Podcast Ep 1: Evolving Role of Compliance and AI Risk Management

Compliance Matters. >> Welcome to the inaugural episode of Compliance Matters. This is a brand new podcast hosted by Ethiccom Consultancy. It is created by and for the compliance community, folks who are navigating an increasingly complex regulatory environment. Compliance matters focuses on issues at the core of our profession. compliance trends, regulatory changes,

best practices and common pain points of which there are many. So we hope to invite members of the community or from the broader financial services industry who will share insights and practical perspectives. Ethiccom sees this podcast as a way of giving back into the community by creating a space for thoughtful discussion, for shared learning, and for professional reflection. In this first episode, we begin with a foundational question. How did the

compliance role evolve from its very traditional role to its current one which is multiddisciplinary and more specialized and is artificial intelligence or AI now part of the compliance remmit? For our inaugural episode, we are really pleased to have with us my buddy Robin Lee, MD of Experentia, someone who's very well known within the compliance and direct tech community. Robin also teaches AI at a local university. Welcome to Compliance

Matters, Robin. >> Hey, Nisam, thanks for having me. It's an honor and privilege to be here. I'm quite excited for this. So, yeah, let's do this. >> Yeah, I I also understand you you you just told me that you're working on a new book. Tell tell us about it. >> That's right. Yes. It's called the the full stack AI ethicist. Um, which I believe will be a a job title of the future. Actually, it's it's an existing job today. So, if you go to Silicon Valley and you look at some a lot of these larger companies or even some of these companies in larger tech companies in China, they actually have people with

with that job title. But I it hasn't quite hit financial services yet, which is what the the purview that we play in, but it will definitely be a lot of overlap with what we do in the the compliance space. So yes. >> Okay. So Robin, you and I, we've been in the trenches, the compliance trenches for many years. Um, and we've seen many changes in the role of the compliance officer. What what what have you observed? Have you seen? Okay. So let me let me go a little bit back in time here

cuz I I actually researched this Niss. So it to my knowledge the compliance industry started in the UK. So the first compliance officers actually um sprouted from the UK with the emergence of the 1986 financial services act. And if you if you look over the years the the background of the compliance the the compliance officer or or or or um fundamental attributes have changed. So,

from what I've seen, you know, and and and please feel free to to jump in if if if there's any disagreement here, but it's kind of gone from accountants and salespeople that couldn't make their numbers to lawyers that don't really want to do law anymore to um more operational research, especially as departments have grown larger and larger and larger. um to not operations research, sorry, operational risk um more than than anything um to to

technology, right? Um data science um I mean not too many years ago I was on a panel and and someone mentioned that the head of compliance will have to have a a PhD in data science, but I think with AI that's even um you know evolved even even further still. So, so yes, that that would be the makeup of it. And if you take a look at, you know, know boiling it down now to the the fundamentals here. And I'm going to refer to some some notes here. I mean,

it began began more as a a regulatory based function, hence the lawyers and and um and what have you, where there was like a focus on regul regulatory interpretation, policy drafting, monitoring, reporting and dealing with regulators, internal controls, training and culture. uh that that foundation still matters. Okay. But um it and it and it provides legal defensibility, consistency and trust, but business models have changed over time, right? So you know I mentioned the the

digitization of of of financial services, automation um you know artificial intelligence, machine learning um and beyond coming to the four. It's scaled across borders and compliance failures have increasingly um emerged and and and and are not coming from bad intent. They they actually came from more systemat systematic breakdowns often driven by technology. So, you know, you know what they say, right? Um the the technology used to be very very

straightforward. you you were either a semiconductor company, a hardware company, a um software company, an internet company, and maybe a social media company. But somewhere along the line, shortly after that, everybody became a technology company. Um you know, Tesla, right, and and BYD with with the the auto industry. Uh IKEA is arguably a technology company now. If you if you go to their website, you can build their furniture online and and and even place it in your your house and see

