AI, risk, and trust: leadership and compliance in the future of banking

Osman Saçarçelik, Global Head of Global Standards, Advisory & Governance for AML/CTF at Commerzbank, discusses how responsible AI governance can strengthen compliance, risk management, and trust in banking, and why leadership will be critical to integrating AI into regulated processes.

 

Could you please introduce yourself, your professional background, and your current role?

My career has always been shaped by the intersection of law and regulation as well as strategy and transformation. I began as a capital-markets and regulatory lawyer at major international law and consultancy firms advising banks, asset managers and Fintechs. Later, I moved into management roles in banking, where I have been navigating complex regulatory requirements and digital change projects — from supervisory licence processes for new banks, regulatory and compliance due diligence in M&A transactions, financial contract negotiations, regulatory capital adequacy, crypto-assets regulations, to financial crime prevention. AI is emerging as the latest wave in my professional development: it can increasingly support defined preparatory and operational steps within controlled risk management and compliance workflows.

Today, I am Global Head of Global Standards, Advisory & Governance for AML/CTF at Commerzbank. Together with my dedicated teams, I develop the bank’s global AML/CTF and KYC policy frameworks, advise business units across the group on financial-crime-prevention matters, perform quality controls, and help translate regulatory expectations into management-relevant insight. I liaise with supervisory authorities and regularly contribute to industry engagement and dialogue by actively participating in working groups and conferences. 

My long-standing engagement with the RegTech and fintech ecosystem — from earlier active involvement in startup initiatives to closely following current market developments — gives me a useful external reference point. What I find most valuable is not the common startup “mythology” or “fanciness”, but the discipline and innovation-drive behind it: focus, speed, direct customer feedback and constructive failure culture. Young technology companies have to make their value proposition visible from the start, often with very limited resources. They must prove quickly which problem they solve better, faster and more efficiently. Regulated institutions should not copy this approach one-to-one. But they can – and often do — translate the best of it into their regulated environment by combining entrepreneurial innovation spirit with resilience, governance and trust.

Should regulators shift from overseeing outcomes to governing AI-driven decision logic — and what does that demand from AML/CTF functions specifically?

The key supervisory shift is no longer only “what was the outcome?”, but increasingly “how was the outcome produced, governed, and challenged?”. In financial-crime compliance, this is already visible in supervisory expectations. It is not enough to point, for instance, to lower false-positive rates in AML transaction monitoring or sophisticated fraud detection systems. Supervisors want to understand the logic and data behind AI-supported decisions: why did the system generate an alert in one case and not in another? Can the reasoning be explained? How does the model differ from existing rules and thresholds-based approaches? Where is the human oversight in the process? These questions should be assessed and documented from the start.

The most realistic use cases in risk-relevant areas are not scenarios in which AI decides autonomously end-to-end, as some people outside the regulated industry might assume. The more practical value of GenAI and large language models lies in supporting preparatory work to increase quality and efficiency: regulatory horizon scanning and research, gap analyses, requirements mapping, policy drafting and consolidation, compliance-risk assessments and regulatory reporting based on available structured data. Subject matter experts still have to verify the outputs and remain accountable for the decisions. 

AI can also help strengthen AML/CTF and KYC processes by identifying weak points and bottlenecks in existing workflows – similar to six sigma or lean management methods. This is particularly relevant in historically grown environments, where transformation often starts with a careful understanding of established processes, dependencies and exceptions. AI can support this work by extracting documentation, deriving test cases and preparing optimisation and modernisation steps in a structured and auditable way. It can also enhance user and customer experience.

How are banks turning compliance into competitive advantage, rather than a cost centre — and where does AI fit into that?

Compliance becomes a competitive advantage when it strengthens trust and risk resilience by helping an institution understand risk earlier, identify and implement mitigating measures and act with confidence in complex and dynamic risk environments. This will help protect customer interests and ensure the integrity of the institution as a “gatekeeper” and the wider financial system. For me, the starting point is a genuinely risk-based approach. Compliance is proportionate and effective only when the specific risk is understood across the customer lifecycle, product, transaction, industry, geography, and broader risk context.

