Navigating the New Frontiers of Bank Compliance

As AI, digital assets, fraud and cyber threats reshape banking, compliance teams face growing challenges. In this episode, Deborah Stephenson and John Soffronoff of Arcsalus Advisors explore how financial institutions can stay ahead of emerging risks, strengthen oversight and prepare for an evolving regulatory environment.

Subscribe to ProSight Podcasts: Apple, Spotify, Amazon Music, YouTube

TRANSCRIPT:

Frank Devlin: This is the ProSight Banking Strategies Podcast. We’re here to inform you on the top trends, challenges, and opportunities in banking today. ProSight is a leading non-lobbying connector of people and information with deep expertise in risk, fraud, compliance, and retail and commercial banking. Our purpose is to empower financial services leaders to strengthen and advance our industry through training and insights, as well as tools and resources like this podcast.

Hello and welcome to this ProSight Banking Strategies Podcast. I’m Frank Devlin, a senior editor at ProSight. As banks and credit unions navigate one of the most complex regulatory environments in recent memory, compliance leaders are facing a growing list of questions with few definitive answers. From the rapid adoption of artificial intelligence and the evolving oversight of digital assets to expectations around fraud prevention, cybersecurity, and BSA/AML compliance, the landscape continues to shift. In this episode, we sit down with two compliance experts to discuss what’s truly top of mind for financial institutions today.

We’ll explore how banks are responding to regulatory uncertainty, preparing for future guidance, and balancing innovation with risk management in an increasingly dynamic environment. Now, I’d like to welcome our guests, Deb Stephenson, executive principal at Arcsalus Advisors and John Soffronoff, founder and managing partner at Arcsalus. Welcome to you both. And before we get started, I was wondering if you both could tell us a little bit about your background in the industry prior to Arcsalus, so starting with Deb.

Deborah Stephenson: Hi, Frank. Thank you. We’re happy to be here today. I’ve been in banking for over 34 years now, started my career as an FDIC examiner, and then was there for about seven years and then went into community banking at several banks sizing from $300 million all the way up to $14 billion. I’ve been chief risk officer, I’ve been a part of compliance officer. I’ve been in human resources, retail banking, leads, also a CEO for a mutual bank up in Vermont. And now I’m very excited to be with Arcsalus sharing my experience with other bankers and helping them guide themselves through risk management, strategy, and performance.

Devlin: Great. Thanks so much, Deb. And John?

John Soffronoff: Yeah. Hi, Frank. Thanks again for hosting this and-

Devlin: Sure.

Soffronoff: Inviting Deb and me to speak. Similar to Deb, I was a regulator. I spent 10 years at the FDIC as a bank examiner in safety and soundness and then a review examiner for compliance. And then I’ve been consulting for the past 26 years. I’ve been working with a lot of community banks and credit unions to help strengthen their risk and compliance programs. I’ve participated in quite a few remediation projects, very substantial remediation projects to address regulatory issues and looking forward to discussing the topics that we have on our plate today.

Devlin: Great. Well, thanks to you both. And I wanted to start out by talking about something that everyone everywhere is talking about, and that’s AI of course, but in terms of the banking industry. And so as of now, we’re talking in September 2026, there is no enforceable federal AI-specific rule for banks. That latest interagency model risk guidance explicitly excludes actually generative and agentic AI, and we’re waiting for something, but it’s not there now. So this being the case, how should banks perceive and how are they proceeding and incorporating AI into their workflow, which everyone needs to do, despite what is being called a gap in guidance?

Stephenson: I would distinguish between a gap in AI-specific regulation and a gap in regulatory expectations. Banks should not interpret the absence of a dedicated AI rule as a reason to wait. The better starting point is what are we using? What are we using it for? What data’s going into it? Who owns that risk? And how do we know it’s working appropriately? And not every AI use case carries the same risk. Using a tool to help draft an internal document is very different from using AI and credit pricing, fraud decisions, customer communications, or BSA. Governance should be appropriate to what the tool is actually doing.

Soffronoff: What I would add from the institutions that we’re consulting with is that the industry and banks are at very different stages. Some are still dealing with informal employee experimentation with ChatGPT, and Claude, and Copilot, and others are building governance before they scale. And some are already integrating AI into fraud, compliance research, customer service, and operations. I think the common denominator should be knowing what is being used and putting appropriate controls around it, basically applying the elements of an effective risk management program: identify, measure, monitor, and control. To be clear though, there is a footnote in the model risk guidance and it explains that generative AI and agentic AI models are novel and rapidly evolving, and as such, they are not within the scope of this guidance. But nonetheless, it goes on to say that “A banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.”

