It’s healthy to sometimes disagree with regulators

That is not an indictment of the regulator; it is the natural result of a regulatory system that depends on judgment.

Bermuda’s financial services framework is not built entirely on rigid prescription. Significant parts of it are proportionate, risk-based and dependent on the nature, scale, complexity and risk profile of the business.

The Bermuda Monetary Authority, as regulator, describes its supervisory process as risk-based, with risk identification, assessment, prioritisation and regulatory response forming core components of supervision.

Its AML/ATF (anti-money laundering/anti-terrorist financing) Guidance Notes require regulated financial institutions to assess their risks, take account of Bermuda’s most recent national risk assessments, and apply compliance resources proportionately to the risks identified.

That is where disagreement begins.

A regulated entity may conclude that a control is adequate because it understands its customer base, transaction flows, systems, staff, outsourcing arrangements and residual risks.

A regulator may look at the same facts and conclude that the control is insufficient, poorly evidenced or inadequately governed.

The disagreement may relate to implementation of a requirement, the severity of a finding, or whether remediation should be immediate, staged, independently validated, board-approved or externally reported.

It becomes more difficult where the source material is not perfectly aligned. Regulations, codes, guidance notes, sectoral guidance, national risk assessments and supervisory expectations all develop over time.

Some guidance predates later risk assessments. Some obligations are expressed as principles, while other expectations emerge through supervisory practice.

In AML, for example, one may ask how much weight should be given to an older risk indicator if the more recent national risk assessment does not identify that risk with the same prominence.

These are not academic questions. They arise during on-site examinations, remediation programmes, shareholder controller filings, mergers and acquisitions, exits from the Bermuda market and new product launches. They arise because businesses change, acquire, divest, outsource, automate, consolidate and discover that what looked clear on paper is less clear in practice.

Litigation may be necessary in some cases, but it is blunt, expensive, slow and often destructive to the working relationship. In regulatory conflict resolution, the choice is not binary: either all-out litigation or unquestioning compliance.

A mature relationship allows deeper engagement, reflection and principled resolution. That is the nature of non-litigation regulatory conflict resolution.

The first step is honesty. A company should not agree with a regulatory finding simply to make the matter go away. That may feel convenient, but it is unfair to the company, unfair to the board and unfair to the regulator. If the finding is wrong, overstated or missing important context, the regulator needs to know that. A risk-based framework depends on feedback from the institution closest to the risk.

The second step is clarity. Clarity requires writing. Meetings are useful for tone, explanation and clarification, but they are rarely enough for nuanced disputes. The company should create a record: what the regulator appears to be saying, what the company accepts, what it does not accept, the legal or regulatory basis for its position, the risk facts relied upon, the evidence available and the proposed way forward.

The third step is precision. Do not merely say, “we disagree”. Identify the exact point of disagreement. Is it factual, legal, proportional, operational, evidential or procedural? Different problems require different answers.

The fourth step is to offer a solution. Regulators exist, among other things, to protect the public interest, maintain confidence and ensure compliance. If a company disagrees, it should still propose a route that achieves the regulatory outcome. That may mean enhanced reporting, board attestation, independent testing, revised policies, additional monitoring, staged remediation or a formal commitment letter.

The fifth step is to preserve the legal record. Bermuda’s enforcement materials recognise written representations as part of the Warning Notice and Decision Notice process, giving licensees and individuals a reasonable opportunity to make representations before final enforcement decisions in relevant cases.

That formal process should not be treated as the first time a company explains itself. By then, the record should already show that the company engaged seriously, respectfully and thoroughly.

Ultimately, disagreement with a regulator is not a breakdown in the relationship. Avoiding disagreement at all costs is the real danger.

A healthy regulatory relationship is not one where the company says “yes” to everything. It is one where both sides can test assumptions, correct misunderstandings, identify better controls and still act professionally.

In a proportionate, risk-based system, conflict is inevitable. Fortunately, well-managed conflicts result in clearer, stronger and more sophisticated regulation and supervision.

First Published in The Royal Gazette, Legally Speaking column, July 2026