This article is a contribution from one of our content partners, Avollone
When speaking to funds and other regulated companies, I almost always discuss the Three-Line Defense (LoD) model.
The idea of the lines of defense was first formulated in 2011 by the Basel Committee in their report “Principles for the Sound Management of Operational Risk” and related to operational risk management principles. Still, it had been in the making years before by more mature risk management practitioners.
It’s a model that’s easy to understand from a theoretical viewpoint but hard to implement practically, as this is usually when all the dilemmas and organizational differences come to light. In short, the 3 lines and their responsibilities are:
The typical problem for a smaller organization is that it’s simply impossible to spread the lines of defense on multiple people. This implies that you will have people “double-hatting” across 1st and 2nd LoD tasks. This adds to the requirements for documenting conflict of interests and to the required integrity of that person.
There is no silver bullet to this other than being fully transparent about the conflicts by documenting this in relevant framework documents. This way, the firm shows the regulator that it is making conscious choices. It’s better to have made a well-documented but wrong choice, as the regulator can see that the firm has thought about it and been transparent about it.
For bigger organizations, the problem is related to the size of the beast and the time it takes to implement changes. Implementing the LoD model requires larger changes, including moving tasks (and often people), reporting obligations, changing processes, and technology. The sheer grit and grunt work required is often underestimated, but it always starts with some very long workshops to define the to-be solution.
After this come the relevant actions and changes needed. Again, it’s better to have defined the to-be model and be transparent that it’s under implementation than to knowingly run around with a model that is not fit for purpose and has been poorly implemented.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click [HERE] or fill out the form below.
This article is a contribution from our partner, Avollone
Artificial intelligence is transforming how organizations manage Know Your Customer (KYC), Customer Due Diligence (CDD), sanctions screening and financial crime investigations. AI agents can review documents, extract information, prepare questionnaires and support risk assessments. For compliance teams dealing with growing workloads, the opportunity to reduce repetitive manual work is significant.
But as organizations move from experimenting with AI to relying on it for daily operations, another question is emerging: What happens when the cost of AI increases?
As Stacia Garr explores in her Harvard Business Review article, How to Respond to the Coming AI Cost Shock, the economics of enterprise AI are changing. For financial crime compliance teams, understanding those economics is becoming an important part of building sustainable AI-powered operations.
Agentic AI refers to artificial intelligence systems that can plan and execute multiple tasks toward a defined objective, using tools, information and predefined permissions. In KYC and financial crime compliance, AI agents can support document collection, information extraction, questionnaire completion, sanctions investigations and due diligence reviews. Unlike traditional automation, which follows fixed instructions, agentic systems can coordinate several steps within a workflow. However, their activities still require appropriate controls, validation and human oversight.
Most organizations evaluate AI investments based on expected efficiency gains. If an AI system reduces the time required to complete a KYC request from an hour to 15 minutes, the potential productivity benefit is relatively easy to understand. But the cost of delivering that automation can be harder to predict.
Many AI services charge based on tokens, which represent units of information processed by a model. Costs can depend on the model used, the volume of information processed, the number of interactions and the complexity of the workflow. In her HBR article, Garr argues that enterprise AI adoption has benefited from software vendors absorbing substantial infrastructure and processing costs, creating expectations around inexpensive or included AI functionality. She warns:
“The era of artificial pricing is coming to an end.”
As vendors introduce or expand usage-based pricing, organizations may find that AI processing becomes a more significant variable operating expense. This is particularly relevant for financial crime compliance, where workload complexity can vary considerably. An AI agent handling a straightforward corporate KYC questionnaire may require relatively little processing. Another investigating a multinational ownership structure could need to examine hundreds of documents, identify connected entities and perform multiple rounds of analysis. The second workflow may consume substantially more computing resources.
Token consumption is an important cost driver for many AI-powered compliance workflows. Consider two hypothetical KYC cases: The first involves a domestic company with a straightforward ownership structure, a small number of directors and readily available corporate documents. The second involves an international corporate group with multiple subsidiaries, complex beneficial ownership, documents in several languages and additional due diligence requirements.
Even if both cases are classified as KYC reviews, their AI processing requirements may be very different.
Agentic systems can also perform repeated reasoning steps, retrieve information and reprocess documents as they work toward completing a task.
Risk consultant Pedro Arevalo – who has deep expertise in risk, financial crime and fraud, including the application of AI, advanced analytics and technology to strengthen controls, improve decision-making and transform customer and operational processes – highlights this concern in his LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, observing that documents, connected parties, ownership layers and transactions can materially increase token consumption. This creates a potential mismatch between the number of KYC cases completed and the computing resources required. For organizations planning AI adoption, measuring the average cost per completed case is therefore more useful than looking only at the price per million tokens.