So it’s not a pass. It’s not saying that we’re just excluding AI from this guidance. It means that regulators aren’t quite sure yet how to pronounce guidance for banks to follow. And so in this interim phase, as we wait for definitive guidance, it’s still a responsibility of the institution to put its own controls in place.

Devlin: You did bring up that there will be some sort of guidance we presume that does specifically address it. Is this something that people are talking about behind the scenes, what it could look like, what the guidance could say? Does it help at all to think about that or should we not really get into that prognostication and just carry on? John, have you heard anything? Do you have any thoughts about what the guidance might say?

Soffronoff: One of the things that the regulators are struggling with is how rapidly things are evolving, and it’s going to take some time, I think, for the regulation to catch up. The basic fundamentals of risk management should apply, and I think a lot of the things in the model risk guidance apply to AI just as it does to any other type of model. One other point that is important is that there’s already a significant body of requirements that the banks have to comply with, and it’s up to the bank to evaluate their particular use cases and determine what the applicability of those existing requirements are to those use cases and proceed accordingly.

Devlin: So we do have from the Conference of State Bank Supervisors a discretionary AI supervisory framework, that this is just released in mid-September. Is this something you’ve had a chance to take a look at? Is this a preview of what the feds might say? I know they’re just recommendations and it’s up to the individual states to take these on and use them, but I’m wondering, Deb or John, if you have any thoughts on that discretionary framework?

Stephenson: When you take a look at this, I would not call it a regulation, but I also would not dismiss it as simply a set of recommendations. It’s a supervisory framework designed for examiners. Each state regulator is going to decide how much to incorporate it. We should not assume that there’s going to be uniform adoption. For banks, I would turn the examiner guide around and use it as a self-assessment. Do we know what AI is being used? Can we explain our governance? Who owns it? Have we assessed the risk and our use cases? And do we really understand the employee use of generative AI within our institutions?

Devlin: Actually, will serve as a reference even for a financial institution or something that they can guide them and they can use as a tool. John, before we move on, do you have anything to add on that topic?

Soffronoff: I think you’re exactly right. Even if the federal agencies don’t adopt the exact framework, there’s certainly a lot of common themes and concepts that are coming out of this document. So inventory of AI use cases, accountability, proportional governance, certainly monitoring, and testing documentation, and critically third-party oversight. A lot of our clients are slow adopters to AI, but from a third-party use case and third-party risk management, they have to be aware of their vendors and third parties that are utilizing AI on their behalf.

Devlin: We know that community banks, an example, and maybe that’s who you’re talking about, they’re so much more reliant, especially when it comes to technology on third parties. And now you would imagine, I’ve heard some people say that’s just going to be magnified even more. They’re going to need to shore up their third-party risk management even more than they had to previously, which is pretty interesting. I wanted to move on and talk about the Restoring Integrity to America’s Financial System order. I feel like there was a lot in the mainstream media about that when that executive order came down, but not a ton lately. So I’m just wondering on the ground, if you’re hearing anything from clients, is this something that is challenging to comply with? Is this something that folks are moving on? What are you hearing?

Soffronoff: It’s an interesting point, Frank. I think the important distinction is that banks are not complying with the executive order itself as though it were comprehensive bank regulation. What the order does though is it sets out actions that the Treasury and other agencies need to do. And what matters operationally is what comes out of those subsequent actions from the other agencies. And I think this is a good example of where regulatory change management really matters. Banks need to be able to distinguish an executive order from an agency advisory, or a proposal, or a final requirement and follow what ultimately becomes part of the supervisory process.

Stephenson: And I’d like to add that this has not been one of the most dominant issues that I’m hearing from banks. Obviously AI fraud and broader BSA challenges have been more prominent, but John’s change management point is so important. You have to track it. You have to understand the stage it’s in and make program changes when something actually requires or justifies that change.

Devlin: That’s another great point. And your point about tracking, Deb, is well taken because we’ve spoken in the past when we spoke to you about state regulations as well. So it’s not just the federal regulations, it’s state regulations and things are moving, and so you really need some way to track what’s happening out there because there’s so much to track, and it seems like that situation is just getting more complex all the time as well. So I want to talk a little bit about digital assets, the impact that the failure of the CLARITY Act have passed recently might have on the take-up of digital assets. I’ve read some people say we were thinking 2027 is the year that digital assets really become a measurable part of the traditional banking system. Maybe now that’s pushed out another year, and so maybe banks and credit unions get a break on being able to comply with the regulatory framework there. In your opinion, I’ll ask John this first, can banks take a breather on this and not worry about getting all that in order or not and why?

