Podcast S8E9 | 2025 Top Compliance Priorities Mid-Year Check-In

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:24
Welcome to Risky Women Radio, and we are thrilled to have a new episode. We kicked off the year with our fabulous experts from Protiviti sharing their views on the compliance predictions for 2025 it was episode one for this series 8 in 2025 so if you haven’t listened, take a listen. But otherwise, stay right here for an update. Given the amount of activity and all the geopolitical influences that we’re seeing, we thought it would be really good to have a mid year check in. And of course, we all often do little mid year check ins of our own and performance reviews, etc. So I think our speakers here need no introduction to regular listeners. Both are highly experienced leaders in risk and compliance with global perspectives, working with a huge range of financial services customers, and you can look at their full bios in the show notes, but in brief, Carol Beaumier is our senior managing director in Protiviti’s Risk and Compliance practice, and she also leads the firm’s global thought leadership program. And we have joining her, Bernadine Reese, who is managing director also in Protiviti’s Risk and Compliance practice, and she’s based in London. Prior to that, she worked at KPMG in the regulatory service practice. So welcome Carol and Bernadine.

Bernadine Reese 1:47
Very happy to be back.

Carol Beaumier 1:49
Thank you, Kimberley.

Kimberley Cole 1:51
Yes, I am looking forward to this. So we started off with your predictions, and it’s going to be great to see you know, how are they playing out and what are we seeing now? So coming into 2025 you grouped what you saw as the likely compliance priorities by region, so North America, Europe and APAC, and there were eight priorities that cut across all three regions. So maybe we’ll kick off with those ones. Remind us what they were, and then tell us whether they’ve played out as you expected. So Bernadine, do you want to kick us off?

Bernadine Reese 2:24
Yeah, very happy to thanks. So our common priorities across those regions were artificial intelligence, financial crime, privacy and security, operational resilience, third party risk management, consumer protection, compliance function optimization, and then resourcing. And if we look across the globe, all of these remain important, but I think we are still seeing some regional differences. So let me cover some of these, and then Carol can pick up on some of the others as well. So if I start with artificial intelligence, which seems to be the topic of the moment, we’ve seen a continuing regulatory focus globally on AI as regulators look to get the right balance between encouraging AI innovation and maintaining financial stability and consumer protection. The EU’s AI Act came into force with bans on prohibited AI, which started in February, and there are more rules coming on high risk AI systems that take effect in August next year. We’ve seen regulators, including those in the US and Australia, focusing on AI within algorithmic trading and credit scoring, and many other regulators are issuing AI risk management guidelines, so a topic to continue to watch. Then turning to operational resilience. It’s been a big year already, with the EU’s Dora requirements coming into effect in January, and also the UK’s operational resilience requirements, which took full effect in March, we’re expecting there to be further focus globally, and as the regulators in Europe look to increase supervision, and other regulators, especially in APAC, are also looking in increasing regulation in this area. So another growing topic, then in security and privacy, this year has seen a surge in cyber attacks and more sophisticated hacks, and this is really driving an increased focus by the regulators on cyber resilience. So we’re seeing this in the US, Australia, Hong Kong, Singapore, taking further steps to improve cyber resilience and reporting of incidents and others such as the UK and Europe have strengthened data protection and privacy requirements at the same time. Then third party risk management. So partly, as a result of the focus on operational resilience, we’ve seen regulators focus and continue to increase new measures this year to strengthen third party risk management, particularly for critical third parties such as cloud service providers and fintech firms, and we expect this to be a continuing area of focus and challenge, very interesting changes there. And then finally, looking at consumer protection before I hand over to Carol, we continue to see the UK adopting a strong regulatory stance on consumer duty and a focus from many other regulators, including in Australia, on frauds and scams and their impact on retail customers. In the US, the administration has made significant changes to the Consumer Financial Protection Bureau this year, but focusing more on deregulation and reducing enforcement actions. So everyone’s slightly different in this space, but Carol’s going to take us through some of the other 2025 priorities.

Bernadine Reese 5:31
Interesting already, though.

Bernadine Reese 5:43
Yeah.

