we take it down to like a real life example, something in Steward we we do a lot and help clients with. I think it's probably one of the biggest problems we we we see clients uh hit a wall with. And that's around uh screening. So obviously, um any firm has to go through some form of screening of their underlying clients. They're looking for sanctions, peps, and adverse media. And today, what happens is you use a really good system. Um, there's many out there where it provides you, right? These are all the sanction lists, these are the potential peps, here's the potential uh address me we filed. And if it's a very common name, you're spending hours going through a long list, clicking through step by step, who is this person? Is this really the person I've been looking at? And unfortunately, there hasn't been a way to manage that until now. So on Steward, for instance, what we do is we do a first run through the mill, going through um checks and going, wait a second, we have a little bit more data on this person. We know uh who they are, um, their date of birth, uh, where they're based. So we can actually make a supporting um kind of recommendation saying actually, this isn't the same person, this isn't the same location. Um, you probably don't want to spend your time uh going through 300 uh checks like this. Spend the time on the hits, because that's really what matters. Now, if you go back to your question, so what does that mean in terms of uh my day? Well, and how I kind of approach the workflows, I don't need to spend that energy kind of going through 300 clicks. I should be using my oversight function, reviewing it, just seeing do I feel comfortable with the explainability here? Um, if it's obviously uh not a match, and then really spending my time and energy on the actual hits. So it's really changing the way I kind of interact with technology, with my work, and I think screening is a great example of that.

Speaker 7:43

So it's about rebalancing where the judgment is applied.

Speaker 1 7:48

Absolutely. I think the I think what we what we find is that the human brain, especially in the AML, the AML world, is being kind of refined to just look at data and see does it fit a box? And what the skill you really need is supposed to be like a detective. You really should be there kind of thinking about is this something that I should be spending my time, my energy on? Can I just dig into this a bit deeper? Um, it's really hard when you don't have that when you're doing like you know hundreds of onboardings, you don't have that time.

Defensibility & AI

Speaker 8:25

So no doubt AI would make the process more efficient, but there's a potential argument around efficiency versus caution. So, where where would you say firms need to be more careful when introducing AI into their processes?

Speaker 1 8:42

It's a really interesting question. Uh, I think that firms don't know or don't understand how to best implement. I think they're they know there's there's a change happening. I think for law firms, for example, they're seeing the benefits of systems like Harvey and Ligora and other types of uh legal tech. They haven't yet been able to see that value come into other parts of their business, such as AML, um, and they don't know how it can be adapted. And the risks are pretty, pretty significant. Like, and this this is something where people need to really spend their time and energy thinking like, when does AI work really well? Where did it not work really well? And if you think about at least how we adopt it, we make we need to think about this, it is not a black box. What should happen is you need to narrow the context window to a very specific task. So if we're looking at um, for instance, um documentation, if you throw in a document into uh an LLM and say to it, look, can you read this and tell me what the risks are? The results will be okay, but it's not going to be great. The reason is the context window is too big, the issues are too wide.

Speaker 3 9:56

Yeah.

Speaker 1 9:56

What firms like Stewart do is we narrow that context window to a very specific task dealing with very specific issues. So we say, wait a second, what does this document relate to? This is related to a uh, let's say a um uh company extract from France um of this type of entity type. We know these entity types, we know what we expect to see in these entity types. AI help us with this predefined rules to make sure that this is the right type of documentation and there's no uh risk or fraudulent uh measures or indicators that we know should be avoided. And that helps really narrow the risk profile. And I think what people need to be careful of is that kind of like just throw everything into the system and hope the good results come out because they won't. That's where you'll have issues arise.

Speaker 10:45

Yeah, absolutely. Where there's an over-reliant over-reliance, false confidence in um, especially as you said, if you've not actually narrowed it down to the correct context.

Speaker 1 10:56

And AI is amazing and make you feel that yeah, this is absolutely correct. We're absolutely 100% sure this is correct. And it's very hard to kind of go go, oh actually, is that is that right? Should I should I agree with it?

