The Compliance Treadmill: Regulated Firms Deserve Better The Problem Across financial services, regulators have quietly closed the perimeter. There are eight core areas that matter in cybersecurity, and regulators now cover all eight. Not lightly, not vaguely, but comprehensively. Some areas are still evolving, but the gaps are gone. They have also discovered something new: they can collect information automatically and issue fines using algorithms. Once regulators learn they can enforce at scale, they do. Fines in financial services have been rising at around 12 percent a year. New cyber rules are landing on top of this trend. If your organisation is still operating on a firewall, antivirus and hope model, the next regulatory cycle will be painful. The regulatory volume itself is escalating: • • •
EU: 45 active initiatives US: 32 UK: 22
These numbers used to be far lower. In 2020 the EU had 12. The UK had 8. The US had 18. Growth has been fast and continuous.
Timelines are tightening too: