Podcast S9E1 | Compliance Priorities for 2026

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:22
Welcome to Risky Women Radio. This is the fourth year that we have had Bernadine Reese and Carol Beaumier from Protiviti join us to unpack their annual review on compliance priorities as well. We did a media catch up last year, which was a new addition to our repertoire. So between the two of them, Bernadine and Carol bring nearly 70 years of experience in financial services compliance. They’ve seen aggressive regulatory cycles, lighter touch regimes, and everything in between. But in their latest report, Compliance Priorities for 2026, the most unpredictable year yet, they argue that we’re no longer just cycling, but we are navigating something far less predictable across the US, the UK, Europe and APAC regulators are still focusing on familiar priorities such as stability, governance, financial crime, consumer protection, but they’re approaching them in ways that don’t look or feel familiar. Add in political change, fragmented global coordination, rapid technological acceleration and mounting cost pressures inside firms, and suddenly setting compliance priorities becomes a strategic decision, not a technical one. So today we’re going to explore what’s really driving that unpredictability where organizations risk misreading the current regulatory mood, and why this moment may demand more judgment, not less from our compliance leaders. So welcome Carol and Bernadine back to the podcast.

Carol Beaumier 2:03
Thank you for having us again.

Bernadine Reese 2:04
Yeah, thanks. Great to be back.

Kimberley Cole 2:06
Yeah, brilliant to have you. So before we look ahead, let’s reflect on 2025 we had the mid year touch point, as I mentioned last year. But Bernadine, can you remind us what did you think the priorities would be in 2025 and comments on how accurate your predictions were?

Bernadine Reese 2:25
Certainly Kimberley lovely to. So in 2025 we certainly expected change, but I think what we underestimated was just how fragmented and regional that change would become and how quickly. So, as you mentioned, the priorities themselves haven’t disappeared. We highlighted AI, financial crime, operational resilience, third party risk, consumer protection, information security and privacy, and compliance function optimization, and these priorities are still very much with us. What changed in the year is the context in which they sit. So I think last year confirmed that regulatory priorities no longer move in a more or less neat global cycle that we’ve become used to, national politics, competitiveness agendas and very divergent supervisory philosophies now shape how familiar risks are addressed. So I’d say our predictions were directionally right, but the volatility quickly evolved into something far less predictable.

Bernadine Reese 3:12
Very, very interesting. So Carol in the title of your 2026 paper, you call this the most challenging year yet. So what kind of tipped us from volatile to unpredictable?

Carol Beaumier 3:41
So I think Bernardine’s comments kind of address that, set the stage for what I’m going to say is we started thinking about 2026 I mean, what really pushed us over the line into unpredictability, I think, is that the sheer number of forces shifting at the same time and not necessarily in the same direction. So as we look around, what we see is major regulatory bodies reevaluating long standing approaches, and not in a coordinated fashion, not in a coordinated cross border fashion. And when you combine that with ongoing rapid technological changes, growing cyber and fraud risks, geopolitical instability. I think what you get is an environment with more variables moving simultaneously than we’ve seen in any recent regulatory cycle. And that really was the impetus for us saying this is a very unpredictable year.

Kimberley Cole 4:41
And is what you’re seeing consistent across the globe?

Carol Beaumier 4:45
Not entirely, but there are common themes. So to name a couple, I would say, certainly this concept of lighter touch regulation. I think we’re also seeing a consensus among regulatory bodies to encourage innovation, but the way that things are playing out in different countries and different regions does differ, and of course, that means for multinational institutions, once again, they’re kind of faced with having to deal with increasingly fragmented supervisory expectations, not new, for sure, for the financial services industry, but I think escalating. And if we look at individual regions or countries, I mean, certainly the changes in the US have been pretty dramatic. We’ve seen large scale rollback of prior rules. We’re seeing very little enforcement activity, except in limited pockets like sanctions or export controls. We’re seeing large scale promotion by the regulators of development of crypto and digital asset businesses within the financial services industry. So very different than what we’ve seen in the past. If we look at APAC, I think, similar to the experience we often have in a pack, it’s very varied across the different countries in the region. I mean, we’re certainly seeing some of the regulators promote a more proportional approach to regulation, to provide some relief to smaller institutions, but we’re not seeing kind of the large scale deregulatory momentum we’re seeing in the US. And Bernadine, maybe I can ask you to comment on the EU in the UK?

