1. Many surveillance programmes were designed around established communication channels and predefined risk indicators. What needs to change to address fragmented and context-dependent communications?

Many surveillance programmes were built for a different communications environment. Today, interactions span email, chat, collaboration and voice communications, with the context needed to identify market abuse, misconduct and conduct risks often spread across multiple conversations, participants and channels.

Firms need the ability to analyse communications in context across channels, participants and time. Indicators of risk may emerge through a series of interactions rather than a single communication. When channels are monitored in isolation, important signals can be missed.

Just as importantly, firms need confidence that relevant communications are being captured completely and consistently. Effective surveillance depends not only on the quality of analytics, but also on the completeness and quality of the underlying data.

2. How can firms distinguish genuine misconduct risks from the growing volume of routine communications without increasing false positives or overlooking significant events?

Much of the noise generated by traditional surveillance comes from rules and keywords that lack context. A phrase that is benign in one conversation may be concerning in another.

AI can analyse patterns across email, chat, collaboration and voice communications, helping firms understand context across channels, participants and time rather than focusing on individual words or messages.

The goal should not simply be fewer alerts. It should be fewer unnecessary alerts while maintaining, or improving, the identification of genuine market abuse, misconduct and conduct risks.

3. Explainability is becoming an important consideration as AI enters compliance workflows. What should firms be able to demonstrate about how surveillance systems identify, prioritise, and escalate potential misconduct?

For any alert, organisations should be able to demonstrate why it generated, what data informed the outcome and why it was prioritised in a particular way. Reviewers should be able to understand that rationale, and regulators should be able to assess it without requiring technical expertise.

The same principle applies to what the model did not flag. If decisions cannot be explained, there is a weakness in the control framework.

Explainability should sit within a broader model governance framework. Organisation should be able to demonstrate how models are validated, how performance is monitored and what would trigger calibration, recalibration or retraining over time.

4. When regulators challenge a surveillance decision, what evidence should an institution have to explain how an alert was generated, investigated, and resolved?

Institutions should be able to evidence the full lifecycle of a decision. That starts with the original communication, the rule or model version that generated the alert and the context used in the assessment. It should also show who reviewed the alert, the steps taken during the investigation and the rationale for the final outcome.

Closed alerts require the same level of documentation as escalated alerts.

Organisations should also be able to demonstrate that relevant email, chat, collaboration and voice communications were captured, retained and made available for review. Where AI is involved, regulators will increasingly expect evidence of model governance, validation, performance monitoring and calibration practices in place at the time the decision was made.

5. Surveillance transformation involves compliance, legal, technology, information security, and business teams. How should institutions establish accountability across these functions?

Each organisation will structure responsibilities differently, but success depends on clear ownership, strong cross-functional governance and shared objectives. The most effective programmes establish clear accountability across surveillance, technology and business stakeholders rather than relying on any single function to own the entire process.

In my experience, challenges are more likely to emerge at the boundaries between teams than within individual functions.

In several multi-country surveillance programmes I have led, one of the most important success factors has been aligning surveillance leadership across jurisdictions while balancing local regulatory requirements, data privacy obligations and operational considerations. Different regions often have legitimate local requirements, but decisions relating to surveillance strategy, risk coverage, technology adoption and governance need to remain aligned to a broader global framework.

I have found that formal governance structures, including Steering Committees and senior leadership forums, are critical in creating transparency, establishing clear ownership and providing a mechanism for resolving competing priorities. They help ensure local requirements are appropriately considered while maintaining consistency in approach, risk coverage and governance standards across the organisation.

The technology itself is rarely the most complex part of these programmes. In my experience, success depends on creating the governance, transparency and decision making disciplines necessary to deliver consistent outcomes across multiple stakeholders, jurisdictions and regulatory environments.

6. AI can increase the volume of signals available to compliance teams, but it can also create additional review work. How can firms ensure that automation reduces operational burden rather than shifting it elsewhere?

Organisations should assess automation based on downstream outcomes; how many alerts reviewers handle, how long investigations take and whether risk is being prioritised more effectively.

More signals do not automatically create more value. The most effective automation removes routine effort, provides transparency into decision-making and allows reviewers to focus on cases that require judgement.

Whilst AI can identify patterns across large volumes of email, chat, collaboration and voice communications, experienced reviewers remain critical in determining whether activity may indicate market abuse, misconduct or other conduct concerns.

Success should be measured by the capacity created for reviewers, not the volume of signals generated. Reviewer feedback should also feed into ongoing model monitoring and calibration to support continuous improvement.

7. What governance mechanisms are necessary to monitor model performance and ensure that AI-driven surveillance remains reliable as employee behaviour and communication patterns evolve?

AI surveillance models should be governed like any other material model risk. That means clear ownership, documented validation and regular performance assessment.

Organisations should monitor KPIs such as precision, detection effectiveness, coverage effectiveness, model stability and reviewer outcomes. Performance monitoring should be supported by periodic validation and assessment for model drift.

Testing should also include market abuse, misconduct and conduct-risk scenarios to ensure surveillance remains effective as behaviours and risks evolve.

Material changes to business activity, communication patterns, channels or underlying datasets should trigger a review to determine whether recalibration or retraining is required.

Ultimately, surveillance models are not static controls. They need ongoing oversight, monitoring and refinement to remain effective.

8. How should compliance leaders balance investment in new surveillance capabilities with the need to strengthen foundational controls, such as data capture, retention, and investigation workflows?

Foundational controls come first.Advanced analytics cannot compensate for incomplete communication capture, poor data quality or weak investigation processes. If an organisation cannot produce the underlying communications when required, the sophistication of its analytics becomes largely irrelevant.

My priority order would be, complete and reliable capture across email, chat, collaboration and voice communications; robust data quality controls; defensible records; efficient investigations; and then smarter detection capabilities.

Once those foundations are in place, firms can focus on model governance, performance monitoring and optimisation. AI should not be viewed as a one-time deployment. Effective surveillance requires ongoing validation, monitoring, calibration and, where necessary, recalibration as risks, behaviours and business activities evolve.

Bio:

Michelle Clark is Global Communications Surveillance Expert at Shield, where she helps shape product strategy and supports financial institutions in strengthening communications risk governance. She brings more than 20 years of global banking experience, most recently as Global Head of Communications Surveillance Capability at HSBC. Her expertise spans communications and trade surveillance, model governance, financial crime controls and the application of AI in highly regulated environments.

About Shield 
Shield is the industry’s award-winning digital communications governance and archiving (DCGA) solution, purpose-built for financial institutions. Shield’s comprehensive platform combines industry-leading AI-powered innovation with deep regulatory expertise to strengthen compliance intuitively, efficiently, and securely. 

Recognized as a Visionary by Gartner and ranked a Top 3 Vendor in the 2025 Gartner® Critical Capabilities for Digital Communication Governance and Archiving, Shield is also recognized as one of the fastest-growing technology companies, including being named to the Deloitte Technology Fast 500™, reflecting its rapid global expansion and market leadership. For more information, visit www.shieldfc.com.