SumatoSoft builds a private LLM compliance copilot inside a European digital bank's own cloud

Overview

A licensed European digital bank (Lithuania) had compliance analysts reading policy by hand and writing case narratives from long transaction histories. SumatoSoft built a private RAG copilot with a LoRA fine-tuned Llama 3 model running in the bank's Azure account, citing the policy clause behind each answer, with analyst sign-off. The source reports onboarding reviews of about five business days now take about two, and case narratives about 90 minutes down to about 25.

The challenge

As its customer base grew, the bank's compliance team spent most of its day reading policy by hand and writing cases from long transaction histories. Transaction monitoring generated a high volume of alerts, the large majority of them false positives, and onboarding customers who needed enhanced due diligence meant reading across several long policy documents that changed often.

The solution

SumatoSoft built a private large language model copilot as a service within the bank's Azure cloud account, with AWS Bedrock as an alternative hosting option. A retrieval-augmented generation pipeline indexes the bank's AML, KYC, sanctions and fraud policies and a history of resolved cases, with hybrid search over PostgreSQL with pgvector and Qdrant; every answer names the clause it drew on and the copilot abstains when retrieval finds nothing that supports an answer. An open-source Llama 3 model fine-tuned with LoRA on the bank's own casework drafts alert briefings and case narratives, agentic steps handle repetitive work such as summarizing transaction histories and grouping alerts, and a human analyst signs off on everything before it leaves the system.

Reported business value

Within the first year of rollout, the compliance team handled a larger book of business without adding headcount in proportion. According to the source, complex onboarding reviews dropped from about five business days to about two, alert triage moved from around 30 cleared alerts per analyst per day to between 70 and 80, case narratives dropped from about 90 minutes to about 25, audit requests that once took three weeks are answered in about four days, and new analysts reach full productivity in about 6 weeks rather than 3 months.