By Elizabeth Travis
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In the breakneck world of compliance, we’re told to sprint ahead, but sometimes slowing down is the true secret weapon. With regulations playing hard to get, taking a breath allows for thoughtful strategy and better preparation. After all, hasty moves can lead to costly missteps—sometimes, patience really is a virtue!
For more than a decade, compliance professionals have been encouraged to anticipate change rather than simply react to it. Horizon scanning is routine. Consultation papers, regulatory speeches, and draft frameworks are examined for early signs of policy direction. The message has been clear: act before the rules arrive.
But what happens when the rules never come?
Across artificial intelligence (AI), environmental, social and governance (ESG) standards, crypto regulation, and economic crime reform, legislative timelines continue to slip. Promised reforms are delayed, softened, or quietly shelved. The result is fatigue. Compliance teams are under pressure. Budgets are tight. Boards are increasingly reluctant to invest in controls built on speculative drafts. Whilst the case for proactive compliance still holds, it now calls for greater selectivity and sharper judgement.
There’s no doubt that early alignment can create value. It builds credibility with regulators, reassures stakeholders, and helps manage reputational risk. As Alison Rose, former CEO of NatWest Group, once put it, “Regulatory clarity may take time, but leadership means acting on purpose, not just rules”. Take GDPR for example: firms that moved early gained operational resilience and public trust. Starling Bank, co-founded by Anne Boden, committed to privacy-by-design well before it was required, giving it a clear edge when the rules arrived. Others, anticipating crypto AML requirements, secured licences and market access before regulatory bottlenecks emerged.
Let’s not pretend proactive compliance is easy. It takes time, budget, expertise, and often a shift in mindset across the business. In better economic times, firms might absorb those costs. Right now? Many are trimming headcount and freezing spend. Shareholders and regulators alike are demanding more for less. In that climate, building systems for rules that may never materialise feels less like foresight and more like a luxury. It is expensive. It is exhausting. And for many, it is becoming harder to defend.
You don’t have to look far to see how this tension is playing out.
In 2018, the Financial Action Task Force (FATF) updated its recommendations to extend the Travel Rule, originally designed for wire transfers, to cover virtual asset transfers. This was formalised in 2019, requiring Virtual Asset Service Providers to collect, verify, and share originator and beneficiary information. Some institutions responded early, but implementation across jurisdictions has remained patchy. In the UK, the Travel Rule was not fully enforceable until September 2023, through the Money Laundering and Terrorist Financing (Amendment) Regulations 2022.
The EU’s AI Act followed a similar pattern. Early drafts proposed far-reaching controls, including bans and strict oversight requirements. In response, some firms quickly developed risk frameworks and governance processes to show readiness. However, the final version of the legislation was softened following intense lobbying. This left early adopters in the position of having to revisit or dismantle systems they had only recently built.
A comparable pattern is emerging with the UK’s economic crime reform agenda. While Companies House reforms have moved forward, broader changes have yet to be defined. Several compliance teams began preparing for stricter AML disclosure and verification obligations, only to find themselves with shelved plans and uncertain timelines. In this context, the appetite for further investment is understandably limited.
These examples don’t undermine the value of proactive compliance. They highlight the need for discipline in when and how it’s applied.
First, compliance teams need to prioritise more ruthlessly. Not every consultation needs a response, and not every draft is worth reacting to. Focus should go to proposals that have political momentum, span multiple jurisdictions, and clearly link to commercial or operational risk. If a draft rule supports the firm’s future strategy, it’s worth early attention. If it’s speculative or likely to stall, a watching brief will do.
Second, preparation should be proportional. Sometimes, a light-touch policy draft, a working group, or a quick gap analysis is all that’s needed to show awareness. These steps keep teams alert without draining resources on rules that may never land.
Finally, compliance leaders must manage expectations. Some of the work will never see the light of day. That’s not failure. It’s sound contingency planning. Being prepared still adds value, even if the rules don’t land. But going too far too soon can drain resources and damage internal credibility. As ever, balance matters.
Speed has become a proxy for leadership, but in today’s volatile landscape, haste is more likely to burn capital than build credibility.
Proactive compliance still offers strategic value. In emerging domains like AI, ESG, and financial crime, early action signals maturity and ethical leadership. But in a tired market, with economic pressure mounting and policy delivery uncertain, chasing every future rule isn’t strategy. It’s burnout.
The best compliance functions are not just fast-moving. They are measured, deliberate, and prepared to pause. They lead not with panic or PR posturing, but with strategic clarity and quiet confidence. And more often than not, they are led by women.
Anticipating regulation still matters. But so does restraint. The ability to pause, assess, and act with purpose is what distinguishes mature compliance functions. In this era of uncertainty, those who move wisely, not just quickly, will shape what good looks like.