Compliance Automation / Applied case study
A proposed AI control framework for trade-document triage, designed around the risk, testing, explainability, and audit responsibilities of a global trade-finance governance leader.
01 / The leadership thesis
Start with a narrow, measurable workflow: prepare an evidence-linked review pack for a documentary letter-of-credit presentation. Use it to establish reusable governance for document AI, fraud prioritization, and, later, counterparty risk models. The deliverable is an operating control framework, not just an AI assistant.
Citi publicly offers letters of credit, guarantees, documentary collections, and supplier and receivables finance. These provide relevant business context for this proposal; they do not establish Citi's internal AI architecture. [1]
Extract fields from varied documents, connect evidence across a presentation, surface candidate exceptions, and draft a cited review summary. Measure preparation time and missed issues against an independently adjudicated baseline.
Authorized people retain documentary determinations, sanctions disposition, credit decisions, suspicious-activity reporting, and financing or payment release. A model score cannot override a hard stop.
FATF's trade-based money-laundering indicators span trade documents, commodities, business structures, and transaction activity. They inform investigative questions; an indicator is not a finding of wrongdoing. [2] This case therefore separates documentary exceptions, financial-crime alerts, and model-control failures into different queues.
02 / A worked, synthetic presentation
Fictional case SYN-LC-001: Synthetic Buyer 01 / Synthetic Supplier 01. The fixture explicitly sets a USD 1.2 million limit, zero amount tolerance, and September 10 as its latest shipment date. These simplified checks are not a complete UCP, ISBP, sanctions, or credit assessment.
This runs fixed fixtures and deterministic rules in your browser. It performs no AI inference, document detection, live screening, bank API call, or data upload.
Fixture rule only: extraction scores below 98% abstain. A real threshold must be calibrated, independently tested and approved for each field and use case; 98% is not a Citi policy or a validated operating threshold.
The default presentation contains two candidate documentary issues.
SYN-LC-001 / fixture-v1 / human-review-only
Production design: case ID; original document hashes and permitted locations; field/page coordinates; extraction and rule versions; current policy and screening references; evidence-linked findings; route and timestamps; reviewer identity, rationale and overrides; approval history; retention and access controls.
The text above is a synthetic trace label, not a tamper-evident production log. Secure evidence storage and identity controls would need implementation and validation.
03 / Proposed implementation
These are logical interfaces, not claims about available Citi endpoints, vendors, or system names. Integration contracts, approved hosting/models, data rights, latency, resilience, and access scopes must be agreed with Technology and control owners.
The model has no credentials or tools to release payments, alter screening, approve credit, email clients, or change controls. An external policy layer enforces permissions; document text cannot become instructions. Server-side authorization and segregation of duties are required in production.
Timeout, stale policy, unsupported language, dependency failure, or evidence mismatch routes to the established manual queue. Preserve service deadlines and escalate queue backlogs. A kill switch suspends the affected version or market, not the institution's independent mandatory controls.
04 / The governance owner's deliverables
Register the whole use case and its components: extraction model, optional LLM, retrieval corpus, deterministic rules, screening dependencies, and later predictive models. Record intended use, prohibited use, materiality, owner, market approvals, vendor, data lineage, versions, validation status, limitations, and retirement plan. Classify each component rather than treating the whole pipeline as one model.
