Self-executing compliance is the newest pitch in regulatory technology: give AI agents your rules and they will draft your policies, work out your obligations, do the work, and assemble the evidence, with your team approving what comes back. Some of that is real. But regulators do not examine software. They examine institutions, and they ask a specific question about every control: who was accountable, and how do you know it operated?
Key Takeaways:
- Much of compliance can run itself: scheduling, reminders, escalations, evidence collection, and deterministic checks.
- A second tier can be drafted by AI but must be decided by a person: alert dispositions, SAR narratives, complaint responses, policy redlines.
- A third tier cannot be delegated at all under current rules: board approval of the AML program, the SAR filing decision, adverse action reasons, and independent testing.
- The Interagency Guidance on Third-Party Relationships is explicit that using a vendor does not reduce your responsibility. "The software did it" is not an exam answer.
What "Self-Executing Compliance" Claims
The term borrows from contract law, where a self-executing provision takes effect without further action. Applied to compliance, vendors use it to mean a program that runs without a compliance team doing the work: AI agents read regulations and agreements, decide which obligations apply, perform reviews, and produce evidence packs, routing only grey areas to a person.
The appeal is obvious for a fintech with one compliance hire and a sponsor bank sending 48-question oversight questionnaires every quarter. The risk is less obvious. When the agent does the work and a person approves the output, the accountable act shrinks to a sign-off. If that sign-off is the only human judgment in the record, the institution has to defend the agent's reasoning as its own.
The Three Tiers of Compliance Work
The useful question is not whether compliance can run itself, but which parts. Sorting work into three tiers makes the boundaries concrete.
| Tier | What it covers | Can it run itself? |
|---|---|---|
| 1. Deterministic execution | Scheduling recurring tasks, reminders, escalations, pulling evidence from systems, OFAC list screening runs, report compilation, checking signups against license coverage | Yes, with logs |
| 2. Judgment-assisted work | Alert research and draft dispositions, SAR narratives, complaint responses, questionnaire answers, policy redlines, rule-change impact analysis | AI can draft; a person must decide and own it |
| 3. Non-delegable decisions | AML program approval, BSA officer designation, SAR filing decisions, adverse action reasons, independent testing, risk acceptance, regulator communications | No |
Tier 1 is where automation delivers without controversy. A system that schedules the quarterly complaint review, reminds the owner, escalates when it is late, and attaches the report as evidence is executing compliance in the plain sense. The output is verifiable and the logic is deterministic.
Tier 2 is where AI agents add real speed, and where accountability gets blurry. An agent can gather alert context in seconds that would take an analyst an hour. But the disposition is a judgment, and the person who makes it needs to see the agent's sources and reasoning, change the conclusion when it is wrong, and leave a record of what they decided and why.
Tier 3 is set by regulation, not by technology. No level of model accuracy changes who must decide.
What Regulations Keep with People
The non-delegable tier is specific and well documented:
- AML program approval. Bank AML programs must be written and approved by the board, with a designated BSA officer, under rules such as 12 CFR 326.8 for FDIC-supervised banks. Money services businesses must designate a person responsible for compliance under 31 CFR 1022.210.
- Independent testing. 31 CFR 1020.210 requires independent testing of the AML program. A vendor that runs the program cannot also be its independent test.
- SAR decisions. The determination that activity is suspicious and must be reported belongs to the institution under 31 CFR 1020.320.
- Adverse action reasons. ECOA and Regulation B require specific, accurate reasons for credit denials. The CFPB's Circular 2022-03 states that complex algorithms do not excuse that requirement.
- Vendor accountability. The interagency guidance applies to AI vendors like any other third party. Your sponsor bank will treat an agent vendor as part of its third-party oversight program.
On top of these, any AI whose outputs inform decisions falls under model risk expectations in SR 11-7: validation, documented limitations, and ongoing performance monitoring. A vendor that has not published accuracy results gives you nothing to validate against.
What Examiners Will Ask About an Autonomous Program
Examiners sample operating history. The FFIEC BSA/AML Examination Manual directs them to test whether the program works in practice, and for any sampled item, expect these questions:
- Who owned this control, and who reviewed it?
- What requirement does it satisfy, and where is the source text?
- When the agent reached a conclusion, what did the reviewer check before approving it?
- When a reviewer disagreed with the agent, where is that recorded?
- If the interpretation of a rule changed, what changed downstream and when?
A program where agents perform the work can answer some of these. The hard ones are the third and fourth. If approvals are bulk sign-offs on agent output, the record shows that a person clicked approve, not that a person exercised judgment. That distinction is exactly what management oversight findings are written about.
Questions to Ask Any Self-Executing Compliance Vendor
Use one real artifact, such as a clause from your sponsor bank agreement with a genuine grey area, and ask:
- Run the same question three times. Do the answer, citation, and routing match every time?
- Can my examiner read each interpretation as written and trace it to the exact source clause, or does it live in a proprietary format?
- Where are your accuracy results published, with the test set and method?
- For one completed item, who is the named owner, who reviewed it, and what did they check?
- When a reviewer rejects the agent's conclusion, is the override and its reason preserved?
- What does my sponsor bank see, and does that depend on the bank or other partners using your software?
- Which work do you classify as non-delegable, and how does the product enforce that boundary?
A vendor with clear answers is describing a tool. A vendor with vague answers is asking you to defend its reasoning as yours.
How Modern Teams Get Speed Without Giving Up Accountability
The teams moving fastest automate Tier 1 completely, use AI to accelerate Tier 2, and keep a single record where every obligation has a named owner. In Canarie, obligations from regulations, policies, and bank agreements are linked to their exact source clauses, approved by a named reviewer, and turned into recurring work with owners, due dates, and escalation. Scheduling, reminders, and evidence capture run automatically. AI-assisted interpretation feeds the chain, but a person approves it, and the evidence attaches at completion. When an examiner samples a control, the answer is a record of who did what, against which requirement, and when.
For a side-by-side look at agent-first products and owned execution, see our comparison of AI agent compliance platforms and Canarie, and for the broader category, AI that reads policies vs. AI that runs them.
See how Canarie keeps every obligation owned and evidenced →
Frequently Asked Questions
What is self-executing compliance?
Self-executing compliance is a vendor term for compliance programs where AI agents perform the work, including drafting policies, identifying obligations, completing reviews, and assembling evidence, with people approving the output and handling grey areas. Parts of compliance can genuinely run themselves, such as scheduling, reminders, and evidence collection, but regulations keep key decisions with named people.
Can compliance be fully automated?
No. Deterministic work such as scheduling, escalation, evidence collection, and list screening can be automated end to end. Judgment work such as alert dispositions and complaint responses can be drafted by AI but must be decided by a person. Some decisions, including AML program approval, SAR filing, adverse action reasons, and independent testing, are assigned to people or independent parties by regulation.
Do regulators accept AI-performed compliance work?
Regulators evaluate outcomes and accountability, not tools. The interagency third-party guidance states that using a vendor does not reduce an institution's responsibility, and model risk guidance expects AI outputs to be validated and monitored. AI-performed work is acceptable when the record shows who reviewed and decided each item, what sources the AI relied on, and how errors were caught and corrected.
What is the difference between self-executing compliance and a compliance execution platform?
Self-executing compliance puts AI agents at the center and treats people as approvers. A compliance execution platform puts accountable owners at the center: each obligation is tied to its source, assigned to a named owner and reviewer, scheduled as recurring work, and evidenced at completion, with automation and AI accelerating that work rather than replacing the owner.
Compliance can absolutely run faster. The programs that survive examination are the ones where speed comes from automation and accountability still comes from people, with a record that proves both.