what it looks like in your room, etc., etc. So I I and and so financial services is is is is naturally a part of that. >> Yeah. and and that's particularly so when you look at some of the web tree um institutions um they all start from tech uh based DNA um and then they happen to offer financial services which are regulated um so that that has changed so so we've seen digitization happening in a huge huge way over the last decade and

beyond actually but more interestingly we've seen datadriven decision- making um and then that means that risk stop respecting silos Um we have seen three types of failure moves happening again and again. First data failures, poor quality data, rubbish in rubbish out right lineage or embedded bias. Uh second model and automation failures, logic errors, lack of explanability. Um that is interesting. Third, control fail failures really governance or overrides,

weak access controls, lack of accountability. So as as you mentioned, it's it's not about compliance. stopping people from breaking rules, stopping bad actors, but it's really be uh you know the systems becoming a monster of its own and breaking trusts. Um so what what are your thoughts about the compliance uh perspective on this? How should compliance respond to to these new risks? Get educated is number one. I I I I and

and by the way I you know I think the next evolution of compliance is such that that where you know compliance officers are going to have to learn a lot about the technology stuff. I if I take a very simple example of of compliance um AML sitting under compliance with what's happened recently with all the you know fraud and scams right third party fraud if you look at a lot of many of the especially the larger institutions fraud has kind of moved

away from operations it used to be an operational role right moved away from operations sits with AML now u because you know people get scammed and then the money gets laundered after, right? Um sitting um under compliance and and have become like almost like a a single department. Now, don't get me wrong, I I think the the roles themselves are very different, right? The mindset of a fraud a fraud person is very different to that of an AML person. The analogy I use is like fraud looks at the future because you're trying to stop stuff. So, it's kind of like finance and AML, you know,

looks at what's happened, flags suspicious activity, presents that to the regulator. So, it's more like accounting, right? because you're looking to the past, right? But I think cyber's next just given the nature of of um you know the fraud how how how financial crime and I'm being very focused on financial crime here but I think this will extend extend to other aspects of compliance but just given the nature of how financial crime has has become digitized as well then um cyber will sit there as well and and actually

if you look at again if you look at most Silicon Valley companies they've already done that and the department's called trust and safety so I It's just a matter of time before trust and safety comes to financial services. >> And I think it has uh because you know over the years we've seen a greater focus on technology risk management >> here in Singapore. I mean the TRM guidelines are notoriously very very wide and then we've got all the various notices and then even um anti-fraud measures have made their way into regulatory prescriptions. So that I

think that's already happening. Um what are your thoughts about compliance and you know how do you deal with this beast called artificial intelligence? You know at the surface of it it sounds great. We we all love chat GPT you know and and and the other uh AI tools you know for for making life of a compliance officers uh more interesting but what are your thoughts about about that? >> I think that again you have to learn as much as possible. Now the trick here is that for a compliance officer to to to

to learn how to program LLM models as well as understand the legal aspect as well it it's not easy right like like you need need to be Superman to do that right um so I think what we'll see emerging more and more from a governance perspective is is AI governance um so I think what you'll see um starting to emerge is is more and more AI like specific AI governance committees being organized within financial institutions where you do have a technical person as

well as a legal person as well as an operations person as well as maybe someone that that fully understands the algorithms and can can code them inside out sitting sitting together in a in a single committee. >> Sure. Robin, you you've been deep in the rect space for many many years. um and AI machine learning has become such a big part of uh the rectac use case and you know what what do you think are the real game changers on the using AI for

compliance? Um so I think if we go back to if we go to fundamentals um first and first is is from an operational perspective. when we talk about operations, we're talking about um efficiency gains. And where where I see the where I see efficiency gains coming um for compliance is stuff like false positive reduction, right? I mean, if you look at the current well not current well yeah

it is still current, right? where where where you have like huge remediation projects and and what have you where you have to hire in some in some cases thousands and thousands of people to come in and and sit there doing this, right? Reducing false positives that that something like the machine learning can easily come in and and and and um circumvent some of that, right? So there's the efficiency angle and then there's the the spotting stuff that a human might not necessarily be able to to identify which is what we call

