Podcast S9E11 | Navigating 2026 Compliance Priorities, a Mid-year Reality Check

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Women Radio, where we are going to explore the forces shaping risk and compliance and financial services around the world. Today’s conversation couldn’t be timelier. We are nearing the midpoint of 2026 and what’s emerging is a compliance environment that’s not just evolving but becoming harder to interpret. Today I am delighted to welcome back two of our favorite guests, Carol Beaumier and Bernadine Reese from Protiviti. This is now, I think, our fourth annual conversation, where we revisit the year’s biggest compliance and regulatory issues, compare them with the predictions that we made at the start of the year, and explore what has surprised us, what’s changed, and what leaders should be watching for in the months ahead. So, quick intro for those of you who haven’t listened to the previous episodes, but Carol is the senior managing director in Protiviti’s Risk and Compliance Practice, and leads the firm’s global thought leadership program, with more than 35 years of experience spanning regulation, consulting, and financial crime. She is recognised globally for her expertise in risk and regulatory issues. Carol is also a valued member of the judging panel for our Risky Women Rights competition, and joining her is Bernadine Reese, Managing Director in Protiviti’s, Risk and Compliance Practice in London, with more than 30 years experience advising financial services firms on risk, compliance, and governance. Bernadine is a highly respected voice on regulatory change and a regular speaker on emerging industry issues. Carol and Bernadine, welcome back to Risky Women Radio. It’s wonderful to have you both with us again.

Carol Beaumier 2:14
Delighted to be back.

Bernadine Reese 2:16
Great to be back, thanks, Kimberley.

Kimberley Cole 2:18
Excellent, and they are the co-authors of Navigating 2026 Compliance Priorities, a Mid-year Reality Check, and we’ll include the link in the show notes to the report. And we hope that today we’re just going to give you a little taster of what’s in the report and get a bit of a some of the thoughts behind what Carol and Bernadine have uncovered here in the mid year report. So, Carol, let me start with you. You describe 2026 as one of the most unpredictable environments that you have seen. What’s driving that, and has anything shifted or surprised you now that we’re at the mid year point?

Carol Beaumier 3:02
Thanks, Kimberley. So, as we set out to think about what 2026 would bring, what we saw was a convergence of forces at play, so technology transformation very much driven by AI, geopolitical tension, shifting regulatory priorities with definite expectations in several jurisdictions for a much lighter regulatory touch, so I would say at midpoint the volatility hasn’t subsided. So, on one hand, no surprises, but I do think there are a couple of really important underlying points to keep in mind. One of them you touched on in your introduction, and that is that regulatory expectations are not necessarily disappearing, they’re being recalibrated, and often in a way that is very hard to interpret at this point. I think the other really important point is that the real challenge that institutions are probably facing is recognising where risk is actually building, even when the regulators aren’t actively signaling an interest.

Kimberley Cole 3:03
That’s very interesting. And Bernadine, how are your clients interpreting this environment? Are they seeing this as easing pressure or growing uncertainty given what Carol said?

Bernadine Reese 3:50
So what I’m hearing consistently is that clients are not really interpreting this as reduced pressure, they’re seeing it as increased ambiguity, and yes, there are signals of recalibration, so simplification, prioritisation, even a lighter tone in some jurisdictions. But as Carol was saying, underneath that many of the underlying risks are actually intensifying. If you think of AI, fraud, cyber, geopolitical fragmentation, those risks don’t slow down just because supervisory intensity changes. So clients are less focused on is this easier, and probably more focused on what does this really mean, and how do we avoid misreading it. And I think that’s the key point that we came away with in the report, is that this year is less about responding to regulators and more about exercising independent judgment in an environment where the signals are incomplete or unclear, because ultimately decisions made today will be tested later, not just by regulators, but customers, stakeholders, and the market more broadly, too.

Kimberley Cole 5:40
Interesting challenges you talk about the core compliance stack, and I know that covers a range of different things that are outlined in the report. So, Bernadine, even with all the noise around regulatory change, you emphasize that the core compliance issues haven’t gone away. So, what still matters most at a fundamental level?

