Risk & Compliance in the Age of Digital Transformation

Seal Llego (Interviewer): Hi. Welcome to episode one of our series, The Future of Financial Services, here at Sheffield Haworth.

I’m Seal, and I’m part of the Change and Transformation practice, where we combine deep subject matter expertise with a solutions-focused partnership to deliver our clients’ complex change and transformation mandates.

Today, we’ll be looking at risk and compliance in the age of digital transformation. As we know, technology is evolving rapidly, regulation is moving alongside it, and firms are under growing pressure to innovate without compromising trust and safety.

To tackle these questions and themes, I’m joined by one of our senior advisers, Mark Taylor. Mark brings 40 years of experience in financial services, complex transformation and compliance, having worked at institutions including Goldman Sachs and Credit Suisse.

Thank you for being here.

I’d love to pick your brain. Would you be able to share a little more about your background and what your career has looked like so far?

Mark Taylor (Guest): Yes. I started at the London Stock Exchange. We actually had a reunion last week for everyone who started there in 1986.

Without moving desks, my desk changed organisations from the Stock Exchange to TSA and then SFA. I subsequently left, but that was when the regulator was born, so I was there at the beginning of regulation in the City.

I spent some time at Hambros, which was a traditional merchant bank, and then worked for 20 years at Goldman Sachs. I was the Compliance Officer for various parts of the business and the Money Laundering Reporting Officer for all its European entities.

For the final five years of my employed career, I worked at Credit Suisse, where I was the MLRO and, on occasion, Compliance Officer. It was a difficult period, which ultimately ended with Credit Suisse ceasing to exist, but it provided a very good learning curve.

I’ve since worked as a consultant, and I’m also on the board of a digital exchange.

Seal Llego (Interviewer): Excellent. You’ve held some significant and perhaps quite scary positions with considerable responsibility, so you must know a great deal about this topic.

Let’s start with the big picture. What worries you most about the pace of change in financial services today?

Mark Taylor (Guest): It’s interesting, isn’t it? If we’d had this conversation in 1986, we would probably still have been talking about the pace of change and worrying about it.

However, the pace of change now is, choose a word, scary. There is a lot of rapid and significant development: digitalisation, AI, regulatory change and reform. There is also a great deal of politics surrounding financial services, so it’s a particularly interesting time.

However, the frameworks you use to deal with rapid change are probably the same.

You have to understand the risks and what is happening. If you’re going to transform, build foundations, establish new businesses or introduce new services, you need to spend time understanding the fundamentals of those businesses and your own firm’s infrastructure.

If you work in Compliance, you also need to understand the rules. I always say that at the beginning. It’s an obvious thing to say, almost pointless in one sense, but you genuinely need to understand what the rules are and how they will or could affect your business. It isn’t as easy as you might think.

SL: Is that what many firms are lacking now? Is that what concerns you: the lack of knowledge, the failure to understand the rules properly or the risk of misinterpreting them?

MT: I don’t know. Given the stage I’m at in my career, I’m always likely to look back with a degree of wisdom and think that I can make better judgements.

There is probably an element of truth in that. However, there are also basic, foundational aspects of understanding risk that you need to be able to consider, regardless of where you are in your career.

You can think about risk even if you don’t yet fully understand the underlying technology. You can identify what some of the risks might be while you’re progressing along the technology learning curve.

Things are moving so rapidly that it can sometimes feel easier to move directly into transformation or implementation without considering the basic foundations. I think that’s when things go wrong.

SL: If you had to put a number on it, how long should it realistically take a major global institution to move from learning the basics and understanding the foundational risks to becoming genuinely fluent, particularly with frontier technologies such as AI and digital assets?

MT: You can learn much more quickly than you used to, and you can find information much faster.

Think about my early days at the Stock Exchange. We didn’t have the internet, and we didn’t have computers on our desks when I started, if you can believe that, although they arrived fairly quickly.

What you did need to understand was how trades settled and how the instruments worked. As the regulator became responsible for a broader range of instruments, you had to understand bonds, derivatives and other products.

