Regulatory change management is a perpetual challenge, but access to information is no longer the bottleneck. Regulatory updates are publicly available and increasingly digital. The real difficulty is knowing which updates are material to the firm, what they demand in practice, who owns the response, and how the organisation demonstrates that it acted. That challenge is intensifying. Firms are operating across more jurisdictions, products and licence types.

Client onboarding has always been a high-friction compliance process. It is now becoming a strategic growth issue. Financial institutions want to expand into new markets, launch new products and serve more client segments. Each of those moves depends on the same underlying question: can this client be onboarded for this product, in this jurisdiction, under the firm’s risk appetite and applicable regulation?

Traditional maturity assessments can show that a control exists, that a process has been defined, that a policy has been recorded. They are less reliable at showing whether any of it is working in practice. For senior managers with prescribed responsibilities under accountability regimes, that carries personal risk. If a control fails and scrutiny follows, the question will not be whether the framework was documented. It will be whether reasonable steps were taken to ensure

Historically, many institutions treated AML monitoring as a distinct control. Scenarios generated alerts. Analysts reviewed them. Cases were escalated where required. That operating model still exists, but the surrounding context has changed. Instant payments compress the time available for detection and intervention. Cross-border activity creates more complex data. Financial crime typologies are more networked. Fraud, sanctions, KYC and AML signals increasingly overlap.

36% of institutions are still in the early stages of financial crime technology adoption — fragmented, under-deployed, or not meaningfully in place at all. True end-to-end financial crime technology solutions remain rare. The market has historically been built around the needs of large institutions, leaving smaller firms to patch together point solutions, manual processes and tools that were never designed for their environment.

Market abuse is rarely visible from a single trade. Behaviours such as spoofing, insider dealing, marking the close and cross-product manipulation only become legible when orders, executions, cancellations, price movement, trader behaviour and venue activity are connected in the right way. That connection depends on data. And data is where most surveillance frameworks start to break down.

Communications supervision has become one of the most complex and consequential areas of market conduct and compliance. For decades, the focus was largely evidential. Firms captured email, voice, chat and messaging data, stored it in archives, and retrieved it when required by regulators, auditors or investigators. That model no longer reflects either the scale of communications risk or the expectations now being placed on firms.

Resilience has become one of the defining risk and compliance themes of the next market cycle. Firms are operating in a more complex risk environment, where technology dependencies, third-party exposure, operational resilience, regulatory obligations, internal controls and AI governance increasingly overlap.

Parker & Lawrence’s latest survey data suggests what many in the market already sense: financial crime is the risk domain where GenAI is producing the strongest financial upside. Financial crime is the top-ranked area of GenAI impact for almost a third of respondents, and half place it in their top three priorities for value creation. That reflects how quickly the economics of financial crime have outgrown legacy tooling.

Across studies, the same conclusion emerges: GenAI has collapsed the cost, effort and expertise required to create convincing fake documents, while dramatically increasing attack speed and volume. This has tipped the balance in favour of fraudsters, unless firms upgrade their detection capabilities. Identifying document fraud with AI is emerging as the most effective countermeasure.