From 9/11 to AI: How Financial Crime Compliance Changed Forever with Richard Harvey

Alex: Richard, pleasure having you here today. Um, so I'll give you a quick call to open for all the audience watching, but um, Richard, you were doing BSA/AML work before there were SARs, which like to a lot of people here like I don't want to say you're old but that is pretty impressive. Uh, before 9/11, uh, before fintech was even a word.

Richard Harvey: So now you're aging me.

Alex: I'm not trying to I'm showing the experience. This is very different.

Richard Harvey: Okay.

Alex: So, yeah, you you testified before Congress on identity theft and you led compliance at both banks and scrappy startup. Um, you've really lived the evolution of risk from a lot of different angles. I' I'd say that's a better way of framing it.

Richard Harvey: That's a good way of framing it. I agree.

Alex: And so, yeah, today I really like to unpack tech trust and how compliance can get in front of AI rather than chase it from behind.

Richard Harvey: Sure.

Alex: Um, but let's go let's go way back. you started out in compliance as I said before SARs even existed. What did compliance really look like in the 90s

Richard Harvey: so long ago? Um yeah, it was it was a different world that we operated out of. Um you know BSA um you know you had the bank secrecy act that was there but in terms of banks and our obligations they were much different back then. Uh before the SAR there was a criminal referral form that we were required to fill out. you know, we still had, you know, monetary instrument um you know, uh forms that we had to fill out and we still had CTR reporting, but nothing nothing nothing like it is today. 9/11 changed everything.

Alex: Yeah. Because you said banks were deputized after 9/11.

Richard Harvey: That's the way it feels.

Alex: Yeah. So, I'm super curious to understand like what did that shift feel like from the inside and how did it change your job the compliance officer?

Richard Harvey: Uh what did it feel like? It felt like um a lot more was imposed upon banks than had been in the past. Um we didn't have the technology that we have today. Um that all came about as a result of regulatory expectations haven't changed dramatically. So um you know I tell people when I used to have BSA/AML exams if they lasted a day a day and a half that was it

Alex: right? I mean, they were asking us specific questions about just general things and making sure that our paperwork and everything was good, but for the most part, day and a half and I was finished with my BSAA male exam.

Richard Harvey: Cool.

Alex: And of course, you know, today that's not the case.

Richard Harvey: No, they can go on for for a significant amount of time. I think like one of the things that I found in your profile that was particularly interesting is you've worked at institutions ranging from like Chevy Chase to Skril to now beneficial state all very different institutions what would you say stayed the same across all of them and what changed so with respect to what ch um um stayed true across the board is that uh compliance became more and more um of something that people had to take seriously.

Alex: So if you take so I'm also a former government lawyer,

Richard Harvey: right? And um so coming into an institution for the first time at Chevy Chase Bank, that was my first introduction to being in a bank, working for a bank and having to deal with um issues that have been raised by regulators, right? So you you know obviously when a regulator raises an issue, you have to address that issue as quickly as possible, right? Um and so that's what we did. We addressed the issues that were raised and uh we pulled together programs. Uh but you know let you know since we're going back in history history you have to understand compliance was a totally different world back in the 1990s.

Alex: So a lot of institutions didn't have compliance.

Richard Harvey: Yeah. I'm really interested like today stats say I don't know how exactly at your institution like compliance usually like 20 25% it could be up to 25% of hires can be in compliance at a bank. How big was like the compliance division?

Alex: So at Chevy Chase, I was brought on as one of the first compliance officers y in the company. Actually, compliance was handled by legal.

Richard Harvey: Interesting.

Alex: That you know, and so that wasn't unusual, especially banks that weren't really large banks, but compliance was just part of the legal function. And it was then that you started to see the change uh that compliance programs were having to be built outside of the scope of legal. And um I was part of the first team uh compliance team at Chevy Chase Bank.

Richard Harvey: And so when you were at Chevy Chase um a couple of years in it got acquired by Capital One. Yes. In 2009 and that was right in the middle of the financial crisis. Mhm.

Alex: What was it like to manage compliance through that kind of institutional upheaval?

Richard Harvey: I wasn't part of Chevy Chase at the time that they um got acquired by Cap One.

Alex: You didn't do the good research.

