Fragmented Controls Leave Banks Exposed

Fragmented control environments continue to undermine the ability of financial institutions to meet a growing challenge of producing consistent and defensible evidence of effective risk and compliance oversight under regulatory scrutiny.

Speaking after her keynote at Risk Evolve 2026, Caitlin Like, Global Head of Customer Success and Account Management at Behavox, said that despite significant investment in surveillance technology, many banks remain unable to prove that their controls work in a coherent and auditable way.

“The controls that govern conduct and market integrity have been built incrementally - by product, by region, by risk type,” Like explained.

She noted that communications surveillance, trade monitoring, policy documentation, and case management are often housed in separate systems with little real-time integration.

This fragmented architecture creates operational inefficiencies, but the deeper issue is inconsistency.

“The same conduct or market abuse risk has to be defined multiple times across those systems, and the definitions often diverge,” she said. As a result, control programs may perform unevenly and struggle to deliver reproducible outcomes.

The problem becomes most acute during regulatory examinations or internal investigations, when firms are required to reconstruct a complete timeline of events.

“Someone has to manually stitch together records from all of these systems,” Like said, describing a process that is “expensive, slow, and error-prone.” In such cases, the absence of a unified evidence chain can leave institutions exposed.

Like argued that the industry must move toward what she described as “defensibility-grade” integration, where controls are designed and operated as part of a connected system rather than as isolated tools.

The distinction, she said, is not about whether surveillance exists, but whether it can be proven to work.

“Can you trace a regulatory obligation through your control design, through your monitoring, through your case outcomes, and through your remediation - with reproducible evidence at every step?” she asked.

Few firms, she noted, can answer that question confidently.

The challenge is being amplified by the growing use of artificial intelligence in surveillance and compliance functions.

While AI offers the potential to improve detection and efficiency, it also introduces new risks around explainability and validation.

“The controls context is unforgiving for AI,” Like said. She emphasized that models used in surveillance must produce transparent and explainable outputs and be capable of passing rigorous validation standards.

Generic AI tools, she warned, often fail to meet these requirements, generating alerts that cannot be clearly justified or producing excessive false positives.