anomaly detection. And an example of that would be um there's software out there including the last company I worked at where I have all of Nisarm's data sitting in the same place and um the anomaly detection algorithm is monitoring that. So it identifies what's normal with Nisarm, what's not normal. So Nisam on the weekends is is always in Malaysia for example then then yes that it nothing will get flagged in that instance but suddenly I don't know he

appears in I don't know South America somewhere then that's definitely not normal and it will that and and and some transactions have happened etc etc then that that will get flagged to the to the um attention of the the financial crime or or compliance team. Now, what's interesting about this is that is that as as technology progresses and scalability comes in, you're able to put more and more data points in there. So

for example, there are vendors out there that offer SDKs that could be in that could be installed on your your mobile phone and it will be able to tell really really interesting data like whether Nisarmms you is usually usually uses his phone in his right hand or his left hand or whether he usually types in a particular manner or etc etc right so it's really really cool behavioral metrics that are are becoming available over time >> so I think I And I think the compliance

community is really benefiting a lot from the use of AI and machine learning uh as part of your your rank tech uh you know pallet of tools. Um but on the flip side um with the greater use of AI by financial institutions um beyond just compliance I mean obviously um AI governance uh has come you know front and center particularly uh um you know what kind of risk management uh framework we put around uh generative AI for instance and and here um you know we

we move on to to another part of this uh podcast um on the uh AI risk management uh um guidelines um which was part of a consultation paper put by the MES uh in November 2025 fairly recently. Um you would recall that in 2018 the MAS started with just very broad principles the the feat FET principles fairness ethics accountability and transparency and even then you is interesting that the focus is on some of the things that

we're very familiar with right fairness fair dealing ethics right the AI ethicists which is a subject matter of your book ethiccom which is a play of ethics and compliance accountability and transparency so these are very real world principles uh being put in a technology- based environment. Um, so in November 2025, the consultation paper issued by the MS is fairly um detailed, right? It's it's uh and and it's against the backdrop of what's been what we've been seeing uh in terms of Gen AI making

its way and you know they're very real use cases within the financial industry. Um so they've developed these draft guidelines having uh worked with the industry uh or working groups of the industry. So that that's a good thing. Um they are meant to apply to all financial institutions in Singapore. So that's that's quite you know wide wide ranging wide sweeping application. However there is also flexibility to use it in a risk proportionate man manner

commensurate with the size and nature of activities. So whether you're a twoperson startup or whether you are a huge bank in Singapore, it has applicability obviously um in a risk uh proportionate manner. Um your your your thoughts on this uh consultation paper Robin is is this a gamecher for the compliance role? Um okay so if I was to look at this from a a global perspective um it's a natural progression but if you

look at the European um AI act right that's that's pretty hardcore I mean there are talks of even startups leaving Europe because it's a AI startups sorry leaving Europe because of of of some of the requirements some of the requirements there um But, you know, I it just so happens I I I I just got qualified to to audit ISO 420001, which is a sorry u yeah 42 42,0001

um which is a a new um is well it's not that new. It's an ISO standard that came out at the at the end of 2020 um 4 um sorry 2023 which which is for AI management systems. So this is this was back then, right? And and ISOs are are more suggestive I like to think versus or or guidelines versus versus, you know, regulation, which is you better do this. Okay. And there's actually quite a

bit of overlap. There's about 70 70 I'd say about 70 80% overlap with with what what MAS is trying to do. And I guess what MAS is really doing here is is setting supervisory expectations for how financial institutions manage AI risk because there are a lot of risks that come with AI, right? So and and and these these need to be identified and and and um and mitigated accordingly. Um, and what's interesting about about

um about this particular consultation paper is generative AI and AI agents get called out specifically and I don't know if you saw there's there's an extension of that that well not an extension something came out from IMDA around AI agents where um where they're they're actually highlighting the account that the accountability aspect being um uh um placed on on on on the um the

