Compliance
Compliance is the function that ensures an organization meets its legal and regulatory obligations, and can demonstrate that it did. The second half matters more than it sounds: in supervised industries, a control that worked but was never evidenced is frequently treated as a control that did not exist.
| Core obligation | Meet the applicable rules, and be able to evidence having met them |
| Distinct from legal | Legal advises on what the rules mean; compliance operates them day to day |
| Distinct from risk | Risk assesses exposures generally; compliance addresses regulatory exposure specifically |
| Three lines of defense model | The business owns the risk; compliance oversees; internal audit tests independently |
| In financial services | KYC, AML, sanctions, consumer protection, conduct, data protection, reporting |
| Evidence requirement | Records showing what was checked, when, and on what basis |
| Common failure | Controls that operate but cannot be demonstrated afterwards |
| Standing tension | Control strength against customer friction |
What compliance actually covers
The word is used so broadly that it stops carrying meaning. In a regulated financial context it resolves to a specific and enumerable set of obligations:
| Obligation | What it requires |
|---|---|
| Customer identification | Verifying who a customer is before opening an account — the CIP requirement in the U.S. |
| Customer due diligence | Understanding the customer’s risk and expected activity, and refreshing it |
| Sanctions and screening | Checking parties against restricted lists at onboarding and continuously |
| Transaction monitoring | Reviewing activity for indications of financial crime |
| Regulatory reporting | Filing what is required, accurately and on time |
| Consumer protection and conduct | Fair treatment, clear disclosure, and the absence of unfair or deceptive practice |
| Data protection | Lawful processing, minimization and retention limits |
Reading that list as a chain rather than a checklist is the useful move, because the first row determines the quality of every row after it. Due diligence assesses a customer, screening checks a name, monitoring compares against a profile, and reporting identifies a subject. All four inherit whatever identification established.
Why evidence is the recurring failure
Examiners do not observe controls operating. They read records. That produces a category of finding that surprises people the first time they encounter it: a program that works in practice and cannot prove it.
The usual shape is an institution that verified identity capably — documents examined, decisions made sensibly — and retained a pass or fail flag rather than what was relied on. Asked to evidence how a sample of customers was identified, it cannot answer per account, and one finding becomes systemic because the answer is the same for every file in the sample.
This is why independent testing tends to find documentation problems rather than judgment problems, and why the second line’s value is as much about producing a defensible record as about making good calls.
Why this matters for identity verification
Identity verification is where several obligations converge, and it is the point in the chain with the longest downstream reach.
It is also the control most often bought on catch rate and audited on evidence. A verification process that returns a correct answer and retains nothing about how it was reached satisfies the fraud team and leaves the compliance team unable to answer an examiner. Capturing what document was presented, what was checked, what the biometric comparison returned and why the result was sufficient turns a decision into a record.
The other standing tension is friction. Every additional check reduces both fraud and legitimate approvals, and the only defensible resolution is proportionality — requirements scaled to what an account can actually do, applied consistently and documented as a policy rather than emerging from whichever threshold someone last adjusted. Identity document verification that produces an auditable record is what makes that workable, and KYC and AML obligations are where most of this concentrates in practice.
What compliance can’t do
It does not eliminate risk. Regulators expect risk-based programs, not the absence of failure. A program that never produces an incident is usually over-controlled rather than excellent.
It cannot fix upstream data. No amount of process discipline repairs identifying information that was never verified.
It is not the same as being lawful. Meeting regulatory requirements and behaving well are correlated and not identical, which is what conduct regulation exists to address.
It cannot be fully delegated. Execution can be outsourced; accountability stays with the regulated entity, as sponsor banks have repeatedly demonstrated.
Frequently asked questions
What is compliance in financial services?
The function that ensures an institution meets its legal and regulatory obligations and can demonstrate having met them. In practice that means customer identification, due diligence, sanctions screening, transaction monitoring, regulatory reporting, consumer protection and data protection — operated day to day and evidenced.
What is the difference between compliance and legal?
Legal interprets what the rules require and advises on exposure. Compliance operates the controls that meet them and produces the evidence that they were met. They overlap and answer different questions — one is advisory, the other operational.
What are the three lines of defense?
A common model for allocating responsibility: the business owns and manages its risks, compliance and risk functions provide oversight and challenge, and internal audit tests both independently. The independence of the third line is what makes its findings meaningful.
Why do compliance programs fail examinations?
Most often on evidence rather than on judgment. Examiners read records rather than observing controls, so a program that operates capably but retains only outcomes — a pass or fail flag rather than what was relied on — cannot demonstrate what it did. Weak customer identification data is a frequent root cause.
Related reading
- Compliance officer — the designated role, and why independence matters
- AML audit — the independent testing that examines whether the program works
- Customer Identification Program — the obligation the rest of the chain inherits
- Regulatory reporting — what the program ultimately has to produce