Bernadine Reese 6:03
Yeah, absolutely. We looked at this and came to the conclusion that everything in that core compliance stack still really matters. So we’re talking about AI, financial crime, cyber, third-party risk, operational resilience, data privacy, consumer protection, culture, conduct – none of those risks have gone away. What has changed is how they’re being evaluated, not whether they exist. I think that there are two important realities here that we drew out in the report as well. Firstly, the legal and stakeholder obligations haven’t changed, even when regulatory focus shifts, for example, consumer protection in the US. The underlying laws still apply, and consumers, advocacy groups, and investors are still watching. And, secondly, and equally importantly, I think, is that these risks are now highly connected. So AI isn’t just a technology question, it cuts across consumer outcomes, model risk, bias, cyber, and governance. Similarly, fraud isn’t just AML, it’s also operational risk, consumer harm, and brand trust. So, for me, what matters most now is not just whether firms are covering the risk, but whether they’re connecting them in a way that reflects how they actually manifest in practice.

Kimberley Cole 7:30
And Carol, you said that interpretation was hard. So, are you seeing institutions misread the current environment and perhaps interpreting the lower regulatory intensity as lower risk?

Carol Beaumier 7:44
I think in some cases that’s true. I think that some institutions have succumbed to the temptation to interpret regulatory de-emphasis as risk reduction, but as Bernadine already mentioned, that’s false comfort, because we know that in many areas, the risk continues to accelerate, and unfortunately, I think those institutions that pull back too aggressively will find themselves exposed later when scrutiny returns, which I have to say I inevitably believe it will.

Kimberley Cole 8:17
Yes, very interesting. And I guess, how would you characterise the shift in regulatory philosophy right now? So that regulatory mindset change, what’s changing in how regulators are thinking about risk and supervision?

Carol Beaumier 8:32
So this may not be consistent across the globe, but I think we’re seeing a number of structural shifts in regulatory philosophy that do affect a number of jurisdictions. I think the first I might mention is more of an emphasis on material financial risk, so less focus on the things around the periphery that maybe ultimately do not affect the safety and soundness of an institution, and in that same vein, I think we’re seeing a move toward more outcome-based supervision, a greater focus also on proportionality, making sure that there’s not an attempt at a one size fits all that unnecessarily encumbers smaller institutions. I think, in several jurisdictions we’re seeing greater focus on global competitiveness and how that affects institutions in that jurisdiction or that region, and I think we’re seeing a broader push to simplify frameworks that many believe have become overly complex. Again, I would point out these are not necessarily entirely new. We’ve seen many of these same themes in play in regulatory cycles before, and again, my bit of caution, they tend to reverse pretty quickly in times of crises.

Kimberley Cole 10:00
Bernadine, do you see this shift towards outcome simplification and proportionality as sustainable, or are we looking at another cycle that could reverse?

Bernadine Reese 10:11
Yeah, an interesting question, I think, on a lot of people’s minds at the moment. As Carol mentioned, I think some elements of the shift are real, but move to outcomes-based supervision. We see that constantly in the UK, proportionality, a focus on material risk, but I’m very cautious about assuming this is permanent, because we’ve seen this cycle before. Simplification and lighter touch approaches often feel compelling until there’s a crisis, and then when that happens, expectations don’t just return, they reset, and often quite sharply, and accountability lands very quickly with senior management, and I think that’s particularly important in the current environment, because while the rhetoric may have softened in some areas, accountability absolutely hasn’t. So my view is that firms should adapt to the current environment, but they shouldn’t be scaling back too far, particularly in areas like AI governance, broad controls, or third-party oversight, because they do risk being caught out when expectations inevitably tighten again.

Kimberley Cole 11:22
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management, and compliance. Partner with Protiviti and face the future with confidence.

Kimberley Cole 11:38
Look, you both speak to a lot of clients, and right across the globe, so it’d be great for you to share a little of that insight. Bernadine, what are the most consistent themes that you’re hearing from your clients globally, and what’s currently sort of rising to the top of their agenda?

Bernadine Reese 11:58
Yeah, so there are probably five themes that emerge consistently across client conversations, and I’d say this is probably a global matter as well. So, firstly, AI – it’s moving into production faster than governance frameworks can keep pace, and that creates challenges around accountability, explainability, customer outcomes, amongst other things. Secondly, fraud risk is intensifying, driven by real-time payments, synthetic identities, AI-enabled attacks, even in jurisdictions where AI scrutiny has become more targeted. We’ve seen that continued focus on broad risk. Then third-party risk has become really a board level resilience issue, particularly giving increasing dependence on cloud providers and technology partners. Fourth, geopolitical fragmentation is a common theme. It’s definitely creating more complex and inconsistent regulatory expectations for global firms, which means it’s more challenging to manage many issues. And finally, talent fatigue is becoming a risk in its own right. These compliance teams are asked to support transformation, AI adoption, and growing obligation with constrained resources. And so what ties all of these themes together is a bigger question that many clients are grappling with, and that’s whether traditional compliance operating models are still fit for purpose in an increasingly automated and technology-driven environment. So, our message in the report is simply that risk is currently evolving faster than governance frameworks and operating models are adapting, but they are going to need to catch up.

