The relationship between financial services firms and their regulators has always been shaped by data, but for decades data was treated as something that firms produced when needed: periodic reports, annual returns etc. As regulators expect firms to demonstrate continuous, evidenced control over the quality, lineage, and consistency of their data, that era is ending.
Data-native regulators incoming
The Financial Conduct Authority’s (FCA) evolving position on data is the clearest signal of where global financial regulation is heading. The FCA has made clear its ambition to become a data led regulator and has already started investing in advanced analytics capabilities, real-time data collection infrastructure, and a supervisory model that goes well beyond the review of static submissions.
Data quality, lineage, timeliness, and consistency are no longer operational concerns to be managed quietly within a firm’s back office; they are becoming supervisory issues, the kind that attract regulatory scrutiny, formal findings, and reputational consequences. When a regulator asks a firm to demonstrate why a particular transaction was flagged, or how a risk metric was calculated seven months ago, the answer must be prompt, auditable, and defensible.
In line with the FCA, movements are visible across the European Banking Authority, the SEC, and FINMA.
Why many firms can’t operationalise this
The uncomfortable reality is that most financial services firms are not structured to meet the demands of a data-focused regulator.
- Data ownership fragmentation - Across most large institutions, no single function owns data from end-to-end. Finance, Risk, Compliance, and Operations each maintain their own data silos, often with different systems, update frequency and governance standards. The result is that a single regulatory question can require a firm to reconcile multiple different data sources before being able to provide a regulator with an answer.
- Inconsistent definitions - Are the ‘customers’ in your AML system the same as the ‘customers’ in your regulatory reporting platform? Across most firms, definitions such as these are subtly different. This often becomes apparent only once a regulatory review begins.
- Manual reconciliation and ‘spreadsheet control theatre’ - Spreadsheets are still used as a method of control across compliance functions. These provide the appearance of oversight, however they run the risk of breaking under volume, create version control risks, and produce no auditable trail that a regulator can inspect.
- Weak lineage means slow response and higher cost of change - When a firm cannot trace a data product back to its source through every transformation, update, and justification, they cannot respond quickly to regulatory questions. In addition, they cannot predict the impact of changing a definition or a rule. Every regulatory change therefore becomes a forensic exercise.
Each of these examples in turn may seem manageable. However, together they introduce significant risk: firms spend more time, money, and effort on compliance than they should, while still being unable to provide the continuous, evidenced assurance that regulators now expect.
Treat compliance data like a product
Firms that are getting ahead of this challenge share a common characteristic: they have stopped treating compliance data as a cost to be managed and started treating it as a product to be owned, governed and continuously improved. This has practical implications for how data is structured, who owns it, and how it flows through an organisation.
A useful framework for putting this framework into place rests on four pillars:
- Common definitions - Establishing agreements on what ‘customer’, ‘exposure’, and ‘suspicious activity’ mean and enforcing those definitions at source. Without this foundation, every downstream process is built on inconsistent understandings.
- Lineage & controls - Full audit trails from source to report, with reconciliations and exception handling built into the pipeline. If it’s not traceable, it’s not defensible.
- Automation of evidence - Controls should, as much as possible, operate continuously instead of periodically. Automated evidence generation removes reliance on manual explanations and creates an auditable record that can be produced on demand. This will adapt to the requirement regulators increasingly expect.
- Re-use layers - Once a data asset is trusted, it should serve multiple purposes. The same dataset that supports regulatory reporting can be utilised in fraud analytics, risk aggregation, and customer insight. This will in turn multiply the return on investment in data quality.
This is not a technology problem at its core. Many firms have invested heavily in platforms and tools, only to find that fragmentation persists because the underlying data ownership and governance model was never addressed. The product mindset is fundamentally about people and accountability: who owns each data domain, what service level they are expected to maintain, and how performance is measured.
The Payoff: Three Specific Business Outcomes
The business case for treating compliance data as a product is clear. Firms that have made this transition report three measurable outcomes that speak directly to both regulatory and commercial performance.
- Faster regulatory response at lower cost - When data lineage is clear and definitions are consistent, regulatory requests that previously took weeks can be answered in hours. The cost to comply drops drastically and the risk of an unsatisfactory response decreases.
- Better fraud and AML prioritisation - Cleaner, well governed data means fewer false positives and stronger performance in financial crime detection. Investigative resources are directed where they can have the most impact and are not consumed by inconsistent or poorly created data.
- Operational resilience metrics that reflect reality - Resilience metrics built on effectively governed and continuously maintained data provide an accurate picture of a firm’s risk position rather than a retrospective review. Boards and regulators can act on information they can trust.
In summary, the firms that will navigate the next phase of regulatory evolution most effectively are not necessarily those with the largest technology budgets. They are those that have made the deliberate choice to own their compliance data and to treat it with the same accuracy, governance and continuous investment that they apply to their profitable products.
In a world where regulators are becoming data-centric, this will no longer be a competitive advantage but rather a baseline expectation. The question for every firm’s leadership is straightforward: do you know where your compliance data comes from?
