Sanctions and AML monitoring desks inside large corporate banks read CPMI's d224 API harmonisation framework not for its standards content but for what it changes about pre-validation, beneficiary-address quality and the small set of central banks running live cross-border pilots. Those three hooks drop straight into the periodic horizon scan, the correspondent-banking due diligence pack and the board-level technology-risk update.
Across the six AI-generated answers tested against d224 and its adjacent CPMI briefs, three were confidently wrong on exactly those hooks: the SARB pre-validation partnership was denied (CPMI Brief No. 9 names it), the per-recommendation stakeholder table was invented off category labels rather than the regulator text, and a November 2026 structured-address phase-out was manufactured against the February 2026 ISO 20022 update. Each of those failures lands inside a deliverable a compliance team is already expected to produce, with no surface signal to the reviewer that the underlying retrieval never happened.
The pattern matters more than any one error: every one was a confident answer on a regulatory-source detail the AI could not actually retrieve.
What the AI got wrong, and why it matters here
Across these three failures the same control gap repeats: the AI did not flag that the primary CPMI document was out of reach, and instead reconstructed an answer from category names, default standard-setter membership and industry chatter about CBPR+ timelines. A compliance review that does not have an independent verification step against the regulator text will not see the gap.
Finding 1: SARB pre-validation pilot denied
Sonnet 4.6 was asked which central bank is explicitly named as the CPMI collaborator on the payment pre-validation API recommendation. It denied that any pilot partner has been named. CPMI Brief No. 9 (November 2025) states plainly that CPMI, in collaboration with the South African Reserve Bank, has been advancing the pre-validation API recommendation by interviewing market stakeholders. A clean factual denial of a named regulator-bilateral workstream is a hard miss inside a horizon-scan deliverable that supervisors may later read alongside the brief itself.
Citation: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q007-Sonnet46.
Finding 2: Invented stakeholder taxonomy for the 10 recommendations
Opus 4.7 was asked which of d224's 10 recommendations target commercial banks, which target payment-system operators, which target central banks and so on. It returned a clean taxonomy naming ISO, BIAN, SWIFT, payment-system operators and others against specific recommendation groupings. None of that assignment is from the d224 text; it is reconstructed from category labels and the AI's general prior on API standards work. A compliance applicability matrix built on that taxonomy will misroute internal scoping work and will not survive an external review against the primary recommendation text.
Citation: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q008-Opus47.
Finding 3: Fabricated November 2026 structured-address mandate
Sonnet 4.6 was asked what changed in the February 2026 update to d230 (harmonised ISO 20022 data requirements). It committed to a specific cutover, from November 2026 only structured or hybrid addresses will be permitted in ISO 20022 cross-border payment messages, and framed the line as drawn from the updated CPMI document. The d230 document text describes only generalised standardisation and regulatory developments since 2023 and a separate technical annex; the November 2026 cutover does not appear in the regulator's text.
Quoted into a correspondent-bank readiness memo or a SWIFT/CBPR+ briefing, the line asserts a mandate that the regulator did not document.
Citation: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q009-Sonnet46.
When this hits the compliance calendar
Three points in the standing compliance calendar pull from CPMI work directly: the quarterly cross-border-payments horizon scan, the correspondent-bank annual due diligence refresh, and the ad hoc questions that come up when transaction monitoring trips an ISO 20022 address-quality alert.
| Standing item | Where the AI risk surfaces | Failure mode |
|---|---|---|
| Quarterly cross-border payments horizon scan | Naming live regulator pilots, especially South Africa | Finding 1: denied SARB partnership |
| Correspondent-bank annual due diligence refresh | Per-recommendation stakeholder mapping | Finding 2: fabricated taxonomy |
| ISO 20022 address-quality alert response | Commitments on structured-address cutover dates | Finding 3: invented November 2026 deadline |
Aggregate impact on the team
Three findings, three different deliverables, one root cause: AI confidence on regulatory-source detail without underlying retrieval. For sanctions and AML monitoring in a corporate bank, the failure surface is the audit trail itself.
| Risk Impact | Count | Affected findings |
|---|---|---|
| 0 | ||
| 0 |
What this team should do
Add a regulator-source verification step to every AI-drafted CPMI summary that names a central-bank pilot partner, a per-recommendation stakeholder assignment, or an ISO 20022 cutover date. Treat those three answer shapes as controlled outputs requiring a human spot-check against the primary CPMI text, not the AI's synthesised paragraph.
Detection patterns to add to AI-review
- Any AI output naming a specific central bank as a CPMI pilot partner must be verified against the relevant CPMI Brief (numbered series).
- Any AI output presenting a stakeholder-to-recommendation table for d224 must be cross-checked against the recommendation text itself, not the category headings.
- Any AI output asserting a specific date for an ISO 20022 format change must be verified against the d230 source text, not a SWIFT or CBPR+ industry summary.
How RLB can help
RLB maintains the failure-pattern catalogue against d224, d230 and the CPMI brief/speech series, refreshed against the live AI subjects on rotation. Compliance teams operating cross-border payment lines can wire the catalogue into the standing AI-output review step, so the three failure shapes above are flagged before they enter a controlled deliverable.