Kimberley Cole 13:45
Yeah, well, so five themes: AI, fraud, third-party risk, geopolitics, and talent fatigue. Carol, when you step back and look across those themes, what’s the bigger pattern, or what do they collectively tell us about how risk is evolving?

Carol Beaumier 14:06
So, I’d say Bernadine hinted at this, but I would say that the bigger pattern is convergence. So risks are no longer neatly separated, fraud intersects with cyber, AI intersects with model risk or consumer protection, third-party risk intersects with resilience and geopolitical concerns, and on and on and on. And as Berndine said, the governance models and the operating structures that we have in place today haven’t fully evolved to manage this sort of complexity, and I think this is why we’re seeing growing pressure to move toward more integrated risk management frameworks.

Kimberley Cole 14:48
I think there’ll be a lot more in the report, so everyone, don’t forget you can look at the full report, Navigating 2026 Compliance Priorities, a Mid-year Reality Check, so go and have a look at the. That, but I think there’s so much in those five themes that you just covered, especially. I’d love to dig into talent fatigue, but we don’t have time. So I also, I know we have got limited time, but I would love to hear a bit about the views regionally, seeing we have a very global audience. So, can you, Bernadine, maybe give us a bit of feedback, or maybe some of the most significant feedback of what you’re hearing from the EU and the UK.

Bernadine Reese 15:31
So, in the EU, the dominant theme is definitely scale and complexity. Clients are dealing with a high volume of regulation and highly prescriptive regulation too. Thinking about the AI Act and DORA to AML reforms, AMLA, the new AML regulator, and MiCA, and that combined with increasing fragmentation and how rules are being interpreted across member states. The biggest challenge for those clients is closing the gap between regulatory ambiguity and operational readiness, particularly around some of our key themes of AI governance, ICT risk, and third-party oversight. In the UK, the environment is, as we’ve mentioned previously, more outcomes focused and accountability driven, a definite trend there. Regulators are less interested in general in whether firms have the right frameworks on paper and more interested in whether they can demonstrate good outcomes in practice. We’re seeing particular focus on operational resilience, fraud, AI governance, third party risk and also the resilience of non bank financial institutions. So to summarise, I guess the EU challenges that volume and prescription and fragmentation, the UK challenge is flexibility combined with very high accountability for outcomes.

Kimberley Cole 16:59
And Carol, I guess same question to you, but if you could sort of give us a view on APAC and North America.

Carol Beaumier 17:04
Sure, so in APAC, I would say no great surprises. What we’re hearing most about are financial crime, operational resilience, culture and conduct, data, and digital assets. The drivers may be somewhat different in different countries, but I think those are common themes across the region. I feel compelled to split North America into Canada in the US, and say in Canada we’re hearing about many of the same issues that we’re hearing in APAC. I think in Canada, additionally, though, there has been or is a focus on credit and liquidity issues. In the US. What I would say is that we’re talking more about what is being de-emphasised than what is being emphasised. So regulators have moved to eliminate the use of reputation risk as a basis for supervisory criticism, and in fact have formally prohibited examiners from taking action based on any perception of reputation risk. They are further stressing that supervision needs to be anchored in objective, measurable risk tied to safety and soundness, that material financial risk I mentioned a minute ago, and I think this is just a part of a broader reorientation away from the focus on procedures and control frameworks that don’t really impact financial stability to looking again at outcomes. I’d say there are a few exceptions to that. Sanctions is one, which I think is fairly significant, where the correlation to financial risk may not be as high, but it’s clearly a priority concern of the current US administration and regulators.

Kimberley Cole 18:51
And I love the section that you had in the report called the H2 2026 Planning Reset. I thought there was some great actions and ideas that would be useful for all of our listeners. So, Carol, as organisations do look to the second half of the year, what’s the single biggest message that you would give to boards and to senior executives right now?

Carol Beaumier 19:16
So, picking up on our conversation to this point, I’d say don’t confuse regulatory signals with risk reality. Even if enforcement activity hasn’t declined, underlying risk, as we’ve said several times, is not necessarily diminishing. In fact, it’s actually accelerating in many cases. So, I think on an institution by institution basis, the focus really needs to be on identifying structural risks, those that are embedded in the institution’s operating model, and making sure that as an institution, as leadership, there continues to be investment in managing those risks.