Building on that governance perspective, the competitive value of AI in financial-crime prevention lies in outlining and managing AML/CTF risks in a more data-driven and robust way and often faster than existing systems. The new EU AML framework points in the same direction. It moves banks and other obliged entities from document-centric compliance towards a more data-centric model with a more holistic view of the customer relationship. For instance, under the new EU AML Regulation (AMLR), more KYC information must be obtained by the obliged entity on the customer profile and the beneficial owner compared to the currently applicable AML/CTF regimes. Moreover, obliged entities must report extensive data to the supervisory authorities, i.e. on customer and specific product types, risk allocations, geographic distribution and the institute’s AML/CTF governance. The supervisory authorities will use the obtained data to assess the inherent and residual risk profiles of the relevant institute and derive supervisory decisions. Read narrowly, all this can look like another compliance burden. Read properly, it becomes the foundation for a more data-driven risk management and compliance system, based on richer, better-structured and auditable information that can be further leveraged by AI. Strategically, this matters because financial-crime prevention is moving closer to a data-and-network logic, potentially supported by reliable data providers, electronic identification services, information exchange platforms and other technologies such as visualised graph analytics supporting the “follow the money” approach; obviously only where legally permitted and subject to data protection rules and strict safeguards.

This means AI’s advantage in financial crime prevention is the ability to detect patterns in more data, faster than a human team could do alone. Done right, this is not an isolated technology topic and not primarily a cost-efficiency story. It has to support operational effectiveness, responsible banking and sound risk management at the same time by identifying risks earlier, reducing blind spots, supporting more consistent decisions and making the institution more resilient against dynamic financial-crime threats. The competitive advantage lies in trusted and robust execution — protecting customers, safeguarding the bank and contributing to the integrity of the wider financial system. The same logic is visible beyond the AML/CTF risk type. For example, in the area of payments, the draft Payment Services Regulation underlines that fraud prevention is also a matter of trust in the payment ecosystem. The common theme is clear: financial-crime prevention is increasingly a cross-risk and network challenge. Individual institutions must improve their own controls, while the wider system also depends on lawful, proportionate and well-governed information sharing. 

Talking about costs: AI use cases also need cost discipline. The value of AI investments should be measurable in operational efficiency, risk reduction, fraud avoidance or better decision quality.

The other side of the equation is governance. AI brings model risk, over-reliance on outputs, bias inherited from training data, and security or misuse risks. For regulated institutions, resilience also depends on adaptability and portability, sound third-party risk management, and sufficient domain expertise from external providers. Because AI models can affect decisions at process level, validation, monitoring and escalation become essential. 

The challenge is not simply to develop more AI use cases. It is to govern the ones already emerging, with clarity on inventory, ownership, data lineage, documentation, explainability, monitoring and escalation. The institutions that benefit most will be those with strong experts, reliable data, disciplined processes and a corporate culture that encourages people to challenge and improve AI outputs rather than uncritically defer to them.

Which bank–fintech partnership models are working at scale, and where do they still break down?

In our experience, scalable partnerships benefit from robust and accountable operating models. The form of cooperation may vary, but the principle is usually the same: time to market can be reduced and sales accelerated by joint partnerships, customer experience can be shared, technology can be provided by a partner, but regulatory accountability cannot entirely be outsourced.

In my view, the strongest partnerships, especially from a risk management perspective, are not built around a generic “bank meets fintech” story. They are built around practical questions: who owns the customer relationship, who controls the data flow, who monitors the risk, who has audit and access rights, who reacts in an incident, and how quickly controls are adapted when the product changes. Governance should be part of the product design, not an afterthought once the commercial agreement is signed. If these questions are answered early, partnerships can combine the best of both worlds: speed and innovation on one side; trust and regulatory discipline on the other.

Fintechs also need to understand how decisions are made in banks. Alignment regularly follows structured governance and procurement processes rather than a single decision line. A strong internal sponsor within an organisation helps but is usually only the starting point. Successful partnerships require alignment across business, technology, risk, compliance, procurement and senior management. And fintechs should be well prepared and present their positions in a common language and not only in tech jargon.

AI will raise the stakes. As more fintech and banking services rely on models, agents or automated workflows, institutions need to understand not only the contractual setup, but also the decision logic, data dependencies and escalation paths behind the service. The future of bank–fintech cooperation will depend less on who appears more innovative and more on whether both sides can make innovation governable, auditable, and resilient at scale. In regulated environments, AI should help reduce opacity rather than add another layer of it.

Can large banks realistically build a "maker culture" comparable to fintechs?

