Nicosia, Cyprus, July 20th, 2026, FinanceWire
A self-hosted LLM connected to the platform’s ledger, KYC/KYB, KYT, and audit trail takes over the routine layer of AML investigations – while every decision with regulatory consequences stays with a human
FinHarbor, a technical platform provider for launching compliant, modular financial products, has announced the launch of its AI Act-ready compliance module – an AI co-investigator that works on top of the platform’s existing compliance stack and is deployed entirely inside the client’s own infrastructure.
The timing matters. On 2 August 2026, the EU AI Act’s transparency obligations take effect for customer-facing AI systems, while the recently adopted simplification package moved the high-risk requirements to December 2027 – a preparation window, not an amnesty. FinHarbor’s answer is a module designed around the Act’s logic from day one: documented, supervised, and architecturally incapable of acting alone.
The problem: compliance teams drowning in false alarms
The economics of AML operations are well documented. According to Google Cloud, more than 95% of alerts generated by rules-based AML systems turn out to be false positives at first review, and roughly 98% never result in a suspicious activity report. Compliance teams at growing platforms spend the bulk of their time reconstructing cases from disconnected tools rather than investigating genuine risk.
The industry results from applying AI to this layer are equally documented. HSBC, working with Google Cloud, cut alert volumes by more than 60% while identifying two to four times more genuinely suspicious activity. In a Coforge deployment at a leading US bank, an AI-powered alert optimization framework reduced false positives by 70% and improved fraud detection rates by 35%.
What the module does
FinHarbor’s co-investigator operates across the platform’s unified ledger, KYC/KYB, KYT, transaction monitoring, and append-only audit trail. In practice, it:
- Pulls client and transaction data on demand. An analyst asks a question in plain language; the module queries the platform’s databases directly – no SQL, no waiting for a data team.
- Clears the routine layer of AML alerts. Recurring false positives are classified and closed with documented reasoning, leaving human analysts only the cases that warrant judgment.
- Assembles the full case. Transactions, counterparties, KYC/KYB history, on-chain trail from KYT, sanctions and PEP screening results – linked into a single investigation profile instead of a manual reconstruction across tools.
- Drafts SAR/STR narratives. The module prepares the regulatory filing in the accepted format; the compliance officer reviews, edits, and signs.
- Prioritizes the investigation queue by risk score, so the highest-risk cases surface first.
- Answers regulator and auditor requests with an export from the unified audit trail rather than a manual evidence-gathering exercise.
A co-investigator, not an autopilot
The module’s operating principle is built into its architecture: AI investigates, humans decide. It never files a SAR, blocks an account, or takes any action with regulatory consequences on its own – every such step requires a human signature. This human oversight model, together with system documentation and model risk management, is how the module addresses the AI Act’s high-risk regime, while built-in disclosure ensures that in any chat-based scenario users always know they are interacting with AI.
The same architecture covers DORA: the append-only audit log meets third-party oversight requirements and streams directly into the client’s SIEM.
Deployed inside the perimeter, not in someone else’s cloud
The module runs as a self-hosted LLM within the client’s own environment, connected to the platform’s modules and databases through an MCP server behind the client’s authentication. Setup means scoping access – which modules and accounts the model can read, under which API keys and limits – selecting the model, and configuring redaction rules for regulated fields. Documentation and human oversight are part of the deployment, not an add-on.
This is also why the module’s relevance extends well beyond the EU. The core design principle – regulated data never leaves the client’s perimeter – answers the same requirement under GDPR, UK GDPR, Switzerland’s revFADP, Brazil’s LGPD, and Saudi Arabia’s PDPL. The AI Act is the entry point, not the boundary.
“Compliance teams don’t need another dashboard – they need the routine taken off their hands without giving up control,” said Ilya Podoynitsyn, CEO of FinHarbor. “Our co-investigator reads the same ledger, the same KYC files, the same on-chain data our platform already maintains, and does the legwork: assembles the case, drafts the narrative, documents every step. But nothing that matters to a regulator happens without a human signature. That’s not a limitation we accepted – it’s the design principle we started from.”
The module is currently running in pilots on several client projects. The underlying infrastructure – MCP and self-hosted LLM deployment within the client perimeter – is already part of the FinHarbor platform and publicly documented. The module is delivered as part of the platform, with commercial terms defined per deployment.
About FinHarbor
FinHarbor is a technical platform provider for launching compliant, modular financial products – from wallets and neobanks to crypto ramps and OTC desks. Built on years of real-world fintech experience, the platform covers onboarding, compliance, wallets, transactions, cards, and reporting, delivered with a microservice-based architecture (ISO/PCI DSS-certified), a robust API layer, and on-premise or cloud-ready deployment. FinHarbor supports fiat-only, crypto-native, and hybrid business models across markets in Europe, MENA, and beyond.
Learn more: www.finharbor.com
Contact
Maxim Yakushev
FinHarbor
press@finharbor.com