Richard Harvey: So I no I had I had already gone on to uh E Trade Bank by then. There was an evolution. So I was at Chevy Chase Bank about seven years, right? So it wasn't just compliance. Um if you remember Gramley's Blley Act came out and when the Graham le BL Act came out privacy became a significant part of that and so we not only had to make sure that we had robust compliance but now privacy became an issue and so in addition to being the BSA officer, the compliance officer, I also became the privacy officer for the bank. But I feel like that's a little bit um bit um how to explain but you know you've got in in compliance you need to know everything and in privacy we're trying to minimize data right so you're trying how do you how do you manage that how do you manage like this kind of like very contradictory way of having to to see things things so as you probably recall I've said this at conferences before there is no privacy privacy

Alex: there is no privacy privacy hasn't existed. I mean we we we talk about privacy in a in a way that um we you know suggest that we get confidential information from from people people

Richard Harvey: and how do we handle that confidential information right but when we talk about privacy um the re reality is that we haven't had privacy for for a long long time and that is because people voluntarily give their information away. So it's really hard to say that you really have privacy. Privacy really at a financial institution is about making sure that you secure the information that you have from customers. And you know I'm going to jump on like a little bit of a tangent especially with what's going on in news today. But you know like the government of uh department of war now uh recently like stopped basically working with anthropic due to due to privacy concerns that they wouldn't open their models and allow them to you know do some surveillance. What do you think about that and what do you think about how this might affect compliance privacy um in general in the next coming years?

Alex: To tell you the truth things are happening so quickly.

Richard Harvey: Yeah, I know. And we we don't know I mean how is it going to affect it's going to affect us because we don't know what is going to be the next big thing that we have to contend with as financial institutions and uncertainty is never good in banking. We create our our our um our controls based upon knowing what the rules are. But if the rules are ever changing it makes it extremely difficult for us to keep up. We we we when when I talk about bill controls, if a a rule changes that makes us have to uh incorporate um new technology technology in order to comply with that new rule, that means that it it takes time for us to implement that technology. And once we implement that technology, we're ready to start operating. But if in the middle of creating that technology and rolling it out, the rules change, that makes it extremely difficult for us to keep up with. I agree. I So, as I said again in the intro,

Alex: um you were there also before fintech was really a thing, right? Yes. It was banks running everything. And you've said some FinTax execs had a forgiveness over permission mindset, you know, which as a startup founder, uh, you can cut out of the of the of this of this podcast, but I I can agree with in some instances where, you know, you have to do things, you have to try it out and you don't have time to ask for for permission. um what does that look like in practice and what do you think that might have like involved the downfall of companies you've worked with or you know yeah look as you know I've worked for three fintexs

Richard Harvey: I know

Alex: and and it's it's it's a different risk philos philosophy right sometimes you want to say let's you know see if we can't push it to the limit and if we break it we'll fix it

Richard Harvey: right um banks don't necessarily have that kind philosophy. Banks are more conservative. Uh banks have been around a lot longer, right? And banks, uh, you know, conservative banker is probably a good banker. Um, fintex, they they're disruptors. I mean, you know, things are, we've built this financial structure over many, many years, and fintex are coming in and say, we want a piece of the pie. We want to we want to use the technology um that we are creating to have uh impact that's going to bring things to customers faster, cheaper cheaper uh and you know uh and so if we if we have to break a few eggs to you know in the in the in the process then you know we know there may be some consequences. So um sometimes what you'll have is you'll have these fintech saying yeah I understand the risk but I'm willing to accept that risk and and so you know it's it so for some of them it's easier to ask for forgiveness than ask for permission permission

Alex: and so now I think it's interesting to put it on the other side as in like if you are a fintech founder working in a fintech okay you might not ask for permission you might do things but now put yourself in the shoes of a consumer

Richard Harvey: um you know the OCC controller Michael Hugh said that if a customer can't tell the difference between a fintech and a bank, something has gone wrong. Do you agree with that?

Alex: I don't know that I could agree with that because you have to put it in context. Listen, what I hope for is that a customer wouldn't know the difference because a customer wouldn't need to know the difference because the only thing that the customer is interested in is money.

Richard Harvey: Well, yeah. It's it's having the service provided in a way that's going to benefit the customer. If a fintech can do that, that's that's great, right? If you can offer me the product or service that I need that's going to benefit me and my family and you can do it at a better rate than uh what a bank is doing, doing, I should be with you.

Alex: Yeah.

Richard Harvey: Right. Um, so I what I'm hopeful of is that FinTechs are going to um continue to create to create and um and and they're going to continue to compete with financial institutions. And I my you know hope is that financial institutions are going to either partner with these fintech or become or they're going to compete.

Alex: I agree with you. I think like that's for me the latter is probably the best the the scenario that makes the most well the first one is probably the one that's going to happen. The second one would be the one that makes the most sense.

Richard Harvey: But when you're the size of JP Morgan Chase, how fast can you actually move?

