The Most Regulated Code You Can Write
Banking software is governed by more regulations than any other industry: SOX (Sarbanes-Oxley: financial reporting accuracy and internal controls), Basel III (capital adequacy, stress testing, market liquidity risk), AML (Anti-Money Laundering: transaction monitoring, suspicious activity reporting), KYC (Know Your Customer: identity verification before account opening), FDIC requirements (deposit insurance eligibility), PCI DSS (payment card handling), and state/federal banking regulations. AI-generated code in banking must comply with all applicable regulations by default.
The consequence of non-compliance: regulatory fines (millions to billions of dollars), criminal liability for executives (SOX violations), loss of banking charter (the bank ceases to exist), and consent decrees that mandate technology remediation. These are not theoretical risks — major banks have paid billions in fines for compliance failures in the past decade.
AI governance for banking: every AI rule must include the regulatory basis. Not just 'log all transactions' but 'log all transactions (SOX Section 302: management must certify financial reporting accuracy)'. The why matters because: auditors will ask why the control exists, developers need to understand the consequence of removing it, and the AI must never suggest removing a control that exists for regulatory reasons.
Transaction Ledger Integrity
The general ledger is the single source of truth for all financial transactions. Every transaction is a double-entry: a debit to one account and a credit to another. The sum of all debits must equal the sum of all credits (the fundamental accounting equation). AI rule: 'All financial transactions: double-entry. Create both debit and credit entries in the same database transaction. After every batch operation: verify that total debits = total credits. Any imbalance is a critical alert.'
Ledger immutability: entries in the general ledger are never updated or deleted. Corrections are made by adding reversing entries (a new transaction that reverses the original). AI rule: 'Ledger entries: INSERT only. No UPDATE, no DELETE. Corrections: create a reversing entry. The full audit trail is preserved. This is not a design choice — it is a regulatory requirement under GAAP and SOX.'
Reconciliation: daily reconciliation verifies that internal ledger balances match external sources (payment processor settlements, correspondent bank statements, Federal Reserve balances). AI rule: 'Generate reconciliation jobs that compare internal ledger totals with external data sources. Flag discrepancies for investigation. Reconciliation must be automated and run daily — manual reconciliation at banking scale is error-prone.'
In banking, the general ledger is an append-only log. Modifying or deleting an entry destroys the audit trail and violates GAAP (Generally Accepted Accounting Principles) and SOX. If a transaction was recorded incorrectly: create a reversing entry (a new entry that negates the original) and then create the correct entry. Three entries instead of one — but the full history is preserved. The AI must never generate UPDATE or DELETE statements against ledger tables.
AML/KYC: Anti-Money Laundering and Know Your Customer
KYC (Know Your Customer): before opening any account, the bank must verify the customer's identity. This includes: government-issued ID verification, address verification, beneficial ownership identification (for business accounts), sanctions screening (OFAC, EU sanctions lists), and PEP screening (Politically Exposed Persons). AI rule: 'Account creation endpoints: KYC verification must complete before the account is activated. Never allow transactions on an account with incomplete KYC. The verification status is a required field on every account.'
AML (Anti-Money Laundering): transaction monitoring must detect suspicious patterns. The AI should generate transaction monitoring hooks, not the detection algorithms (those are specialized). Patterns to flag: structuring (multiple transactions just below reporting thresholds), rapid movement of funds between accounts, transactions with sanctioned countries or entities, large cash deposits followed by immediate wire transfers. AI rule: 'Every transaction: emit an event to the transaction monitoring system. Include: amount, source, destination, timestamp, type. The monitoring system applies rules and generates SARs (Suspicious Activity Reports).'
Currency Transaction Reports (CTR): transactions over $10,000 must be reported to FinCEN. AI rule: 'Cash transactions >= $10,000: automatically generate a CTR. Multiple transactions by the same customer that aggregate to >= $10,000 in a day: also generate a CTR (anti-structuring). The AI should generate the reporting hook, not skip it for efficiency.'
Cash transactions of $10,000 or more must be reported to FinCEN via a Currency Transaction Report (CTR). Deliberately splitting transactions to stay below $10,000 (structuring) is a federal crime. The AI should generate transaction monitoring that flags both: single transactions >= $10,000 (automatic CTR) and multiple transactions by the same customer aggregating to >= $10,000 in a calendar day (potential structuring alert).
Dual Control and Separation of Duties
Dual control: critical banking operations require approval from two different authorized individuals. Wire transfers above a threshold, account closure, system configuration changes, and regulatory report submissions all require dual control. AI rule: 'High-value operations: implement a maker-checker pattern. The initiator (maker) creates the request. A different authorized user (checker) approves it. The same user cannot both initiate and approve. The AI must generate the approval workflow, not bypass it.'
Separation of duties: no single individual should control all phases of a critical process. The person who writes code does not deploy it (separate deployment approval). The person who creates accounts does not approve transactions. The person who reconciles the ledger does not create ledger entries. AI rule: 'Role design: separate creation from approval, execution from reconciliation. The AI should generate role-based access that enforces separation — not a single admin role with all permissions.'
Audit trails for controls: every dual control approval and role-based access decision must be logged. The log must include: who initiated, who approved (or denied), the timestamp, the operation details, and the reason for approval or denial. AI rule: 'Every approval event: log both parties, the decision, and the context. Retention: 7 years minimum (SOX requirement). The audit trail is what regulators examine during bank examinations.'
The dual control (maker-checker) pattern ensures no single person can complete a high-value operation alone. The maker initiates the wire transfer. A different authorized checker reviews and approves it. This prevents: insider fraud (one person cannot steal funds), errors (a second pair of eyes catches mistakes), and unauthorized transactions (the checker verifies the business justification). The AI should generate the full workflow: create request → notify checker → approve/deny → execute/cancel.
Banking AI Governance Summary
Summary of AI governance rules for banking software development teams.
- Ledger: double-entry, INSERT-only (no updates/deletes), corrections via reversing entries
- Reconciliation: daily automated comparison of internal ledger vs external sources
- KYC: identity verification before account activation. No transactions on unverified accounts
- AML: every transaction emits monitoring event. CTR for transactions >= $10,000
- Dual control: maker-checker for high-value operations. Same user cannot initiate and approve
- Separation of duties: separate creation from approval, execution from reconciliation
- Audit trails: 7-year retention. Every control decision logged with full context
- Regulatory basis: every AI rule should cite the regulation it implements (SOX, AML, KYC)