Banks look to AI to replace spreadsheet-era compliance with continuous checks

Why spreadsheets are running out of road

As BizTech Magazine reported, much compliance work in banking still depends on spreadsheets, emails and people reviewing material by hand. That approach is slow, and it gets harder to scale each time regulations change.

The load keeps growing. More users, more systems and more access permissions mean more things to oversee, and more evidence to produce when an auditor asks for proof. The article says organizations already struggle to keep oversight consistent and to hand over audit-ready records.

Jim Taylor, president and chief product and strategy officer at RSA, argues that the next wave makes this worse. He points to nonhuman identities, meaning accounts that belong to software rather than to a person, and to agentic services, which are AI systems that take actions on their own. In his view, only automated governance tools can keep up with them and shrink the attack surface, the set of places an attacker could get in, as it changes.

SOX testing without the sample

SOX is a US law about the accuracy of company financial reports. Proving a company follows it means testing its internal controls, the checks that stop errors and fraud in the numbers.

Sam Abadir, a research director at IDC covering risk, financial crime and compliance, says AI can turn that work into something closer to an industrial process. It can pull evidence from the systems where it lives, match each piece to the specific control it supports, and spot gaps before the formal testing cycle starts.

The bigger idea is what auditors look at. Today a review often rests on a static sample gathered for one moment in time. Abadir describes a future auditor who works from risk signals across whole data sets. He calls this a move from periodic validation of controls to continuous assurance.

Tracking the rulebook as it changes

The second use case is watching the rules themselves. Taylor says AI can keep reading regulatory publications, enforcement actions and supervisory updates, then link each change to a bank's internal inventory of controls and its policy documents.

The payoff he describes is speed. Responding to a regulatory change can take months today, and he says this kind of mapping can bring it down to days.

He also says speed is not the whole story. In his words, the gain is earlier visibility into emerging risk conditions and control gaps. That means seeing a weak spot forming, not just learning about a violation after it has happened.

Where the value is greatest

The article singles out Bank Secrecy Act and anti-money laundering programs, known as BSA/AML, along with sanctions programs. These are areas where regulators examine banks closely.

The claim is that the real value lies in finding and fixing exposure before it surfaces in an examination. A bank that catches its own gap first is in a different position from one that hears about it from a regulator.

How to read these claims

The excerpt we have is built on two experts describing what AI can do. It does not give results from specific banks, error rates or costs, so treat it as a picture of direction rather than proof of outcomes.

Even so, the logic is clear. Rules change often, systems multiply, and software accounts and AI agents add yet more things to supervise. A process built on periodic samples and manual review has a hard time keeping pace with that.

• Continuous checking replaces point-in-time checking.
• Evidence is gathered from source systems instead of assembled by hand.
• Rule changes are matched to internal controls automatically.

What the piece leaves open is how much human judgment stays in the loop, and how regulators will treat evidence produced this way.