Bernadine Reese 6:29
Yeah, sure, Carol, so I guess that the trends from that continuing in the EU and the UK, consistency in what regulators care about, but not that much consistency in how they’re acting on it. So we’re seeing a clear push towards that regulatory simplification, the desire for faster authorizations, reduced reporting burdens on firms, and encouragement of innovation all very explicitly tied to a growth agenda, but it’s billed as simplification, not deregulation. Supervisors are being very careful to insist on the same outcomes, but how each financial institution gets there might look a little different. And so that creates a more judgment based environment for firms, without the prescriptive rules, organizations have that much more flexibility, but also more responsibility for deciding where the risk boundaries sit.

Kimberley Cole 7:30
Interesting. So your article says the big test for compliance organizations in 2026 will be balancing business objectives and compliance considerations. So Bernadine, let’s start with you, and Carol can jump in and add as well. But what are the most significant industry developments that are driving those objectives?

Bernadine Reese 7:51
Yeah, so many Kimberley. I’ll highlight three, and the first one, that’s probably the one that we hear about all the time. So AI and data driven business models clearly no longer experimental, very much part of the mainstream, and that makes those questions around transparency and governance and accountability absolutely central. Secondly, I think we all see embedded finance and platformization of financial services in areas such as lending, insurance, savings, cross border payments, which is really reshaping distribution models financial services therefore being increasingly delivered through a non financial platform, which fundamentally changes a number of risk areas, including third party risk, consumer protection, accountability, whole host of things. And then thirdly, national security and geopolitical risk has really become an operational reality, not a macro economic issue we’re dealing with a day to day, whether that’s sanctions, cyber resilience, supply chain dependency. So business is really being shaped by these forces and compliance needing to be part of that conversation from early on.

Carol Beaumier 9:10
And I would certainly agree with those. I would add escalating fraud as, I think, a really significant issue facing the industry today. But I think the real key is at the macro level. And it goes back to Kimberley, how you actually posed the question. I think the big development that compliance has to face is this collision of fast moving changes that are reshaping the industry with the fragmented regulatory signals they’re getting, so I think that is kind of the key to managing through this year.

Kimberley Cole 9:46
Interesting, yes, and do you think this is a moment of a genuine regulatory reset, or are we in sort of another pendulum swing that compliance leaders have seen before?

Carol Beaumier 10:02
So to me, and maybe this is a US view, it feels more like a pendulum swing, albeit a bigger and broader swing than we’ve seen in the past, and we’ve watched regulation tighten and loosen before. What’s really different this time as we’ve suggested is that it isn’t happening in one dimension. It’s happening across multiple dimensions, so against political backdrops, technology backdrops, economic backdrops, you know, all of these are coming to play. And at the same time, we’re seeing heightened operational risk, cyber risk, fraud risks. And I think if we kind of step back, we’re also seeing regulators, maybe in certain jurisdictions, under more pressure than they’ve been in the past. So we have this strange dynamic where everything is kind of coming together. And so I think even if the pendulum swings back, I think this is really a strategically distinct moment in history here, because I think that we’ll find, when we look back on this, the decisions that institutions make really will go a long way toward shaping risk and trust outcomes well beyond when and if the pendulum swings back.

Kimberley Cole 11:23
Yeah – so looking at sort of some of those implications for the compliance organization. Bernadine, a challenge for you in one sentence, how would you describe the compliance function’s mission in a year of lighter touch regulation and rapid technological change?

Bernadine Reese 11:40
Yeah, challenging one. Thank you, Kimberley, I think I’d start with the fact that the challenge is to help businesses move faster, but without moving blindly, but with a clear direction. And as Carol mentioned, that comes from anchoring on innovation and growth and decision making, but in risk awareness, ethical judgment, long term trust, I probably used up my sentence by now.

Kimberley Cole 12:10
Yes, yes, I think so!

Kimberley Cole 12:12
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management and compliance. Partner with Protiviti and face the future with confidence.

Kimberley Cole 12:28
So challenges aside, Carol, are there any upsides to the compliance organizations in operating in this sort of lighter touch regulatory environment?