Kimberley Cole 19:56
Excellent. And Bernadine, I guess, what are some of the most practical actions that institutions should take over the next six months to stay ahead of those shifts?

Bernadine Reese 20:07
Yeah, so in the report we’ve suggested five very practical actions. Firstly, doubling down on those structural risks that Carol mentioned, AI fraud, third-party dependency – these risks are already embedded in the operating model, and continuing to grow regardless of regulatory tone. Secondly, reprioritise, but don’t descope, so narratives may change sequence, but not the underlying obligations. Those remain there. Thirdly, holding the line in areas of false comfort, so what we mean by that is consumer protection and data privacy, maybe as examples, even if those are being de-emphasised in some countries, they still carry legal and reputational risk, and something needs to be addressed for each of those. Fourthly, integrating across risk domains, I feel like this has been a common theme of the discussion today, that fraud, AML, cyber, customer harm – they’re all converging in the modern business model, and siloed models are looking increasingly ineffective. And then finally reinvesting in the compliance operating model that capacity strain, those talent fatigue risks that we mentioned earlier are real. And increasingly it’s not just about execution, but judgment capability as well, because in our view the biggest risk at the moment is not doing too little, it’s expecting high-quality judgment without enabling it adequately.

Kimberley Cole 21:42
Very interesting, and obviously leadership is always key. So, Carol, in a year like this, where signals are fragmented, what do you feel distinguishes leadership or strong leadership from, say, more reactive leadership?

Carol Beaumier 22:00
So, I think this is going to sound a bit contradictory, but I’m going to say that leaders need to be disciplined in how they interpret ambiguity, and by that I mean they really need to be able to separate the real signals from the noise. Not every regulatory development, not every political shift carries the same weight, so discipline means resisting overreacting to the most recent pronouncement or the most visible pronouncement. I also think that they need to anchor on principles and not headlines. To a leader, to a strong leader, effectiveness, accountability, resilience. resilience should remain important, regardless of what the regulatory environment is, what the regulators are asking about. So, anchoring on those principles, and then I think being able to make a decision without necessarily having all the facts, which is a definite skill, right? But in this period, where things can get very confusing, I think leaders need to be able to make a decision and not wait for the clarity, because that’s not a way to run an organisation. So, I think all of those are important.

Kimberley Cole 23:19
Yeah, and Bernadine, from your perspective, what does the environment really demand from compliance leaders?

Bernadine Reese 23:26
I think it comes down to three things: judgment, judgment to see through fragmented and sometimes conflicting signals, as Carol was saying. Clarity to help the organization understand what really matters and where the risks are building. And then not to be underestimated, but the courage to challenge false comfort when regulatory tone changes, but underlying risks don’t, and recognising that a shift in regulatory focus doesn’t necessarily mean a reduction in risk.

Kimberley Cole 23:57
Well, I’m going to have one more question before we wrap up, and it’s going to be, get your crystal balls out, and you know we always do these things like we did our 10 year predictions, and then we came back and we looked whether you were right or not, so…

Carol Beaumier 24:16
So be warned, yes?

Kimberley Cole 24:19
It’s a good one! So tell us in a few sentences what you think we will all be talking about in compliance at this time next year? So, Carol, you first.

Carol Beaumier 24:32
All right, so I’m going to caveat this with, barring any major political shifts, I think the single most important compliance issue in 2027 will continue to be demonstrating real end-to-end effectiveness of controls in this technology driven interconnected environment in which we’re operating, and with regulators really expecting organisations to prove through their outcomes through the data that they know how to manage risk, not just write policies.

Kimberley Cole 25:04
Great. Okay. And Bernadine, you get the final word and the final gaze into the crystal ball.

Bernadine Reese 25:10
So I’m thinking that next year’s compliance conversations are going to centre on that one thing that we’ve spoken about a lot today, risks accelerating faster than governance can keep up with. I think it might manifest itself in various ways on the AI, or fraud, or third-party risk management side, but regulators are still going to expect good outcomes rather than just box ticking from compliance teams.

Kimberley Cole 25:41
Well, thank you both, Carol, Bernadine. It’s been fabulous again to speak to you, and such an insightful and grounded discussion. And, of course, everyone can go back and listen to the first episode that we did this year in series nine, but also make sure that you go and read the report, so as I said, Carol and Bernadine are the co-authors of the Protiviti Navigating 2026 Compliance Priorities, a Mid-year Reality Check. We’ll put the link in the show notes. And to everyone listening, thank you for joining us for this mid year check in on our compliance priorities in 2026 Thank you, everyone, for joining.

Kimberley Cole 26:28

Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org