institution using using AI. Sorry for that ramble there. >> Not at all. Um so well broadly the the the draft guidelines or the AI risk management guidelines cover some broad areas like AI governance and oversight systems policies and procedures including AI identification inventor in inventory risk materiality assessment uh AI life uh cycle controls. Let's let's get to some of the more interesting issues within the CP. Um the first issue

is the width of the definition of AI. Is it done too broadly? Um so ju just to recap so the MEES defines AI quite expensively to include uh AI models systems use cases machine learning deep learning reinforcement learning generative AI AI agents with autonomy uh internally developed and third party uh AI. So they've excluded things like rulebased calculators >> but anything that learns or infers is included. Um,

does this matter for for the compliance role? Uh, Robin, you know, does >> absolutely it does. Yes. As I mean, as well, it matters if you're using AI, right? Cuz there are a lot of financial institutions that that don't necessarily need AI. Um, I think the core expectation that I I the the takeaway that I got from the paper is that if AI can materially affect customers finances or stability, it must be governed like any other critical risk. And I mean, the bottom

line here is no invisible AI, no unowned AI, no untested AI, and no ungoverned AI. That's that's my takeaway from the the paper on that front. >> What does this mean for the compliance officer now? Does does he need to find out how the tools are being built? >> Absolutely. >> And does he need to identify codes? Um >> yes. I I mean just just as someone coming from the the reg tech space there are a lot of um

um and someone who sold to these these types of compliance officer as well. There are a lot of compliance officers who who just aren't aware of of of some of the um the um the the the aspects when it comes to to to putting some of these solutions together. So, I'll give you an example, right? There's a there's an EKYC vendor that I know of. Um, so so one of my one of my roles, sorry, let me go back to to one of my roles in the

past was I was I was running uh Southeast Asia strategy for one of the risk intelligence database vendors. Okay. And and part of that was assessing partners, people that wanted to take our data and use it for screening. And just for a quick 101 for any anyone who might not be in compliance, a risk intelligence database is a list of individuals or organizations that may pose some sort of risk to your organization, whether that's their money launderers, potential terrorists, etc., etc. And the idea is that before you you

on board your customer or on a regular basis, you need to screen these customers against that list just to make sure that that they're they're they're not on that list. And if they are on that list then you can still you just have to you know move with a a higher degree of risk management as to what you want to do with that customer. But as a risk management tool essentially and there were vendors that wanted to take our data and leverage that within their their own solution. And part of my role was to assess who our partners are because we had such a great reputation,

this this firm that I worked at, and and and and and ensure that we're not aligned with with vendors who um who who haven't um um who who again who may pose some of our risk to to us, I guess, as a third party risk exercise. and we came across this one EKYC vendor who um leveraged a um a software solution. So they didn't make anything basically. They they they took a little bit of

this, a little bit of that, a little bit of something else, stitch it together, and then boom, we have an EKYC solution. So I asked them, you know, for the the facial recognition, um you know, do you make this? No, we don't. Okay. um who makes it and they they named the vendor and I was like does the vendor um are you using the free version or the or the uh the paid version said the free version cuz they wanted to keep costs low and and the free version of this

software you have to leverage this their their their own server which sits in another jurisdiction and so what was happening was all their customers faces were being sent to that jurisdiction without the compliance office the end customer's knowledge, right? The compliance officer or the end customer's knowledge. Um, so I was like, okay, uh, that's interesting. Um, what about your your um data extraction? So, what I mean by that is you you take a copy of someone's identity card or passport and

the data gets extracted out of that and placed into into their system. Um, and then the screening is usually done after, but but they didn't make the data extraction either. So again the question is who who are you using the the free version the the Tommy the vendor uh you using the free version or the the paid version they said the free version again and that data was being that data extraction was being sent and resided on a another server in another jurisdiction. So, and there in lies the risk, right? You you you you have data

