Virtual Assets Regulatory Authority CEO: Finance’s AI future moves at the speed of its slowest regulator

Most industries are passive recipients of artificial intelligence. Financial regulation is not. Regulators are both being transformed by AI and acting as the gatekeepers deciding how much of its gains reach the financial industry.

That dual position will define the next decade of finance more than any single technology, firm or policy. It will separate the financial centres that lead from the ones that get bypassed. I know this because I have spent the last several years building one of those regulators from scratch.

Before VARA, I spent over a decade advising financial institutions on cybersecurity and technology risk. What I see now from the other side is that the infrastructure through which oversight is delivered matters as much as the rules themselves. That is where real transformation is happening.

An uneven starting point Tier 1 banks spent more than a decade and billions of dollars on regulatory technology, with mixed results. Thomson Reuters’ annual Cost of Compliance surveys show compliance budgets and headcount climbing steadily, with productivity gains linear at best. The 2023 wave of large-language-model adoption produced widespread experimentation but very little production deployment in compliance-critical workflows, because the cost of a wrong answer in regulation remains higher than the cost of a slow one.

Among regulators, the gap is wider. The Monetary Authority of Singapore, the UK’s Financial Conduct Authority, the Hong Kong Monetary Authority, and the Bank of England run serious supervisory-technology programmes. Many other authorities operate predominantly on PDF rulebooks, sample-based onsite inspection and email-driven supervisory cycles.

Virtual assets as the catalyst Virtual assets matter beyond their own market. They were built differently from the ground up: programmable, always on, cryptographically auditable, indifferent to borders. Those are not feature choices, they are constraints on supervision.

You cannot audit a 24/7 cross-border