The return on investment from AI in KYC should reflect the full cost of completing a compliance process. This includes AI processing costs, software fees, implementation, human review, quality assurance and exception handling.
A practical approach is to compare the total cost of an AI-assisted workflow with the cost of completing the same work manually, while maintaining comparable quality and control standards. For example, an organization could assess how much time AI saves when preparing KYC responses, how often human reviewers need to correct its work and how frequently cases require additional investigation. As Garr explains:
“The key pricing elements are out of your control.”
Her point refers to the uncertainty surrounding interactions per agent, usage per request and unit pricing.
For compliance leaders, this implys that understanding AI return on investment requires monitoring both processing costs and the operational value delivered. The objective isn’t simply to maximize automation. There’s also a need to reduce the cost and effort of completing KYC accurately, with consistency and within acceptable risk parameters.
AI can prepare information, identify inconsistencies and recommend next steps. But organizations still need people who understand the regulatory context and can exercise professional judgment. This becomes particularly important when cases involve complex ownership structures, sanctions exposure, politically exposed persons or enhanced due diligence.
There is also an operational resilience consideration. If an organization becomes heavily dependent on AI and subsequently faces a major price increase, provider outage or service disruption, it needs a practical way to maintain essential compliance operations. Garr highlights the risks of losing institutional knowledge when organizations replace employees with AI-driven processes. And Pedro Arevalo raises the same concern specifically for financial crime compliance, asking:
“If AI becomes too expensive, can humans absorb the work?”
This is a particularly relevant question for compliance teams, where experienced professionals may need years to develop expertise in financial crime risk assessment and investigations. Organizations should therefore retain sufficient internal expertise, document procedures and establish contingency arrangements. The most resilient model would combine AI efficiency with human accountability.
Many have pointed out that not every task requires the most advanced or expensive AI model, and this is certainly true for compliance. Extracting information from a standardized document, identifying missing questionnaire fields and preparing a simple summary may require different capabilities from analyzing complex ownership structures or evaluating ambiguous adverse media findings. So, organizations can potentially reduce costs by matching the model to the task. For example, simpler models may handle routine extraction and classification, while more capable models are reserved for complex analysis. Some organizations may also consider open-weight models for suitable tasks, although infrastructure, maintenance, security and validation costs still need to be included. Arevalo makes a similar recommendation, encouraging organizations to balance commercial and open models rather than relying on the most expensive LLM for every compliance task.
Some have considered the usage of lower-cost models. However, it needs to be weighed against their ability to meet the necessary standards for accuracy, reliability and data protection. Models that do not will fail at meeting both the economic and data requirements, causing more work and risk.
Predictability starts with understanding how AI is actually being used. Compliance teams should establish baseline processing costs for common workflows, including KYC questionnaire completion, document extraction, ownership analysis and screening investigations. They should also monitor how costs change with case complexity and volume.
Vendor arrangements matter as well. Organizations should understand how usage is priced, whether there are consumption limits, how price changes are handled and what happens when demand exceeds forecasts.
Garr recommends incorporating AI consumption into broader organizational planning rather than treating it solely as a technology expense. Arevalo extends this argument to financial crime compliance, recommending that organizations:
“Plan capacity and budgets around headcount AND tokens.”
This recognizes that AI is becoming an operational resource alongside human expertise.
Organizations should also distinguish between purchasing AI infrastructure directly and using software that incorporates AI into its services. Customers may not be billed per token, but underlying AI economics can still influence pricing and service delivery.
Sustainable AI adoption requires a balance between automation, cost control, governance and operational resilience. For KYC teams, one effective approach is to apply AI where it can eliminate repetitive administrative work while preserving human review for decisions that require judgment, and this is particularly relevant to information collection and KYC response management.
Fintech / Regtech saas software providers such as Avallone have AI-powered KYC capabilities uniquely designed to support activities such as preparing KYC responses, reusing previously validated information and coordinating tasks across the response process. For example, Avallone’s KYC Responder lets organizations reduce the effort involved in repeatedly answering similar requests from banks and other counterparties, and their KYC Collector supports structured information gathering, document management, screening and risk assessment workflows.
Centralizing information and reusing validated data can also reduce unnecessary duplication, although actual AI cost savings depend on system design and usage.
There is no argument that agentic AI has considerable potential to improve KYC and financial crime compliance operations. But automation should not be measured solely by how many tasks an AI agent can complete or how much employee time it saves.
Organizations also need to understand processing costs, changing usage patterns, human oversight requirements and the financial implications of scaling AI across their operations.