that's sensitive data sitting in in jurisdictions that neither the FI nor the end customer are aware of and and so we decided not to move forward with that that that partner as a result of that. >> Yeah. For good reasons. you know coming back to the consultation paper I think um the other interesting area is um and not surprising uh this is on the issue of B and senior management accountability for AI um so that's not surprising you know given the various

regulatory trends uh towards accountability um here um just just to summarize some of the considerations or the prescriptions so there's an expectation that boards and senior management must approve AI governance frameworks explicitly include AI risks in the risk appetite framework. So if you have a enterprise risk uh dashboard um yeah yeah AI AI is specifically there um and understand AI sufficiently to challenge management. Um so this is interesting.

Now there's a the board must understand what AI is to ask meaningful questions to to the management team um and to establish escalation and incident reporting for AI failures. Um and when the AI risk is material and I I expect in most financial institutions when you leverage on AI it's likely to be material so the MS expects a dedicated cross functional committee which you referred to earlier. >> So um again what what what is the impact on this on on the compliance role? I >> I I think the compliance officer will

have to definitely be part of that committee if not leading that committee. So maybe alongside procurement I I'm I'm it depends I guess it depends on the the institution but they definitely have need to have a significant role in that committee >> and it's it's not really like like we we discussed earlier it's not just focusing on outcomes but you need to also understand how the machines work right yeah >> yes you do >> okay um so if if AI in in the scenario where AI causes customer harm you know

hypothetically or compliance failure or a breach who will be on the hook within the organization. >> It's always the board or senior management, right? And the compliance officer themselves of in in um depending on on what the the nature of the risk like um you know, but in you know some some jurisdictions compliance officers can go to jail, right, for for AML breaches for example. But I I would say ultimately it always boils down to

senior management and the board. >> Yeah. and and we've seen that happening already. You I like you pointed out in AML CFT, there's been a lot more uh enforcement action takens against um you know senior management and and the board of directors personally. So personal liability or the threat of jail or has a very chilling effect. Um so it'll be interesting to see um in terms of um when it comes to compliance breaches arising from a lack of proper risk management in AI what what the attitude

of the regulator regulators would be. Um okay the other requirement is on mandatory AI identification and inventory. It sounds you know very simple um but you know the expectations are um there must be clear definitions and criteria for what constitutes AI within the organization. A robust process to identify AI usage. Um an updated accurate AI inventory. Um assigned control functions for identification inventorization at theest

stationation and ongoing reviews. Um and the inventory must also capture attributes. uh there's been some prescriptions like purpose and scope, data use, dependencies, risk, material, materiality, owners, etc. Do you think this creates a totally new workflow for compliance officers? >> Absolutely. I mean I mean ultimately when I when I read that AI identification side, what it means is no shadow AI, right? You need to know exactly what it's being used for, how it

works, what could go wrong with it, etc., etc. And when I look at the AI inventory side, I interpret that as a um I mean I think the best way of going about that is to keep a central register of all your all the AI that's being used. So so yes, it is a an extra task for compliance officers to do >> or they can go to you right and I'm sure you ethic can come up with something like that. >> Well, yeah, we can. So, do do you think it's very conceivable when the MES comes

for an inspection and ask the financial financial institution, show me your AI inventory list? >> Yes, I absolutely do think it is. And and and and hey, if if if if they don't have it or or they have difficulty in in in putting that together, like a register, right, of of of all the AI that's being used, then I'm I'm sure they can they can go to Unis and you'll be able to help them put that together. >> Yeah. But I I think that the argument is that if you don't have an inventory >> um how can you put in place a governance

framework around the use of AI because you don't know what what what you're looking at right >> yes >> and I think there's a very real risk of a supervisory finding in in that in that manner >> um the the thing about the way memes or regulators tend to approach these things is that in in the early stages it tends to be very broad right the feed principles in 2018 and then you see more prescription which is found in this consultation paper but they are still generally in the form of guidelines. They technically do not have the force of law but when the MES comes and