Carol Beaumier 5:49
Let me start with financial crime, because I do think the landscape for financial crime compliance has gotten a bit more complicated in recent months. I would start by saying I think the US has probably sent some mixed messages about how it intends to deal with financial crime. So I would point first to watering down of the beneficial ownership registry rule in the US. And also come in on the US’s 18 month freeze on any enforcement actions under the Foreign Corrupt Practices Act. But I’d also point out on the flip side, in an effort to stem the effects of the cartels, which would be in drug trafficking, violence, border security, the US has named a number of cartels as international terrorist organizations, and that has some really significant both sanctions and AML Compliance challenges and risks for any companies primarily dealing with Mexico. But given how widespread the cartel operations are certainly goes beyond that as well. So we’re kind of seeing both sides from a US perspective. And then I think if we look at global we’re seeing less global coordination on sanctions. We continue to see, I think, a building widespread attention on money laundering and sanctions risk in crypto assets and in real time payments, and we’re seeing, I guess, what I would call an unrelenting focus on fraud, and that’s coming from the media, from the regulators and from customers of financial institutions, and then I think, in the FinCrime space, another dynamic that’s coming into play right now is that we’re beginning to see local authorities prepare for their next FATF review. So in the next year or two, there are many countries, including Italy, Singapore, Canada, Mexico, China, the UAE and the US who are scheduled to have on site FATF assessments, and often in the build up to those on site reviews, we see increased regulatory scrutiny and kind of a mad dash, if you will, to try to address whatever issues might have appeared in the last report, so that in a lot of markets, will put some additional pressure on institutions. I think also, all of this is happening, and all of the issues that Bernadine covered are happening against this backdrop of the industry still trying to improve efficiency and effectiveness of their compliance functions, which brings us to resourcing and optimization. And I think, you know, resourcing is probably been on our priority list since we started compiling the risk, it’s a perennial issue, being able to attract and retain the right talent. And as a compliance department and as a cost center, often being kind of the first target for staff reductions in difficult times. But we think there is another dynamic beginning to come into play in certain markets right now that will be important to watch, and that is for those markets which believe that they are seeing or will see kind of lighter touch regulation and supervision, we’re beginning to see some signs that institutions are looking to use this as a justification to cut compliance staffing below levels that would have been acceptable in prior years. And I think for any of us who have been around long enough to see this cycle before we know that doesn’t necessarily end well, but definitely something to keep an eye on. And I think the resourcing issue also relates to the compliance function optimization. I think the industry, you know, entered the new year with a continued commitment to migrate to smarter, more integrated, more risk enabled compliance models, and I think there’s been a fair amount of progress. I’m sure we’ll talk a bit more about that as we go along. You know, their motivation is both efficiency, and I think there’s also an element of doing this defensively, as they have to deal with more complex and fragmented regulatory environments and with just a, you know, an ever evolving threat landscape, but to be able to continue to make progress on this front, the industry needs strategic investment, and they need resources. The resources we’ve already talked about could be a struggle, and I have some concerns, obviously, that in these uncertain times, there may be some desire to cut back on the strategic investments, and I think, you know, unfortunately, that would be a lost opportunity for compliance functions, and I think really hold back and detract from their efforts toward optimization.

Kimberley Cole 10:58
I actually opened up questions to our member base as well, and so maybe it’s good for me to jump in now, because one of them was around resourcing. Because they said, Well, you spoke a lot about resourcing on the last podcast that we did. And the question was about, what about resourcing at the regulators? Do they have enough? How are they managing it? Who are they tapping for resource, and will they have the requisite skills, etc. So maybe that’s a good one to add into your resourcing points there.

Carol Beaumier 11:27
So I’ll answer for the US, and then maybe Bernadine can join in and answer for the UK and Europe. So you know, obviously, as part of the efforts undertaken by the administration in the US, we’ve seen some dramatic changes in the regulatory agencies here. There have been some significant staff reductions. Bernadine made a bit of a reference to the Consumer Financial Protection Bureau, which you know has almost been eliminated through the actions taken so far. It still exists, but the staffing levels are way down. So I think it is definitely a legitimate question right now on whether or not the US regulatory agencies will have sufficient resources. But you know, it goes hand in hand with what the objectives of the administration are, and if indeed the focus is on lighter touch regulation, fewer enforcement, then it might not be as challenging as it otherwise would be. But I think the agencies, like the industry, still struggles with not just numbers of people, but the right people, and especially as we continue to deploy technology, and the skill sets that are needed are different, the same battle, and probably even more challenging, often for the regulators, because not the same pay scale as the private sector may have.