Alex: Well, that's right. So you you think about JP Morgan Chase as his behemoth, right? And uh how mobile will they be? How fast is it going? Um who knows? But I know that you know JP Morgan Chase and other large institutions they're trying to um uh to to compete with respect to the technology that is coming on and and we all have to we all have to take a look at that technology and we all have to determine what's the best way to take advantage of that technology incorporate it into our business models in a way that benefits us and benefits our clients. piggy back on technology um not necessarily going to like the fintech side of thing but rather on the compliance side of thing. So back in the day you probably had to flag those activities manually and it was like hey does this person look legit or not legit and you didn't have like systems to help automate that work.

Richard Harvey: Yes. What's the biggest compliance tooling shift you've seen which was the most effective like in helping you automate work, helping you become more efficient or just catching more fraud?

Alex: So if you if you think about it from a BSA/AML standpoint and and I want to make sure we distinguish because when we talk about compliance um you know at a bank we have consumer compliance and we have BSA/AML, right? And reality is our regulators look at it totally different. BSA/AML is safety and soundness.

Richard Harvey: Consumer compliance is consumer compliance and we get exams separately. On the BSA/AML side though, um in terms of tools, the tools that have really really helped us are those tools that help us um um look at customer transactions on a day-to-day basis and um can alert us to activities that appear to be unusual, unusual, right? having that as a tool as opposed to human beings having to try and evaluate all of that information. Um that's been a significant benefit to um financial institutions.

Alex: But there's still the problem which is lesser problem obviously but the amount of false positives being created by by those systems.

Richard Harvey: Have you today like since being at beneficial bank because the rise of AI has really existed since your time there. Um, have you implemented tools to help reduce that? How well do you think regulators are going to see a tool like that? Uh, which inherently would like potentially automate some of the decisions. So, the tools are getting better. They're listen, they're not going to be perfect,

Alex: right? So, it's reducing and and we have to the thing about it, a tool in and it of itself isn't enough. we have to learn how to appropriately use the tool in order for it to maximize what it it does for us. Right? So it is that handinhand process and the um the manufacturers of those tools are also learning and so they're continuing to upgrade those tools in a way that that help us. So at the AAMS conference that you and I were at um uh I I met with uh of one of the vendors there who reached out to me and said listen I can help you reduce significantly your force positives it's like call me right it's like that's what anything that can help so I know that there are continu you vendors are continuing to create these uh ways to make it better for us um and so I listen I think the technology is going to keep getting better. It's going to reduce the amount of false positives that we have and we can um you know put our resources better directed towards those things that we really need to be looking at and and not running around, you know, trying to chase things that aren't worth chasing.

Richard Harvey: But how do you do so? Because you said at a conference you said AI has the power to do immense good.

Alex: Yes,

Richard Harvey: obviously. uh but it can also be warned it can worsen bias and so reducing false positives positives in the sense where like an AI makes a decision based on like the procedures and the policies and doing research on someone someone things can go wrong you could onboard a person that shouldn't be onboarded you could reject someone that shouldn't be rejected rejected how do you make AI responsible in compliance compliance okay now we're talking about broad compliance again right

Alex: BSA Let's go.

Richard Harvey: And so, okay, so when I when I mention the fact that um that I have certain concerns about AI in terms of um you know making decisions that are um you know it it could be based upon criteria that we're not allowed to make decisions upon, right? So you think about uh in a compliance in a consumer compliance pers from a consumer compliance perspective right if you're embedding AI into the decision-making process and AI generative AI is um based upon information that has already been fed into that program I don't know Chad GBD whatever one you want right there's inherent bias that's already there because we know that outcomes um you know based upon testing and things like that have shown that there's a bias towards um some groups of people over other groups of people. So that bias is going to be embedded into the outcomes if you're just using AI to make those decisions.

Alex: And so to that extent in your view where should AI never be used without human review and where do you think full automation is safe? Yeah, when I thought about that question, I don't know if auto automation is safe with generative AI. So, you're talking about if if you're talking about agentic AI.

Richard Harvey: Yeah.

Alex: Right. I you know, if if if a if if I make a call, which I do, I make calls to um companies that I work with, you know, that that that you know, maybe an electric company or something like that. I'm trying to check on my electric bill. I get uh you know um an AI assistant

Richard Harvey: AI assistant on there.

Alex: Honestly, I hate that.

Richard Harvey: Some of them are getting weirdly good, but most of them are bad.

Alex: I Oh my gosh, I hope they get a whole lot better. Uh I just want to get to a person, right? But in that I mean the autonomy there probably is okay, but um if you're talking about final decisions, I'm concerned about that. I'm concerned about AI driving final decisions without human intervention even if it's for lowrisk false positive alerts in transaction monitoring because I would understand like if you're like hey we will not file a SAR without human intervention.