inspect you and you are not in complian to the guidelines you know you you you can get into trouble. I think I think an important aspect of that inventory that that AI that that that that that register is is you include risk assessments in particular the materiality assessments um on that front and what are you looking at you're looking at the the impact the complexity

of the the AI that you're leveraging uh as well as the the reliance right and and and when we talk about reliance we talk about autonomy versus human fall back, right? Although it should it should always you should always have a human I know we've heard this term to death, right? Human in the loop, but I I I I prefer to rephrase that as it's it's Robocop, not Terminator, right? You need to you need to have that that human element to to operate. >> Hang on. I thought the Terminator was

also half human, right? >> No, no, no. It was completely >> It's 100% machine with the the the human skin over it, right? I need to catch up on uh yeah my Schwartzenegger collection. Okay, let's let's move on to to to the other expectation which is um that full AI life cycle controls are expected. So uh controls have to be put in place uh throughout the entire AI life cycle including data governance, fairness, uh

transparency and and explan explanability, >> human oversight, third party AI risks, independent reviews, pre and post uh deployment, change management and kill switches, uh incident management and reporting. So quite a lot of prescriptions. >> Yeah. and and and just to just to you know um make everyone make sure we're all on the same page here. When we talk about the AI life cycle, we're talking about design to deployment to monitoring to retirement. Okay. So, just

make sure we're all aligned on on on on what the AI life cycle is here. >> Well, there was an interesting term that was used, explanability. Can you explain what explanability is? >> Sure. Um and again this this is this is I used to see this a lot in in in in the last organization I worked at where where I can safely say that our algorithms were explainable from the perspective that we had a a gentleman who was actually the last two firms I worked at where there's a gentleman and

a lady who were teaching AI in some very prestigious universities had a team working under them and they were writing the algorithms from the ground up. So it doesn't get more explainable from from that perspective when you're you're you know when you when you have the original code of the algorithm. And so there's there's that level of explanability. How explain explainable is the code? This is explainable to who is the question here, right? Then there's the level where it's explainable to the compliance officer where where they have to justify, you

know, why was this false positive reduced for example, right? Um and and our solution had it there in in plain text with a percentage rating, confidence rating as to why that false positive was was reduced. Um and then and then there's explanability to the board and and and and and to the end customer if needs be as well. So it depends on who you're explaining to I think. >> Right. and and also now the the role of the compliance is I mean you can't afford to be in a silo because you know

you have to intersect with areas such as data governance conduct risk outsourcing technology risk and some of the other specific uh prescriptions for AI risk management >> um again um you know is it I mean there all these new or additional expectations on the role of the compliance officers your thoughts on this >> well um this is where I think it'll be be useful to to have you know acquire

some new skills um take on some new training add some resources maybe some infrastructure because at the end of the day is as you know we don't understand it it's not an acceptable excuse for this meases white paper um another another tip could be if you're if you're if you're using a vendor or if you're you if you're building your own algorithms inhouse um get ISO 420001 certified. I think that that helps a lot. Um I don't think

it's the the be all and end all. There's still like I said there's about 70 80% overlap with what's covered in the in the consultation paper, but it's it's it's it's a fair chunk. Right. >> Right. Okay. that so I mean we spoke about a little bit about explanability but you know transparency is also uh a key issue or key feature in the consultation paper um in the consultation paper the MEES explicitly links AI to fairness the concept of fair

dealing customer outcomes um they've also talked about bias and discrimination um and for higher impact AI you know for instance credit underwriting or advisory um there is an expectation that there's a stronger element of explanability or fairness assessments and even disclosure and redress mechanisms. Um impact on the compliance officer Robin. >> Hi, you you need to be able to to to explain why why the results are the

results and and I think this stems back to to bias in the algorithm, right? In in in in sorry bias in algorithms. Um classic case was in the US. Um there was a a a credit lending agency. They took in all this past data and the algorithm, you know, learned from that data and immediately if you're African-Amean and you're applying for um a loan, your credit rating was automatically, you know, either declined or or or reduced

