Failure class on record for Compliance teams at Retail Banking firms: Numeric Driftand Source-Credit Fabrication.

Frontier AI models tested by the RLB Specialist Panel on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) produced 3 discrete hallucinations bound to verbatim regulator-issued source text. Each finding has a direct read-through into compliance teams at retail banking firms's working deliverables.

The pattern in one line

Leading AI assistants used by compliance teams at retail banking firms on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) returned answers that looked sourced and coherent but conflicted, in load-bearing specifics, with the regulator's verbatim text. The errors survive a first-pass review of compliance teams at retail banking firms's compliance attestation, NED briefing, or horizon-scanning entry and only surface when a counterparty, regulator, or independent reviewer checks the primary record.

The shape of the failure is consistent across the the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) test set: a confident, specific, institutionally plausible answer that maps to general payments-system knowledge rather than to the regulator's actual issued text on the question asked.

How the RLB Specialist Panel tested this

The Panel prepares questions based on real practical AI usage in the workflows retail-banking compliance officers use AI for: drafting, validation, benchmarking, and source-citation tasks against the CPMI Harmonised ISO 20022 Data Requirements (Updated Report). Each tested question is bound to verbatim regulator-issued source text held as primary substrate; the Panel does not generate findings against documents whose verbatim text it cannot anchor. For this cell, the Panel ran three Specialist Panel questions against two frontier AI subjects with web search on, and recorded the AI's confident answer alongside the regulator's actual text for direct comparison.

The Specialist Panel questions are framed in the form a working retail-banking compliance officer would actually pose: not abstract knowledge probes, but deliverable-shaped requests that reflect the compliance attestation, NED briefing, or horizon-scanning entry this audience produces. A Specialist Panel direct question asks the AI to state a regulator-issued fact; a Specialist Panel application-style question asks the AI to draft, validate, or benchmark using that fact. Both formats are run, and the Panel records the failure modes that surface across the two.

What the models got wrong

Finding 1 (RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q004-Sonnet46, Claude Sonnet 4.6 (web search on)). On the Specialist Panel question covering which central bank chaired the CPMI working group that produced the harmonised ISO 20022 data requirements, the AI returned: "Federal Reserve Bank of New York." The regulator-issued source text, held by the Panel as primary substrate from RBA press release of 18 October 2023, records: "Reserve Bank of Australia." The Panel classifies this as Source-Credit Fabrication.

The audience-specific impact statement for this finding is recorded in the per-finding analysis card on the cell's detail surface, with the compliance attestation, NED briefing, or horizon-scanning entry read-through spelled out for sign-off use.

Finding 2 (RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Opus47, Claude Opus 4.7 (web search on)). On the Specialist Panel question covering the share of faster payment systems and RTGS systems currently using ISO 20022, the AI returned: "approximately 79% for both RTGS and faster payment systems." The regulator-issued source text, held by the Panel as primary substrate from Fabio Panetta BIS speech r260316d (March 2026), records: "more than three quarters of faster payment systems, approaching half of RTGS systems." The Panel classifies this as Numeric Drift.

The audience-specific impact statement for this finding is recorded in the per-finding analysis card on the cell's detail surface, with the compliance attestation, NED briefing, or horizon-scanning entry read-through spelled out for sign-off use.

Finding 3 (RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Sonnet46, Claude Sonnet 4.6 (web search on)). On the Specialist Panel question covering the share of faster payment systems and RTGS systems currently using ISO 20022, the AI returned: "approximately 79% for both RTGS and faster payment systems." The regulator-issued source text, held by the Panel as primary substrate from Fabio Panetta BIS speech r260316d (March 2026), records: "more than three quarters of faster payment systems, approaching half of RTGS systems." The Panel classifies this as Numeric Drift.

The audience-specific impact statement for this finding is recorded in the per-finding analysis card on the cell's detail surface, with the compliance attestation, NED briefing, or horizon-scanning entry read-through spelled out for sign-off use.