The next stage of AI adoption in compliance will require organizations to think about capacity in two dimensions: people and computing resources so that KYC operations that remain efficient, reliable and financially sustainable as AI becomes part of everyday work.
Stacia Garr, Harvard Business Review, “How to Respond to the Coming AI Cost Shock,” August 17, 2026. https://hbr.org/2026/08/how-to-respond-to-the-coming-ai-cost-shock
Pedro Arevalo, LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, October 13, 2026. https://lnkd.in/p/etXbM6n2
OpenAI, “What Are Tokens and How to Count Them?” https://help.openai.com/en/articles/4936856-what-are-tokens-and-how-to-count-them
Have more KYC questions?
Avallone is here for you. Connect with one of our KYC professionals who can address your questions, concerns and needs.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is a contribution from our content partner, TreasurySpring
AI agents could gradually change how corporate treasurers manage cash, reducing the inertia that keeps large balances in low-yielding bank accounts and putting pressure on banks’ deposit funding.
Torsten Slok, Apollo’s Chief Economist, put out a short note recently asking whether an agentic bank run is coming. He argues that AI assistants could soon start moving household cash automatically into accounts paying over 3%, rather than leaving it in US checking accounts paying 0.1% on average. If enough people did that, banks would lose a lot of the cheap funding they rely on to lend.
Although he’s talking about households, I think something similar could eventually happen in corporate treasury, although it might take longer. The balances are much bigger, most sit well above any deposit insurance limit, and moving them means treasury policies, approvals, and an audit trail. Nobody wants to explain to their board that an agent moved £20m somewhere it shouldn’t have.
When it does happen, though, I think the impact on banks could be much bigger too. I don’t necessarily mean a bank run in the traditional sense. More likely, it means gradually removing some of the inertia that keeps corporate cash sitting in low-yielding bank accounts today.
In July, the average rate on UK companies’ interest-bearing instant-access deposits was 1.97%. In the euro area it was 0.60%.
For context, central bank rates today are 3.75% in the UK and 2.50% in the euro area. They aren’t directly comparable with the rates available on corporate deposits, but they give a sense of the gap. A 178 basis point difference on £10m, for example, is equivalent to £178,000 a year.
For banks, this spread matters a lot. US banks’ net interest margin was 3.32% in the second quarter, according to the FDIC. In the UK, the Bank of England says aggregate net interest margins across the major banks increased year-on-year in the first quarter, with UK-focused banks benefiting from higher structural hedge income. Across European banks, net interest margins are around 1.6%. Cheap deposits aren’t the only thing driving those margins, but they’re clearly valuable to banks.
None of this is because treasurers aren’t paying attention. Nearly half of the organisations in the AFP’s 2026 benchmarking survey have fewer than five people in treasury. Moving cash somewhere new usually means another onboarding and KYC process, plus internal approvals, and there’s nearly always something more pressing that week.
It’s also worth saying that rate isn’t the only reason companies keep money with their relationship banks. Balances often sit alongside an RCF, better FX pricing, or access to capital markets business, and those relationships have real value. My view is that most teams just don’t have the time to work out how much of their balance the relationship genuinely needs, what could sit somewhere else, and what leaving it there is costing them. That’s the kind of analysis an agent could eventually run every day. In combination with access to secured institutional-grade products, treasurers could have an opportunity to generate enhanced risk-adjusted returns on their cash.
AI adoption will take time. Andrej Karpathy describes current models as having jagged intelligence, and anyone who uses them regularly will recognise that. They can do something genuinely impressive and then get something simple wrong.
Our own AI in Treasury Report, a survey of 55 treasury professionals, found only about a quarter use AI regularly. Cash flow forecasting is where they most want help, chosen by 73%, yet more than three quarters say accuracy is their biggest concern. Only 4% want AI involved in executing transactions. For now, treasurers want AI that supports decisions rather than one that carries them out, which I think is a reasonable position to hold today.
It is changing quickly though, with many companies looking to address issues with existing AI models. One interesting example is TypeSafe AI, which released Jev in early access this month. It isn’t a chatbot. It’s designed to take in messy information and return structured decisions. TypeSafe says it gives more consistent answers than a large language model and tells you how confident it is in each one.
It’s early, and those claims will need to be proven in practice, but the direction is interesting for treasury. Deciding where surplus cash should sit this week given your policy, existing exposures, and today’s rates is exactly the sort of structured problem that these systems should eventually be able to help with.
