Financial services in 2026: compliance that lives in the workflow

Where the sector is

Financial services firms are the most regulated organizations most engineers will ever work with, and the regulation reaches into internal operations that have nothing to do with customers. Expense approval, travel authorization, vendor payments, access requests, policy attestations. Every one of these is governed by a written policy, and every one of them is executed, in most firms, through a process where the policy is checked by a person reading a form.

The customer-facing side has been modernized. Onboarding, payments, servicing. The employee-facing side has not. Large firms run internal processes on a mixture of an aging ERP, ticketing tools, email and shared spreadsheets, and the compliance function reconstructs what happened after the fact.

Into this environment arrives AI, with the promise of automating exactly these workflows. The compliance function is, reasonably, cautious. A model that cannot explain why it approved a payment is a regulatory finding waiting to happen, and every firm has a story about a pilot that was stopped by risk.

What is changing

Policy is moving into the process

The shift with the most durable value is unglamorous: encoding the policy in the workflow, so that a request that breaches policy cannot be submitted, or is routed for exception approval with the breach named. The person reading the form is replaced by a rule the compliance team owns. For a large global financial services company we rebuilt travel authorization this way. Platforms of this type can cut processing time by up to 38% and administrative effort by up to 27%, with the policy applied at the point of request instead of at audit.

Employee-facing systems are being treated as products

Internal tools used to be whatever the ERP shipped. Firms have noticed that employee experience affects retention and error rates, and that a request form which takes a quarter of an hour and three follow-up emails is a cost. The better internal systems are now designed with the same discipline as customer-facing ones: discovery, usability testing, iteration.

Model governance is becoming a discipline

Where AI is used, the questions are now specific. What data trained it. What it does when confidence is low. Who can override it. How a decision is reconstructed a year later. Firms are building model inventories, approval processes for model deployment, and monitoring for drift. This is slower than the vendors would like, and correct.

Audit trails are being designed in, not bolted on

The recognition that a trail has to be a property of the system, not a report generated from it. Every state change with an actor, a timestamp, a policy version and a reason. Immutable. Queryable. This changes architecture: event-sourced workflows are becoming normal where they used to be exotic.

What breaks in practice

Policy ambiguity. Policies written for human interpretation contain phrases like “reasonable” and “where appropriate”. Encoding them forces a decision about what those mean, and that decision has an owner who may not want to make it. The engineering is straightforward. The policy meeting is not.

Exception handling. A rule-based workflow that has no exception path is bypassed on the first day a senior person needs something urgently. The exception path has to exist, be fast, and be logged more thoroughly than the main path.

Legacy integration. The general ledger, the HR system and the identity provider are all authoritative for something and none of them are being replaced. A new workflow platform that does not integrate with all three creates reconciliation work rather than removing it.

Segregation of duties. The policy says the person who raises a payment cannot approve it. The old system enforced that through org charts and habit. A new workflow platform has to enforce it in role design, and it has to keep enforcing it when people change roles, act up during leave, or hold two positions at once. Role-based access in a regulated firm is a harder problem than it looks, and we have written separately about where flat role models break. The short version is that roles, scopes and delegation need to be modeled as three separate things, and most off-the-shelf workflow tools model one.

Reporting to the regulator. Every workflow that is rebuilt is also a workflow the regulator may ask about. If the platform cannot produce, on request, every instance of a policy exception in a period, with who approved it and why, it has not replaced the manual process. It has hidden it.

AI scope creep. A document classification model that works is quickly asked to also make the approval decision. Hold the line. Reading and routing are defensible. Autonomous approval in a regulated workflow is not, and the firm that lets it through will explain that to a regulator.

Where we would start

One internal approval workflow with a written policy, high volume and visible pain. Travel and expense is the usual candidate: everyone uses it, the policy exists, the cost of the current process can be timed, and it touches finance, HR and compliance without touching a customer. Rebuild it with the policy in the flow, an exception path and a trail. Then use what was learned about integration and governance to take on the next one.

Where AI belongs in that first workflow: reading receipts, classifying expense types, flagging duplicates and anomalies for a reviewer. Where it does not: deciding.

Bring compliance and internal audit into the design from the first week, not the last. They will find the ambiguities in the policy faster than the engineers will, and a workflow they helped shape is one they will defend when the regulator asks about it.

What to watch

Regulatory guidance on AI in operations is arriving, and firms with a model inventory and a decision log will adapt cheaply. Watch for the internal audit function becoming a design stakeholder rather than a reviewer, which is happening in the better-run firms. And expect the employee-facing systems to be judged against consumer standards by a workforce that no longer accepts otherwise.

Read more at /industries/financial-services/, or see the case study: A Large Global Financial Services Company.