Efficiency vs Caution in AI Implementation

Speaker 11:09

Exactly. Okay, so I was just thinking when someone's reviewing a file, so for example, when I um when I do audits, when I complete audits, I'm not just reading the information, I'm actually interpreting it and forming a view. So if AI is summarizing that initial process that a person would have gone through, do you think it better supports judgment? I'm speaking specifically in an AML context, or does it risk shaping the way people interpret the information before they've actually fully understood it themselves?

Speaker 1 11:43

Yeah, that's a that's a really deep, deep problem set. And I think it's about how how we almost need to rewire our brain a little bit. And I think that's I always give this example when I was uh a trainee. Um, I used to rely heavily on this system called practical law. And the partner used to uh I remember one time partner kind of pulled me up. It's like, where did you this research you did for me, where do you get the answers from? I was like, I mean, I took it off practical law, and it's like, well, that's not that's not the right thing. You need to go to primary sources, you need to kind of do the heavy lifting, you need to understand, you need to think about it. And I think that the the analogies are really similar. So I think about how, you know, do I copy and paste the results from from from uh some an AI summary, or am I thinking about it? Is it helping make that decision better? It's you know reducing the time for me to do research, but it also requires me to kind of think a little bit about wait a second, that's great, that that's true, but I can still go back to the JMSCG guidance and have a think about the problem set and research it more, or even use AI tools to help me kind of analyze that problem set better. Um I think we need we we need to be careful not to be uh slaves to judgments and like be able to like think about use, and I think this is particularly important for like the more junior people that don't have that, haven't had to use the critical thinking parts and make sure they can actually make critical decisions and understand and almost like test themselves against it. Like, have you have you thought about, especially when you're dealing with more high risk, have you thought about the impact of this decision and what it means? Have you read it, have you reread it? Um, and I think that's a really critical part of that equation. And I I hear a lot in the um the um technical the tech world, people say to me, Well, Claude told me to do this, or Chat GPT told me to do that. I'm like, oh my word. Right. If we're at this stage, like what does it mean for humanity? Um, but it I think it's important to to you know if we all suddenly became you know level-setted against a specific uh model, then we're all gonna think the same. Um I think the the ingenuity, the creativity comes from us. Like we we we can't you know just follow through on what we've been told. We need to use our brain to think about it.

The Role of Human Judgement in AI Processes

Speaker 14:05

Absolutely. The AI can't take responsibility for a decision or fully understand the context um in which that decision sits. So I absolutely agree with all of those. Um we're seeing a very different approach across the market. So some firms are very cautious, others are experimenting actively, some are embedding AI quite deeply into their workflow. So 2025 seems quite noteworthy. So I'll give some examples to give context to my question. Um 2025, the SRA approved the first quote-unquote AI law firm. A number of firms announced how they're working with AI. Um Fenchurch Law announced in June. It was using AI, as far as I understand, to build AI versions of their lawyers. Kingsley Napoli, July 25, announced a collaboration with Legal Tech to develop a first of its kind knowledge exchange. Charles Russell Speech League announced that they adopted Harvey. Clearly acquired Springbok AI to create custom AI-powered solutions too. This goes on too. How do you see that spectrum playing out in practice? Would you say there are more firms using AI or more are still watching on the sidelines just to see what happens?

