The FCA's October 2024 AI guidance makes this unambiguous. When your firm uses cloud AI for compliance work, the Senior Manager named on the permission cannot delegate accountability to a vendor. Every decision VELA makes is documented, cited to source, timestamped, and logged — for the supervisor who will ask about it.
The structural problem with cloud AI in UK-regulated firms
UK GDPR Chapter V restricts international transfers of personal data to countries without an ICO adequacy decision. The Bahamas does not have one. When a UK-regulated trust company, fund administrator, or compliance firm uses ChatGPT, Microsoft Copilot, or any cloud AI tool to process client documents, every query containing personal data is a potential Chapter V transfer — requiring an IDTA, SCCs, or a TIA that most firms have not conducted.
VELA sovereign deployment eliminates this obligation at the architecture level. When data does not cross a network, no transfer has occurred and no Chapter V mechanism is required. This is not a contractual assurance. It is an architectural fact.
Regulatory exposure — answered by architecture
Under SM&CR, the Senior Manager with the relevant function cannot attribute a poor AI governance decision to a vendor. They own the outcome. When the FCA examines an AI deployment, the question is whether the named individual understood what the system was doing and documented the governance rationale.
VELA's answer
110-entry NIST AI RMF governance register, nightly-verified across 19 automated gates. Every architectural decision documented with what was proposed, why it was chosen, and what tradeoff was accepted. The Senior Manager can hand this to a supervisor on the day of examination.
Cloud AI services route queries through servers in the US or EU. Even when the service provider offers a DPA, the routing of data through infrastructure without an adequacy decision triggers a Chapter V assessment obligation. Most firms have not completed one. Most firms are not aware they needed to.
VELA's answer
On-premise inference means the query never leaves your network. No transfer occurs. No SCCs, no IDTA, no TIA required. The obligation is eliminated at architecture level — not managed, not contracted around.
When a compliance officer uses cloud AI to answer a regulatory question and is later asked what they relied upon, the answer "ChatGPT said so" is not a defensible record. The FCA expects AI-assisted decisions in regulated activities to be traceable, documented, and reviewable.
VELA's answer
Every query, every retrieved document, every generated answer, every timestamp — logged at the architecture level. The compliance officer can trace any VELA answer to the exact source document and the moment it was produced. This is the record an FCA supervisor will ask for.
The architecture — not the claim
VELA runs on hardware inside the client's jurisdiction. The model runs locally. No query crosses a network boundary during inference. The audit trail is written to a local database under the client's control.
This is not a data residency pledge from a cloud provider. It is the way the system physically operates. A UK-regulated firm deploying VELA in Nassau for a Bahamian subsidiary, or deploying a dedicated instance inside their UK infrastructure, achieves Chapter V compliance as an architectural outcome — not a legal one.
Nicolas Astwood will be at ExCeL London, November 11–12, as one of eight Caribbean technology companies selected for the ITC/FCDO UK Trade Mission 2026. A 20-minute conversation before the 11th is the right entry point.
ITC · FCDO UK Trade Mission 2026 · ExCeL London Nov 11–12 · Cova Systems Limited · Nassau, The Bahamas