Carol Beaumier 12:39
I would say absolutely, if organizations use the moment and the time well. I think the lighter touch oversight really gives compliance room to be more strategic and not purely reactive, and this should allow compliance to develop deeper collaboration with the business and shift toward outcomes based thinking, which I think makes it easier for compliance to align, again, with the strategic goals and the risk appetite of the organization. The flexibility comes with responsibility, though, because I think institutions will still need to make sound decisions, and they’re going to have to make those sound decisions without the safety net of detailed regulatory instructions.

Kimberley Cole 13:27
Yeah, I think that’s a very interesting point. And given that the national regulators stepping back. Bernadine, what’s your view on how do you keep the shareholder, customer, the community trust in the front and center. And when do you say no? Because I think that trust element is going to be key.

Bernadine Reese 13:49
It’s super important, that’s for sure. And we see that lighter touch supervision from regulators doesn’t reduce the expectations of those stakeholders, so shareholders, customers, communities do care deeply about outcomes and not whether something was technically correct or allowed at a particular moment in time. So compliance has to act as the organization’s conscience, really, and that means asking, how will this decision look when we look back and the cycle turns? Or would we be comfortable defending this decision publicly? And there are absolutely moments to say no, but it is much more of our role to say, well, let’s slow down, understand the risk properly, and design this in a way that’s sustainable but doable?

Kimberley Cole 14:42
Yes. So Carol, your article also argues for moving from reactive rule following to forward looking, risk aware, strategic partner. So what does that look like in practice at a large financial institution, especially for multinational organizations that have to deal with different national regulatory approaches?

Carol Beaumier 15:04
So I think first and foremost, it means compliance is at the table early and not just validating decisions, but helping to shape decisions. I think it places a premium on something Bernadine and I have talked about in a number of the articles we’ve written in, and that is horizon scanning, because it is critically important to be able to anticipate the regulatory direction in different jurisdictions. Compliance can play a very important role, I think, in embedding compliance consideration into transformation initiatives and to make this all kind of come together, I think it will be increasingly important to align the metrics and KPIs that compliance uses with those that the business uses. So we’re moving to again, more outcome based than procedural check the box approaches to compliance. I also think it means that compliance needs to adopt a problem solving mindset. Needs to move away from that tag that it hates, as being known as the “no” organization, to being an organization where the approach is, let’s work together to figure out how we can make this work responsibly. And I think again, key to being able to accomplish this is a need for compliance to continually think about reskilling, because building teams that have the legal, the regulatory, the data, the technology fluency will be critically important to be a good partner with the business.

Kimberley Cole 16:43
And I think you’ve sort of covered a fair bit there, but I was going to ask, given everything that you’re seeing, what advice you do have for compliance organizations? Are there other ones?

Carol Beaumier 16:54
Yeah. I mean, I think maybe to kind of summarize, three things come to mind immediately for me. The first is, redefine the role of compliance, if you haven’t done so already. So embrace being that strategic, forward looking partner, and focus on outcomes, not process. Invest in talent and technology, because that will be critically important. And to pick up on a point Bernadine made, hold your ground when you need to, because even in the lighter touch environment, certainly there are other stakeholders that expect ethical and prudent decision making, and compliance organization does need to be that conscience.

Kimberley Cole 17:36
Yes, anything from you Bernadine?

Bernadine Reese 17:38
Yeah, I’d add that this isn’t the moment for compliance to become cautious or inward looking, as might be quite tempting, I think, in lighter touch and less predictable regimes, the organizations that struggle are the ones that wait for certainty before they do anything, and that certainty never comes. So compliance would be well advised to focus on those regulatory outcomes and retaining the trust of stakeholders in decisions that are ethically sound.

Kimberley Cole 18:09
Interesting. So given all of this, I think there’s a lot going on with technology and innovation. So let’s look at some of that. Because often with all of this uncertainty we see cost cutting, and when cost cutting hits compliance is often first in the firing line. So what are your thoughts around tech and innovation? And let’s explore whether doing more with less, finally breaking the compliance operating model – is it going to do that? Or is it really going to force innovation, which you’ve mentioned a bit? So we’ve got AI, digital assets, quantum computing. What emerging technology do you think compliance teams are most underestimating for 2026 so Carol, your thoughts?