Soffronoff: Great point. I wouldn’t say that the CLARITY Act is dead. The procedural vote failed to move the legislation forward in its current form, but a motion was put forward to reconsider. The future is a little bit uncertain, but I think the bigger point for banks is that digital assets aren’t disappearing because this legislation stalled. Banks still have customers interacting with digital assets and still have to manage the risks that touch their institutions.

Stephenson: Yeah, exactly, John. And I would not interpret the vote as permission to take a breather or stop paying attention. Community bank does not need to develop crypto product tomorrow, but we do not offer crypto does not necessarily mean the digital assets aren’t absent from that bank’s risk profile. Customers may be moving money to digital asset platforms, fraud teams may see scams coming out, and BSA may seed the transactions.

Soffronoff: The banks really need to look at it from two perspectives. First is, do we want to participate directly in digital assets? And second is, do we already need to manage the risks associated with them? You can answer no to the first, you don’t want to be involved, but you better be ready for the second because there’s probably clients and customers that are already active in digital assets. I’d also offer that there’s a competitive element to this. A bank needs to take a step back and look, is this something that’s important to the customers? Are they putting themselves at a competitive disadvantage if they’re not participating?

Devlin: Taking it from this newfangled, if you will, technology and digital assets and how they affect the industry to something that is an old problem but is bubbling up now to the point that regulators are talking about it more and that’s fraud. A recent ProSight fraud survey found respondents expect to feel more regulatory pressure or attention. Maybe this question gets asked more. Maybe there are even certain guidelines to protect customers that aren’t there now, maybe even outside. We know that the CFPB has been cut back, but maybe there are other ways that that gets addressed. Fed Governor Michelle Bowman gave a speech in May on consumer fraud. FINRA, the Fed, and the SEC issued updated guidance and priorities addressing fraud risks. Is this making its way to examiners? Are they asking more questions about what banks are doing to protect customers? And do you envision a time when maybe a bank’s fraud prevention processes could receive attention in the way that BSA/AML practices do?

Stephenson: I think fraud is absolutely getting more attention, but I would be careful about saying we are heading toward a separate kind of fraud regulatory regime that looks like BSA and AML. What has really changed is really the magnitude of the risk, financial loss, your consumer harm, your reputation, operations, and sometimes BSA implications, they all come together. From an examiner perspective, if something becomes a material risk to an institution or its customers, you should expect those questions about how management understands and manages it. So I would not categorize that yet as a wholesale new examination program, but if you have extended risk, examiners are going to ask about it.

Soffronoff: Banks and credit unions are facing… Fraud isn’t necessarily confined to one department in the institution. Operations is dealing with check fraud. BSA is doing the transaction monitoring and identifying suspicious activity. IT and cyber is dealing with account takeovers. Compliance is evaluating complaints. Payments is dealing with error resolution. I think one of the challenges is kind of looking at fraud holistically and collectively across all these different areas and being able to manage the risk from the broad perspective.

Stephenson: That’s where I’d focus. Banks have a tremendous amount of fraud intelligence within their organizations. The problem is it may be sitting in five different places, so it’s all working together.

Devlin: We did do a webinar earlier this year and it was about cybersecurity, that team in particular, working with the fraud team and breaking down silos and making sure they share information and how beneficial that can be. Speaking of BSA/AML, and obviously it applies to fraud as well, there are challenges that compliance teams might be seeing due to AI-enhanced schemes, and also real-time payments, and then digital assets as well. So maybe converting cash to a digital asset, getting around sanctions and that kind of thing. What kind of challenges are teams seeing in this area with this sort of new technology or regime? How are fraudsters and maybe money launderers using that and what can banks do in response?

Soffronoff: I guess the common thread across all three of these is speed and sophistication. AI is making scams and identity fraud way more convincing than it was in the past. Faster payments are compressing the amount of time a bank has to recognize something is wrong and deal with it. And digital assets are adding complexity when you’re trying to understand the digital trail, where the funds came from and where they’re going.

Stephenson: And so that really puts the pressure on your traditional processes. A lot of programs were built around a world where you had more time to investigate after something happened, but now the question is whether your people, your technology, and your escalation processes can actually operate at the same speed as the risk that’s coming through.

Soffronoff: When we talk about AI, it really impacts both sides of the equation. Criminals are using it to improve their deception, but at the same time, institutions can use it to help identify patterns and prioritize investigations. It’s an arms race really, not simply an AI problem.