Kimberley Cole 12:55
Yeah.

Bernadine Reese 12:55
And from a very much that points about, you know, what is the regulator aiming for? What are their objectives? We’re seeing that from a European and UK perspective. So the UK in particular, looking to be a smarter regulator. So we’ve seen them recruiting different skill sets, looking at behavioral economics and data and AI and the development of technology. So very different skill set to what they’ve had historically, we still continue to see a rapid turnover of staff from the regulator into industry. I think it’s always been there, but frustrating for firms who are facing a succession of supervisors. But that continues, and then we’re also seeing more staff being recruited into areas like authorizations, where dealing with applications more quickly is seen to add to the economic growth agenda and be an enabler for government policy. So very much following the objectives of the governments in question.

Kimberley Cole 13:54
So those areas were all of the things that we had sort of in common across the region. So that was a lot, as it was. And then one of the areas of divergence, certainly for Europe, that you identified this year was ESG. Is that playing out how you expected Bernadine?

Bernadine Reese 14:09
Well, it’s certainly been a busy few months on this front. But the emphasis has really been, I think, on reducing the scope of ESG regulation in Europe, which we expected to come, but has been really quite significant. So in Europe, the omnibus simplification package was introduced in February with the aim of streamlining the EU regulations, particularly in areas like sustainability reporting and due diligence. And the package actually removes around 80% of companies from the scope of the corporate sustainability reporting directive. So that’s a big change. The UK was arguably less advanced in its ESG regulations, so we’ve not seen that same reduction, but all new changes and things introduced are being assessed through that regulatory burden, cost benefit lens now, so we’re expecting a slightly slower pace of change on ESG as well.

Kimberley Cole 15:08
Good, good. For the US you called out heightened uncertainty, which I don’t think was a surprise, and the impact of the competitive landscape as really significant priorities. So what’s your mid-year view on the significance of these issues?

Carol Beaumier 15:25
While it was clear from the start that the administration planned to roll back some regulations and ease up on enforcement, I don’t think we, or I can certainly say I don’t think I appreciated the breakneck speed at which some of this would happen. I didn’t anticipate, as an example, how quickly the administration would move to change the leadership of the regulatory agencies. I mean, historically, that’s not the number one priority of a new administration, but they move very quickly, and in turn, the new leaders have moved very quickly to reverse policies of the prior administration and to advance the administration’s agenda, along lines of, say, crypto as an example. You know, we already talked about the significant staff reductions, which I don’t think I fully appreciated out of the box. And I think, you know, while the overall goal seems clear, there’s still so much uncertainty. So, so many regulations are potentially still subject to reversal or modification. We’re seeing a lot more litigation around regulations. We’ve seen the agencies pull back litigation that they brought against financial services in the prior administration. We’ve even seen in at least one case that a penalty that had been assessed against a financial institution was retracted and modified, lessened. It is interesting to understand that the administration also has promulgated what it’s calling the 10 to one rule. And the 10 to one rule says that for every new regulation, guidance or rule issued, agencies must identify and repeal at least 10 existing ones. So what the effect of that will be long term? Who knows so very unpredictable landscape. And you know, while the administration has said it’s doing a number of these things to promote competition, and I can see that with some of the things that they’re doing, I think there’s another issue with competition that we called out in the beginning, which I think is still important to watch, and that is because we’re expecting a dearth of new regulation. I still think that there’s the potential for some of the newer market entrants, which historically have been less regulated, to have some competitive advantage over historical financial institutions, like banking organizations. So watching how that plays out, I think will be interesting too. So lots of uncertainty. Good call. We probably could have even played it up more.

Kimberley Cole 18:18
Definitely a good call.

