Regulatory Compliance and AI in Financial Services: A Case Study

Thesis Abstract

The accelerating integration of artificial intelligence (AI) into financial services presents significant opportunities for efficiency, innovation, and risk management, yet it simultaneously amplifies regulatory and compliance challenges, including model governance, data privacy, algorithmic accountability, and cross-border supervisory coherence. This study investigates how regulatory compliance is operationalized within AI-enabled financial institutions, with a focus on how firms implement governance frameworks, risk assessment, and auditing processes to align AI deployments with statutory and supervisory expectations. The central aim is to elucidate the mechanisms by which banks reconcile rapid AI-enabled decision-making with stringent regulatory requirements, and to identify practical pathways for robust compliance that do not stifle innovation. The specific objectives are (1) to map the regulatory landscape governing AI in retail and corporate banking, payments, and asset management; (2) to evaluate the effectiveness of existing governance structures, including model risk management, data lineage, and explainability controls; (3) to examine the role of internal audit and external supervision in monitoring AI-related compliance; (4) to assess stakeholders’ perceptions of regulatory sufficiency and organizational readiness; and (5) to develop a framework of best practices for regulatory-compliant AI deployment in financial services. The study adopts a multi-method research design combining a comparative case study approach with a cross-sectional survey. The population comprises 12 large commercial banks and 6 fintech lenders operating in a bounded financial ecosystem, selected to reflect both traditional regulated institutions and emerging AI-driven players. A purposive sampling strategy identifies 12 banks (including three with significant AI-based credit and fraud-detection platforms) and 6 fintech firms (ranging from payment processors to lending platforms) that publicly disclose AI governance initiatives. Primary data are collected through semi-structured interviews (n=40) with senior compliance officers, chief risk officers, internal auditors, and heads of AI governance, complemented by document analysis of internal policies, model risk reports, regulatory submissions, and supervisory correspondence over the last three years. A structured questionnaire (n=240) surveys IT risk managers, compliance professionals, and data scientists to quantify perceptions of model risk, data quality, explainability, data provenance, and regulatory impact on workflow. The data collection instruments are validated through pilot testing with two banks and two fintech firms. Quantitative data are analyzed using descriptive statistics, factor analysis to identify underlying constructs of AI governance maturity, and multiple regression to examine determinants of compliance effectiveness, with robustness checks via bootstrapping. Qualitative data from interviews are subjected to thematic analysis, guided by the Theory of Regulative Compliance and the Legitimacy Theory, to interpret how organizational routines, legitimacy pressures, and regulatory expectations shape AI governance practices. A cross-case synthesis integrates findings to identify common success factors and contextual variations between banks and fintechs. The expected results anticipate a positive relationship between mature model risk management practices and perceived regulatory compliance effectiveness, moderated by data governance quality, explainability, and cross-border regulatory coherence. The study also anticipates identifying gaps in supervisory guidance related to dynamic AI systems, data lineage traceability, and real-time decision auditing. Contributions to knowledge include (a) a nuanced understanding of how AI governance structures translate into regulatory compliance outcomes in diverse financial institutions, (b) an empirically grounded framework for best practices in AI model risk management and regulatory reporting, and (c) practical recommendations for policymakers on harmonizing cross-border AI supervision. The study concludes that robust model governance, transparent data provenance, auditable decision processes, and proactive internal audit engagement are indispensable for achieving regulatory alignment without constraining innovation. Recommendations emphasize harmonized supervisory expectations for AI explainability, standardized data lineage frameworks, and the establishment of joint industry-regulator AI governance pilots to accelerate compliance maturity across the sector.