Carol Beaumier 18:58
I’m going to say quantum computing. And I don’t think that that is limited to the financial services industry. I think, as you know, Kimberley, we publish an annual Top Risk survey in conjunction with the ERM Institute at North Carolina State University, and we published the 14th version of this in December. And I have to say, I was surprised across the board, across industry, at how little concern executives and board members were expressing around the evolution of quantum computing. It was really striking to me. Obviously, AI gets the most attention, but I think quantum could be really a looming blind spot. And to me, the interesting thing is that the moment that Q day, the day when current encryption can be broken, arrives, today’s cyber security frameworks will be obsolete. So and I feel like the regulators are kind of in the very early stages of considering impacts here. But to me, the operational, the financial, the trust consequences of not being prepared could really be massive.

Kimberley Cole 20:13
And interesting on the regulators. Is the biggest risk that regulators move too slowly on AI, or that they move too fast and lock in the wrong assumptions?

Bernadine Reese 20:24
Honestly, I think both risks are real, but locking in the wrong assumptions worries me much more I think. AI is evolving at a pace that regulators simply can’t match and overly rigid and structured frameworks I think risk becoming obsolete pretty quickly, so I think that’s why those outcomes based principle driven approaches matter, firms won’t be able to wait for perfect regulatory clarity, but they do need to press ahead with strong internal governance, clear accountability, model oversight, bias mitigation, and transparency, those types of big issues so that they’re resilient, regardless of how regulation eventually lands.

Kimberley Cole 21:11
And you mentioned Q day, Carol, so quantum risk often still sounds abstract to many firms. At what point does Q day stop being theoretical and become a board level compliance issue?

Carol Beaumier 21:25
I would say it already is, or it already should be. I think although the timeline to Q day continues to be debated, I think the risk is really asymmetric, by which I mean investing in preparedness now in the scheme of things, could be relatively inexpensive, but being late could be catastrophic. So I would expect board level committees, compliance committees, to already be talking about preparedness and doing scenario planning. Because I think the reality is that when Q day does arrive the window to react will be very short. It won’t be months, it won’t be years, you know, it’ll be hours or days.

Kimberley Cole 22:09
So I was going to say, can you define Q day for us? Because often we have sort of younger, emerging talents, and it’d be good to make sure that we’re explaining that.

Carol Beaumier 22:20
The short answer is it’s the day when current encryption can be broken. So it kind of sets a whole new framework for how we’re going to have to manage going forward.

Kimberley Cole 22:35
So a lot of content there, and obviously everyone should read the report where there’s a lot more detail, but bringing all of this together, if someone only remembers one thing from the report, what should it be and why does it matter now and not in five years time?

Carol Beaumier 22:51
So I think one thing the compliance organization should remember is that unpredictability doesn’t reduce accountability. And Bernadine made this point earlier. I think with regulators stepping back in some jurisdictions, it’s time for institutions to step forward, and this is really the moment for compliance to help define what responsible, innovation and risk aware growth looks like, before we have another wave of regulatory tightening. And I think the organizations who really look at the current situation as a strategic inflection point will emerge stronger, more resilient and more trusted in the end.

Bernadine Reese 23:34
I’d add that for 2026 and probably for a few years to come, compliance isn’t about ticking boxes. It’s about judgment and using technology wisely. We see that the organizations that succeed will be those that embed compliance into strategy, into innovation and culture, because when the rules feel less certain that external stakeholder trust becomes a very valuable asset.

Kimberley Cole 24:02
Very interesting. So thank you for that, and we’ll come back to wrap up after this. But we thought we’d add in a little rapid fire round so once again, making you try to keep it short and sharp. So the first one, one KPI that you would retire, and one that you would add to drive outcome based compliance.

Carol Beaumier 24:23
I would retire number of policies updated it measures activity, not impact. And instead, I would add a metric around evidence of risk reduction outcomes where I look at trends in repeat issues or high risk issues, and really try to get to behaviors and outcomes rather than activity.

Kimberley Cole 24:48
Like it. Bernadine, you got one to add, one to take?

Bernadine Reese 24:52
Yeah, so I’m going to go for retiring volume based monitoring metrics that don’t measure anything and don’t really contribute to actual risk reduction. They’re just a way of counting. And I’m going to go for adding time to risk decision. So some measurement of how early compliance gets involved, and how quickly compliance helped the business to reach a conclusion on a matter.

Kimberley Cole 25:20
Okay, name one AI control that you would automate first, and why?

Carol Beaumier 25:26
Carol, that one’s easy to me, because to me, it has to be transaction monitoring. I think that AI holds such promise for both AML and fraud monitoring that it’s got to happen.