Kimberley Cole 18:20
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management and compliance. Partner with Protiviti and face the future with confidence.

Kimberley Cole 18:37
I guess I mean thinking about that. So you said you maybe would have put more emphasis on that, but if you were sort of redrafting some of these priorities today, is there anything that you’d add? And maybe let’s kick off with you Bernadine.

Bernadine Reese 18:50
I’d really pick up on Carol’s comments about picking up on that regulatory change in the US. I think I also underestimated the broader trend across a number of countries, including the UK and Europe, towards regulatory simplification, reducing the regulatory burden, the efforts to spur economic growth. And I think that’s really important to watch, because everyone has a slightly different agenda. And as a result of that, there is increased competition in terms of regulatory arbitrage in some ways, right? So to gain a competitive advantage, to encourage economic growth, to get more investment into a country, consideration of the regulatory regime is a key part of that. So I think we’re going to see more divergence, but also different sets of rules and different levels of rules and requirements in different countries. It’ll be very interesting.

Kimberley Cole 19:45
Yeah, absolutely. And I think you sort of covered some of this, but this was another question that came in from our Risky Women members was given all of the sanctions and a lot of these geopolitical disturbances, what about the supply chain risk as a sort of key area of focus? You had it on the list already, but would you change the priority?

Carol Beaumier 20:06
I mean, I think supply chain risk itself is certainly something that we highlighted in the Top Risks for 2025 the annual report that we’ve produced in conjunction with North Carolina State University that, to me, supply chain itself is more of a business risk than a compliance risk, but there are a host of trade related compliance risks that come out of the current geopolitical environment. And certainly I made the comment before, we’re not seeing as much coordination on sanctions. I think the US has seemingly signaled that there will continue to be a big focus on export controls. I think there is the possibility there that the coordination is not as strong as it might have been in years past. So I think that does present tremendous challenges for any global financial institution that has to figure out, you know, it feels like kind of we’re going back to where we used to be, instead of taking advantage of the cooperation that had existed for a number of years.

Kimberley Cole 21:16
And I guess adding to that Carol to the efforts that you’re seeing in the US and the UK towards this regulatory rollback that you’ve mentioned, and simplification across the board, what are the sort of implications beyond the national borders?

Carol Beaumier 21:33
Yeah, and I think that one of the most pressing issues to watch is the growing regulatory fragmentation. So as we see different countries roll out different approaches to whether it’s crypto or privacy or ESG or so many other things we could manage, I mean, this really creates challenges for multinational institutions. It adds a layer of operational complexity. It increased costs. It creates, you know, some level of legal and regulatory uncertainty. And I’m going to date myself here about for anybody that remembers kind of the rollout of the Basel Committee on Bank Supervision in the mid 70s and one of its overarching goals towards standardization of global regulatory practices. It does feel to me like we’re taking a big step backwards.

Kimberley Cole 22:27
Interesting. And so we’ve spoken a lot about Europe and the US. What about Asia Pacific? Do you want to make a comment on that?

Carol Beaumier 22:36
Sure. So, I mean, I’m not sure my APAC colleagues will agree, but here’s my take, any institution that operates in APAC has dealt with regulatory fragmentation forever, right? It’s the nature of their market, and to survive in that market, you have to deal with that. When I kind of look at what we called out as the challenges for APAC at the beginning of the year, which were largely the areas of commonality across the globe. I would say, for the most part, APAC is playing out the bway I might have expected it to. So I’m pretty jealous from a US standpoint, because it seems a little bit more predictable. I mean, I think, you know, the one area maybe of additional focus, or maybe two areas. One would be that there are some countries in APAC that will soon have FATF reviews, so they may see again, some stepped up activity there, and there might be a bit more focus in APAC on operational resilience, because I think they’re playing a bit of catch up. And I think Europe and then the US were kind of out of the box on ops risk before some of the APAC countries. So little bit of catch up there, but not too far off what we said.

Kimberley Cole 23:48
Very good. And Bernadine, are there new requirements that financial institutions need to be focused on during the rest of the year?