Richard Harvey: Yes, that makes sense.

Alex: Okay.

Richard Harvey: Okay. If you're talking about alert disposition, name screening, transaction monitoring screening, ID verification, source of funds, like checks that might be smaller and more manageable, do you think that those will at some point be fully automated or do you still think that if it comes to an onboarding decision, decision, a human has to be involved?

Alex: Yeah. So, it depends. And what I what I mean by that is what is going to be acceptable to our regulators. So remember it all it comes back down to have you validated the system to the point that you know within a certain certainty that it's going to be accurate. Right? So the systems that we have in place now, we have to go through a validation process on a regular basis to make sure that the information that you know we're we're getting from that system is validated and the regulators expect to see that. So yes, you know, uh if the if the regulators are comfortable with us using something that is just, you know, that a human being doesn't have to get involved in, I guess we might get to there. Um, but we're going to we I I I would be hesitant to say we can get to their that point on our own without having the regulator say, "Yeah, look, as long as you have this validation process in place and it works." But remember, as soon as things blow up, it's on it's on the institution.

Richard Harvey: Yeah. All the time. And um so let's zone zoom in a little bit more in the in the regulation in the regulatory system and how you see future shifts happening. Before going back to AI um I want to talk about a topic that a lot of our guests have talked about. We had a lot of crypto companies uh people from crypto companies come here. You said you f first asked regulators about crypto rules and regulations in 2012.

Alex: Yes. And now 14 years later,

Richard Harvey: I'm still waiting.

Alex: You're still waiting.

Richard Harvey: Why does regulation always trail innovation?

Alex: Uh it it would never catch up. So you have a process that you have to go through for regulation. You got everybody has an opportunity to weigh in and uh along the way through that administrative process there are bumps along the way. Uh and so regulators

Richard Harvey: 14 years is big bumps.

Alex: It's a it's big bump. Big bump. Listen, I I suspect regulators are still trying to decide what what they're going to do now, you know, um listen, cryptocurrency has come a long way since since

Richard Harvey: Geocach already and

Alex: yeah, I mean, look at look at how many uh um you know, cryptos and and and stable coins, all of these things have come about in that 14-year window that we talk about, Right. And I am still waiting on regulators. I've been on panels with regulators back then when I was working for a company then we were you know um working with folks in crypto right and and and back then they were talking about yes we don't want to stifle technology but we do understand there has to be some guard rails around it.

Richard Harvey: But if you wait 14 years to build the guardrails then inherently there's a 14 years period with no guard rails. And I'm I'm assuming that what's happening within the uh regulatory framework. Now look, I I believe that you do have some examples though that have been positive. Um I think about the state of New York and some of the things that the state of New York has done around um crypto regulation and working with the crypto industry. Um, as a matter of fact, uh, the former, um, superintendent of financial services there, um, Adrien Harris, um, she was outstanding and she left recently. Um, and I must say that she used to be a board member of Beneficial State Bank before she took that job. But, um, she's been hailed for, you know, working across the country, but also across the world in the space of crypto um, and and other putting regulatory controls around um, you know, crypto and and other um, fiat currency or whatever we want to call it. But um so it can be done but again you know you're talking about a government and and and the processes that government goes through in order to make some decisions about what they're going to do and then it's and you know we were talking about it earlier and then you know then you'll have a new administration and their focus will be something different

Alex: but how do you think this so the we've said it earlier the speed of in of innovation has just like done this basically basically and the speed of regulation flatline basically stay the same.

Richard Harvey: If we assume that the speed of innovation is going to continue increasing like that,

Alex: what do you think has to change so that regulation maybe doesn't go like that but you know has a so think about it though think about the way regulations usually come about. Graham Leech Blley Act for example, we didn't see privacy provisions come about until Graham Leech Blley act after there was some kind of uh problem that happened around privacy. I mean regulators tend to respond to um issues after something bad has happened, not getting ahead of it.

Richard Harvey: So So something about has to happen. Listen, I I tell people all the time is what's going to happen with AI is that somebody's going to go out there and do something that hurts people.

Alex: For sure.

Richard Harvey: And that's when regulators are going to say, "Oh, say, "Oh, we can't allow that to happen anymore."

Alex: Interesting.

Richard Harvey: I want to go back to Chevron very quickly. Um, so post Chevron, of course, will interpret laws, not regulators.

Alex: Yeah. How will that shift change compliance and what are the risks of law by litigation?

