AI Governance for Credit Scoring, AML and Fraud: Follow the Decision Path

A score or alert is not the whole decision. The pathway includes source data, thresholds, analyst queues, overrides, escalation, case closure and the historical record that may later train another model. Governance has to follow that sequence.

The blind spot between model output and action

A model may be accurate against a selected test set and still sit inside a weak operational pathway. An alert can be ignored because a queue is overloaded. An analyst can override a score for a good reason without recording that reason. A threshold can be adjusted to reduce workload while changing which cases are ever investigated. A closed case can become a future label, even when its closure reflected limited evidence rather than confirmed truth.

These are different questions from model optimisation. They concern data provenance, decision authority, review quality, escalation and the way operational choices feed back into later datasets. FINMA’s AI guidance asks supervised Swiss institutions to consider AI’s impact on their risk profile and to align governance, risk management and controls. It highlights data quality, bias, explainability, robustness and responsibility. Its 2026 guidance on digital fraud risks also points to the need to identify, assess, manage and monitor significant fraud risks.

One operational chain, several governance points

1. Data enter: customer, transaction, behavioural and contextual signals are selected, transformed and combined.
2. A model or rule acts: a score, ranking or alert is produced against a defined purpose and threshold.
3. A person or workflow responds: the case is prioritised, reviewed, overridden, escalated, closed or passed onward.
4. An outcome is recorded: the rationale, evidence, authority and resolution may be captured fully, partially or not at all.
5. The record is reused: historical cases can shape monitoring, validation, model updates or future training labels.

The question is whether the institution can reconstruct why a particular path was taken, who had authority at each point, what evidence was available and what happened when a boundary was crossed.

Four patterns a diagnostic should test

Data and label bias

Historical data may be incomplete, outdated or unrepresentative of the current population. Labels may reflect which cases were investigated, not the true distribution of risk. A no action outcome may mean no risk, insufficient evidence or insufficient review capacity. Those meanings must not be collapsed without examination.

Threshold and queue effects

Changing a threshold changes the population seen by analysts. Queue design can make some risks visible and others practically invisible. A governance review should connect threshold changes to rationale, approval, downstream effects and monitoring.

Overrides and escalation

An override is not inherently a failure. It can be a necessary exercise of human judgement. The control question is whether the reason, evidence, authority and subsequent review are documented. Repeated overrides may reveal a model gap, a policy gap, a training issue or a pressure pattern that deserves investigation.

Feedback into future models

If alert outcomes and analyst decisions become future training data, operational practice can be reproduced at scale. A model may learn what an institution historically investigated or closed, rather than the underlying phenomenon it intends to detect. This is a hypothesis to test with sampling, independent review and outcome evidence.

A bounded pilot pattern

The original sector proposal envisaged an eight to twelve week controlled pilot using a limited scoring stream and one AML or fraud workflow. It would review historical decisions, alerts, anonymised or lawfully processed override and escalation records, and cases across risk categories. It would not change the live operating model during the diagnostic.

• Map: data sources, transformations, model purpose, thresholds, ownership and handoffs.
• Sample: alerts, non alerts, overrides, escalations and closures under predefined selection rules.
• Review: rationale, evidence quality, consistency, authority and outcome against an agreed protocol.
• Test: label reliability, data gaps, reviewer agreement, subgroup or context differences and changes over time.
• Govern: assign control owners, monitoring, escalation, challenge and stop authority before any live change.

Possible outputs are a pathway map, risk heatmap, data and label gap register, override and escalation signature, and a prioritised control roadmap. Lower false positives, lower false negatives or better regulatory defensibility are potential objectives for a later measured intervention. They are not results established by this illustrative use case.

Regulatory scope must be assessed separately

Credit scoring, AML monitoring and fraud detection should not be treated as one undifferentiated legal category. Under the EU AI Act, systems intended to evaluate the creditworthiness or credit score of natural persons are addressed as high risk, while the regulation provides a specific exception for AI systems used to detect financial fraud. Classification depends on intended purpose and the legal conditions of the particular system. Other financial, privacy, consumer and sector obligations may still apply. The EBA’s work on machine learning in internal ratings based models likewise discusses prudent model use and interaction with wider legal frameworks.

Personal data processing, profiling and solely automated decisions with legal or similarly significant effects require their own legal assessment and safeguards. Pseudonymised data remain personal data where reidentification is possible. The diagnostic should minimise data, restrict access, document purpose and retention, and preserve meaningful human review and challenge.

Where NomaMind’s research direction fits

NomaMind can help build the operational AI strategy, Data Governance, risk management, oversight and control foundation. Its separate SMGI research direction asks whether a changing Decision Pathway can be read against Cognitive Maturity, Admissibility, authority and accountability. Real time Drift Type evaluation, threshold calibration and SMGI validation remain research and implementation work. They are not represented here as an existing production engine.