Market data and candlestick charts over a trading screen

04 · Finance

Who knew what, when, and why.

Financial institutions are memory-bound: models get approved with limitations, AML procedures change after findings, exceptions get accepted. Months later someone has to prove which judgment was current, approved, and validated by outcome. Cognition is the memory, governance, and evidence layer around that human-led work.

Memory-bound work

Regulated work runs on judgment that must stay defensible.

Wikis, chat transcripts, tickets, and generic RAG can find documents. They cannot prove which judgment was current, approved, scoped, stale, superseded, or validated by outcome. That proof is the product.

  • A model was approved for a purpose, with limitations
  • A policy update changed an AML/KYC procedure
  • A vendor AI tool was allowed in one workflow but not another
  • A control failed and an owner accepted a remediation plan
  • An adverse-action reason had to be specific enough for disclosure
  • A compliance training intervention needed proof beyond completion
  • A fraud or cyber pattern required a cross-team handoff
  • A regulator or auditor asked who knew what, when, and why

The governed evidence loop

From finding to defensible memory, in seven steps.

Source systems never write directly into authoritative memory. Everything enters as a draft and is promoted only through explicit review.

Source

A policy, ticket, finding, or model document.

Draft memory

Becomes a draft decision, issue, or control. Never truth by default.

Owner review

A responsible human approves, edits, rejects, or suppresses.

Approved memory

Institutional judgment with provenance, scope, and authority.

Scoped retrieval

Into the agent, workflow, or review packet where it applies.

Audit & outcome receipt

Every reuse is recorded with what happened next.

Refresh or suppress

Outcomes decide what strengthens, what gets revisited, what dies.

Where it lands first

Four wedges, one substrate.

Not raw AI capability, but the governance substrate that makes AI-assisted financial work inspectable.

Model-risk governance memory

WhenModel docs, validations, exceptions, and overrides are scattered across committees, tickets, and inboxes

Cognition keeps model purpose, limitations, review decisions, exceptions, owners, and outcomes available to the next reviewer or agent.

For CRO orgs, model risk management, validation, and internal audit.

AI-tool governance

WhenTeams adopt copilots, agents, and vendor AI features faster than governance can map them

Policy, provenance, approvals, and outcomes travel with the workflow instead of sitting in a static policy PDF.

A use-case register with data boundaries, human-review requirements, and an incident ledger.

AML/KYC procedure updates

WhenA regulatory or internal finding changes a procedure and evidence has to exist

A bounded six-week pilot on one procedure update: coordination, governance visibility, evidence readiness, and reusable decision capture.

The default bank pilot: training-vs-process diagnosis, approver gates, and an audit trail for every decision.

Third-party & vendor AI risk

WhenEvery AI vendor adds diligence, contract, and monitoring work across its lifecycle

Vendor-risk memory: a diligence tracker, contract and control map, model and data boundaries, and exception approvals.

For third-party risk, procurement, legal, and vendor security.

Where the system stops

Around the decision, never inside it.

The wedge is governed institutional judgment, not autonomous decisioning. Every boundary is architectural, and pilots run on synthetic or de-identified data by default.

Read the data boundary
  • Autonomous credit underwriting or adverse-action decisions
  • Trading or investment advice
  • SAR filing or KYC adjudication
  • Account actioning
  • Regulatory certification, or compliance claims without customer-scoped receipts

No claims of BSA/AML, SOX, PCI, SOC 2, or FFIEC readiness, supervisory approval, or audit acceptance are made without customer-scoped receipts.

Bring one procedure. Leave with evidence.

The default engagement is a bounded six-week pilot on a single AML/KYC procedure update: synthetic or de-identified data, human approval on every external action, and an audit trail for every decision.