Richard Harvey: Chevron had been around for a long long time and what that meant was that we could rely upon the fact that uh these regulators who interpret the law and they put in rules that tell us how to follow the law. We could rely upon that. We don't have that reliance anymore.

Alex: No.

Richard Harvey: No. And so I don't know what the total impact is going to be other than remember consistency.

Alex: Yeah.

Richard Harvey: What I suspect is that folks who feel agrieved by um the way a regulator wants to interpret the law, they're going to go to court and they're going to try and pick and choose the jurisdiction in which they want to go to court that they think is going to be more favorable to them. And then we could end up with this patchwork of rules that we're trying to figure out which one should we follow. So if one court says this, another court says that, says that,

Alex: it's it's going to be very difficult for us to to know um how far it's going to have to go through the judicial process before a final determination is made. So my concern is that you know because Chevron had been around for so long and it did didn't just impact banking it was you know all industries right yeah 100%

Richard Harvey: and so um the uncertainty and and like I told you in the beginning for as a bank we you know that's the worst thing for us uncertainty we need we need some certainty so we can build our programs around uh rules that we're going to make sure that our folks follow

Alex: funny you talk about courts because in June before the Supreme Court actually overturned Chevron's deference which was 40 years after it happened. Um in practical terms what does that mean for a compliance officer who's built their program around agency guidance?

Richard Harvey: It means that we have to continue to stay alert uh in terms of um what what the requirements are.

Alex: Yep. as they change, as we start to see things going to court, we need to be um aware. So, in the past, we weren't looking to courts to make these determinations for us. We're looking to agency guidance. And so, you know, a when the agencies um give us that guidance, we're, you know, we're all over that. We're saying, "Okay, this is what this is how they're going to evaluate us when they come in to examine us. I I I suspect they'll still give us the guidance, but what if someone challenges that guidance, the agency's interpretation? Now, they have a recourse to do so. Now, they've always had recourse. It's just that Chevron uh was there and it said deference is given to the regulator.

Richard Harvey: Yes.

Alex: Right. No more.

Richard Harvey: It's crazy. It took 40 years for it's those timelines are 14 40 years. Um but yeah I want to tap now again talk about the your experience as former um CPO so not not product but privacy.

Alex: Mhm.

Richard Harvey: So you said bluntly there's no such thing as privacy. We already covered that. Um but what led you to this? Like obviously we're saying that we have we take all the information. We're as a privacy officer you're trying to minimize the risk of that uh of that information leaking out or having any issues with that.

Alex: But

Richard Harvey: But why do you really think like there's no such thing as privacy which is concerning for for a CPO? This is not big brother right all those cameras here.

Alex: So so think about it. Think about all of the things that people give out voluntarily. So why do you think it's um it's fruitful for people to be calling you on your telephone and and saying that you know um I'm calling from CVS and um you know the government wants to give you something. All you have to do is tell me your um your um social security social security number. People trust.

Richard Harvey: Yeah.

Alex: And that trust gets us in trouble, right? And so when I say but okay and that's one way but what about Facebook? People go on there and they give up tons of information. They look I I can go on there and find out where somebody lives. I can go in there and find out where someone is having dinner. I can go out and find out all kinds of things if I wanted to. wanted to.

Richard Harvey: I'll tell you something funny. So Sphinx, the company we're running, has been out for we've been running for a year and a half, right? Um so 2024 um around I don't know July, which was before like the whole the hype of AI was starting to take place, but it was still not as big as it is today, right? And we were doing discovery and we're talking to a lot of compliance analysts and offices from different banks, FinTech and whatnot. And we talked to compliance analysts at probably top five US bank, right?

Alex: Okay.

Richard Harvey: And I'm like, hey, do you use AI? And they were telling me, "No, we can't." At the time, they couldn't use it. Management would say, "No, privacy reasons, etc." And then I asked them, I I won't give their name because otherwise they'll probably get fired, but I asked them, "Do you use AI?" And they were like, "Yeah, of course." They said they would take all the documents. So proof of address or that dump it into chat GBT and you know this was like a one instance of like someone admitting it.

Alex: Yeah.

Richard Harvey: But there's no way that this must have had hundreds if not thousands or tens of thousands of compliance analysts across banks in the US and worldwide doing exactly that.

Alex: Yeah.

Richard Harvey: What do you think is the impact? It's significant. Listen, um, when you put that information out there, you don't know where it's going to end up. And that is the problem. Um, how are you? So, if I'm telling my compliance folks, don't provide that kind of information to anyone outside of this organization, and then they go and they rely upon rely upon some AI tool that they have absolutely no control over, they don't know what they're going to do with that information. Uh, that's a huge risk and that's what we need to be concerned with. We need to find out how do we create guard roles within our own institutions to make sure that that doesn't happen.

