Why banks are moving voice AI in-country before the regulators ask

I was sitting in a windowless meeting room in the Singapore headquarters of a major bank when a question was posed that stopped the project dead in its tracks.

We were involved in supporting the bank on SBCs, and roped into a discussion on a next-generation voice AI assistant for their contact center. It was brilliant. It could authenticate users, understand three different accents, and process complex loan queries in real time.

Then the enterprise architect — a very experienced one — leaned forward. "When the customer speaks, where exactly does the audio go to figure out what they said?"

The vendor in the room proudly replied: "It's processed in our highly secure, global AI cloud in the US-West region!"

For the last decade, data residency in enterprise IT was primarily a storage question: where do the database records live? If the hard drives were physically located in Malaysia or Singapore, the auditors were happy. But the explosion of conversational AI has fundamentally broken that model. Voice AI turns data residency into a processing question.

Audio has to be transcribed, interpreted, and synthesized somewhere. And in the eyes of a financial regulator, streaming a live phone call of a customer reading out their credit card number to a server in California is a massive, flashing red compliance violation.

Here is why regulated institutions across Southeast Asia are aggressively moving voice inference in-country ahead of explicit regulatory mandates, and why it is easier to run a perfect demo than to actually build it.

Processing is the New Storage

When you plug a standard cloud-based voice bot into your contact center, you are taking a live RTP (Real-Time Transport Protocol) media stream and blasting it across the open ocean.

To a regulator like Bank Negara Malaysia (BNM) or the Monetary Authority of Singapore (MAS), it doesn't matter if you aren't "storing" the audio offshore. The act of an offshore server receiving the audio, processing the speech-to-text, running it through a language model, and sending a response back constitutes offshore data processing of Personally Identifiable Information (PII).

Banks are realizing that if they wait for regulators to explicitly write new rules for generative voice AI, they will be caught flat-footed. They have to move now because existing frameworks surrounding technology risk management and data sovereignty already implicitly forbid sending unencrypted, raw customer voice data to foreign jurisdictions for processing.

What "In-Country" Actually Means to an Auditor

To satisfy an enterprise IT audit in 2026, "in-country" cannot be a marketing term. It has to be a provable architectural boundary.

You cannot simply use an offshore service that promises not to save the logs. The inference — the actual compute power transcribing the voice and generating the response — must physically execute on servers located within the country's sovereign borders.

Historically, this meant buying massive, expensive on-premise servers and running open-source models, which resulted in a terrible, robotic user experience. You had to choose between being compliant or being good.

The Latency and Cost Penalty

Building this local boundary isn't free.

First, there is the cost of compute. Running heavy speech-to-text and language models locally requires serious GPU power. If you are managing this yourself, the hardware investment and the engineering effort to maintain the models are staggering.

Then, there is the latency tax. If your core banking systems are in one local data center, your SBC (Session Border Controller) is in another, and your AI inference is running in a local public cloud region, you have introduced multiple network hops. In voice communication, anything over a few hundred milliseconds of delay sounds terrible. We have to engineer the network paths with obsessive precision to ensure the audio doesn't hairpin — travel back and forth unnecessarily — across the country.

The Architecture: Keeping Media Local

So, how do we actually build this without forking the entire platform and starting from scratch? It all comes down to controlling the media path.

In a compliant architecture, the enterprise SBC — a Ribbon 5400 Core, for instance — acts as the absolute boundary. When a call comes in, the SBC anchors the media locally. We utilize platforms like Microsoft Foundry (formerly Azure AI Foundry), which allows us to consume native voice AI capabilities — through the Voice Live API and Azure Speech integration — directly within the local Microsoft Azure regions that are now operational in Malaysia and Singapore.

The SBC streams the audio directly to the local Azure region via a private, dedicated network link such as Azure ExpressRoute. The Microsoft Foundry environment processes the audio, understands the intent, and generates the voice response entirely within the country's borders — in this case, specific to Singapore.

No offshore API calls. No data leakage. The entire conversational loop happens in-country, satisfying the auditors while utilizing world-class AI models. It must be clarified that if you are deploying a live solution in Malaysia, the cloud management and endpoint orchestration typically anchor out of the primary Southeast Asia (Singapore) region at the time of writing.

The Summary

The days of blindly sending enterprise voice traffic to global cloud endpoints are over for the financial sector. Data residency is no longer just about where a file is saved; it is about where a thought is processed.

Regulated institutions are moving voice inference in-country because the regulatory writing is on the wall. By architecting solutions that anchor media locally and leveraging in-country AI deployments like Microsoft Foundry, regional banks are proving that they can deliver cutting-edge conversational experiences without compromising sovereign data boundaries. It requires rigorous engineering and strict SBC management, but the peace of mind — and the approval of a Chief Risk Officer — is worth every ounce of effort.