All Posts

Regulatory change management is a perpetual challenge, but access to information is no longer the bottleneck. Regulatory updates are publicly available and increasingly digital. The real difficulty is knowing which updates are material to the firm, what they demand in practice, who owns the response, and how the organisation demonstrates that it acted. That challenge is intensifying. Firms are operating across more jurisdictions, products and licence types.

Client onboarding has always been a high-friction compliance process. It is now becoming a strategic growth issue. Financial institutions want to expand into new markets, launch new products and serve more client segments. Each of those moves depends on the same underlying question: can this client be onboarded for this product, in this jurisdiction, under the firm’s risk appetite and applicable regulation?

Traditional maturity assessments can show that a control exists, that a process has been defined, that a policy has been recorded. They are less reliable at showing whether any of it is working in practice. For senior managers with prescribed responsibilities under accountability regimes, that carries personal risk. If a control fails and scrutiny follows, the question will not be whether the framework was documented. It will be whether reasonable steps were taken to ensure

Historically, many institutions treated AML monitoring as a distinct control. Scenarios generated alerts. Analysts reviewed them. Cases were escalated where required. That operating model still exists, but the surrounding context has changed. Instant payments compress the time available for detection and intervention. Cross-border activity creates more complex data. Financial crime typologies are more networked. Fraud, sanctions, KYC and AML signals increasingly overlap.

36% of institutions are still in the early stages of financial crime technology adoption — fragmented, under-deployed, or not meaningfully in place at all. True end-to-end financial crime technology solutions remain rare. The market has historically been built around the needs of large institutions, leaving smaller firms to patch together point solutions, manual processes and tools that were never designed for their environment.

Market abuse is rarely visible from a single trade. Behaviours such as spoofing, insider dealing, marking the close and cross-product manipulation only become legible when orders, executions, cancellations, price movement, trader behaviour and venue activity are connected in the right way. That connection depends on data. And data is where most surveillance frameworks start to break down.