The other thing that will set the pace is infrastructure. An agent can only act on cash if the places holding it can be reached programmatically, with the right permissions and controls. Most corporate banking infrastructure wasn’t designed with autonomous agents in mind. My feeling is that platforms built API-first will enable these workflows much sooner, and that’s where treasurers will see the benefit first.
So I don’t expect anything like Silicon Valley Bank, where more than $40bn left in a single day. What seems more likely is a gradual shift. As more of the analysis gets automated, some of the inertia disappears. Banks then come under steady pressure on deposit margins and either pay more for corporate balances or find other ways to hold on to them.
If you ask an agent to find the highest rate, it will do exactly that, and that’s not a good enough objective for corporate cash.
An unsecured deposit is effectively a loan to the bank. At the end of 2022, around 94% of SVB’s deposits were uninsured. A well-designed agent should be weighing up the same things a good treasurer does. How likely is this counterparty to default? What would we recover if it did? Are we being paid enough for that risk? And does putting more money there leave us too concentrated?
At TreasurySpring, we look at every product on a risk-adjusted basis for this reason, rather than treating the headline yield as the only thing that matters.
This is where I think we are well placed. A single onboarding gives you access to more than 120 counterparties and 1,100+ Fixed-Term Funds (FTFs), so you aren’t limited to the banks you already have accounts with. Many of those FTFs are secured by collateral through repo.
More importantly in the context of agents, that information is increasingly machine-readable. Our MCP server lets AI assistants see available FTFs, current yields and your portfolio, while our API allows other systems to connect directly to the platform. This lets clients either plug that data into their own agent or, over time, use an intelligence layer built natively into the TreasurySpring Portal, with the products, the risk analysis, and their treasury policy all in one place.
For the time being, I’d still want a person signing off on anything material, with the agent doing the analysis and the treasurer making the decision.
But that alone could change quite a lot. If an agent can continuously look at a company’s cash, its treasury policy, its existing bank relationships, counterparty risk, and the alternatives available, it removes a lot of the work that means this analysis doesn’t happen as often as it could today.
I don’t think the corporate version of an agentic bank run will look much like a bank run. It’ll probably be much slower. But if AI gradually makes it easier for treasury teams to work out how much cash genuinely needs to stay with their relationship banks, where the rest could go, and what they’re giving up by leaving it there, the end result could still be significant.
*TreasurySpring’s blogs and commentaries are provided for general information purposes only, and do not constitute legal, investment or other advice.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is a contribution from our content partner, PrimeTrade
I never would have thought, at the start of my emerging career as a trade banker, supply chain financier and potential “Master of the Universe” (per Tom Wolfe), that debit notes would be interesting, and that thirty years later I might be writing a blog about them.
But here we are!
It is quite a long post, but this is a topic that merits a detailed treatment, even if the subject matter is rather dry and somewhat technical.
This post sets out five myths about invoices and debit notes.
These myths can lead to various confusions, complications and inefficiencies when it comes to supply chain finance.
The post aims to set out clearly how things normally work in the real world of general ledgers and corporate ERPs. It also digs into the implications for SCF and for the design of platforms that help suppliers to access supply chain finance.
There are generally three strategies used to deal with debit notes in supply chain finance – and these are covered in the final section.
With the right design and approach, debit note recovery can be automated and fully-optimised – no more spreadsheets, no more manual tracking, and no need to get suppliers to deduct debit notes from future invoices.
A debit note acts as the evidence in the buyer’s books for a reduction in its expenses.
So it is issued by the buyer’s accounts payable team to a supplier when the buyer seeks to pay less than it has been invoiced.
For supplier financing transactions (including SCF), a debit note can be an unwelcome event. If an invoice has been financed and even purchased by a financier, the financier typically relies on the invoice being paid in full.
What if I told you that “invoices always get approved”?
A valid invoice is one that is properly addressed, is from a recognised counterparty (ie: a supplier), has the right taxes on it shown in the right way, and which adds up correctly.
Valid invoices always get approved and there is a good reason.
This is a fundamental part of the way financial controls work. A valid invoice has been received representing a claim for payment from a supplier and it will be posted in full to the general ledger.
If this didn’t happen, we would get in a mess very quickly. Accounts payable teams cannot use their discretion and post valid invoices to the general ledger with whatever numbers on them they decide might be right.
Audits would be failed and financial controls would have broken down.
If the invoice from the supplier is for an amount that is too high (for whatever reason), a debit note is raised by the buyer so the supplier gets less money. The question is “what’s the debit note?” not how much of the invoice should be approved.
Some accounts payable teams will, alternatively, ask the supplier to raise a credit note and the invoice remains pending and not posted until the credit note is received. Here, for ease of explanation, we assume the debit note route is the one that the accounts payable team uses.
