2027’s Hidden Control Bill: Below the Waterline

Evidence, authority and supplier control: priorities for 2027. AI is moving into anti-money laundering (AML) and know your customer (KYC) workflows. Can firms still explain and defend the decisions it helps produce?In this episode of RegCast Season 8: Below the Waterline, PJ Di Giammarino joins John Neasham, Deirdre Moynihan and Janine McKelvey toexamine the evidence, authority and supplier dependencies behind AI-assisted decisions.The discussion explores data governance, who authorises AI activity, why supplier contracts matter and whether firms can retain access to decision evidence when infrastructure or services fail. The guests also consider smaller, curated language models and the different protections firms obtain through DORA contracts.

Regulatory Reporting 2027: Report Less. Prove More.Reporting reform is accelerating across the UK and Europe. Regulators are pushing for simpler reporting and lower cost, while data-quality expectations, analytics and AI-enabled supervision continue to rise.In this episode of RegCast Season 8: Below the Waterline, PJ Di Giammarino speaks with Pierre Khemdoudi, Co-founder and CEO of Gentek, about what this means for the regulatory reporting stack.The FCA estimates its UK MiFIR reforms could reduce annual industry reporting costs by £108 million. At the same time, ESMA is advancing reporting simplification, data quality and more technology-enabled supervision.Pierre brings the discussion down to one practical test:Pick one reported field. Can you explain why it was reported, where the data came from, what interpretation applied and what logic produced the final value?If that takes ten days of technology effort, the underlying complexity has not disappeared.PJ and Pierre discuss:UK MiFIR transaction reporting reformFCA PS26/15 and the £108m cost opportunityESMA reporting simplificationDigital Regulatory Reporting and ISDA DRRregulatory data lineage and traceabilityAI and agentic workflows in regulatory reportingdata quality and supervisory analyticsshifting control upstream without adding more headcountstructural cost reduction and the 2027 reporting agendaThe management challenge for 2027 is simple:Report less. Prove more. Know exactly what needs to change before the regulator asks.Follow RegCast for more conversations on regulatory reporting, AI governance, RegTech, control architecture and the 2027 regulatory agenda.

As AI moves from pilots into production, financial institutions face a more practical question: what do you fix first?PJ Di Giammarino speaks with Kim Prado, Global Head of Product, GlobalLink at State Street, about the 2027 control environment and the data, technology, operating-model and regulatory foundations firms need to scale AI.They discuss AI in banking, data and standards, regulatory change, business logic and entitlements, the changing role of product and technology, and how firms can use their 2027 change budgets to build reusable capabilities while reducing structural cost.The central message: move towards capabilities that can scale, rather than another generation of large standalone applications.Part of RegCast Season 8: Below the Waterline.

Shadow AI is no longer confined to employees experimenting with unapproved chatbots. It is appearing in everyday workflows, approved technology and emerging agents as financial institutions move AI from pilots into production.PJ Di Giammarino talks with EPAM’s Sandro Schmid and Michael Nicholls about what happens when adoption moves faster than control. Can management see where AI is operating? Who owns it? What is it authorised to do? Where does meaningful human oversight sit, and what evidence is needed to demonstrate that the control environment is actually working?The discussion looks at the shift from AI governance as policy towards practical AI Control in production, including visibility, ownership, authority, continuous assurance and the conditions firms need to scale AI safely.This episode accompanies RegRisk Navigator 21, “Your AI is crossing the line. Now what?”, as Season 8 of RegCast goes Below the Waterline ahead of the RegRisk Control Forum on 15 October.

Financial institutions are locking in 2027 technology, AI, data and supplier decisions now, but the control costs may still sit below the visible plan.In the Season 8 premiere of RegCast: Below the Waterline, PJ Di Giammarino and Corrina explore what firms are preparing for as they enter 2027, where AI and agents can remove cost and friction, and why the control implications of today’s architecture choices need attention before plans harden.Season 8 follows real regulated workflows into the data, systems, AI, dependencies, controls and evidence underneath them, across:Regulatory ReportingAI ControlSovereign ControlThe season will feed into the RegRisk Control Forum on 15 October 2026 and the wider 2027 RegTech research agenda.RegRisk Control Forum | 15 October 2026 | London https://regrisksolutions.com/regrisk-control-forum/

If You Cannot Explain It, You Cannot Defend ItSupervisors are testing decision paths. Most firms are not ready.MiFIR reporting is no longer judged by what gets submitted.It is judged by whether firms can prove how the decision was made.Supervisors are asking more pointed questions, comparing data across regimes, and exposing weaknesses in governance, lineage, and control.Most firms are still treating reporting as an output problem. This episode explains why that no longer works.PJ Di Giammarino, Founder and CEO of RegRisk Legal Solutions, Kim Prado, former CIO at BMO and Sam North, Executive Director of Product Management at The DTCC explore where reporting is breaking today, why divergence matters more than harmonisation, and what firms need to build now if they want to move from producing reports to proving control.

AI infrastructure is no longer politically neutral.A leaked diplomatic cable suggests data sovereignty has moved from regulatory debate to geopolitical confrontation. For financial institutions, this raises a harder question than data residency: which law executes inside your AI stack?Sovereignty now lives in the control plane: who holds the encryption keys, who can compel access, whether service can be withdrawn, how models are governed, and whether data and workloads can be ported under stress.In this episode, we examine sovereignty as an operational condition, not a policy label. From foreign access risk and vendor lock-in to regulation-to-enforcement in live operation, we ask what provable control really looks like in 2026.Because when governments disagree, something still executes.

The fines are no longer theoretical. Supervisors are alreadypenalising weak reporting controls, inadequate governance and fragile operating models. Not for misconduct. For failure to demonstrate control. And this is before large-scale AI supervision has fully arrived.AI pilots are moving into production across capital reporting, AML, surveillance and resilience. The legal and technical obligations governing accountability, outsourcing, and operational control are already on the books. When supervisors begin testing AI-driven systems at machine speed, “it was just a pilot” will not be a defence. This episode confronts the uncomfortable reality: if you cannot evidence control now, escalation is not a question of if, but when.

MiFIR reporting reform is no longer something firms are preparing for. Live inspection has started.Regulators are now correlating MiFIR data against prudential and statistical views of the same activity, turning divergence into evidence and data quality into a supervisory judgement. This is happening while core reporting systems remain operational, leaving little room for trial-and-error change.In this episode, industry leaders share 80+ years of experience on what breaks first during in-flight reform, why loss of supervisory trust is the real failure mode, how costs escalate before root causes can be fixed, and what must be reused to prevent fragmentation becoming permanent. They also explain why AI and automation will surface weaknesses faster unless meaning, validation, and governance are fixed first.This is not about designing the target state.It is about regaining control while your systems are being examined.Join in and follow all the analysis from the RegTech FS conference registration site:https://regtechconference.co.uk/.

Supervisors are rebuilding reporting from the ground up.Regulators are moving away from prescriptive templates toward model-based reporting built on granular data, shared semantics, and provable lineage. This shift promises better data quality and faster insight, but it also forces firms to make hard architectural and governance decisions now. In this episode, regulatory and industry leaders explain what“templates to models” really means, why fragmented dictionaries and interpretations will fail, and why 2026 is the year supervision starts testing whether firms can prove how their reporting actually works. If reporting quality, data lineage, and regulatory convergencematter to your 2026 agenda, this episode is required listening.Join in and follow all the analysis from the RegTech FS conference registration site: https://regtechconference.co.uk/.