Why this matters for compliance teams at retail banking firms

Compliance teams at Retail Banking firms working on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) carry a direct read-through from the AI's wrong answer to the compliance attestation, NED briefing, or horizon-scanning entry they sign off on. The exposure is misstated peer-group benchmark in NED packs and a discoverable factual error in supervisory exchanges. The failure modes recorded here are not edge-case linguistic slips: they touch the load-bearing operational, benchmarking, or governance specifics that compliance teams at retail banking firms are paid to get right.

Where an AI assistant returns a confident, plausible-looking answer that conflicts with the regulator's verbatim text, the cost of correction rises with every downstream artefact that cites it.

The compounding risk for this audience is structural. A first-pass reviewer sees a specific number, a named institution, or a structured schema and treats it as evidence the AI has retrieved an authoritative source. The Panel's testing surfaces the cases where that assumption does not hold, and where the corrective regulator text is materially different from the AI's confident output. Once an AI-sourced figure or attribution enters a board pack, a regulatory submission, or a vendor specification, the audit trail of correction can extend across multiple deliverables before the error is contained.

The regulator's actual position

On which central bank chaired the CPMI working group that produced the harmonised ISO 20022 data requirements, RBA press release of 18 October 2023 states:

The Reserve Bank of Australia chairs the CPMI working group, with Michele Bullock as former Co-Chair of the Messaging Workstream

On the share of faster payment systems and RTGS systems currently using ISO 20022, Fabio Panetta BIS speech r260316d (March 2026) states:

More than three quarters of faster payment systems covered by the survey, and approaching half of RTGS systems, are now using ISO 20022.

On the share of faster payment systems and RTGS systems currently using ISO 20022, Fabio Panetta BIS speech r260316d (March 2026) states:

More than three quarters of faster payment systems covered by the survey, and approaching half of RTGS systems, are now using ISO 20022.

Each verbatim block above is held by the Panel as primary substrate and is the anchor against which the AI subjects' answers were compared. Where a Specialist Panel question crosses more than one regulator-issued document (a BIS speech together with an FRB Services FAQ, for example), the Panel records the source attribution per finding so the corrective text is unambiguous. The verbatim quoted above is the text against which the AI's answer fails.

    ## What this tells us about AI for compliance teams at retail banking firms

    The pattern recorded against this cell maps to the failure classes the RLB Specialist Panel
    catalogues across regulators:

    - Source-Credit Fabrication: the model produced a confident, sourced-looking answer that conflicts with the regulator's actual text on CPMI working-group chair misattribution.

• Numeric Drift: the model produced a confident, sourced-looking answer that conflicts with the regulator's actual text on ISO 20022 adoption rate conflation (RTGS vs faster payments).
• Numeric Drift: the model produced a confident, sourced-looking answer that conflicts with the regulator's actual text on ISO 20022 adoption rate conflation (RTGS vs faster payments).

  For compliance teams at retail banking firms, the practical signal is that AI assistants with web search enabled remain
  prone to producing single composite figures, structured-field over-specification, missed
  retrievals, and source-credit attribution errors on questions where the regulator's primary
  document is the only authoritative anchor. The errors are most dangerous where they look more
  conservative or more specific than the underlying rule, because that is precisely the shape a
  first-pass reviewer is least likely to challenge.
  
  The Panel's broader catalogue records that web-search-enabled frontier models on cross-border
  payments topics tend to default to general payments-industry knowledge (CBPR+ schemas, blended
  adoption statistics, well-known central-bank names) when the underlying regulator-issued text
  contains a specific, less-familiar fact. For compliance teams at retail banking firms drafting against the CPMI Harmonised ISO 20022 Data Requirements (Updated Report),
  the corrective is straightforward: where the workflow depends on a specific regulator-issued
  fact, the primary substrate has to remain the anchor, and the AI's draft has to be checked
  against it before sign-off.
  

