Case Study: A private LLM compliance copilot for a European digital bank
A licensed European digital bank offers accounts, cards, consumer loans, and payments across the EU. As its customer base grew, the compliance team could not keep up with manual alert triage and KYC review, and regulators expected every decision to be explainable. SumatoSoft built a private large language model copilot inside the bank’s own cloud. It grounds each answer in the bank’s policies and past cases, cites the relevant clause, and drafts alert briefings and case narratives for an analyst to approve. Within a year, complex onboarding reviews ran about 55% faster, analysts cleared more than twice the alerts per day, and every decision carried an audit trail.
Project details:
About the Client:
A licensed European digital bank, based in Lithuania, offers accounts, cards, consumer loans, and payments to customers across the EU.
Location:Lithuania
Industry:Fintech, digital banking, and consumer lending
Team size: 8 specialists (a solution architect, two LLM and ML engineers, one data engineer, two backend engineers, a QA engineer, and a project manager)
Project duration: 8+ months
Business challenge:
As the bank’s customer base grew, its compliance team could not keep pace. Analysts read long, frequently updated policy documents by hand to clear alerts and onboard customers, and most transaction alerts turned out to be false positives. Case narratives were written from scratch, and audit requests took weeks to answer. Regulators, meanwhile, wanted every decision explained and traceable.
Additional requirements:
- Keep all customer and transaction data inside the bank’s own cloud perimeter
- Cite the exact policy clause behind every answer
- Fit the existing case management and transaction monitoring tools
- Give regulators a complete, auditable trail of decisions
Our solution
SumatoSoft built a private compliance copilot that runs inside the bank’s own cloud. Retrieval-augmented generation grounds each answer in the bank’s AML, KYC, sanctions, and fraud policies and its past cases, and the copilot cites the clause it used. When the policy base doesn’t cover a question, the copilot says so rather than guessing.
An open-source model, fine-tuned with LoRA on the bank’s casework, drafts alert briefings and case narratives for an analyst to review and sign off. Guardrails block prompt injection, and role-based access matches each analyst’s remit. An evaluation harness checks output quality on every release.
Additional info about the case
The system re-indexes policies as soon as they change, so answers always reflect current rules. Every prompt and analyst decision is logged for audit. SumatoSoft modeled the token cost before rollout and built monitoring to keep the running cost predictable as volume grows.
Additional features:
- Policy-update pipeline with automatic re-indexing
- Full audit log of prompts and analyst decisions
- Role-based access control by compliance function
- API integration with case management and monitoring
Business value
Before:
- Complex onboarding reviews took about 5 business days
- Analysts cleared roughly 30 alerts a day, most of them false positives
- Writing a case narrative took about 90 minutes
- Answering a regulator’s audit request took about 3 weeks
- New analysts needed about 3 months to reach full productivity
After:
- Complex onboarding reviews take about 2 business days, roughly 55% faster
- Analysts clear 70 to 80 alerts a day with clustered briefings
- A case narrative now takes about 25 minutes, with citations attached
- Audit requests are answered in about 4 days from the decision log
- New analysts reach full productivity in about 6 weeks
