Curvestone AI's CEO on the shadow IT threat, why spot-checking is a failed strategy, and how 100% compliance became affordable
Dawid Kotur (pictured top), co-founder and chief executive of Curvestone AI, has spent more than a decade building AI systems for some of the world's largest organisations.
Sitting in a meeting room at the company's offices on Kingsway in central London, a short walk from Holborn station, he is clear-eyed about the gap between what the mortgage industry is being sold and what is actually landing in production. It is not the technology itself that concerns him, but the demos, the chatbots, the Innovation Day theatre that never changes how a single case is processed.
Curvestone launched in 2023 with a specific thesis – general-purpose AI fails in regulated industries because it has not been built for them. The platform now runs compliance checks for approximately 25% of UK mortgage network case files, and
Stay ahead of the UK mortgage market. Subscribe to the Mortgage Introducer daily newsletter for broker news, rate updates, and the industry latest delivered to your inbox every morning.
Kotur is at pains to point out that mortgages was not a market Curvestone chose. It was a market that chose them.
"We were looking for use cases that were relatively narrow so we could really focus down and make something excellent," he told Mortgage Introducer. "AI always fails
His previous company had built AI research and application systems for clients including PwC, Grant Thornton, and Meta, and had already worked with large mortgage networks and legal firms. That history gave Curvestone's founders an unusually precise read on where the compliance problem was both serious enough and contained enough to solve well. The company started with basic file checks for buy-to-let and residential cases and has expanded
Spot-checking was never a strategy
Ask Kotur about the industry's approach to compliance sampling and the answer is blunt. Most mortgage firms check somewhere between 5% and 12% of their case files. That figure, he said, was never arrived at because it made anyone feel safe.
"I think that number was what is the highest number we can come up with that sort of gives us some level of comfort that it's not going to break the bank," he said. "Compliance functions are very expensive, often one of the most expensive functions in those organisations, so I don't think that was ever a comfort choice. It was – what's the minimum?"
The risk attached to that minimum has grown considerably. Consumer Duty has shifted what the FCA expects firms to demonstrate – away from having the right processes and towards evidencing good outcomes across every client interaction. Networks, directly authorised (DA) firms, and appointed representatives (ARs) running on 10% sampling are, in Kotur's view, carrying exposure they may not have fully quantified.
What has changed, he argues, is the economics. Running AI-assisted compliance across 100% of case volume now costs firms something very close to what they currently pay to check a fraction of their book.
"Now some people call me crazy for saying this," he said. "But if something is possible, it eventually becomes the norm. Because why would you not want more compliance checks? It makes no sense why you wouldn't want that, especially if the cost is extremely similar to what you'd be paying right now."
The data risk firms are not talking about
There is a compliance problem most firms are not measuring, and it is happening inside their own walls. Kotur believes shadow IT – individuals using public AI tools to process real client data, often without realising it is a problem – is far more widespread than the industry acknowledges.
"I actually don't think the industry quite realises how big the issue is," he said. "You've got individuals who want to get stuff done, and they may even not know that they're doing something wrong. They may not know that using their private version of ChatGPT and uploading a document with personal data is just not okay."
The data residency question compounds this. "Do you know whether your data gets only processed in the UK and EU, or does it go to the US? I think a lot of those tools do fly through the US."
Broker appetite for AI in mortgage technology is rising sharply. Research published in June by Nottingham Building Society found that 89% of brokers want technology to play a bigger role in the mortgage process, up from 74% six months earlier. Without governance frameworks to match that appetite, the shadow IT problem Kotur describes is likely to deepen before it is addressed.
What to actually ask a vendor
When it comes to evaluating AI compliance systems, Kotur has five tests he applies. The starting point is independence, and he frames it in terms that are hard to argue with.
"You should not mark your own homework," he said. "There are a lot of companies that would say, oh, we can build this ourselves. But even if they could hire a team of 15 to 20 people to do that – which they probably won't – should you be checking your own homework? Isn't that why we have independent compliance?"
The same logic applies when buying compliance functionality from an existing CRM or technology provider. The closeness of that relationship to the process being assessed is a problem in itself, however the arrangement is presented.
The remaining four tests cover an auditable evidence chain reproducible without the vendor in the room; a rule set the firm genuinely understands; systematic logging that can withstand FCA scrutiny; and training embedded across the full deployment. Firms that cannot get clear answers on all five, Kotur said, should keep looking.
On the build-versus-buy question, his position is settled. The hidden cost is not the build itself, it is year two, when the internal system goes stale and the engineers who built it have moved on. "Building isn't a project," he said. "It's a permanent commitment."
A counter-pressure in the DA market
Kotur ended with an observation about a trend he had been reading about. The number of directly authorised firms in mortgages and wealth fell by 17.2% between 2020 and 2025, a net loss of 1,853 businesses, according to FCA data obtained by Network Consulting. Running a DA operation carries real overhead, compliance not least among it. Kotur's view is that AI tooling may start to shift that calculation.
"Tools in compliance and other automation tools in the space might change that trend, because all of a sudden you may not have to rely on some of the others in order to do things like compliance for you," he said. "Those tools will enable smaller and medium firms to do a few more things of their own."
Whether that plays out depends, in part, on whether the industry moves past the demos and builds something that holds up when the volume arrives. Kotur has been making that argument for over a decade. In the mortgage market, he thinks the moment has finally come.
"You should be selling evolution, not revolution," he said. "The industry, the clients, the FCA, and everybody else needs time to adjust. An evolution that can take three, five, maybe a few more years to get to a place where the industry does change, but it's not an overnight thing."
Want to be regularly updated with mortgage news and features? Get exclusive interviews, breaking news, and industry events in your inbox – subscribe to our FREE daily newsletter. You can also follow us on Facebook, X (formerly Twitter), and LinkedIn.
