Virtual Assets Regulatory Authority CEO: Finance’s AI future moves at the speed of its slowest regulator

Most industries are passive recipients of artificial intelligence. Financial regulation is not. Regulators are both being transformed by AI and acting as the gatekeepers deciding how much of its gains reach the financial industry. That dual position will define the next decade of finance more than any single technology, firm or policy. It will separate the financial centres that lead from the ones that get bypassed.

I know this because I have spent the last several years building one of those regulators from scratch.

Before VARA, I spent over a decade advising financial institutions on cybersecurity and technology risk. What I see now from the other side is that the infrastructure through which oversight is delivered matters as much as the rules themselves. That is where real transformation is happening.

An uneven starting point

Tier 1 banks spent more than a decade and billions of dollars on regulatory technology, with mixed results. Thomson Reuters’ annual Cost of Compliance surveys show compliance budgets and headcount climbing steadily, with productivity gains linear at best. The 2023 wave of large-language-model adoption produced widespread experimentation but very little production deployment in compliance-critical workflows, because the cost of a wrong answer in regulation remains higher than the cost of a slow one.

Among regulators, the gap is wider. The Monetary Authority of Singapore, the UK’s Financial Conduct Authority, the Hong Kong Monetary Authority, and the Bank of England run serious supervisory-technology programmes. Many other authorities operate predominantly on PDF rulebooks, sample-based onsite inspection and email-driven supervisory cycles.

Virtual assets as the catalyst

Virtual assets matter beyond their own market. They were built differently from the ground up: programmable, always on, cryptographically auditable, indifferent to borders. Those are not feature choices, they are constraints on supervision. You cannot audit a 24/7 cross-border smart contract through a quarterly inspection, just like you cannot police an autonomous lending protocol through paperwork. The regulators who take on this domain must build something genuinely new: on-chain audits rather than sampled reviews, real-time monitoring rather than after-the-fact reporting, and programmable compliance rather than rule-engine workflows. Not by choice. It is the only way to do the job.

The boundary between virtual assets and traditional finance is dissolving. Tokenisation is pulling government bonds, money market funds, equities, real estate, and, increasingly, private credit onto programmable rails. McKinsey’s 2024 analysis projects $2 trillion in tokenised financial assets by 2030. The Bank for International Settlements’ Project Agorá, now in its testing phase with seven central banks and more than forty financial institutions, is bringing tokenised wholesale settlement into live infrastructure. The supervisory technology being built for virtual assets today will run mainstream finance within a decade.

Two waves of transformation

AI’s transformation of regulation will come in two distinct waves. A near-term, 12-to-24-month wave is already arriving. Authorisation reviews that take weeks today will be compressed into days. The volume of compliance alerts, where industry research shows false-positive rates between 90% and 95%, will drop as AI learns to read transactions in context rather than flag them by rule.

A medium-term, three-to-five-year wave will break the model. The interface between regulators and their licensees will move from periodic submissions to continuous data exchange. Once data flows in real time, the operational case for sample-based inspection collapses. The compliance functions inside global banks shrink, with junior analysts and legacy compliance software taking the biggest hit.

Why the regulator is the rate-limiter

Caution is the regulator’s instinct, and a defensible one. But caution about the wrong thing, paper instead of data, snapshots instead of live feeds, is no longer protective. AI advances in finance only as fast as its regulators allow. A firm can build supervisory-grade compliance infrastructure, but if its regulator still demands PDF returns and human-mediated supervisory cycles, the productivity gains stay trapped inside the firm. Capital follows the regulators that move. Jurisdictions that fall behind get bypassed.

The accountability question reinforces the dynamic. The legal architecture of compliance assumes human decision-making throughout. When AI generates a suspicious activity report or contributes to a fitness-and-propriety judgement, the question of who carries the legal weight is not a footnote. It is the central problem. Until regulators resolve it, firms will hold back the highest-impact applications, because the bottleneck is regulatory rather than commercial. MiCA’s full implementation across Europe and the United States’ CLARITY Act framework are both moments where this question is answered. And those answers will shape which licensees keep pace.

Who shapes the transformation matters. Regulators who treat the AI transition as something happening to their industry will be the bottleneck first and the casualty second. The ones who treat themselves as the engine will inherit the operating environment of finance, and their licensees will inherit the advantage.

The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

This story was originally featured on Fortune.com