| Risk / ID | Prevent or detect | Trigger and response | Owner / retained evidence |
|---|---|---|---|
| G01 / Wrong or missing extraction | Field-level evidence, schema checks, calibrated confidence, completeness tests | Missing critical data or below approved threshold: abstain; checker verifies original | Trade Operations + model owner / corrected field, provenance, QA outcome |
| G02 / Fabricated rationale | Approved retrieval corpus, claim citations, independent evidence checks | Unsupported material claim: suppress draft; manual review and investigation | AI product owner / input-output version and reviewer correction |
| G03 / Financial-crime control bypass | Read-only screening references; separate authorized disposition | Unresolved, absent, or unavailable screening: hold; route to sanctions / AML owners | Financial Crime Compliance + Operations / screening case and decision link |
| G04 / Prompt injection or exfiltration | Untrusted-document isolation, least privilege, egress allowlist, red-team tests | Suspected attack: quarantine AI path; security investigation; preserve manual controls | Security + Technology / incident and adversarial test evidence |
| G05 / Unapproved use or data transfer | Entity / market / purpose allowlist; policy expiry; data-location controls | Unapproved market or stale policy: no automated processing | Local Legal, Compliance, Privacy + business owner / applicability and data approvals |
| G06 / Uneven error rates | Evaluate by language, document type, scan quality and approved market; review proxy risks | Material cohort gap: restrict affected scope; remediate and revalidate | Model owner + independent validation / segmented error and fairness assessment |
| G07 / Drift or unapproved change | Version pins, change approval, monitoring, dependency tests and rollback rehearsal | Critical miss or approved limit breach: suspend version, investigate and retest | Technology + AI governance / monitoring, incident, rollback and re-entry approval |
| G08 / Automation bias or weak audit trail | Originals visible, mandatory reason codes, maker-checker, protected audit records | Missing lineage or decision evidence: not ready for approval; recover record | Operations control owner / reviewer actions, QA sample and control attestation |
Trade sponsors the use case and owns operational outcomes. Product and Technology implement controls. The AI-governance lead coordinates the inventory, risk register, committee pack, escalation, and closure tracking; exact line placement must be confirmed.
Model Risk / independent validation challenges applicable models. Operational Risk, Compliance, Privacy and Security challenge their domains. Release requires the bank's designated authorities; the developer does not self-approve.
Internal Audit provides independent assurance, not design approval. Material incidents reach the accountable executive and control owners. Findings need evidence, an owner, due date, retest, and independently validated closure.
05 / Validation and explainability
Build an adjudicated, permissioned test set with independent Trade and control specialists. Hold out whole transactions and counterparties to reduce leakage; separate retrospective tests from time-forward shadow evaluation. Synthetic fixtures test logic, not production accuracy. Include poor scans, multilingual packs, amendments, duplicate invoices, near-match entities, missing documents, vendor outages, and malicious instructions.
| Measure | Gate and interpretation | If it fails |
|---|---|---|
| Authority boundary | Zero unauthorized writes or hard-stop bypasses across release tests. Every missing mandatory field must abstain in the challenge set. | No release of the AI workflow; investigate and retest. |
| Critical-issue detection | Pre-agree recall and one-sided confidence-bound targets by risk class. Example: 300 independent known-positive cases with zero misses implies an upper 95% miss-rate bound of about 1%, not zero risk. | Extend testing or restrict use. A curated set does not establish production prevalence or recall. |
| Evidence and summaries | 100% mandatory evidence fields present in review packets; zero unsupported material summary claims in the release challenge set. Measure ongoing citation accuracy through human QA. | Suppress affected drafts; use deterministic evidence or manual review. |
| Usability and fairness | Track false positives, missed issues, correction rates, override reasons and review time by approved cohort. Set material-gap thresholds before seeing results. | Investigate data, language and workflow gaps; limit affected scope. |
| Business outcome | Compare total preparation + review + rework time and error rates with manual control groups; include queue delays and cost. | No scaling based on a faster draft alone. |
Show source page/field coordinates, confidence calibration, corrections, and conflicting values. A confident extraction is not proof of authentic documents.
For a later fraud or counterparty score, test suitable SHAP / LIME attributions for stability and meaningfulness. Counterfactuals must be feasible and lawful. Feature attribution is not causality, fairness certification, or a reason to approve credit.
Show supporting evidence and policy references, not hidden chain-of-thought. Evaluate claim support, omissions, consistency, prompt attacks, and abstention. Explanations themselves must be tested.
06 / Current guidance, local applicability
On April 17, 2026, Federal Reserve SR 26-2 superseded SR 11-7. OCC Bulletin 2026-13 also replaced prior guidance. The revised guidance excludes generative and agentic AI and deterministic rule-based processes from its scope. It is guidance, not an enforceable statutory standard. [3] [4]
Design implication: Ask Model Risk to determine applicable model classifications. Establish explicit GenAI, software, cybersecurity, vendor and operational controls for other components; exclusion is not permission to leave risk unmanaged.
