Building or buying AI: a conversation with Dawid Kotur

I studied Archaeology and Anthropology at UCL, not the most obvious route into banking, but I found my way in, and the rest is history.

It started at Metro Bank, where I became their first Head of Mobile Banking during the rise of the UK challenger banks, and earned an Employee of the Year award. That role gave me a front-row seat to how modern regulated firms operate.

I've been working in applied AI since roughly 2017. We worked on AI automation programmes at PwC, IPSOS, Mubadala and GKN, and ran one of the UK's largest applied-AI communities as the London lead for Facebook Developer Circles.

We were drawn to the mortgage sector because it represents a perfect storm of industry challenges: massive volumes of messy documents, strict regulation, and an incredibly high cost if you get things wrong. Having solved similar problems in the legal and financial sectors for years, the emergence of generative AI finally gave us the technology needed to fully solve the problem, shifting our focus from advising to building the product itself.

Curvestone AI automates compliance checking for regulated financial services. AI agents review every case, not a sample, and leave a full audit trail. In short, we make compliance auditable at scale. We're production-proven, so not a pilot, running live in mortgage and commercial-finance compliance and processing thousands of checks a quarter.

We deliver four things to lenders.

Comprehensive case review. The AI reads real-world cases including scans, photos, emails, call transcripts, fact-finds, bank statements and IDs, then checks them directly against the lender's specific compliance criteria.

Automated flagging and auditing. We review every single case, returning a clear pass or flag. Any exceptions are automatically routed to a human specialist, and the system generates a fully structured, explainable audit trail ready for regulators.

Scale and accuracy. The hard part isn't being right about one document, it's holding that accuracy across an entire case, every time. The platform is built for consistency across the full workflow, so compliance stays defensible end to end rather than looking clever on the first document and drifting after that. When policy and regulation change, Curvestone incorporates them, and our trust layer ensures there is never any regression, so you can make updates quickly as the rules move.

Human-in-the-loop judgment. By shifting the intelligence work of reading documents and verifying data to AI, lenders' teams can focus their time on final judgment and accountability, backed by a bulletproof audit trail for every decision. Human expertise doesn't just sit at the point of decision, it sits behind the technology too. We're actively hiring subject-matter experts from the industry, such as mortgage compliance reviewers, to build, shape and stress-test the AI itself.

It plugs into the systems you already run, like CRMs, document management and loan origination software, with no rip-and-replace and no new workflow for staff to learn.

Our recent integration with One Mortgage System (OMS) embeds Curvestone's AI compliance checking directly into the core OMS CRM case journey. For broker users, this means compliance becomes a natural part of their normal workflow, with no new tools to learn or legacy systems to replace.

The integration automatically reads and cross-references entire case files, including fact-finds, income evidence, bank statements and IDs, to flag missing documents, data mismatches, regulatory exceptions and suitability gaps. This cuts file review times from two to three hours down to a matter of minutes, allowing for consistent oversight across 100% of cases rather than a random sample. We are currently rolling this out across OMS's wider client base, using tailored checklists for larger firms and standard configurations for smaller ones.

This partnership also extends to OMS's lender origination platform, and we are currently building a pre-underwriting check that runs cases against lenders' specific lending policies before they ever reach an underwriter, with the results piped straight to the lender. The exact same core AI engine powers both workflows; we are simply adapting the rules and source systems to fit the lender environment.

When lenders weigh building an internal solution against buying a third-party one, the trade-offs fall into a few clear buckets.

Building an internal solution

The primary appeal is total control. An internal build lets you shape the software precisely to your unique internal lending policies and regulatory frameworks.

The cost is real. It is highly resource-intensive, typically taking 12 to 18 months to reach production-grade, and the true expense lies in hiring and retaining a specialised team of ML engineers, compliance experts and security specialists in a hyper-competitive market.

Then there is the hidden risk. AI systems are never truly finished. Document formats change, regulations tighten, and foundation models can drift and degrade quietly over time. Without a permanent, dedicated AI reliability function to monitor these shifts, an internal system won't fail loudly, it will go stale silently, which is the most dangerous outcome in compliance. Most teams don't regret the initial build, they regret year two, when the novelty wears off and they are left maintaining a system the market has already outpaced.