Bernadine Reese 23:55
So I think the rapid growth of AI is going to generate new requirements and require new thinking as well across financial institutions. So we do have some regulation, for example, in Europe, other regulators are still deciding how to regulate AI to encourage its use in a controlled manner, but the compliance teams that we deal with are having to make decisions now about how to assess the regulatory implications of AI in their businesses as their businesses rush to roll out AI technologies. So we definitely expect this to be a focus for the second half of the year. And then I’d also highlight operational resilience and Dora both still working their way through in terms of system changes and requirements, authorized push payments regulations, and that wider fraud concern is going to be areas where we’ll see a lot more.

Kimberley Cole 24:51
Yeah, and I think we’ll talk a bit more about fraud. Anything for you to add there Carol?

Carol Beaumier 24:56
That’s my entry to fraud.

Kimberley Cole 24:58
Good. Good. Because we had a question from one of our people as well, wanted to know more. You mentioned fraud, and they wanted to know more on fraud.

Carol Beaumier 25:07
And I would say, not necessarily new regulations, but I would just say the drumbeat is so loud that it’s really important that financial institutions invest in advanced fraud detection technologies that they improve their internal controls across both digital and traditional channels. So I think just recognizing and obviously it benefits institutions too to make the investment here, but I think this one needs a lot of work on the part of the industry. So an important one to keep an eye on.

Kimberley Cole 25:45
Great. So Victoria, who is in our us connect risky women Whatsapp group. She also was asking about this, and it’s specifically elaboration around the payment space. So I don’t know, Bernadine, if you can add something there?

Bernadine Reese 25:59
So happy to. Great question. Yes, a rapidly evolving topic in Europe. In the UK, new legislation was introduced late last year to compensate victims of frauds and scams, and there had been fears in the industry of a surge in compensation payments to victims, but that appears not to have happened so far, and the regulator issued an update report a month or so ago and seemed happy with how the scheme is working. So we’re expecting to see that continue and perhaps be refined. I think the other interesting development is that there are discussions ongoing across Europe between the Financial Services regulators and technology and telephone companies in terms of the role that they play and could play in preventing scams, taking things down, preventing customers being reached through their platforms and through their technology. So that’s interesting, I think.

Kimberley Cole 26:56
And look, I know you spoke about AI before, and it’s, you know, such a hot topic. Another question we have was, any examples of how AI is being a game changer? We discussed about resourcing. But have you got any examples of where you think, is anyone getting a competitive edge that you spoke about in the report?

Carol Beaumier 27:18
Yeah, I think there are some really good examples of the progress being made. FinCrime spaces, I think, an obvious space to focus on. So AI and machine learning and advanced analytics, I think, are helping institutions to make great strides in transaction monitoring and sanction screening. I mean, some of the stats out there would suggest that for some institutions, they’ve seen an 80% drop in false positives. So really important progress from that standpoint. Also AI can be used for is being used to support context aware systems, which allow kind of the analysis of in detection of like patterns across large data sets that it would be very difficult, if not impossible, for a human to pick up. AI is being used for KYC, and, in fact, can be used to support perpetual KYC, kind of a long standing industry goal, and across different types of compliance, AI is being used to develop and maintain regulatory inventories and just for general regulatory research purposes. And obviously, AI has been used for a long time, and credit underwriting and other areas within financial institutions, I’m not sure any institution would admit or would be willing to say they’ve done it all. They’re already there. But I think again, the industry continues to make good strides. And I think the regulatory environment, the regulators, seem supportive of the efforts. And in part too, we always have to keep in mind the fraudsters are using AI as well. So you know, there’s another motivation for making sure that we’re keeping pace.

Kimberley Cole 29:05
Yes, indeed. And I guess a lot of these things play into another one of our favorite topics around culture and conduct. So what are the changes that we’re seeing or that all of these things bring together mean for culture and conduct do you think Bernadine?

Bernadine Reese 29:21
Yeah. So really interesting, and both culture and conduct tend to be longer term issues that we’ll probably only see some of the consequences of these changes in years to come. But we are seeing regulators reconsidering their approach. For example, in areas of regulating non financial misconduct, some regulators stepping away from targets for inclusion, targets in senior management and boards, for example, where, as part of that regulatory simplification, we’re expecting to see less prescription and reporting relating to conduct, and maybe more regulatory emphasis on senior managers taking appropriate steps to manage non financial misconduct within their own firm. So putting the onus onto the firm. But I think, in our view, culture becomes even more critical when there is that focus on regulatory simplification. It’s simply essential.

