AI for compliance officers
Ultramarine Work builds the risk assessment, redlines required procedures, writes monitoring workpapers and tracks exam responses, from the policies, rules and prior workpapers already in your compliance folder.
Q3-OFAC-wire-testing.xlsxExample| Sample | Wire date | Amount | Screened | Released | Result |
|---|---|---|---|---|---|
| S-07 | Jul 9 | 184,250.00 | 10:42 | 10:51 | The wire was screened before release with no hits. |
| S-14 | Jul 22 | 62,900.00 | 14:05 | 14:31 | A partial name hit was cleared with a documented rationale. |
| S-23 | Aug 14 | 97,400.00 | 16:58 | 16:12 | The wire was released 46 minutes before screening ran. |
| S-31 | Sep 3 | 51,075.00 | 09:20 | 09:24 | The wire was screened before release with no hits. |
| S-38 | Sep 26 | 250,000.00 | 11:02 | 11:40 | The BSA officer reviewed and cleared the hit before release. |
NoteRate S-23 high because a manual release skipped screening, and pull every Q3 wire released through the manual queue.
Ask it for
“Build the 2026 risk assessment for the three retail deposit products, the two MSB relationships and the correspondent accounts, with volumes behind every score.”
2026-compliance-risk-assessment.xlsx“Update the customer identification program procedures to match 31 CFR 1020.220, and flag every sentence in the current version the rule no longer supports.”
CIP-procedures-redline.docx“Test OFAC screening on a sample of 40 of the 612 wires over $50,000 sent in Q3, and rate each exception high, medium or low in the workpaper.”
Q3-OFAC-wire-testing.xlsx“Read the amended Regulation S-P and list the new obligations, the 30-day notification trigger, the compliance dates and every gap against our written policy.”
RegSP-gap-analysis.docx“Turn the OCC exam request list into a response index that maps each numbered item to the document it came from, the owner and the due date.”
OCC-exam-response-index.xlsx“Draft the investigation plan for hotline case 26-087, a supervisor approving his nephew’s vendor invoices, with evidence log and interview outline.”
INV-26-087-plan.docx
Inside the Compliance & Ethics mode
Compliance risk assessment
Rates products, customer types, geographies and channels, shows the volumes each score rests on and credits no control your testing has not shown to work.
Compliance policies and procedures
Drafts the policy a rule requires, from AML programs and WSPs to 2 CFR 200 internal controls, and traces every required element to the section that demands it.
Compliance monitoring and testing
Turns the testing plan into workpapers, pulls the sample, documents each exception with a root cause and a rating, and retests findings before they close.
Compliance program effectiveness review
Walks the program against the DOJ ECCP, USSG 8B2.1 and OIG’s guidance element by element, and reports where each element lacks evidence.
Regulatory applicability and change
Reads a final rule as issued and answers what it obligates you to do, who is exempt, when compliance falls due and where current practice falls short.
Regulatory exam and inquiry response
Builds the exam response index with owners and dates, then drafts responses that meet appeal deadlines and CSI handling rules.
Regulatory and compliance analysis
Prepares breach analysis memos, OFAC ownership reviews under the 50 percent rule, anti-bribery third-party diligence, DPIAs and records of processing.
Ethics disclosure and conflicts review
Reviews OGE 278e and Form 450 filings for conflicts under 18 USC 208, then drafts the recusal memo or the gift review with its basis in the rules.
Investigation plan and findings report
Writes the investigation plan, evidence log and interview outline, adds Upjohn or Garrity advisements where they apply, and drafts findings tied to evidence.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
How it works
- 1
Open the compliance folder
The policies with their version history, last year’s risk assessment, prior testing workpapers, the rule or guidance as issued, exam correspondence and the hotline report exported from your case system.
- 2
Ask for the work
Ask for the risk assessment workbook, the redlined procedure, the OFAC test with its sample and exceptions, or the investigation plan. The file it hands back names the source behind each finding and notes anything it could not reconcile.
- 3
Review, rate and decide
Every rating and finding cites its evidence, so you can challenge a score before it reaches the committee, the board or the examiner. The judgments stay yours, and nothing gets signed or submitted without you.
Who it’s for
Compliance and ethics staff in any industry, from analysts to chief compliance officers, including bank, broker-dealer, adviser, insurer, lender and healthcare compliance officers.
Questions
Will it invent rules or cite sections that don’t exist?
No, it cites the file it relied on and notes what it could not find or reconcile instead of guessing. Check every rule citation against the current text before the draft leaves your desk, because the failure that slips past everyone is a real section that does not support the sentence around it.
Can we defend AI-assisted work in an exam or to the board?
Yes, when your review is part of the record. Every statement points to the file it came from, so the trail runs from the evidence through your edits to the decision, which is the record examiners and DOJ expect. What they do not accept is a finding nobody on your staff checked, so review every file it touched and keep what you changed.
Does it set the residual risk ratings and grade the findings?
No, you decide both the ratings and the grades. It assembles the data behind each score, from alert volumes to prior test results, and writes the rationale your methodology requires. Challenging those numbers is the judgment examiners look for, and nothing enters the assessment or the board report until you accept it.
Where does our data go, and can we work on PHI?
PHI is a decision for your privacy and legal team, so ask them before it goes in. Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page.
What about confidential supervisory information from exams?
Your firm and its legal team have to make that call, because each banking agency defines how CSI moves and mishandling it can be criminal. Ultramarine Work works from the files you put in the folder and hands drafts back for your review, so the only thing that reaches the regulator is what you file yourself. Ask before exam reports, supervisory letters or MRAs go in.