Buying a third-party solution

You get immediate speed and ongoing maintenance. A partner can deploy a solution in weeks rather than months, delivering compliance coverage this year. The vendor also assumes the entire burden of tracking FCA changes, catching model degradation and updating infrastructure. It is their core business, not an internal side project.

The traditional arguments for building no longer apply. Modern buy solutions can be configured entirely to your specific lending policies, deployed within your own cloud tenant, and designed to keep human judgment and a full audit trail at the centre of every decision.

While buying means relying on an external roadmap, it is not an irreversible decision. A partner can bridge your immediate needs now, and if you change your mind later, the cost of switching is minimal compared to a failed internal build.

Right now there is a massive gap between the headlines and actual daily workflows. Most of what we see is AI theatre: boardroom demos, pilots and innovation-day chatbots that look impressive but never fully launch or change how a single case is processed.

Meanwhile, the real risk is happening quietly behind the scenes, because the technology has moved faster than company safeguards. Plenty of individuals in the industry are already using public AI tools to process real client information without any corporate controls. That security gap is where the real risk sits today, not in the headlines.

In my view, two major shifts happened at the same time to make AI adoption a necessity rather than a luxury. First, the technology is ready: AI can finally read and understand the messy, real-world documents a mortgage file is actually made of, such as scans, photos of ID, handwritten fact-finds and long email chains, not just perfectly clean data fields. Second, the regulatory bar has changed: Consumer Duty shifted the burden from having good policies and a random sample to proving good outcomes across your entire book of business on an ongoing basis.

The combination means regulation now demands a level of 100% oversight that manual compliance simply cannot deliver, while the technology to actually achieve it finally exists.

My advice is not to reinvent your whole business at once. Start with high-volume, document-heavy routine checks. Take that tedious work off the critical path so your experienced people can focus their time on human judgment and edge cases, rather than chasing documents and re-keying data.

Auditability is the ultimate gatekeeper. The FCA hasn't written a specific AI rulebook; instead it is applying existing frameworks like Consumer Duty and the Senior Managers and Certification Regime (SM&CR) to the technology. The practical test for any lender is simple: if you cannot explain and defend an automated decision after the fact, you shouldn't be using it. Successful adoption means keeping a human accountable for every flagged case, with the AI providing clear evidence and reasoning rather than winging an end-to-end process on its own.

Having reached profitability before our seed round, and recently ranking #16 on Sifted's leaderboard of the UK and Ireland's fastest-growing startups, our roadmap centres on three main pillars.

Expanding the lender and platform ecosystem

Our biggest strategic push is extending our AI checking engine directly to the lender side of the market. We are actively building and piloting pre-underwriting checks that test a case against a lender's specific policies before it ever reaches an underwriter. This is being rolled out both directly with lenders and through origination-platform partners, alongside the continued rollout of our integration across the wider OMS client base.

Broadening compliance checks and self-service configuration

We're significantly widening the library of checks that run on our core engine, both in the products we cover and the risks we catch. Alongside mortgages, users can expect protection compliance, plus a growing suite of financial-crime checks such as adverse media screening, Politically Exposed Person (PEP) and sanctions checks, and appointed representative (AR) checks that give principal firms genuine oversight of their networks. We're extending into more specialised areas too, including vulnerability assessments, offer checks and social media monitoring.

Just as importantly, the platform is becoming highly configurable. Rather than waiting on us, internal compliance teams will be able to adapt and build their own workflows as regulations shift, making compliance something they can shape around their own risk appetite, not a fixed set of rules.

We are also extending our technology into other areas of financial services that face identical burdens, with wealth advisory and its strict suitability and evidencing obligations being our natural next step.

Governance and regulatory engagement

As a business built on making compliance auditable, we prioritise top-tier governance. Alongside our existing ISO 27001, we are completing ISO 42001 this year, the international standard for managing AI responsibly.

That same outlook shapes how we work with the regulator. We've worked closely with the FCA throughout the year, and earlier in 2026 we took part in its Open Finance TechSprint on mortgages and SME finance, building and testing solutions on synthetic data. Most recently we collaborated again at its Mortgages and Open Finance Policy Sprint, contributing directly to the regulator's thinking on how open finance should be deployed across the mortgage lifecycle. Helping shape that direction at both the technology and policy stage, not just responding once the rules are set, is how we keep our technology aligned with where supervision is heading.