Alex: I'm going to give an analogy. My question is going to be what what would privacy framework built for AI look like? And the analogy I was going to make is you know um well you just met my dad which is funny enough around the corner. But um my parents never told me not to smoke or not to drink, right? You know um because I think you have this incentive when oh you can't do this and I'm going to do it. You know what I mean? So I've I've never smoked and I've like okay I'll have a beer with you afterwards. That's the extent of it. And I believe like this was exactly the same that happened with AI. Like you tell everyone, hey, you can't use AI. You can't use AI. Well, obviously you see how efficient everyone is. You want to use AI and you're going to use it regardless of the risk that that it entails.

Richard Harvey: So now the logic thing to say is like everyone will use AI period. Um, and so how do we actually create a privacy framework built for AI so that's we can use it in a safer way?

Alex: You have to put some controls around it. You have to so yes and and the thing about it is everybody should be wanting to use AI. is a fantastic tool.

Richard Harvey: It's my favorite two-letter word.

Alex: Absolutely. It's a fantastic tool but just like any tool it could be used for good or it could be used for bad. And what you need to do is you need to one um learn um how AI can help you, right? And learn how it can hurt you. I mean, it it you know um it can give you false information that you're relying upon and um we've seen that happen in in in the law where folks are using AI to create briefs and then submit them to the court and the court said that there is no case like that. Yeah. Right. So you cannot rely exclusively on AI to do your work for you. So what we as institutions and you know we're doing this at our institution you you got to put some guard rails up. You got to say what you can do and what you can't do. But we want to encourage the use of AI in a responsible way. But I'm curious to see like whether it's at it's at beneficial state bank or like other people practitioners that you know that are in different institutions

Richard Harvey: practically speaking what does that look like? Have you implemented AI tools at beneficial state? Do you know of people that have started implementing those tools in production at other companies? How does the implementation of those how does it take like how does it work and how does the trust you have in those tools is being built.

Alex: Yeah. And I think that's an ongoing discussion, right? It's and every bank is going to be different. Um there's so many different AI tools. I I get emails. I get calls from all over the world about this AI, how this AI can help you and how this I I can't take a look at all of them. Yeah. Right.

Richard Harvey: But I have looked at a few of them and absolutely they can help me. You know, whether it's in compliance, BSA, legal, those are tools that can help, but I have to be cognizant of the fact that there are also limitations there. the same tool that can help me if it's misused can hurt me or hurt my bank. And so I have to um scrutinize anything before I allow implementation.

Alex: Let's talk about people training and the compliance analyst of the future because things are changing and as we said AI is changing things. So now roles are going to inherently change. Um, so we've talked about this right now, but you said like, okay, AI won't replace people. We're still going to have to be the ones making the decisions, but the grunt work itself is going to be vastly reduced.

Richard Harvey: Yes.

Alex: Um, so this means that it might shrink teams teams probably will most definitely actually will.

Richard Harvey: How does that shift what a compliance analyst in BSA for instance needs to be good at today?

Alex: Technology. You think about BSA/AML, it is a specialty.

Richard Harvey: Yeah.

Alex: Right. We we train our folks on being good at um um looking at customer information, evaluating the transactions that they engage in, making certain determinations as to whether or not it's suspicious activity that's going on, all of that. But now we have all these tools. We've got this AI tool now that can help us make those decisions. But it's not just about relying upon AI. It gets back to what I was saying before. It's how can I best use AI to achieve the goals and objectives that we have to make make us better, more effective, more efficient, but at the same time to make sure it does no harm.

Richard Harvey: So do you say that do you think that the compliance analyst of the future has to be a better technologist than a domain expert? I don't know if better than the main expert, but they definitely have to understand and appreciate how to use the technology. So, you know, let's go back to 1996 when I first started, right? We didn't talk about these kind of things. We didn't have these kind of tools.

Alex: Um, and so we didn't get trained. We weren't they weren't expecting us to know technology or anything like that. The world has changed significantly. If you want to be a compliance uh BSA/AML person in particular, you have to um get trained on how to use this technology to benefit your organization. Otherwise, you're going to get left behind.

Richard Harvey: But you did mention that a lot of compliance folks, they don't get trained in tech.

Alex: Mhm.

Richard Harvey: Why is that? And do you think there should be a completely way that any organization has to rethink how they train compliance people?