My answer is a clear yes — but it has to be a different maker culture. Large banks can learn from the best parts of startup culture: speed, ownership, experimentation and customer focus. But they have to translate those strengths into their own operating model, without compromising resilience, risk management or trust. The useful lesson from fintechs is to empower the people closest to the process to improve it. In my own area, I see many talented colleagues, at all levels of seniority and experience, who are intrinsically motivated to find better, smarter and more efficient ways of working, increasingly by using AI — and who support one another in doing so.

The role of leadership is to create the space, incentives, and trust for a maker culture to happen. Real team spirit is not a soft factor; it is what turns individual ideas into joint progress. The real value comes when skills, governance and workflows develop together, and teams have safe formats to test AI use cases responsibly.

None of this means setting risk-management principles aside. Speed and control are not opposites if experimentation is designed properly. One practical example is shadow-mode deployment: an AI model runs in parallel to the existing process, and its output is compared with human decisions without touching a live case until there is a reliable evidence base. I also prefer pilots with a clearly defined testing scope — for instance, one product line, one country or one customer segment — with clear success metrics and stop criteria defined before the pilot starts. Co-creation matters as well. In the AI era, organisational development means bringing business, technology, compliance, risk, legal, data, and operations closer together, with shared forums, clear decision rights and a common view of value and risk.

Real AI adoption is not a rollout announcement. It is the gradual integration of AI into workflows, controls and decision routines. The real lesson is not speed for its own sake. It is the discipline to make solution orientation and feedback loops part of organisational behaviour. Trust, resilience, and accountability have to scale with innovation.

What does effective leadership look like when human decision-making is increasingly augmented by AI?

This is the question I think about most. Leadership in the AI era is no longer mainly about having the best individual judgement in the room. It is about designing the system through which judgement is formed, challenged, and ultimately owned.

Effective leaders will need to orchestrate a hybrid environment of people, data, models, regulatory requirements, controls and AI-assisted processes. That requires more than technical fluency. It requires the ability to translate strategy into execution, create trust in moments of uncertainty, and help organisations move forward while technology, regulation and markets are changing at the same time.

For me, successful AI transformation starts with designing people into the change, not around it. The important question is not only whether a tool works, but whether employees understand it, trust the governance around it and feel invited to improve the process. People adopt what they helped shape. That is why AI adoption cannot be driven only top-down or only bottom-up. It needs clear strategic direction from leadership and enough ownership in the teams to discover where AI creates real value.

That has implications for organisational design. Central AI capabilities can provide coherence, standards and speed. But their value depends on how closely they work with business, operational processes and control functions, so governance and execution move together. In risk and compliance, this is particularly important. AI can support faster analysis, better documentation and more consistent controls, but accountability must remain clear and human judgement must stay active.

AI also has implications for the way we work together and workforce planning. Over time, the focus is likely to move from purely manual activities toward roles that require judgement, process ownership, model-challenge skills and the ability to manage ambiguity with empathy and guidance.

That is why I see AI increasingly as a leadership, change-management, and translation task. On a personal note, growing up in Germany with a Turkish family background, studying in Germany and the UK, and working in Switzerland and international corporate environments have shaped how I think about leadership. Moving between cultures and languages trains the ability to translate between systems, develop ambiguity tolerance, and remain creative, effective and resilient when expectations are not fully aligned, or things unexpectedly change direction. That matters in AI transformation as well. Leaders have to connect regulatory logic, business logic, and technology logic in a way that people can understand, trust, and adopt.

In my view, the strongest risk and compliance leaders of the next decade will not be those who deploy the most AI use cases. They will be those who build the institutional capability to use AI responsibly, repeatedly, and at scale. In banking, that is not only an efficiency question. It is a question of trust.

About Osman Saçarçelik

Dr. Osman Saçarçelik is Global Head of Global Standards, Advisory & Governance AML/CTF at Commerzbank. Prior to this, Osman was Head of Supervisor Law at DekaBank. Before that, he worked as an attorney in international law firms Norton Rose Fulbright and Deloitte Legal in Frankfurt, Germany and as Associate at PricewaterhouseCoopers in Geneva, Switzerland. On a regular basis, Osman participates in industry panel discussions and working groups of banking associations focused on AML/CTF. Osman holds a PhD in law from the University of Munster.

 

 

 

About Commerzbank

Commerzbank AG is Germany’s leading bank for the Mittelstand and a strong partner for corporate client groups and private and small-business customers in Germany. The Bank offers a comprehensive portfolio of financial services, combining personal advisory, digital banking, corporate finance, international trade, and capital markets expertise.