substantially. That that's that's not fair, right? And so you so the transparency here is can you explain why it did that and you'd have to go back and rumage through the data and and and and show show that and address that to the customer. >> So here we we see that the efficiency element of AI becomes a double-edged sword. >> On the one hand if you get things right things can be done quick but if it goes wrong then it could result in systemic breaches on a very large scale and

affecting people in a very large way. So um that's that's the reality of it right the double-edged sword. >> This is why I think it goes back to what we were saying earlier right about the role of the compliance officer having to to evolve. I mean and this is just the AI part you know prior to that we had the the the privacy element right and and and data privacy and data leakage and and etc etc. These are very cyber securityesque um um roles, right? But it it falls

under compliance now >> and it also means that in my view that a compliance officer must be engaged very early on even in the use case design of of that AI tool that you're looking at. Uh because you can't later on assert that it was the model's fault, right? You you can't say that anymore. >> You cannot. >> So it's accountability. >> Yes. >> Yes. Okay. Um so again on accountability another expectation of the consultation paper is when it comes to third party

AI. Um so just like the the approach towards outsourcing the financial institution remains accountable even for the outcomes of the third party AI. Um and then you can mitigate some of these uh transparency gaps through testing, increased oversight or disclosures. Um and obviously if you have legal agreements in place, the MS expects there to be um you know provisions relating to audit rights, notifications, data protection, performance guarantees.

Um again what what do you think are the you know the impact for the compliance role more work? Um, but again, this is stuff that that that the compliance commu community is going to have to understand, get on top of in some shape or form. A and look, like I said, because the role is becoming so multiaceted, you you don't necessarily have to to

understand this yourself 100%. But make sure that you have someone in your team or someone available to you who who does. Right. So, >> does it make the financial institution think twice before using third party AI because of all this risk? >> Um, it depends on who you are, right? I mean, if you're a big tier one bank, you you you could probably afford to build stuff in house and there are a lot of of of banks which are doing that. But if you're a a guy and gal in the garage

starting a fintech, then I don't think you have much much choice, right? >> Yeah. Um I I think it does uh create more um expectations when it comes to vendor risk management. Uh you know obviously under the current MEES outsourcing guidelines there are some expectations but I think it also means that the procurement and the legal team needs to make sure that there are new clauses relating to this in your agreements. Um because you when you outsource AI you don't outsource accountability. So I think that's a key

message. >> That's correct. Um now the coming back to another aspect of the consultation paper and this relates to capability capacity and culture. Um and you know what what you've been stressing on on training um you know for compliance officers even um so adequate AI risk management skills training for staff involved in AI oversight ongoing capability reviews sufficient technology in infrastructure anything you want to add on on the impact on the compliance

role >> um yes I I look I I it's it's not too different from a mindset perspective, right? Cuz you're you're ultimately it's a a riskmanagement exercise, but it's it's it's just a it's just extra an extra type of risk that that that's emerging, if not emerged, that that you need to be aware of. And and from a

career perspective, I recommend everybody everybody jumps on this in some shape or form. Actually, it's a big big reason why um I was approached by the International Compliance Association to to write the um the AI and ethics course that they're they're putting out right now. And and that's what I mean. Sorry, I know I'm I'm going into a bit of a ramble here, but I think this is this is important, right? Um ethics is the precursor to governance, risk, and compliance. So as long as you you have a

good understanding of ethics and are fundamentally an ethical person then I think the rest of this should should flow accordingly pretty pretty naturally after. Yeah, I think in terms of practical impact, it also means that before an AI decid sorry and a financial institution decides to use a particular type of AI and the more powerful or the more complex it is and the greater the impact it is, there is correspondingly a bigger expectation by the regulators on

the financial institution that you got to get your you know control framework correct, your governance correct, your training correct, uh your your your your people have to upskill because you cannot say to the regulators that look we we we lacking expertise there's no excuse anymore so you know it's like if you are driving a Ferrari you got to make sure that the driver is capable to drive that beast >> right so um that that would be I think the actual impact on the compliance team as well as the broader financial

