The Regulator’s Alarm Clock Just Went Off

By Chiara Barbacci
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian

Intro: For years, many GRC functions have treated compliance as a local sport – training for their “home league” rules, playing to the tempo of one regulator, and tuning out the rest. That mindset is now dangerously out of date.

Supervisors worldwide, from Europe’s AMLA to US prudential agencies to Asia-Pacific innovators, are upgrading their oversight, sharing data, and borrowing each other’s playbooks.

Looking at compliance only from the perspective of one region can mean missing key obligations elsewhere, and it won’t prepare you for the increasingly connected, technology-driven oversight that regulators around the world are adopting.

The long off-season is over. The referee is global, the whistle can blow at any time, and the camera is always rolling.

What’s new (and why it matters)

Historically, GRC teams could prepare for “exam season”: assemble evidence, refresh policies, and lean on one-off remediation. That’s fading. In Europe, authorities are codifying tech-enabled supervision (SupTech) and standing up new agencies to harmonise methods; the EBA’s latest report confirms tools that analyse data and track remediation are already in production, bringing faster, more granular oversight. At the same time, the EU has created AMLA to coordinate supervision – a structural signal that convergence and standardisation are here to stay.

But this isn’t just an EU story. The UK’s Consumer Duty has moved firms toward demonstrable, measurable customer outcomes – not simply procedural compliance – with the “closed products” deadline landing in July 2024. That reorients governance and MI around evidence of fair value and support. In Australia, APRA’s CPS 230 (effective 1 July 2025) hard-wires operational resilience into board and management decision-making, explicitly calling out technology, data and third-party risk as core supervisory concerns.

And in Asia, supervisors are investing in digital oversight and innovation pathways – from HKMA’s supervisory incubator for DLT to APAC-wide initiatives promoting responsible use of AI and data analytics in supervision.

In the US, the picture is more mixed – but still evolving. Prudential priorities for FY2025 underscore continued focus on risk management, while debates over capital reform (the “Basel endgame”) and climate disclosure rules show that supervisory direction can shift, yet the expectation for credible risk governance remains.

Bottom line: oversight is becoming faster, more data-driven and more outcome-oriented across regions, even where the regulatory tools differ.

EU vs US vs Asia: same destination, different roads

• EU/UK: Convergence and standardisation. Expect common methodologies and machine-readable reporting; evidence must be complete, structured and comparable. (Think: AMLA coordination, EBA SupTech signals, Consumer Duty outcomes testing.)
• US: Continuity with contention. Supervisory plans stress risk and safety-and-soundness; capital and climate rules are in flux, but boards are still expected to demonstrate effective risk and data governance under tightened expectations.
• Asia: Pragmatic digital adoption. Authorities pair innovation sandboxes and RegTech/SupTech capacity-building with clear expectations on resilience and data quality (e.g., HKMA’s DLT supervisory incubator, regional SupTech skills efforts).

For multinational firms, that means fewer chances to “localise” weak practices. What counts everywhere: clean data, fast execution, and proof that controls actually work.

Welcome to the Always-On Control Room

To thrive under continuous oversight, firms need more than new dashboards. They need a different operating model. Here’s a practical blueprint you can implement in quarters, not years.

1. Evidence by design (not by scramble).
   Shift from ad-hoc evidence collection to “born-audit” processes: every material control and review automatically produces time-stamped, queryable artefacts (decisions, data checks, attestations, outcomes). Align data structures with how supervisors ingest and compare information so you can supply machine-readable packs on demand. (This aligns with EU standardisation pressures and UK outcomes testing.)
2. Risk sensing that beats inspection cycles.
   Deploy lightweight analytics over customer, transaction and loss-event data to detect early indicators: deteriorating response times, rising complaint themes, repeat sanction false-positives, supplier SLA drift. The aim isn’t perfection, it’s early, explainable detection that prompts pre-emptive fixes.
3. Evergreen remediation.
   Replace “projectized” clean-ups with a standing remediation factory: playbooks, pre-agreed evidential standards, capacity you can surge (internally or with managed services) inside compressed supervisory timelines. That matches regimes like CPS 230 where operational resilience and supplier remediation speed are board-level obligations.
4. Outcome MI that executives actually use.
   Board packs should answer three questions clearly: Are customers treated fairly? Are operations resilient? Is risk within appetite with evidence? Tie each answer to a small set of leading indicators, threshold breaches and completed corrective actions, not just policy inventories.
5. Standards first, local nuance second.
   Build global common cores for policy, data dictionaries and control libraries; layer local addenda only where law requires divergence. This reduces rework as EU/UK standardise, Asia digitises, and US themes evolve.

Stop, Drop, and Comply: To-Do List For This Quarter

• Map your “regulator-ready” evidence. For one priority area (e.g., complaints or critical third parties), list what a supervisor would request tomorrow. Automate the collection of anything you currently assemble by hand.
• Stand up a remediation sprint team. Define RACI, SLAs and artefacts now; test on a small backlog so you can credibly quote timelines when asked.
• Normalize three cross-border data fields. Pick high-value items (e.g., vulnerable customer flags, critical service mappings, sanctions disposition codes) and standardise formats across entities.
• Reframe board MI. Replace two pages of policy updates with one page on outcomes, evidence and exceptions.

Why this is an advantage and not just a burden

Done well, the “Always-On Control Room” reduces last-minute scrambles, shortens regulator queries, and surfaces operational waste you can fix. It also travels well across jurisdictions: EU’s push for comparability, UK’s outcomes focus, APAC’s digital supervisory channels, and US prudential priorities all reward firms that can prove control with clean data, rapid remediation and clear accountability.

Continuous supervision is here. Treat it as a design constraint and a competitive edge. The firms that win won’t just comply faster; they’ll run better.

Key sources:
EBA homepage note on SupTech report;
EU Regulation 2024/1620 establishing AMLA;
FCA Consumer Duty implementation materials;
APRA CPS 230 operational risk standard;
HKMA supervisory incubator and APAC SupTech capacity initiatives;
OCC FY2025 operating plan;
current US capital/climate rule