In the ordinary course of business, accounts payable teams in corporate clients approve payments and not invoices.
A few key points:
This makes supply chain finance and supplier financing tricky – since bankers and lawyers like to think in terms of transactions rather than balances.
Bankers purchase invoices not balances.
Debit notes do not conveniently fit into this model.
Whilst the corporate client may be settling a balance that is due to a supplier (invoices less debit notes),
bankers want the invoices that they have purchased to be paid in full to them.
This is also one of the two main reasons why many corporate clients operate an all-or-nothing model with suppliers when it comes to supplier financing.
These two reasons mean SCF programs can lose a lot of agility. There’s no easy way to move suppliers between financiers, and no easy way to have dynamic management of funding, switching suppliers between financiers whenever needed (even daily) to optimise the use of limits and mix in own treasury funds as a funding source.
I made a statement earlier about “valid invoices always being approved”.
The key question for the accounts payable team when they are deciding what the supplier might be owed is not how much of the invoice to approve.
The key question is: how big should the debit note be?
Yes, that’s right. The full amount of a valid invoice is always posted to the ledger but if there is a reason to pay less than the full amount, then a debit note needs to be raised.
The questions being answered by the accounts payable team reviewing purchase orders, delivery paperwork and the invoice (ie: the 3-way match) are (a) whether a debit note should be raised and (b) how much it should be for?
For example, the invoice face value is 100, but there is a shortage on the delivery of value 5. So that means the invoice of 100 is posted to the ledger, and a debit note of 5 is created and posted – and 95 is the balance on the supplier account, which is what will be settled in due course.
As stated above, the general ledger is an account-based (ie: balance-based) system.
The supplier account is credited with the full amount of the invoices and debited with debit notes to reach the correct amount that should be paid to the supplier when a payment run is operated.
So what is the bank buying when it provides supplier financing?
Is it an “approved payable” (an invoice that is net of specified debit notes) or is it an “approved invoice” (due at face value without deduction)?
This is a key documentary point and one which might not always be clear in the paperwork used to support supply chain finance. On the one hand, the bank wants to buy invoices free and clear of any debit notes. On the other hand, the corporate client may well want the ability to net pre-existing debit notes (at the time of financing) against those invoices.
Is the IPU for the same amount as the invoice? What exactly is the claim that the bank is buying and relying on here – the invoice or the payable amount (at IPU creation-time) in relation to each invoice? If the supplier financing is documented on the basis that the bank is buying the IPU (and not the invoice) – query the accounting treatment and whether the arrangement might then become financial indebtedness in the books of the corporate obligor?
Debit notes “sort of” relate to invoices – but this is an artificial construct and not one that is required in the ordinary course of business.
Companies typically want to collect claims (debit notes) against suppliers immediately. Why wait?
Invoices are posted with a due date (in the future) that reflects when the amount claimed by the supplier should be paid.
Debit notes are often posted with an immedate due date.
That means debit notes are usually collected by set off against the next amount due to be paid to the supplier – ie: as soon as possible. There’s no waiting.
That would be the case even if the debit note might relate to a delivery where the invoice(s) for that delivery are not due to be paid for many days.
And debit notes may also arise that are wholly unconnected with individual deliveries – for example, where there are volume rebates or programme-wide discounts to be recovered.
As mentioned above, settlements clear the due portion of the balance outstanding on the supplier account.
The settlement is calculated by adding up all the transactions that are due and ignoring future-dated transactions. The debit note is always due immediately and is included as soon as possible in any payment that is made to the supplier. The invoice may be due in the future and has to wait.
The idea that this specific debit note goes with that specific invoice is typically a myth when it comes to the practical reality of payables and settlements.
Most platforms ignore debit notes. These are “someone else’s problem”.
That’s why many accounts payable teams don’t like supply chain finance and specifically prefer to limit the size and scope of programs to a handful of large suppliers.
And many SCF platforms ignore debit notes completely.
Corporate clients are expected to provide them with a nice and tidy file of “approved payables” which are guaranteed to be paid in full no matter what else may be going on.
This makes life easy for the platform and easy for the bankers and lawyers involved.
But this also makes life complicated for the corporate accounts payable team.
If clean “approved invoice” or “approved payable” files are to be provided to the SCF platform, this typically means that:
This can mean that many clients end up failing to collect all the debit notes that they might claim, or end up having to track debit notes manually in excel and away from the general ledger. This all leads to extra work for everyone, compromising financial controls and adding costs and complexity.
Yes – it requires a modern approach to the way that the supply chain finance platform is developed and operates.
There are three approaches:
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