Kimberley Cole 30:17
And I loved on the last podcast, we talked about this model of looking at horizon scanning, but having your central vision, your fringe vision, and your peripheral vision, and so this might be a bit unfair, but the peripheral vision are the things that are kind of far out that we’re not at all, that they’re going to have a big impact. But I would love any that you want to call out. I guess I’m asking for predictions on the predictions.

Bernadine Reese 30:43
I’ll try my best. So I think in some of our thought leadership, we talked about the PESTEL framework, which is a way of identifying some of those peripheral vision issues. And PESTEL stands for political, economic, social, technology, legal and environmental. What are the changes in those areas that could have an impact on the business and on regulation? I think the past six months have shown that politics and economics are the most substantial drivers there, as we see that shift away from globalization to more national interests, and we’re expecting a lot of repercussions. That’s where I’m looking. I don’t quite know what we’ll see next, but that’s where I put my money.

Kimberley Cole 31:32
Okay. And Carol, anything to add?

Carol Beaumier 31:35
Obviously, predicting a couple of months in advance is difficult right now, so beyond that, I don’t know. I do think, and I think there’s probably beyond the financial services industry that as companies look for ways to increase revenue in years to come, I think we’ll see more ecosystems developing more partnerships, and I think it’ll be interesting to watch how that affects financial services and what risks and challenges that that may bring.

Kimberley Cole 32:07
Great! I think that has covered so many topics and been a really good refresh on everything that was covered in our first predictions for the year. So if I can give you one last question, which is, what’s your advice to compliance officers as they try to manage through these really unusual times? So maybe kick off with you Bernadine?

Bernadine Reese 32:33
Yes, I think I’d still suggest focusing on outcomes, not processes, and that links so closely to culture as well. What does the compliance function do to help a business achieve the right outcomes for the business or for its customers, for the market? It’s a great steer as a way forward. And then there’ll also be opportunities that arise in times of significant change. So I think that’s also important to be on the lookout for those opportunities as financial markets change, as people come on the market, as new technologies are available, how can that help? Or can they add to a compliance team?

Carol Beaumier 33:13
And I think maybe to pick up on that. I think, you know, sometimes during uncertain times, the tendency is to just sit back and wait to see how things unfold. But I think best in class compliance departments, CCOs, know that they need to be proactive during these times. So we talked a bit about the horizon scanning critically important in this period. The other thing, I think is very important is even more engagement with senior management and the board, because I think that’s one good way to help prepare the institution for whatever the regulatory eventuality may be, right? And we’re probably dealing with multiple possible scenarios, so just helping the institution kind of think through what the consequences might be. I also think that the best in class compliance departments, if indeed we’re going to be in a period of lighter touch regulation, less enforcement, are trying to make the best use of this time. So whether that’s, you know, making long term, sustainable improvements to the compliance function, because I think we’ve talked about in the past, financial institutions, often, because of the regulatory pressures, will patch a problem, but not necessarily in the most cost effective or efficient way. I mean, this might be the time to step back and think about how you can really kind of design the compliance function that you want in the future.

Kimberley Cole 34:42
Excellent. Use the time wisely. So I think that is a wrap for our catch up on our 2025 priorities. Everyone should enjoy this, I think, as a good refresh and a good update on what we are seeing going on at the moment. So thank you very much to both of you for taking a re look at the 2025 predictions, and it has been fabulous to get your views. And I would also like to thank all of the Risky Women members who contributed a few questions, because I think that’s actually nice to have a bit of a question and answer session too. So thank you for joining us. Thank you everyone for listening. Please go and give us a five star rating and a comment, and please subscribe to the channel as well. But thank you Carol.Thank you Bernadine.

Carol Beaumier 35:30
Thank you Kimberley.

Bernadine Reese 35:31
Thank you so much.

Kimberley Cole 35:35
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org