The world is obviously far more complex now. When I look at digital currency, digitalisation and tokenisation, I think the broad concepts are relatively easy to understand.

It becomes more complicated when you need to understand how assets are traced, how record-keeping works and how transactions settle. However, in my view, you still need to complete that foundational work before you can assess the risks properly.

The key point is that you can now train and learn much faster than you could previously.

SL: Exactly.

Let’s move on to the rewards. Where are the biggest opportunities? Everything is evolving, and technology is developing quickly. We know there are risks, but where are the rewards?

MT: When I talk to people in the digital asset space, I look at crypto and wonder what will happen and how it will work.

Many people of my generation might ask, “What’s it for? I’m never going to look at that.” However, something is clearly happening in the payments and transaction space.

The speed of payments and the way payments are accounted for are developing so rapidly that, at some point, you’ll complete a transaction using crypto without necessarily knowing you’ve used it.

Digitalisation and the tokenisation of equities and other financial instruments will transform what happens in traditional finance, while also creating opportunities through entirely new instruments.

Earlier this year, I attended a blockchain conference in Paris, which was fantastic. I spent some time at a session where people presented business ideas and somebody selected one of five presentations. There’s a television programme with a similar format, although I can’t remember its name.

Two or three of the presentations came from people working in credit, private equity, art and other asset classes. They were talking about establishing businesses based on the tokenisation of those assets.

Property is a good example. There is a real possibility of tokenising property and placing all the painful, laborious documentation relating to property ownership onto the token. You could then buy and sell property in a nanosecond, rather than through a process that currently takes months.

I was transfixed by the fact that people from traditional banks were establishing new companies and fundamentally transforming the old ways of conducting those businesses.

Some of these assets aren’t currently tradable. There is no established venue where you can trade them. Digitalising them opens them to a much wider market and creates a substantial new pool of liquidity.

A considerable amount of capital is locked into private credit and is difficult to move. Tokenisation could transform that market.

It’s fascinating to watch this happen, particularly because some of these businesses grow from nothing into substantial organisations within a year.

SL: Definitely. It’s also slightly frightening how quickly it’s progressing because that pace of evolution introduces additional risks.

If we move away from the instruments and products themselves and focus instead on risk and compliance functions, what opportunities are there to use frontier technology within those functions?

Is it something firms should embrace, even if it’s as straightforward as using AI to make risk and compliance processes more efficient, or is it something you’d prefer to avoid?

MT: You have to embrace it. What you can do with the technology is unbelievable. If you aren’t pushing yourself to use it now, that’s a problem.

There are issues involving confidentiality, completeness and hallucinations. However, you need to work through those concerns and use the technology.

As with everything, you need appropriate checks, reviews and testing, but you still need to use it.

There was an article today featuring somebody from FCA Authorisations discussing the cryptoasset regime. Firms are completing their entire authorisation packs using AI.

I can’t remember the individual’s name, but he said something that I found very informative. He said that using AI isn’t inherently bad and shouldn’t simply be prohibited.

It would clearly be a problem if somebody pressed a button and submitted the application without reviewing it. However, why wouldn’t you use AI to populate the application and help create the required policies, subject to proper checking and review?

It could save a significant amount of time. You can create an entire suite of policies relevant to your business.

You need to ask the right questions and apply the correct parameters, but why wouldn’t you use it?

If you work in policy writing within any firm, you should now be using AI. It’s better to be the person using it than the person who isn’t.

People are developing tools that can write all your policies for you, although some of those tools may eventually be overtaken by an enterprise version of Claude or something similar.

Agents are even more interesting. You can expand your surveillance capability using AI agents. People may continue to operate the surveillance function, but agents can create new surveillance routines and undertake review work.

When I hear people discussing this, I’m most interested in the control framework. How will you ensure that the technology is properly controlled?

If you aren’t thinking about using this technology, you’re going to be overtaken.

SL: Agentic AI is particularly interesting because, in some respects, an agent could operate like another employee.

MT: It could. It’s like a person.

SL: AI agents could conceivably form half of an entire compliance function. Is that frightening?