What the RLB Specialist Panel is doing about it

The Panel runs Specialist Panel direct questions and Specialist Panel application-style questions against frontier AI models on every reg-rooted workflow compliance teams at retail banking firms actually use AI for. Each surfaced hallucination is bound to a verbatim regulator-issued anchor before publication, and each is recorded with a citation ID that traces the question, the AI's response, the verbatim source text, and the audience-specific operational consequence.

The Panel works directly with institutional readers, AI labs, and regulator-facing teams to feed back the patterns the Panel records, so the same failure modes can be addressed at source rather than caught at the reviewer's desk.

For institutional readers in compliance teams at retail banking firms roles, the Panel's surface is designed to be used in two ways: as a reference index when an AI-drafted deliverable references the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) directly, and as a workflow-level signal of where AI assistance is and is not robust on cross-border payments topics. The Panel's per-finding cards include the regulator's exact text alongside the AI's failed response, so a reviewer can resolve a question without leaving the cell.

Partnership conversations are open to AI labs that want the catalogue's full failure taxonomy fed into their evaluation pipelines.

What Retail-banking compliance teams should do

• Verify against primary substrate: where the deliverable depends on a specific number, chair attribution, or schema definition from the CPMI Harmonised ISO 20022 Data Requirements (Updated Report), do not rely on the AI's summary; open the regulator's verbatim text and confirm the load-bearing detail.
• Treat AI-sourced statistics as a starting point, not an anchor: any single composite figure applied uniformly to two distinct regulated populations is a red flag and should be checked against the regulator's separate per-population numbers.
• Build a verification step into the workflow: for the compliance attestation, NED briefing, or horizon-scanning entry this audience produces, introduce a primary-source check on every numeric, schema, or institutional-attribution claim before sign-off.
• Use the Panel's citation IDs as a reference index: when an AI answer matches a known Panel finding, the cited regulator text is already provided as the corrective anchor.
• Treat stricter-looking AI outputs with the same scepticism as looser-looking ones: in the Panel's catalogue, over-specified schemas and over-confident composite figures are precisely the shapes a first-pass reviewer is least likely to challenge, and therefore precisely the shapes most likely to flow into a downstream artefact uncorrected.
• Where the AI workflow is repeated across corridors, jurisdictions, or product lines, run a periodic spot-check against the Panel's catalogue: a single template error can propagate across multiple markets before discovery, and the Panel's per-cell surface is structured to make that template-level audit straightforward.

The Panel records the 3 hallucinations above with citation IDs RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q004-Sonnet46, RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Opus47, RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Sonnet46 for direct reference in this audience's workflow. The same citation IDs are surfaced on the cell detail page so a reviewer running a sign-off check against an AI-drafted deliverable can pull the corrective regulator text without leaving the briefing.

Right of Reply

These findings and associated work have been put up in public with a view of the greater good for the development of a safer AI ecosystem. Any party reading this or any finding on reglegbrief.com may contact us and have an unconditional right of reply; the Specialist Panel will publish any factual correction or contextual response alongside the original finding, with no editorial gatekeeping. Researchers, regulators, and compliance teams with questions on methodology or specific findings can reach the Specialist Panel via the same channel.

Source & Methodology Standards

RegLeg Brief is operated by Verdus Technologies Pte. Ltd. (UEN 201616982R), incorporated in Singapore. The RLB Specialist Panel, with an aggregate of over 60 years of public-policy and industry experience, documents only confirmed hallucination findings, under a methodology that requires a verbatim regulator excerpt for every documented claim. All findings, citation IDs, model outputs, regulator excerpts, and methodology notes are open-access.

Primary source verified: CPMI Harmonised ISO 20022 Data Requirements for Cross-Border Payments (2026 Update) · Substrate documents: p_09_OTHER_Governance___which_institution_chaired_t_brief10.htm, p_10_SPEECH_ISO_20022_adoption_rates_across_payment_r260316d.htm · CPMI portal: bis.org/cpmi

Citation IDs referenced:

• RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q004-Sonnet46
• RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Opus47
• RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Sonnet46