What I want to flag about this roadmap, before anything else, is the order the three phases run in. It would be easy to sequence this as "fix the AML model, then train the team," because that is how most organisations I have worked with across twenty-plus markets actually plan a rollout: technology first, people afterward, as a kind of cleanup pass. This roadmap runs the opposite way on purpose, and that choice is the whole point of bringing workforce literacy into the same room as the governance and AML work, rather than scheduling it as a separate initiative six months later.

Weeks one to four exist entirely to close the review-layer gap before the parallel run gets serious, because training thirteen analysts against real flagged alerts, not hypothetical training-deck cases, only works if those alerts already exist to train against. That is a genuinely different exercise from a generic AI-literacy workshop, and it is the reason the literacy baseline was built from Kelvin Bridge's own backtest data rather than a template. Assigning named backup reviewers in the same phase is not paperwork; a nine-person bottleneck on Tier 2 and Tier 3 escalations is a single point of failure I have seen stall a compliance rollout for months when the one person who could sign off went on leave.

The middle phase, weeks five to eight, is where most organisations quietly let the literacy work slide, because a re-tested literacy score does not show up on a status update the way a falling false-positive rate does. Tracking both on the same weekly cadence, not just at the ninety-day mark, is what keeps the workforce side from becoming the thing nobody checks until it is already a problem.

What I would tell Kelvin Bridge's leadership directly is this: a false-positive rate improving from 15.4% to 10.7% will look, from outside compliance, like the project succeeded. It has not succeeded until the eighteen-of-twenty-two target holds at the same time, because a control the operating team cannot independently defend is not actually a control, whatever the backtest says about it. Weeks nine to twelve exist to prove both held together, not separately, which is the only version of "done" a workforce transformation lead should accept.

Sameen Khan, PBM · Global HR, AI and Workforce Transformation Leader

I have sat across the table from MAS inspectors often enough to know which of these three questions gets asked first, and it is never "does the model work." It is "what happens when it's wrong, and who catches it." Kelvin Bridge's answer here is the right shape: a wrong ranking delays or mis-prioritises an alert's review, it does not itself clear a customer or file a report, and every Tier 2 or Tier 3 alert still passes a named human reviewer before any filing decision. That distinction, between a ranking error and a filing error, is what keeps this whole architecture defensible rather than merely automated.

The second question is harder, and I would not let Kelvin Bridge present it as fully answered yet. Showing the control existed before a specific decision, not reconstructed after the fact, is demonstrable for the ranking layer: the audit log captures ranking factors at the moment of ranking, retained for five years, which is exactly the record-keeping standard I would expect under both the MAS AI Risk Management Guidelines and the EU AI Act's Article 12. But an inspector who is any good will not stop at "the log exists." They will pull a specific flagged alert and ask the reviewing analyst to walk them through it live, and today that only works reliably for nine of twenty-two analysts. A audit trail nobody in the room can narrate under questioning reads, to an inspector, as documentation built for the file rather than for the work.

The third question is the one I have watched compliance teams get wrong most often, because it is tempting to answer it about the vendor rather than the institution. Eighteen of twenty-two analysts understanding what the model does and does not decide is a real literacy floor, and it is the number I would lead with in a board pack. But "the workforce understands this control" and "the vendor understands this control" are not the same claim, and only the first one satisfies a regulator asking whether Kelvin Bridge itself, not ComplyAdvantage or Chainalysis, owns the judgement behind a filing decision.

Read together, these three answers describe an institution that built the right architecture and is honest about not yet having fully proven it operates it. That is a defensible position to bring to a board today. It becomes a defensible position to bring to a MAS inspection once the nine becomes eighteen.

Jason Lee · Head of Compliance & AI-Driven AML Specialist

The reason this programme puts three named practitioners in the room rather than one generalist covering all three disciplines is visible in exactly the way Kelvin Bridge's example plays out above. A governance framework built without Jason's AML fluency would have produced a checklist that reads well but doesn't survive a RegTech-specific question about false-positive reclassification. An AML implementation built without Sameen's workforce lens would have shipped the parallel run on schedule with nobody checking whether the review layer could actually defend it. And a literacy baseline built without a governance frame around it risks becoming a training-completion metric rather than a control anyone can point to under questioning. Each of us is accountable for one block precisely so none of those gaps gets averaged away inside a single generalist's judgement.

What the day is actually building, underneath the three separate documents, is the muscle to check them against each other before a regulator does it for you. That is a different skill from producing any one document well. Kelvin Bridge's own case shows why: on paper, all three outputs look reasonable in isolation. The governance checklist names an owner and a bounded decision scope. The literacy baseline shows a majority of the team above the explanation floor. The AML note shows a real, backtested improvement with sensible go-live discipline. It is only when you hold the three together, as the closing joint session forces a room to do, that the actual constraint surfaces: not one of the three documents individually, but the fact that the literacy baseline's weakest number, nine of twenty-two, is exactly the number that determines whether the other two documents' claims can be defended live, in front of either an internal board or an inspector.

That is also why this closing session runs with all three of us in the room together, not sequentially. A synthesis produced by one facilitator reading the other two blocks' outputs after the fact would catch the surface-level gaps. It would not catch the kind of gap Kelvin Bridge's example surfaces, where the constraint sits at the seam between two blocks rather than inside either one. Participants leave this programme with three connected documents and, more importantly, with a rehearsed answer to the question a regulator or a board member actually asks: not "is each of these individually complete," but "do these three things agree with each other, and can your own people say why."

Terence Kok · Executive Director, AI Governance & Assurance Practice · Enterprise AI Strategist and Keynote Speaker