The Future of AI in Legal Services

Speaker 1 15:23

So we work with very forward-thinking firms. They they're the firms that um want to delight their customers. Um, but we also work with firms in their kind of risk departments where they're very centered on risk and making sure that they can demonstrate, I mean stand behind their responses. I would say across the board, I've not come across a firm that hasn't been intrigued to see how AI can support their processes. Um, there's a lot of also question marks about how the regulators may look at that as well. And I think that's a really critical point to kind of just kind of go back to and just think about like what does that mean? Like, what does it mean, how the regulators are actually looking at AI and the adoption across not just the UK, we should look also abroad and see kind of what are the what are the countries, uh, how are they adopting um or adapting to this world? So starting with that, I'd say like looking the FCA, for example, which is I think the good starting point. Um they've they've been very open to to AI, and we see this with their sandbox, they're like encouraging firms to come use, uh, think about it, uh play with it and make sure they can feel comfortable with the with uh how AI is adapted. I also look at the US, it's really interesting. So Finsen, the um AML um authority out there, they've brought up they brought through some uh consultations around um how they think about AML going forward. And within that, they say when we and when we carry out enforcement actions, we're going to look at firms. And part of the considerations for whether we enforce or not is how they're using automated tools, including AI. So they put it in writing there. They're expecting firms to kind of be be ahead of the curve and making sure they're using risk measures uh to ensure they can they can be ahead of uh potential fines. So I think that's a really important that that that helps teams kind of go, well, look, my regulator's on board with this. I should probably spend my energy looking into this because I don't want to be behind behind the curve, as I was saying. Um and I think specifically with law firms, it's very interesting that because they've been pushed by their clients to show more efficiency, they have been adopting it on their core work around like their legal work. So I think it filters down very quickly to say, well, if the lawyers are using this, we should be using it on the risk teams as well, so we can also demonstrate how we're um ensuring the firm's more efficient and driving better better outcomes for our clients.

Speaker 17:59

So you've you've kind of preempted my next question, which I'll just hold fire on. Just to uh add into what you just said there, um the SRA has published guidance on its website about practical tips for firms taking on new technology, which includes AI on its website. So I'll link that in the show notes for anyone who hasn't seen it. So there's uh there's almost an expectation that firms are using it, and if you're using it, this is what you should be doing to be using it safely. Right. So to bring everything we've touched on together, um for a firm, so assuming I'm in a firm that's now very new to AI, I'm an exploring, or even if I'm a firm that has been using AI already, um, what would you say your focus should be on to ensure that it's used in a way that's effective, it's proportionate, and it's defensible? So my regulator or AML supervisors is gonna come knocking. What do I need to make sure I that I have right?

In The Next Five Years....

Speaker 1 18:56

So I think what's missing a little bit is kind of a guide for firms on how to adopt AI safely and proportionately. I think like what are the questions I'm asking for my vendor? What do I what should I what should I know? Like what is right, what is wrong? I think people don't have like a set uh list of questions. I think that's the starting point is understanding what is the the critical um the critical pieces that will help a regulator feel comfortable when they do an audit. Yeah and I'd say there's two critical points to that. The first thing is, and this would be a no-brainer, but audit trails. Like just so how decisions be made and make sure it's it's very clearly documented. Um, and I think that's it's something which is obvious, but not necessarily obvious with vendors about how AI plays a part in that. So all decision making we do is good. There is immutable logs to make sure we can show how decisions were made. The second thing which is really important, I think this kind of covers the point you you brought up earlier around uh whether this is a recommendation or how do you use this. It's really important that AI provides explainability or the firm provides explainability of how AI is being used and the outcomes of why it's recommended or suggested a potential action. And for example, when we do screenings, we use that very clearly. We put a kind of a context window where we explain this was identified as the false positive because it was a different jurisdiction or was a different um person. And it's really first helpful the person doing the work to understand like why a decision's been made. But if you're gonna if regulators are gonna come in and go, like, why did you agree to this decision? It was wrong, let's say, God forbid, but like why would that happen? You could go, look, this is why this happened, this is the log, this is the audit trail for that. I think it's really important to have those two points really nailed.

Speaker 20:50

Yeah, absolutely. So I I couldn't tell you how many times um I went to audit a firm and you'd look at an electronic verification report and it would say something on there, and you'd say to the firm, you know, do you understand what this means? And actually, no, they you know, the report turned it out, so it must be true. They they actually don't understand what it was that it was checking, which um believe it or not, happened more times than I would like it to have happened. Um, but yeah, I think it's been a really insightful discussion. I think training as well, um, I would add onto that is really important. If you're gonna take on any new piece of technology, it's important that people understand how to use it, um, given the example I just gave. But is there anything that you would like people to know about AI that we haven't spoken about so far?

