Compliance teams at Retail Banking firms operating under the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) are increasingly using AI to update correspondent-banking onboarding checklists against the CPMI data model, generate horizon-scanning entries for the payments business line, and prepare NED briefings on the regulator's adoption-rate posture. The same tools validate citation accuracy in compliance attestations and supervisory exchanges.
Two frontier AI models tested by the RLB Specialist Panel on the workflows retail-banking compliance officers use to support advice on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) produced three discrete hallucinations bound to regulator-issued source text. The Panel records two distinct failure classes, Numeric Drift and Source-Credit Fabrication across the set. Questions were prepared by the Specialist Panel based on real practical AI usage in the workflows retail-banking compliance officers use AI for, and each finding is bound to verbatim regulator-issued source text held as primary substrate.
For Compliance teams at Retail Banking firms, each hallucination has a direct operational consequence in the compliance attestation, NED briefing, or horizon-scanning entry. The Panel's testing surfaces CPMI working-group chair misattribution, ISO 20022 adoption rate conflation (RTGS vs faster payments), and ISO 20022 adoption rate conflation (RTGS vs faster payments). Where these errors flow into a deliverable, the exposure is misstated peer-group benchmark in NED packs and a discoverable factual error in supervisory exchanges.
The pattern is uniform across the set: the AI returns a confident, sourced-looking answer that conflicts in a load-bearing specific with the regulator's verbatim text, and the error survives a first-pass review precisely because the surface form is plausible. The Panel records each hallucination with the regulator's primary substrate held as the anchor, so the corrective text is available alongside the failure.
The Specialist Panel records the citation IDs as follows: RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q004-Sonnet46 (Claude Sonnet 4.6 (web search on), Source-Credit Fabrication); RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Opus47 (Claude Opus 4.7 (web search on), Numeric Drift); RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Sonnet46 (Claude Sonnet 4.6 (web search on), Numeric Drift). Each citation links to the verbatim regulator-issued source text, the tested AI question, and the recorded AI response, so the Panel's assessment is traceable end to end.
For compliance teams at retail banking firms, the citation IDs operate as a reference index: when an AI answer in the working draft matches a known Panel finding, the cited regulator text is already available as the corrective anchor. The full per-finding analysis cards, including the audience-specific impact statement, sit on the cell's detail surface for sign-off use.
This is the consolidated view of findings. Click the Citation IDs or 'see details →' on any item for the full details for each finding.
An AI assistant asked which central bank chairs the CPMI working group behind the harmonised ISO 20022 data requirements attributed the role to the Federal Reserve Bank of New York, naming a specific individual as co-lead, when the authoritative RBA press release confirms it is the Reserve Bank of Australia, with the RBA Governor as former Co-Chair. A Compliance team at a Retail Banking firm that embeds this attribution in a board paper, a regulatory horizon-scan, or training materials for the payments business line is producing a governance narrative that is factually wrong at its foundation.
The risk is not merely reputational: if the error surfaces during a supervisory review or a correspondent-bank due-diligence exchange, the firm must either correct the record, exposing the gap in its regulatory intelligence process, or allow the error to persist in its compliance documentation.
An AI assistant asked about the current ISO 20022 adoption rates for faster payment systems and RTGS systems produced a single figure, approximately 79% for both, when the authoritative source (an Andrew Bailey speech, March 2026) reports materially different rates: more than three-quarters for faster payment systems but only approaching half for RTGS. The AI later acknowledged the figure was reconstructed rather than retrieved.
A Compliance team at a Retail Banking firm in international jurisdictions that uses this conflated figure in NED briefings, regulatory horizon-scanning submissions, or correspondent-bank positioning statements overstates RTGS adoption by roughly 30 percentage points, misrepresenting where the firm's infrastructure peers actually sit and potentially misjudging the urgency and timeline of its own implementation obligations.
Claude Sonnet 4.6 with web search exhibited the same blended 79% adoption figure as the Opus 4.7 test on the matching question, collapsing the regulator's separately-stated faster-payment and RTGS rates into a single composite. The structural exposure for this audience is identical to the Opus variant: an AI assistant asked about the current ISO 20022 adoption rates for faster payment systems and RTGS systems produced a single figure, approximately 79% for both, when the authoritative source (an Andrew Bailey speech, March 2026) reports materially different rates: more than three-quarters for faster payment systems but only approaching half for RTGS.
The AI later acknowledged the figure was reconstructed rather than retrieved. A Compliance team at a Retail Banking firm in international jurisdictions that uses this conflated figure in NED briefings, regulatory horizon-scanning submissions, or correspondent-bank positioning statements overstates RTGS adoption by roughly 30 percentage points, misrepresenting where the firm's infrastructure peers actually sit and potentially misjudging the urgency and timeline of its own implementation obligations.
Every finding on this page compares an AI subject's account of the rule against the regulator's verbatim text from the regulator's own portal. Both are linked. Each delta, its root causes, and impact analysis are documented and published with immutable Citation IDs.