Devlin: I just mentioned cyber, you’re talking about AI, and that makes me think about using AI to defeat cybersecurity practices. And this has been a big alarm since the Mythos, but then recently we had the Hugging Face incident. So are examiners or people on the ground talking about we have to right now shore up our cybersecurity because now we have AI that can very easily defeat and get into our systems. John, what are you hearing about that?

Soffronoff: Yeah, I mean there’s definitely increased regulatory attention to AI-enabled cyber risk, although I wouldn’t say it’s necessarily a standard Mythos examination procedure, but what Mythos has changed is discussion about speed and scale.

Stephenson: Yeah, and for a bank, that turns this from simply an IT issue really to an enterprise risk and operational resilience issue. How quickly can we identify something, patch it, isolate a system, and then more importantly, keep operating if something really gets through?

Soffronoff: Yeah, and Frank, you made the point earlier about third parties and how critical they are to community banks. And while the bank may not control the underlying technology, certainly the bank needs to understand the dependencies and what key providers are doing as the threat environment changes. And the same AI that increases the threat can also strengthen the defense.

Devlin: So John and Deb, you were both panelists for our GCOR conference and it was a great session. We thank you again for that. Has anything changed about your outlook for the compliance space since then? Anything surprised you? If not, that’s fine. I’m just wondering. The world does move so fast now in many ways. Anything that you’d like that really caught your attention?

Soffronoff: I wouldn’t say that my overall outlook has fundamentally changed, but certainly the pace has reinforced something that we were talking about at GCOR. In some areas, we’re seeing more emphasis on tailoring and materiality while risks like AI, fraud, cyber, and digital asset are moving incredibly quickly. What has probably surprised me the most is how quickly some of the emerging risks have gone from conceptual conversations to things that banks actually have to govern. I think one fascinating development is the emerging backlash against AI, whether it is concerns about unemployment, the environmental impact of data centers, agents escaping their sandboxes, threats from China, or even the economic risks of circular financing, and the overall rising usage cost. While none of these may have an immediate impact on a bank’s operations, there are definitely developments that banks have to follow.

Stephenson: What struck me from a slightly different angle is that compliance cannot just be about waiting for a regulation and then figuring out how to comply. I mean, look at almost everything we’ve discussed today. Now in several areas, the risk is moving faster than the regulation, and if compliance only enters that conversation when somebody publishes a final rule, you’re probably entering that conversation too late.

Devlin: Right. That’s a great point. John, what you mentioned also was so interesting. You mentioned how some of these compliance issues move quickly from conceptual, you said, to now they’re here, and I feel like just in this AI-fueled world, how many things are we hearing about that are now here that we’ve almost may have even been in a science fiction book two or three years ago or five years ago, things that were conceptual, that were theorized, but yes, now they’re here and we have to deal with them. It’s pretty wild, and it’s pretty challenging, and it’s a fast-moving world, and we’re down to our final question here, and you can choose from something we talked about or something I forgot to mention, but is there something that you think is top of mind for compliance professionals now that people aren’t talking enough about or is it just a sort of takeaway on where we are today, starting with you, Deb?

Stephenson: Yeah, I think one issue that I’d add is third-party risk management, and not because third-party risk is new, because it’s not, but because the nature of the dependency is really changing. If you think about everything we have talked about today, AI, cybersecurity, payments, digital assets, and fraud, banks are increasingly relying on these third parties somewhere in the ecosystem. The agencies just produced a more tailored risk-based approach to that third-party risk management. I think the practical lesson is important. Not every vendor creates the same risk, and banks do not have to have unlimited resources. The focus on those resources has to really be on the relationships that can create meaningful risk for those institutions.

Soffronoff: That requires a lot of judgment from the institutions. The response can’t simply be sending the same due diligence questionnaire to every vendor every year. Management has to understand which relationships really matter through their risk assessment process and criticality assessments, and then allocate the resources where the highest risk in criticality exist.

Stephenson: Yeah, John, that really brings us back to the theme, right, running through the whole conversation today. Good risk management, it’s not doing everything. It’s really knowing where your meaningful risks are, putting those resources there and document those decisions and being able to explain why you did what you did.

Devlin: Thank you so much, Deb and John, for sharing your perspectives with our ProSight Banking Strategies Podcast audience. To our listeners, thanks for spending your valuable time with us. If you liked it, please spread the word. I’m Frank Devlin.

The views expressed by the speakers are the speakers’ own and do not reflect the views of ProSight Financial Association, BAI, or RMA. The views expressed and information shared are of a general nature and are not intended to address the circumstances of any particular individual or entity. No one should act upon any such views or information shared during this podcast without appropriate professional advice after a thorough examination of the particular situation.