There’s a particular kind of quiet that settles over a room the moment an engineer proposes moving customer data from the bank’s on-premises servers to the cloud. Keyboards stop clicking. Compliance officers look up. The audit lead, mid-sentence, trails off. What follows is rarely a conversation about technology at all – it’s a conversation about trust. Can anyone in the room prove, with evidence rather than assurance, that this migration is actually safe?
This unspoken silence represents the central theme currently impacting how regulated banks operate. As institutions transition their core systems to the cloud and add more Artificial Intelligence (AI), the old tension between regulatory requirements (compliance) and innovation has returned. Will compliance inhibit innovation or will it cause engineers to construct their applications correctly from the onset? Tripatjeet Singh, a Senior Cloud Engineer with more than 14 years experience in banking and financial technology, has developed a philosophical approach to these questions. Compliant behavior can either represent a barrier or be treated as a design principle.
Singh has worked in regulated U.S. banks for over eight years, focusing primarily on cloud engineering, infrastructure automation, and enterprise security. During his career in regulated banking environments, he has worked within numerous regulatory frameworks (e.g., SOX, PCI-DSS, Anti-Money Laundering). Instead of viewing compliance regulations as barriers to circumvent, he created an enterprise wide cloud governance program and embedded compliance regulations into reusable infrastructure constructs. Data residency controls, privacy constraints and security policies are included in the base configuration so that application teams receive compliant configurations and do not need to develop them individually. After developing the cloud based program, he extended the same principles to include AI-based services, specifying how new tools/models are properly onboarded to ensure they handle data appropriately and responsibly.
Results are quantifiable. Setup times for environments that previously required weeks to configure decreased to hours, and each environment is now shipped with encryption, access controls and audit trail configurations. Manual certificate administration processes that represented significant amounts of time-consuming activity and a silent risk area were completely eliminated through automation resulting in greater than 60% reduction in administrative burden and a complete elimination of a category of exposure. At maturity, the overall time required to develop and deliver an application to production was decreased by approximately 40%, due in part to the fact that the bulk of the associated compliance activities had been completed during initial configuration phases.
However, many of Singh’s most difficult challenges were typically related to non-technical aspects. When Singh migrated legacy banking infrastructure from on premises data centers to cloud platforms, the audit and compliance groups were concerned that data would leave behind their respective physical walls. While Singh could say that he would create controls to address concerns; he needed to provide documentation on where data would reside, who would have access to it and how every transaction would be documented. Therefore, Singh addressed each of these items at the outset of the project by utilizing encryption, access controls, and transparent audit trails. In addition, he began with less critical systems to establish credibility prior to migrating core systems.
In a second project, Singh continued to apply the same concepts. Singh directed efforts to create an AI powered check fraud detection system. Regulatory laws define when a hold may be placed against funds, which anti-money laundering screening activities must occur, and how to reactuate when processing instantaneous payments allow for a limited window of opportunity. These restrictions were incorporated into the system architecture as opposed to being added as an afterthought.
Detection accuracy increased by approximately one-third while false positive rates decreased by over 60%. This resulted in significantly fewer consumers having their money inadvertently held up by incorrect fraud determinations. Each questionable item generated by the AI model is reviewed by a human.
Singh notes that the practice isn’t about pressuring the system to render final determinations across the board. Rather, it reflects a best practice built around confidence scoring: the AI evaluates every case and assigns a score, and human reviewers step in for anything that falls below a defined threshold say, a score under 90 or that surfaces as an edge case requiring judgment. However, in banking, if the system makes a wrong determination it impacts an actual person, and certain determinations require a human in the loop. Permitting the system to determine all outcomes was the wrong decision from both a regulatory perspective and an engineering standpoint.
Singh’s work even in his stress testing was used to justify his position. Conducting intentional failures of production systems via fault injection testing appears reckless in a banking environment. However, demonstrating that systems fail correctly is precisely what regulators wish to see; therefore, what appeared to be risk became evidence.
Singh’s influence also transcends systems he develops. He writes technical whitepapers. Some examples include cloud observability, scalable logging pipelines with AI driven compliance and methods for audited just-in-time secure access using short lived credentials. Additionally, Singh is affiliated with several professional research organizations, and provides peer review of academic works authored by others in areas of cloud and security.
When asked whether compliance slows things down, Singh does not sidestep the issue. “Compliance slows things down at times,” he states. “But viewed from afar, it is what drives you to build things correctly.” In his opinion, the discipline of compliance is evolving from a static and reactive process into a dynamic process. Banks are increasingly monitoring transactions in real time, identifying issues earlier, and producing audit trails continuously instead of manually creating them after the fact.
Singh believes that the future direction is already taking shape. Agentic AI and predictive analytics are enabling faster identification of legitimate threats and faster investigation of potential issues thereby reducing false positives and integrating IT, data and third party risk functions into integrated units. There is increasing interest in ensuring that models deployed by banks are fair and unbiased. Singh cautions that fraud evolves similarly to defensive strategies employed by banks; thus banks that remain competitive will employ systems that learn/are smart/connected versus merely responding/reacting post-loss.
In conclusion, according to Singh, banks have moved past viewing compliance as a limitation preventing them from making progress. Rather, when incorporated into development early in the process, compliance enables the sustainability of the progress made.