Financial institutions are layering AI onto compliance operations that were never built to support it, and that mismatch could undermine the automation gains many are chasing. According to Duna, a structured AI readiness assessment is now essential for any firm hoping to scale automation safely across its compliance function.
The urgency is clear. Duna points to the Association of Certified Anti-Money Laundering Specialists (ACAMS) Global Threats Report 2026, which found that more than half of anti-financial-crime (AFC) teams already use AI in their compliance programmes. Yet 52% say outdated data and legacy IT systems pose a high or very high risk to those same programmes.
Duna argues that compliance is fundamentally different from areas such as customer support, coding or marketing, where generic AI can handle low-risk tasks without serious consequences. In compliance, mistakes carry financial and regulatory weight, and leaders can face personal liability and fines. The EU’s Anti-Money Laundering Authority (AMLA) has already signalled in its draft guidelines on ongoing monitoring that firms using AI must be able to explain its role, functioning and outputs so they can be reviewed and challenged.
For this reason, Duna says banks need AI that is explainable, auditable and repeatable. Teams must be able to show auditors why a case was flagged or accepted, keep a full record of what the AI was asked and what it returned, and ensure the same information under the same policy always produces the same outcome, with hard rules such as knockout criteria applied every time.
To assess readiness, Duna recommends three steps. First, firms should document current processes, including onboarding, customer due diligence (CDD), enhanced due diligence (EDD), legal reviews and periodic reviews. This means recording each stage, the systems and teams involved, handovers and pain points, then mapping the same journeys from the customer’s perspective to build a data-backed baseline.
Second, policies and tooling should be graded separately. Many policies were written for experienced analysts who can interpret ambiguity, something AI cannot do in the same way. Duna gives the example of a policy stating: “International transactions — For international transactions, country risk is assessed against a geographical risk list to identify increased or unacceptable risk.” Preparing this for AI would require clarifying whether transaction frequency, multiple jurisdictions or the purpose of a payment changes the assessment. On tooling, firms should look for workarounds, fragmented systems and manual information gathering, while recognising that fragmentation does not always require replacing existing technology.
Third, firms should build a blueprint showing how compliance could operate with AI, such as onboarding that collects missing information in real time, a single analyst interface for evidence, and automatic reviews triggered by new customer data.
Duna advises using that blueprint to select a first use case where staff spend significant time on work machines could reasonably take on. Ultimately, the firm says, a readiness assessment is a chance to rethink the compliance function itself, reducing customer friction and freeing analysts for genuine investigative work.
Investors
The following investor(s) were tagged in this article.