Alex: Yes. Not not just organizations. And so when you say how they train, organizations usually make sure their people get trained, right? So um I teach for the American Bankers Association. I've been teaching for them for a long long time, right? And um and we need to incorporate um technology training in in in our trainings that we do for folks and we need to you know that they should be doing that at any kind of training of your compliance staff now needs to have some kind of training that says how do you use this technology okay we still assume that alerts will be reviewed manually for now but let's go five years maybe 10 years in the future where we can say that AI handles routine other triage and maybe disposition, right? AI is able to go over 80% of the false positives and the alerts that we have today. This will remove the biggest chunk of what a human has to do today. Um what do you think is the compliance like the BSA role of the future in the next 5 to 10 years? Is it going to be about building programs? Is it going to be about opening up new regions and new markets? Is it going to be about products and then being like the person behind like orchestrating those, you know, safety nets and those guard rails for the expansion or is there something else that you think it's going to be relevant?

Richard Harvey: Actually, I think it's probably going to be a combination of the things that you just talked about. I think um as as we have these new technology advances cuz you know look we're at the initial phase of really starting to incorporate AI but AI is not going to stop. It it it's going to continue to get better. It's going to so we need to first and foremost be um attuned to and training our people to stay up to date on that technology. That's why I told you you got to incorporate technology training into um the training that you do for your your your BSA/AML teams. Now, it's just got to be part and parcel and understand that um this technology and and listen, we may not call it AI, maybe something else, but technology is just going to continue to um to proliferate and we need to stay up with it. So, compliance person of tomorrow, get, and I've been saying this for a while, learn to be someone who understands technology and can incorporate it into the work that you do. So, you've got all of this knowledge about how to identify, you know, potential criminal activity, but now you've got all these tools to help you be, you know, more refine your your um conclusions, right? how you going to use that technology so you can make decisions but make them faster and more accurate decisions. Um but remember the bad guys are using this technology too.

Alex: Yeah.

Richard Harvey: Right. How you going to stay they they level up always.

Alex: Absolutely.

Richard Harvey: That's always a thing. So everyone watching here uh learn how to be a technologist.

Alex: I think one thing that was really interesting when I read over your profile was that you testified before Congress Congress on identity theft.

Richard Harvey: Yes. But I don't think a lot of people can say they've done that. Um, how does a compliance officer end up in front of Congress and what was that experience like?

Alex: Let's start with what the experience was like, right? Because I didn't anticipate that I would ever be before Congress.

Richard Harvey: But I was working with the American Bankers Association at that time. Like I told you, I've been working with them for many, many years. And they asked me if I would do that, if I would testify uh for on behalf of the ABA and and the industry. And um absolutely it was, you know, honored to be offered that opportunity. What was it like? It was very enlightening, right? Um I was there. There was law enforcement there to testify. There were other experts that were there to testify about privacy and things like that. And I got to hear things that I would not have otherwise gotten to hear. like, you know, yes, you know, you guys sent us in all of these um uh reports and and things like that, but yeah,

Alex: we can't we can't take a look at all of them. So, we got these thresholds, right? These dollar thresholds before we would even think about it. And and one of the other things I learned is look, you know, because I'm I'm seeing all these reports, but the government, they get so many of them that they have to put a threshold, a dollar threshold, and they know that criminals now understand those thresholds, too.

Richard Harvey: And so criminals were deciding, listen, instead of going out and shooting people and everything, it's so much easier for me to just go and um defraud folks because even if I get caught,

Alex: Yeah. the the penalties are less. Yeah. Interesting.

Richard Harvey: Right. So, so it it was a great experience. Um I am, you know, I'm always grateful to the ABA for the opportunities they provided me over my career and u like I said I continue to work with them.

Alex: So you've said earlier today um for regular issues something something bad must happen, right?

Richard Harvey: Yes. Things like um put rules into place.

Alex: Yeah. that it typically follows after something bad has happened.

Richard Harvey: So, let's say that you're testifying before Congress today.

Alex: Yes.

Richard Harvey: Not on identity theft like in the early 2000s, but on AI and compliance VSA in 2026, 2026, what would you tell them they did wrong that they didn't do today that they should do today? What they should do today is they should put So, um, okay. So, I'm in front of Congress now. Yeah. What I'd love to see them do is to um just give us the rules. What are the rules around um cryptocurrency? What are the rules that are going to be in place around AI and other technologies that are going to come um after AI? Give us the rules. Give us some certainty that these rules aren't going to change before we even implement our processes to to follow the rules. right? That look, we will adapt

Alex: Yeah.

Richard Harvey: to whatever the rules are, but if you really want to um assist the banks in doing the job that we've been commissioned to do, right, um then you've got to help us. The other thing that I would ask is law enforcement, right? I'd love to see more information given to the financial institutions. Um because when we don't when it's just a one-way communication, we send in SARs.