institution >> yes >> yeah um now um so the the consultation paper says that firms have got a 12-mon transition period to comply. Well, technically they haven't issued the guidelines yet. >> So, once the guidelines issued, they have 12 months to to um >> Yeah. But I think both of us would would agree that now is the time that they start looking at putting in place uh you know an appropriate risk workers framework for themselves. U do you think the 12-month period is reasonable

though? >> Um I do. I do. A lot can happen in 12 months, right? So, so and and and look, if if just being upfront here, if you if you're in financial services, there's a lot of material activity that happens in financial services, you should be doing something like this already. >> Absolutely. >> Um, so what what what do you think they should do now to prepare for the implementation of the guidelines? I mean

training uh attend any u feedback sessions for the consultation paper. Um um yeah start start like looking into things like putting together that that um the committee and the inventory etc etc. do a do a quick, you know, risk assessment of what you got right now, right? If you're if you're using AI right now and where the the risks are and identify any gaps and see if you

could see if there's any way of mitigating those gaps and then and then maybe calling ethic and say and then checking whether whether you know what you've done is is is good. >> Yeah. Okay. So, let's let's move away from the MES consultation paper you mentioned earlier. um that you ISO 42,0001 um and and you you're you're a qualified assessor for that. Um can you tell us more about this um ISO 40 42,000 you

mentioned that it it supports me compliance up to a certain threshold maybe >> so it's a global standard for AI governance it it establishes and this concept of an AI management system or or aims um it's certifiable auditable and aligned with with other ISO standards as well um who's it for it's for organizations that build, deploy or use AI, so it's beyond financial services.

Um, it applies across all sectors and AI maturity levels as well. Um, in terms of what it delivers, the idea here is that that once you once you've been certified for this, you you have responsible and trustworthy AI. Um, and it's a structured control of AI risk, ethics, and compliance. Um, and as well as clear accountability and oversight. uh the core controls around 420001 um AI governance and leadership so that

aspects of the board and and and senior management um AI risk management um in particular bias safety privacy and misuse um the life cycle controls which I I spoke to to earlier um human oversight and escalation and transparency and documentation as well. Um so I I guess the oneline takeaway on this is that you know 420001 provides an auditable framework to govern AI

responsibly without slowing innovation. >> Do you think it makes sense for financial institutions uh to go down this route of getting this ISO certified? >> It depends depends on how much AI you're building in house. If you're building a lot of AI in house, then yes, I I I do recommend that or at least take the principles from this and and and and and you should be using the principles from this anyway. But if you're using a vendor, I think you're going to see many vendors out there um looking to get certified for this. There's already another certification 27001

which revolves around um data security. Um most if not yeah most of the significant players in in the the compliance technology space the reg tech space have this already and and I can only see 420001 being another requirement if you're going to use a third party vendor. >> So so if you're a financial institution and you want to buy over a third party

AI tool you would look out for this 421 certification. Okay. Okay. Now coming back to you know we we talk about the foundational question you know how compliance has changed over the years. Uh so I think by and large there there are five layers for modern day compliance right one is regulation and ethics two governance and accountability. Three risk and controls for technology and data management. And lastly people and culture. When when you talk about AI governance does it cut

across all these five dimensions you think? Yes, I do. Yes, it does. Sorry. Yes, I think it does. >> Okay, so um I think we've we've covered what what we want to to cover uh for this episode. Thanks very much for joining us, Robin. >> Thank you for having me, Nam. It's been an honor and a privilege as always. >> No, thank really thank you. Uh we we appreciate your your time and presence and and preparation for this as well. Um so that's this episode sets the foundation for compliance matters. Uh in

future episodes we will explore regulatory developments, compliance, governance and risk challenges and we hope to invite uh others from the community as well to share what works and what does not. Thank you for listening because compliance matters. >> Thank you everyone. >> Compliance matters.