MT: No. It’s a good thing, but it can also be a bad thing.

The great advantage is that the business can run much faster, which is obviously attractive. If you’re in the business of running, then running faster is beneficial. Nobody on the business side is going to tell you to slow down.

Compliance shouldn’t necessarily tell the business to move more slowly, but it should operate in parallel.

That takes us back to understanding. Compliance needs to understand how the technology works and how to verify that it is producing the correct outcomes.

Fintech firms are moving extremely quickly, and that can be positive. There is a cypherpunk libertarian philosophy that says you should discard the old, introduce the new and change everything.

There is something exciting about that, and I’m not opposed to it. Many good things can come from that mindset.

The problem arises when you implement it without checking what’s happening. If you employed somebody and never reviewed their work, that would be disastrous.

If you deploy agents, you need to check how they’re operating. Again, it comes back to understanding.

You need to understand how to control and instruct them, what parameters have been established and what the risks are.

Most firms using this technology are already playing catch-up to a greater or lesser extent. That’s also where Compliance can help.

We can have these conversations openly and ensure there is a framework controlling what is implemented in the future, while also retrospectively reviewing what is already happening.

The exciting part is that, if you identify something wrong, you may be able to remediate it within seconds.

Some of the large remediation exercises we undertook years ago could now be completed very quickly.

Finding a problem is therefore not necessarily as punishing as it once was. You still need to tell the regulator if the issue is serious, but you may be able to correct it within 24 hours. It’s remarkable.

SL: I agree. It’s remarkable, particularly because firms need to keep pace.

Something came to mind while you were talking about your experience. You must be a goldmine of stories.

Without identifying the organisation, can you share any horror stories where risk and compliance went completely wrong? Bonus points if it involved new technology, but any relevant case study would be useful.

MT: The most obvious example is parameter setting. That applies equally to decentralised finance and traditional finance. The same principle applies in either environment.

If you set the parameters incorrectly at the beginning, it can be difficult to discover that you’ve done so. That establishment point is extremely important.

If you’re using agents to develop surveillance, that’s a point at which problems can arise. If the agents miss an entire category of activity, you have a serious issue.

Data is another example. You might assume a fintech firm wouldn’t experience data problems because everything would be held in one place and there wouldn’t be any legacy systems. However, fintech firms still have those problems.

They’re frequently caused by incorrect parameter settings. You might miss an entire block of data or alerts, or configure something so that it doesn’t flow to the place where alerts would normally be raised.

Those are the kinds of mistakes that create long-term problems. If you miss something at the beginning, the problem continues.

One consequence is that you need a reliable way of discovering it, and testing may be the only way to do that.

What I’m about to say may sound dull, but compliance testing is extremely important.

You can also use AI to assist with testing. However, you still need people testing the outputs, inputs and frameworks.

Testing can appear to be an easy area to cut when firms are reducing costs. However, if you remove it, you won’t discover the problems created during implementation.

SL: There’s a great deal to consider.

If you could give one line of advice to a leader in a traditional financial institution, what should they be thinking about now?

MT: The technology is extremely powerful because it isn’t merely a tool. It’s a tool that can, to some extent, think. That makes it different from many historical technological inventions.

If you aren’t using it, that’s a problem. Being fearful of it is dangerous, but being complacent about it is equally dangerous.

Testing and implementation controls remain fundamentally the same as before, but everything is moving faster.

It can be difficult to resource control frameworks and testing properly within large, rapidly changing environments. However, firms fail to resource them at their peril.

Be enthusiastic about the technology, but proportionate and disciplined about the testing and controls you apply to it.

SL: That’s a very senior risk and compliance leader’s answer.

MT: Yes, but it isn’t wrong.

SL: It can’t be!

Thank you, Mark, for giving us so much insight, and thank you to everyone watching.

That concludes episode one of The Future of Financial Services here at Sheffield Haworth.

In our next episode, we’ll look specifically at AI and how it is being governed within financial services firms.

We hope you’ll stay tuned. Thank you once again, and we’ll see you in the next episode.