In many organisations, compliance occupies a strange position. It is respected in principle and resented in practice. It appears in budget discussions as a line to be contained. It appears in project meetings as the department that says no.
I think this framing is not just unfair. I think it is commercially wrong.
The argument in one sentence
A financial institution’s licence to operate is its single most valuable asset, and compliance is the function that protects it. Everything else — the customers, the technology, the brand, the growth plan — is built on top of that licence. Underinvesting in the foundation to spend more on the building is not efficiency.
Where the real cost sits
When leaders describe compliance as expensive, they are usually describing something else: badly designed compliance.
Manual processes that could be automated. Duplicate data collection because systems do not talk. Reviews queued behind a single overloaded person. Rules applied uniformly to low-risk and high-risk cases alike, so that ordinary customers wait behind genuine exceptions.
That is not the cost of being compliant. That is the cost of being disorganised while compliant. The two get conflated, and the conclusion drawn is “compliance slows us down,” when the accurate conclusion is “our compliance operations need engineering attention.”
The advantage that accrues
Institutions that build this properly earn advantages that are difficult for competitors to replicate quickly:
Speed with confidence. A well-instrumented risk framework lets you approve the ordinary customer in seconds and reserve human review for the genuine exception. That is a better customer experience and a better control outcome.
Partnership access. Serious counterparties — banks, networks, technology partners — perform diligence before they work with you. A clean, well-documented control environment shortens those conversations from months to weeks. That is a growth advantage measured in real revenue.
Optionality. The institution with strong controls can enter new products and new markets when the opportunity appears. The one still fixing basics cannot move, because every expansion multiplies an existing weakness.
Resilience. Problems happen everywhere. The difference is whether you find them first, in a controlled way, or whether someone else finds them for you.
Making it work culturally
The practical shift is moving compliance from the end of the process to the beginning.
If the compliance team first sees a product two weeks before launch, they have only one available answer, and it will be a cautious one. If they are in the room at the design stage, the conversation changes completely — from “can we approve this” to “how do we build this so it works.”
That requires two things from leadership. First, compliance must have genuine standing, including the ability to escalate without career risk. Second, compliance leaders must be commercially fluent — able to articulate risk in terms of business consequence rather than rule citation.
Both sides have to move. Business teams stop treating controls as an obstacle course. Control teams stop treating the business as a source of problems.
The long view
There is no version of financial services where doing this badly ends well. The only real choice is whether you build the capability deliberately, on your own timeline, or reactively, on someone else’s.
I would rather choose the timeline.
Dr. Mohamed Mousa writes about financial services, technology, and leadership.