Speaker 1 21:36

Yeah, I think the it's really interesting, this innovation curve. Um it's very exciting to be on it. Um, but it's also you you see the different the spectrum of different uh views, but also um um how people are adapting to it. And I think what what's really it's really interesting to see is how How much of the world is really using AI and how they're actually in practice using it? So, I mean, the stats are pretty pretty crazy out there. Like, actually, but you may think everyone's using AI, but it's it's in the like the low uh tens in terms of percentage of people actually using it. Within that, like I can't remember the exact number, I think it's like 80 so percent are just using Chat GPT. Uh most firms roll out copilot as as a standard. Uh so that's kind of if you think of the business context, people are used to copilot. But then I go, I go to conferences or I do speaking engagements, and I ask people, you know, who here has used Aud or who has used Mistral or who's used other systems, and people generally are very um taken back and you're like, no, I haven't got to that, I haven't used that. And I think what's interesting is this this adoption code where people are still kind of being dragged along for the ride, but not actually getting access to more interesting ways of how to use um AI. And I think you talked about training, I think that's a critical part. And I one of my key messages is like go back to the team and like try something, do a hackathon together, like really spend some time like seeing what you could do if you put your mind to it. And so I've seen some great outputs from these types of uh exercises with firms. Um, because in reality, you will also find there are people in your team who are using it on a personal basis and have a really good understanding and and their thoughts about how they could use it. And sometimes they're held back because of the internal processes. And I think it's about obviously putting it within a safe environment to use it, but just go and and and try something, like see what that looks like, see how you suddenly have that kind of aha moment of wow, I could use this to save time to make my life a little bit easier. And people come back to me and send me messages afterwards, like, thank you for that. Like, I wish I I did that earlier. I wish I tried, um, I don't know, like a lovable to to do a website or uh clawed code to just do a quick uh tool. And it's been a great experience. And I uh you know, I'm gonna use this more and more. So I definitely think like it's one of those things like don't be left behind, even if you're professionally being stuck because you can't use it within your environment, on a personal level, on the weekend, just go get you know, run a specific uh query, run some like ideas through it, create an app, create websites. It is a lot of fun.

ChatGPT Made Me Do It

Speaker 24:21

Yeah, I mean I I dabble, I'm not I'm no expert, but I I definitely don't want to get left behind. I I think it's it's the future, and uh I I don't want to be dragged along either. Um final question, just out of curiosity, so in the next five to ten years, do you think the real differentiator will be how firms is actually how they're integrating AI as opposed to whether they're using it at all?

Speaker 1 24:45

I mean, five years from now, every firm will have AI native engineers within the firm. And that's that's not necessarily like tech people. I'm gonna be very clear. I mean, operational people that have dabbled, um, have experience, have certifications in how to use AI, don't need any coding skills, um, and they're building internal tools for companies to utilize. Like, I I already see that happening in certain firms. I think it's gonna take a long time for that to be uh the status quo, mostly because a lot of firms have very unstructured uh data or very uh legacy systems. It's very hard for them to actually go ahead and like create that happen. But I think there'll be this massive shift where we'll see these new jobs and roles come out where the people today who are kind of getting ahead of the curve and like learning a little bit more about um how to use AI are become champions within the business. And there'll actually be people who be building the future apps of the business.

Speaker 25:43

Yeah, I I I think I I agree with you. Um let's wait and see. But thank you so much. Thank you, Arik, for sharing your insights. It's been a really valuable conversation.

Speaker 1 25:54

No, thank you. It's been a great conversation. I've really enjoyed it.

Speaker 25:58

And thank you to everyone listening. I hope you found this episode valuable as you think about how AI is beginning to reshape onboarding, compliance in general, and decision making across the legal sector. If you found this episode useful, please do share it with colleagues working in the world of nuance, risk, and raise of thing judgment calls. And if a topic you would like me to consider in the future, I'd love to hear from you. Thanks for listening to the AML Clinic. Until the next time, do stay informed and stay compliant.