Redefining compliance

First, the question everyone actually wants answered: will AI replace the compliance officer?

For years, compliance roles have been seen as secure. With growing regulatory demands, banks have relied heavily on AML/CTF professionals. These roles were considered stable, essential, and enduring.

AI has now entered the stage. Its role in compliance was one of the key topics of PwC's second EMEA AML survey, published in May 2026, with a Swiss-specific view based on responses from FINMA-regulated institutions. 73 % of Swiss respondents are considering AI adoption in AML processes, yet over half allocate only 0-3 % of their AML budget to it. Data quality was named the main barrier by 73 %, regulatory uncertainty by 53 %. So the ambition is running ahead of the execution - but AI is coming to Swiss AML/CTF regardless.  For compliance officers, it is exactly that uncertainty - what will be absorbed, and when - that feeds the fear of being replaced.

From fear to focus: how AI is already shaping AML/CTF

Fear of a new technology is nothing new in this function. What matters is where AI actually sits in AML/CTF today. The graphic below shows the most common uses, and each one changes the compliance officer's work in a different way:

As AI moves from flagging cases to handling them, supervisory expectations rise with it, and the officer's accountability shifts from running the controls to governing the systems that run them. Alongside FINMA's guidance on governance and risk management when using AI, the FATF, EBA, FinCEN and FCA have all begun articulating expectations on the responsible use of AI in detecting money laundering and terrorist financing. The EU AI Act matters most directly: many AML/CTF and customer due diligence use cases are likely to fall within its high-risk classification, triggering obligations on transparency, human oversight and model governance. Following the AI Omnibus package^[1], the core high-risk obligations apply from 2 December 2027, with existing systems given until 2 August 2028. That leaves time to prepare, though less than it sounds. Easily overlooked alongside all of this are the data privacy implications: wherever AI processes large volumes of customer data, questions of lawful basis, automated decision-making and data minimisation arise under the GDPR and the Swiss FADP alike. These belong in the same governance framework as model risk, and they are far cheaper to settle when a use case is designed than once it is live.

Governing systems calls for a different competency profile than running controls. Human expertise moves towards the defensibility of decisions that an automated system has already made. Algorithmic bias and hallucinated outputs are precisely why judgment stays with people: someone has to validate the outcome, challenge the assumptions behind it, and put their name to it.

It also rewards curiosity. An affinity for new technology is quietly becoming part of the job description.

As AI absorbs the high-volume work, the day shifts towards exceptions and oversight: reviewing what the model flagged, investigating the hard cases, interpreting regulatory change, and making the final call when the answer is not obvious.

Skills that future-proof the role:

• Data literacy / understanding of ML concepts
• Prompt engineering
• Model validation and testing
• AI ethics and governance
• Critical thinking around AI outputs

The talent pipeline is already being redesigned around this. An example is the Lucerne University of Applied Sciences and Arts, which from autumn 2027 will offer Switzerland's first Bachelor's degree in Business Law & LegalTech, with a dedicated RegTech specialisation preparing graduates for compliance, legal operations and digital risk management.

So where is this heading? AI will automate large parts of risk and compliance processes. Accountability will not move with it. Regulatory responsibility cannot be outsourced, because individuals are held to account, not systems. AI also lacks the nuanced judgment and ethical reasoning this function depends on. And criminals are adopting the same technology - deepfakes and synthetic identities at onboarding, AI-orchestrated mule networks - so the workload moves; it does not disappear.

For compliance officers, the message is clear: AI is not a threat but an enabler that creates more space for judgment, context and accountability.

An orchestra only sounds like one when the parts are in tune with each other. Compliance now works the same way: data, technology, processes and people either fit together or they do not. Your role is increasingly the conductor's. You may build few of the tools yourself, but you answer for whether they are aligned, governed and used responsibly.

Waiting to see how this settles is the one option that is not available.

Getting there depends less on the tools than on the operating model built around them. Three priorities stand out:

• Define a clear AI strategy - and scale it responsibly: align AI adoption in AML/CTF with the bank's risk appetite and regulatory obligations, start where value is measurable, and prove effectiveness, false positive reduction and audit readiness before scaling.
• Strengthen AI governance and embed human accountability: model risk management, validation, explainability and human oversight, with clear escalation paths and ownership so accountability stays with named individuals.
• Build skills and break down silos: pair these capabilities with continuous learning, create the roles this shift demands - AI model governance, responsible AI compliance, data quality management - and work jointly with Data Science, IT and Legal.

If you'd like to explore what this means in your context - shaping an AI compliance strategy, strengthening governance or upskilling teams - please reach out, and explore our other AI-related publications on AI insights.