Deepak Kinger, Chief Strategy Officer and Co-Founder, EvoluteIQ
Regulatory compliance is one of the single largest expenses for UK financial firms. Last year alone, the industry spent more than £33.9BN on compliance measures, which accounts for over 13% of operating costs. Recent regulatory updates, and indications from the FCA’s 2026 agenda, will do little to reduce this workload, with increased regulatory pressure set to intensify amidst greater scrutiny of AML frameworks.
And yet, when new rules land, most banks still bring out the same textbook they used a decade ago. A short-term, one-off workflow gets built using a temporary team only to get silently shelved and forgotten about the minute it is no longer needed. This process then starts again once the next change arrives.
25 years of working with global financial institutions has surfaced the same pattern time and time again. At its core, it’s a design problem. Operating models are only designed to be temporary when we all know that regulatory change is a continuous permanent.
Why the one-off approach keeps failing
Each time a bank isolates a new regulation as a standalone project, it ends up paying the same tax multiple times. First, the direct cost of hiring contractors and training staff on rules that will be outdated and long forgotten within a few years. Secondly in the opportunity cost of never building anything reusable, leaving businesses with no option but to start from scratch the next time a regulatory shift starts.
A third cost is also added that can be difficult to put an exact number on. Every time a temporary team is removed, their expertise and context they built up goes with them. Nobody in the business has the knowledge of how prior regulatory changes had been handled. With no context into what worked well or why certain decisions were made, new teams are left to start from the bottom and dedicate their time to learn and onboard.
And this is exactly how compliance functions end up absorbing more than 13% of operating costs without ever feeling like they’re keeping pace. The spend ends up buying multiple short-term solutions instead of one resilient model.
Treating regulatory change as infrastructure
Some may question the feasibility of creating permanent capability for these regulatory changes, given the frequency and volume in recent years. After all they have ones for payments and credit risks.
In practice, that means building a solid, reusable framework that can identify which products and processes are affected by each change, translate the requirements into business rules, and route the exceptions that don’t fit neatly into those rules to the right human expert. This also means legal and operations teams should be coordinated around a shared process, making sure that a clear and complete audit trail is made as these rules continue to evolve.
To be clear, none of this is about removing people from the process. It’s about giving them a structure that does not need to be rebuilt from scratch every time the FCA publishes a new policy statement.
What this looks like in practice
We saw this in practice when a European bank faced the FCA’s regulatory deadline with over 10,000 legacy contracts that needed to be updated. The bank had initially prepared to bring in a small army of paralegals to work tirelessly until each contract had been manually updated before the deadline.
Instead, a framework was built around the above principles with the aim to minimise costs and time as much as possible. The affected contracts were identified, and new reference rate requirements were translated into rules that could be applied consistently. Cases that systems deemed complex were also redirected to the correct human team. This resulted in a 65% cost saving and a 96% accuracy rate on the contracts without the extra headcount that had originally been budgeted.
What really made a difference here was the decision to build something that could easily perform under intense regulatory scrutiny and adapt as the requirements were clarified and changed.
Building the muscle, not the project
Realistically, the same underlying framework that connects data to business rules, workflows and approvals, applies to almost any regulatory change that a bank will face. AML requirements may evolve, sanctions lists will consistently get updated, and Consumer Duty obligations will continually get refined over time. With every change, it becomes increasingly clear that creating one operating capability that new requirements can be plugged into is the way forward. Time should no longer be wasted having to keep building one-off capabilities.
But this is a harder case to make internally than it sounds. Building reusable infrastructure requires upfront investment and a willingness to think beyond the current deadline, at a point when most compliance teams are already stretched thin just meeting it. However, banks that make that investment stop treating every regulatory change as business disruption, and can continue operations, business as usual.
The cost of standing still
We all know by now that the pace of regulatory change is not slowing down. Banks and financial institutions that keep responding to each shift with temporary teams and manual workarounds will stay in the vicious cycle of paying the same costs, both monetarily and in stretched compliance functions.
The £33.9 billion figure is a testament to show how much banks are willing to lose for the sake of initial ease. Breaking the cycle does not require a strong headcount to tackle each issue as it arises, all it requires is a willingness to invest time upfront, so that the next regulatory change doesn’t mean starting from scratch again.
