Complied out of business

Faced with increasing regulatory expectations, the instinct has been to add more controls, more checks and more process. In doing so, many firms have created frameworks that are heavier, slower and less effective. Those controls were once suitable. Yet the supervisory environment has changed.

The BMA is becoming increasingly data-driven, technology enabled and continuously engaged. Supervision can no longer be assumed to be periodic, document based and retrospective. It is now faster, more granular and more comparative across firms. The BMA is building the capability to collect, aggregate and interrogate information across time and market actors.

At the same time, the demands on compliance functions are expanding in both scope and intensity. Sanctions updates are more frequent and more complex, often driven by daily geopolitical developments that require immediate interpretation and implementation. Data requests are broader, more detailed and increasingly extending beyond traditional AML metrics into beneficial ownership, governance structures and operational characteristics. Thematic reviews require firms to explain how risk is identified, assessed and managed across the business. Supervisory engagement is more persistent and focused, with increasing emphasis on how decisions are made in practice.

The cumulative effect is clear. There is more to do and it must be done more quickly.

Earlier model compliance programmes struggle to adapt. Accumulated controls, complex though unclear systems, slow processing and reduce responsiveness to clients and to the regulator.

Resources are absorbed responding to activity rather than determining which activity to undertake. What begins as a support function gradually becomes the defining operation of the business.

Also at that point, compliance is no longer managing risk. It is creating it.

Although risk-based AML and sanctions language and intention is widely adopted, in practice, many compliance programmes do not reduce workload by specifically addressing their own risks.

The AML-sanctions framework requires more than reacting to any given risk indicator. It requires determining what that indicator means in context and calibrating the response accordingly. The distinction is reflected directly in the legislation. Firms are required to determine the extent of customer due diligence measures on a risk-sensitive basis, taking into account the customer, the transaction, the product and the geographic exposure.

The applicability becomes clearer when considering how higher-risk jurisdictions are treated in practice. The AML-ATF Ministerial Advisory 1/2026 draws a deliberate line.

In a limited number of cases, such as DPRK and Iran, firms are directed to treat the risk as high and apply countermeasures and enhanced due diligence measures. The response is effectively predetermined.

For all other higher-risk jurisdictions, the instruction is different. Firms are required to ‘take appropriate action to minimise the associated risks, which may include enhanced due diligence’. This is supported by the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations, Regulation 11 which requires a deliberate assessment of risk (or relevance) prior to applying enhanced due diligence. In other words, the outcome is not prescribed – it is determined. That difference is critical.

It confirms that a risk signal, even one labelled ‘high-risk’, is not in itself a conclusion. It is an input into a broader assessment. The nature of the activity, the purpose of the transaction, the structure through which it is conducted and its consistency with the customer’s profile must all be considered before determining the appropriate response.

In practice, however, this step is often compressed. A high-risk jurisdiction becomes enhanced due diligence. A politically exposed person becomes a risk committee meeting. A monitoring alert becomes painstaking workflow. The potential for risk is treated as if the risk occurred.

The result is a framework that is reactive but imprecise, often creating more work without reducing risk.

A true risk-based approach requires differentiation. Risk indicators vary in relevance, severity and extent. A connection to a higher-risk jurisdiction may reflect meaningful exposure in one case and limited or incidental exposure in another. A politically exposed person may present material risk in one context and minimal risk in another.

Also, the consequences are cumulative. As signals increase, controls increase. As controls increase, systems become more complex. Complexity reduces clarity and resources are directed toward managing ever expanding processes.

The commercial impact follows. Onboarding slows. Transactions are delayed. Costs rise. Teams focus on completing steps rather than making decisions. What begins as an effort to strengthen compliance gradually constrains the ability of the business to operate.

Businesses are, quite simply, complying themselves out of business.

To operate effectively in the modern regulatory environment, businesses must confront the instinct that has driven most compliance programmes to date: when in doubt, add a control. That instinct is understandable. It feels safe, prudent and defensible. In the current environment, however, it is no longer effective.

The issue is not that firms have too few controls. It is that they have too many broad, untargeted controls. Controls which are imprecise and unsupported by clear reasoning. This raises an important question: what does a risk-based approach actually require in practice?

Take higher-risk jurisdictions as examined earlier. In many cases, these are treated as automatic triggers for enhanced due diligence. Yet the regulatory framework requires firms to ‘apply on a risk-sensitive basis enhanced due diligence’ where ‘higher risk’ is present. So not, ‘higher risk equals enhanced due diligence’ but ‘higher risk equals assessment’, which may lead to enhanced due diligence. Even then, the enhanced due diligence must be ‘specific and adequate’, which provides flexibility to suit the specific circumstance.

The same applies to politically exposed persons. Where PEP status is an automatic escalation, it reduces the inherent complexity which the ‘risk-sensitive’ permissions are designed to accommodate. Some use the criteria ‘a PEP is a PEP is a PEP’ meaning that the condition is absolute and perpetual. That quickly runs into the inherent realities such as PEPs that have very limited authority or abilities. Does the individual have influence over state or international resources? Are they connected to the transaction, or are they ancillary? Are they even aware the transaction is taking place? The answers to those questions determine the control response – not just that they are a PEP.

The distinction is subtle but important. The framework requires assessment, not absolutism.

Trigger-based controls are understandable. Supervisory engagement often focuses on whether enhanced measures have been applied in higher-risk situations and on-site findings frequently highlight gaps where such measures were not evidenced or consistently applied. Over time, this creates an operational bias toward applying controls defensively rather than proportionately.

The result is a framework that is consistent but not precise. Also, the absence of precision creates, ironically, additional compliance obligations and regulatory risks. In other words, a local police inspector gets treated the same as a foreign Cabinet Minister before the courts.

In a data-driven, analytical and nearly real-time supervisory environment, a lack of precision means a compliance programme will not be able to withstand its own weight. What begins as a conservative approach ultimately handcuffs the business to wildly inappropriate actions.

An AML and sanctions programme built on precision will apply customer due diligence, ongoing monitoring, suspicious activity reporting and related obligations in a way that is necessary, proportionate and clearly linked to defined risks.

Businesses that introduce precision into their AML-sanctions compliance will thrive as the Authority becomes more exacting, data-driven and persistent. A distinct competitive advantage.

First Published In the Bermuda Business Review 2026-2027 – June 2026