Banks are being pulled in two directions at once. The appetite to deploy AI has never been stronger, yet the regulatory bar for how that AI behaves keeps rising in step. Reconciling the two has become the defining challenge of the next wave of banking transformation.

Gelmini, who spent close to two decades working across KYC, anti-money-laundering and financial crime, makes the case that the real leap ahead isn't more AI tooling — it's automation that operates inside clear, explainable and governed processes. Handled that way, she argues, compliance stops being a drag and starts becoming an advantage.

The hard part isn't the AI — it's the guardrails

Beyond the usual friction of change management, the toughest task banks face when modernising old systems is holding innovation and regulation in balance at the same time.

Institutions are pushed to modernise while still satisfying strict compliance, security and governance expectations, and many are doing so on top of fragmented legacy platforms and inconsistent data that make any transformation harder. Layered onto that is a shift in tempo: after years in which progress felt incremental, generative and agentic approaches over the past year or so have made it feel genuinely transformative again. The open question is no longer whether AI can help, but how to roll it out in a way that delivers measurable efficiency while staying explainable, governed and trusted — and without costs running away.

Bake governance in, don't bolt it on

The core move is to embed governance into innovation from the very beginning, instead of treating compliance as something to sort out later.

Compliance teams matter here because they translate regulatory principles — fairness, accountability, transparency, data governance — into working operational controls. Their job is to keep the organisation asking the right question: what outcome are we trying to reach, and how do we prove we reached it? That means working hand in hand with technology teams and the board so risk management becomes part of the culture rather than a box to tick. Regulatory sandboxes can help firms experiment under supervision, Gelmini notes, but they are no substitute for real compliance. In the end, durable innovation pairs strong human oversight, explainability and solid governance with the ability to actually run AI at scale.

Regtech turns complexity into something you can change

Compliance is inherently messy, and regtech's biggest contribution is shifting that mess into places where it becomes automated, visible, governable and easier to adjust.

Rather than leaning on manual steps, spreadsheets and periodic clean-up exercises, banks can build controls directly into their data, workflows and monitoring. That makes regulatory change easier to absorb, supports continuous practices such as perpetual KYC, and cuts the duplicated control work that piles up across departments. Looking further out, AI-driven automation could push this well beyond simply digitising existing processes: intelligent agents can run inside governed, deterministic workflows that produce predictable results while remaining explainable — letting firms gain efficiency without giving up control.

Firms that map obligations to controls to data adopt a new regulation in weeks. Everyone else is still running a project. — On why governance-by-design pays off

The next AI edge is reasoning you can test

Generative and agentic AI are the technologies genuinely reshaping banking, and the conversation has moved from whether AI can help to how to deploy it responsibly at real scale.

Gelmini is candid that her sense of the biggest game-changer has shifted. Not long ago she'd have pointed to AI that can explain the reasoning behind its recommendations — but regulators already require that, and a smooth-sounding rationale is easy to produce and hard to contest. The real differentiator ahead, she says, will be AI whose reasoning can actually be tested: consistent and predictable across similar cases, traceable to the evidence it genuinely used, and wrong in ways you can detect.

Smoother experience, without the added risk

The best customer experiences strip out needless friction while keeping governance woven into the process rather than sitting outside it.

Over the past decade banks have made real gains through self-service and digitised onboarding, and the next opening is automation that lets AI assist customers within clear policy limits, with human oversight and a human touch retained where it counts. That depends on strong AI governance and orchestration — explainable models, high-quality data, privacy designed in from the start, continuous monitoring and unambiguous accountability. With those foundations set, banks can lift both speed and experience without raising their compliance exposure.

The mistakes that stall transformation

A frequent error is treating AI as a standalone technology project instead of a broader rethink of how work gets designed.

Many organisations end up deploying dozens of isolated tools and agents that never connect into existing workflows or governance frameworks. Another common trap is staying stuck in experimentation without ever scaling the use cases that work — the moment has arrived to move past pilots toward deployment that delivers measurable return. And governance is routinely underestimated: weak data quality, poor explainability, fuzzy accountability and thin human oversight all raise legal, regulatory and reputational risk. AI has to be explainable, well documented and embedded within the controls a bank already runs.

What to prioritise over the next few years

Gelmini's guidance is to put AI to work where it actually matters, responsibly, rather than piling on tools out of a fear of missing out — not everything needs to become an agent.

That means graduating from scattered experiments to enterprise-wide automation, viewing initiatives holistically and connecting them instead of running each as a separate project. AI should live inside governed workflows that offer explainability, predictable outcomes and predictable costs, backed by strong human oversight. Alongside that, banks should keep investing in data quality, governance and compliance capability, because AI is only ever as good as the data underneath it. The institutions that come out ahead, she argues, will be the ones that fuse innovation with trust — making AI a core part of how they operate while holding onto transparency, accountability and regulatory confidence.