Compliance automation: what actually works

I have bought, built and killed compliance tooling across several operators and multiple licences. The pattern is consistent: automation works brilliantly on high-volume, rule-stable, evidence-heavy tasks, and it fails on anything that requires judgement about a specific human being. Most failed RegTech projects I have seen were failures of that classification, not of the software.

The test: volume, stability, evidence

Before automating anything, score the process on three axes. Volume: does it happen hundreds of times a month? Rule stability: would the rule survive a year without a rewrite? Evidence: does someone need proof it ran? A process scoring high on all three is a strong candidate. A process scoring low on rule stability will produce a maintenance burden larger than the manual work it replaced.

What genuinely automates well

• Screening and monitoring runs — sanctions, PEP, adverse media, on schedule and on trigger.
• Document collection, validation and expiry chasing.
• Evidence capture: every control run writes its own timestamped record, automatically.
• Regulatory reporting assembly — collecting and formatting the data, with a human signing it off.
• Deadline management: a single calendar across markets with escalation before, not after, a miss.
• Tiering and routing: deciding which case a human sees first.
• Training assignment, completion tracking and attestation.

What should stay human

• The decision to file a suspicious activity report.
• Source-of-funds judgement on a complex customer.
• Interpreting new regulation before it has an internal rule.
• Anything where the output ends with a named person's accountability.

Automate the gathering. Keep the judging. The regulator is not asking your software why you made a decision — they are asking you.

Sequence: workflow before intelligence

Teams reach for detection models first because they are the exciting part. It is the wrong order. If your cases live in spreadsheets and shared inboxes, a smarter model just produces alerts you cannot process. Fix the pipe first: case management, structured data, a single customer record, evidence written at the point of action. Once the workflow is clean, the intelligence layer has something to stand on — and you finally have the labelled outcomes needed to tune it.

1. 1.Single source of truth for customer and case data.
2. 2.Case management with states, owners and SLAs.
3. 3.Automated evidence capture on every control.
4. 4.Rules engine with versioning and a full audit trail.
5. 5.Only then: models for prioritisation and false-positive reduction.

Measure the right thing

The metric that matters is not alerts processed. It is analyst minutes per meaningful decision, and the false-positive rate. If automation raises your alert volume by forty percent and your true-positive count is unchanged, you have automated waste. Baseline before you buy, so the vendor's business case can be checked against your own numbers six months later.

Buying: the questions vendors dislike

• How do we export every record if we leave — including audit history?
• Who can change a rule, and where is that change logged?
• What is realistic time-to-value with our data quality, not your demo data?
• How does the system behave when a new market goes live?
• What does the auditor see when they ask how this control ran on a given date?

The uncomfortable conclusion

Most compliance automation programmes underdeliver because the underlying process was never designed, only accumulated. Automating an undesigned process just makes the mess faster. Spend the first month mapping and cutting steps. Very often the biggest win is not the tool at all — it is the twelve steps you deleted before you bought it.