Bernadine Reese 25:40
Yeah, mine is actually similar, so it’s AI for those broader surveillance and monitoring activities in compliance, prioritizing alerts by the real risk rather than by volume, and allowing compliance to focus on judgment where it actually matters, rather than endless lists of false positives.

Kimberley Cole 26:02
Yeah, and one regulation you expect to be most disruptive in 2026 and why?

Carol Beaumier 26:08
So I’m going to go with one set of regulations, if I may, and I’m going to say digital asset and tokenization frameworks, because clearly, regulatory bodies all over the globe are rolling out frameworks, not a lot of coordination, again, creating a lot of ambiguity around AML obligations, consumer protection, even ops risk. So I think this will be a challenging area for the industry.

Bernadine Reese 26:38
I totally agree with that, but I’m going to go with AI governance expectations, because I think the time has come and they cut across every part of an organization, so they will also vary significantly by jurisdiction, and are going to be rapidly evolving. So I think all of that is going to be very disruptive in 2026.

Kimberley Cole 27:01
Okay, and if you had to simplify one compliance process tomorrow, which would it be with your magic wand?

Carol Beaumier 27:08
I would go with regulatory reporting, which I would argue is time consuming, costly, was developed for a different time and is ripe for streamlining.

Bernadine Reese 27:21
I have to vote for that too. It really is the thing that needs to be rethought and done differently.

Kimberley Cole 27:27
And last one, is compliance in 2026 more powerful or more exposed?

Carol Beaumier 27:33
I’m gonna go with more exposed, I think with less prescriptive regulatory guidance, compliance really has to make tougher judgment calls, and it really will have to own more of the consequences of those calls and if it makes wrong decisions. That said, I think it’s a great opportunity for compliance organizations to step up and make their mark.

Bernadine Reese 27:55
Yeah, I’m going to go for both, both more powerful and more exposed. I think compliance can be much more influential, but only if it earns that influence through credibility and judgment. So I’ll be positive and go for both.

Kimberley Cole 28:11
Okay and then final thoughts, if you could instill one new habit in a financial institution’s compliance culture for 2026 to promote its success, what would it be?

Carol Beaumier 28:24
So I’m going to pick up on something I said before, and my recommendation would be to build a culture of constant horizon scanning. I think the organizations that will be most successful are those that have the ability to look ahead, whether that’s looking at regulatory signals, emerging technologies, geopolitical developments, even shifting stakeholder expectations, if the organization can form a view about those and translate that foresight into action, I think that’s the key to success, really, in an unpredictable environment, I think anticipation is a really powerful form of control.

Bernadine Reese 29:05
I think I would end up with the conclusion that both Carol and I’ve mentioned that compliance won’t be able to wait for certainty or clarity. So leaning into that judgment is critical repositioning compliance as an active partner and strategy and innovation, not just an interpreter of rules, investing in horizon scanning, being explicit about risk appetite and embedding compliance early in product design and technology decisions is going to be absolutely key.

Kimberley Cole 29:36
Fantastic. Well, fabulous to have you both on and hear all of that insight as we wrap up. I think what really stands out from this year’s report is that compliance in 2026 isn’t just about keeping up with regulatory change. It’s about deciding what kind of institution you want to be when the rules feel less certain, as you have outlined. So lighter touch regulation may offer flexibility, but as you’ve both said and you’ve made very clear, it shifts responsibility back onto firms and onto compliance to make hard calls about risk, ethics, innovation and trust, and often without clear guidance. So this is the fourth time we’ve hosted this annual conversation, and what’s really striking to me is how much the role of compliance itself has changed, from rule enforcer to strategic partner, from reactive function to organizational conscience. So I would recommend, if you’re a compliance leader, planning for 2026 this report isn’t just a checklist, it’s provocation and a reminder that unpredictability doesn’t remove accountability. So we’ll give you the link to the full Protiviti Compliance Priorities for 2026 report in the show notes, and I strongly encourage you all to read it, particularly the sections on regulatory simplification, technology risk and the future of compliance function, which we’ve touched on in nearly every podcast that we’ve done. So Bernadine and Carol, thank you for joining us again and for continuing to challenge how we think about compliance in moments like this.

Carol Beaumier 31:19
Our pleasure! It’ll be an interesting year to watch!

Kimberley Cole 31:21
Absolutely! Thank you and look forward to speaking with you again soon.

Kimberley Cole 31:28
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org