For each booking and processing entity, Legal must determine applicable AI Act roles, use-case classification, obligations and current implementation dates. Do not assume all trade-document AI is automatically high-risk, or that a US approval covers an EU workflow. [5]
Market pack: Legal applicability, data residency and transfer basis, language validation, sanctions regimes, record retention, local operational controls, and named approvals. No expansion until the overlay is approved.
The NIST AI RMF and its 2024 Generative AI Profile are voluntary resources for the design of lifecycle controls; they are not regulatory approval. [6] OFAC's framework supplies a US sanctions-compliance program reference. Its use here does not replace institution-specific screening, legal analysis, or authorized disposition. [7]
07 / A first-90-days delivery proposition
Days 1-30 / Align
Meet Trade, Operations, Technology, MRM, Compliance and Audit stakeholders. Inventory AI uses and existing controls; agree pilot scope, baseline, risk taxonomy, component classification and decision rights.
Exit evidence: Sponsor and control-owner agreement, risk register, data permissions, model-risk card and pre-agreed test protocol.
Days 31-60 / Challenge
Build evidence lineage and the rules/AI separation. Run blind comparisons, adversarial tests, reviewer usability checks and fallback drills. Independent reviewers challenge results.
Exit evidence: Validation report, limitations, remediation closure, market overlay, monitoring and incident runbook. No automatic live decisions.
Days 61-90 / Prove
Seek conditional approval for a supervised queue only after gates pass. Track quality and end-to-end time, review incidents weekly, and demonstrate an audit evidence pack to stakeholders.
Exit evidence: Measured pilot decision: expand, extend, redesign, or stop. Thirty-plus-market governance is a staged ambition, not a 90-day rollout promise.
Illustration only: 10,000 presentations/year × 70% eligible × (60 − 40) minutes of total handling time ÷ 60 = approximately 2,333 gross capacity hours/year. All figures are assumptions, not Citi volumes or results. Confirm eligibility, baseline and post-change time in the pilot. Deduct additional QA, remediation, training, model, infrastructure and control costs; Finance validates net value. No headcount reduction is assumed.
Reuse evidence lineage and controls, but create distinct instrument/rule packs and specialist validation. Do not reuse LC assumptions as guarantee or collection rules.
Add invoice-duplication and anomaly prioritization only with approved data linkage and fraud-owner validation. Alerts prompt investigation, not automatic accusations or financing denial.
Treat scoring as a separate, potentially more material use case with credit-owner accountability, independent validation, appropriate explainability, lawful fairness testing and explicit decision-use limits.
“My vision is to make every AI-assisted trade review reproducible: what evidence it used, which controls ran, who decided, and when we must stop. I would scale the control framework only after a narrow pilot proves both safer decisions and measurable operational value.”
Suggested leadership narrative for this proposal; not a statement of prior delivery or Citi's approved strategy.
08 / Evidence and boundaries
Sources checked September 14, 2026. Publication dates below remain the sources' original dates. All architecture, controls, scenarios, targets, ownership mapping, roadmap and economics are this case study's proposed design, not facts about Citi implementation.
[1] Citi / Trade & Working Capital. Product context; undated product page, with separate metrics dated October 2025 (not used in this case). Official Citi source.
[2] FATF / Trade-Based Money Laundering: Risk Indicators. March 11, 2021. Investigative context, not proof that a synthetic flag represents a crime. Official FATF source.
[3] Federal Reserve / SR 26-2. April 17, 2026. Supersession of SR 11-7 and revised model-risk guidance. Official Federal Reserve source.
[4] OCC / Bulletin 2026-13. April 17, 2026. Scope, exclusions and nonbinding status of revised guidance. Official OCC source.
[5] European Commission / AI Act. Living implementation overview; checked September 14, 2026. Local Legal must assess the current text, transition dates and applicability. Official Commission source.
[6] NIST / AI RMF and Generative AI Profile. Framework released January 26, 2023; GenAI profile July 26, 2024. Voluntary resources. AI RMF and GenAI profile.
[7] OFAC / Framework for OFAC Compliance Commitments. May 2, 2019. US sanctions-program reference. Official OFAC source.