Alex: Yeah.

Richard Harvey: We have no clue whether or not anything happens as a result of those SARs. So what if I got a bad customer and I terminate that customer relationship? they go right down the street to the next bank and it's going to take the next bank some time before they start seeing those kind of transactions that cause us to um you know terminate their relationship. So the more sharing of information between financial institutions and law enforcement would really be helpful. One of the last questions is you've sat at the table of some of the biggest shifts in the industry and I think we've covered probably all of them today but um 9/11 the financial crisis the fintech boom and now AI is there a moment throughout your career that genuinely changed how you think about the job one moment

Alex: the one moment where things change if there is any there's often like one or two but I don't know if there's like one big one I'd love to mention

Richard Harvey: um look I I I always go back to 9/11. That was the big thing. The the changes that were made after 9/11 were throughout my career, those were the most um significant changes to the way that um from a compliance standpoint, we, you know, having to build those kind of infrastructures that we didn't have built before and then continue to enhance those infrastructures. I guess that would I would say that's probably the the biggest incident that sort of changed the way compliance um broadly speaking compliance right um throughout my career that that's just been the biggest thing.

Alex: All right, let's do a quick lightning round. I got like 10 questions. We can't just speed through them.

Richard Harvey: Um what is the most overhyped AI buzzword in compliance today? I would say that what what what's most overhyped is the fact that AI is going to um solve all our our needs. It's like, you know, like I told you, I I've talked to so many folks about AI who have this AI product, this AI product. It's like we can solve all of your needs. Well, that that's probably over, right?

Alex: What's the one compliance task you'd automate immediately? If I automate something then I might not have people to to to oversee the automation. So remember I am I am I trust but verify. That's so I I'm not I'm not looking to I want this the the AI to help me. I you know and if it can help me yes we're going to be able to not have a need for as many people but I still want to oversee it.

Richard Harvey: Yeah 100%. What's a legacy system you'd love to to rip out tomorrow? I don't know if it's a legacy system that I would want to see ripped out. I would like to I would like to to see I I guess look I I go back to I don't care what system you put in place. Let's just give us an opportunity to understand what the needs are, what the systems require and give us the time to implement and follow and don't keep changing things so rapidly on us.

Alex: What keeps you up at night?

Richard Harvey: I sleep well.

Alex: Good. answer.

Richard Harvey: You know, the reality is that you you said it in in the beginning. I've I've been through a lot.

Alex: You've been through it all. So,

Richard Harvey: yeah. So, it's it's not that I'm it's not that I'm seeing any anything that's different other than the way that we're, you know, able to do our jobs. And and and and that's that's what you you want to have, right? You know, with new technology, there's new opportunities. Change is the one constant. So, we always manage change. We always have. Uh but slow it down. I mean because you know like I said before

Alex: we now I mean things are so up in the air right now in terms of um uh what they're requiring what the regulators are requiring of us. Um I can think of a number of things that we were building towards because the regulators told us we needed to build towards and now all of a sudden they've come and said no don't you don't have to do it anymore. So what do you think is the most common best practice in compliance BSL that you think is complete nonsense? So if it was a best practice, I don't think it would be complete nonsense. Right? So regulators talk about best practices, auditors talk about best practices, but the reality is the the whole notion of best practice for who? for who?

Richard Harvey: Yeah.

Alex: Right. We all run our our our institutions a little bit different and yes I get you know I I just was going through um an audit report and they were talking about best practice like yeah it might be best practice for somebody else it doesn't work for us. Yeah.

Richard Harvey: So best practice is just that it's um you know uh and I value the opinions of the auditors. I value the opinions of regulators obviously um but it has to fit our needs right. What we want to make sure of is that we have a program that we we're implementing. It meets the requirements and it meets our our customers needs.

Alex: All right. And my last question is if you weren't doing compliance PSA, AML legal, what would you be doing? you. So, if I were not doing these things, um, I probably would have to go back to u my prelaw school days, right?

Richard Harvey: Yeah.

Alex: I was thinking, so I had for one, you know, fleeting moment, I had this thought that I would um go into politics and I'm so happy that that I'm so happy that didn't happen. Um, but what did I want to do as a kid? Hey, NFL.

Richard Harvey: NFL. it is.

Alex: NFL. That was going to be it, right?

Richard Harvey: From NFL to compliance.

Alex: Richard, pleasure having you on the podcast. It was great. Uh, thank you very much for swinging by and yeah, hope everyone enjoys our conversation.

Richard Harvey: Thank you. Thank you for having me. Appreciate it. I heard her right.