Beyond the Obvious

There is an old saying that bureaucracy expands to consume the time available for its administration. Increasingly that feels less like satire and more like a business model.

No sensible executive disputes the need for Know Your Customer (KYC) or Anti-Money Laundering (AML) checks and or controls. They are essential safeguards against fraud, organised crime and financial abuse. The question is not whether organisations should comply but whether they have remembered why those rules exist in the first place.

Across industries there is a growing tendency to confuse risk management with document collection. Every additional form, every extra proof of address, every unnecessary identity check is treated as evidence of diligence. In reality, it is often evidence of something quite different, an organisation transferring its own decision making responsibility onto the customer.

Let me illustrate the problem with an example. A reputable UK accounting firm engaged to value a group of long established UK private companies requested 12 months of address history and insisted that the client’s current residential address be in the UK, despite the engagement relating solely to UK owned businesses. The quantity and restrictive nature of the address evidence requested appeared to exceed any clear legislative requirement, with no transparent risk based justification provided. Instead, the demands seemed to arise primarily from the policies of a third-party electronic identity verification provider, presented as necessary to satisfy Institute of Chartered Accountants (ICA) requirements, neither condition appears to be a universal requirement imposed by ICAS, with little apparent consideration given to proportionality or the data minimisation principles that underpin both KYC/AML and data protection legislation, a client relationship was dismissed.

This is becoming an increasingly familiar pattern that extends beyond this simple compliance scope example. Third party compliance platforms develop standardised rule sets designed to accommodate thousands of customers across multiple jurisdictions. Those rules then become embedded within organisations as though they were statutory obligations. Internal legal and compliance teams, understandably cautious about regulatory criticism, frequently reinforce the process rather than questioning whether the controls are actually proportionate or even required in the circumstances. Somewhere along the way, judgement quietly leaves the room as organisations fall victim to compliance capture, where the software vendor’s workflow had become more authoritative than the legislation itself.

The legislation generally requires firms to understand their customers, assess risk and apply proportionate due diligence. It rarely dictates a single rigid process for every client. Professional judgement remains not only permissible but expected. Yet many organisations behave as though compliance software has replaced professional responsibility, think of this as swapping software for statute!

The irony is striking. Businesses invest heavily in experienced lawyers, accountants, compliance professionals and risk specialists, only to defer critical decisions to a workflow configured by a software vendor. This has wider consequences than customer frustration. Management time is diverted into resolving administrative disputes rather than creating value. Commercial relationships begin with unnecessary friction instead of trust. Customers increasingly view regulated firms not as trusted advisers but as administrative gatekeepers. Meanwhile genuinely sophisticated criminals simply become better at satisfying the paperwork. The result is compliance theatre, activity that demonstrates process without necessarily improving outcomes. Executives should be qualifying what is mandatory compliance and what is elective and pushing back, if they will not they should be prepared for the consequences of their clients doing so. A good starting point would be to ask themselves three simple questions.

• Is every piece of information we request explicitly required by law or merely by policy?
• Have we delegated judgement to a third-party platform/software/workflow rather than empowering our own professionals?
• Does each additional control measurably reduce risk or simply reduce our perceived regulatory anxiety?

Good governance has always been about proportionality. Effective regulation depends upon informed judgement not indiscriminate administration. The strongest criticism is not that the firm is undertaking KYC/AML checks, which may be entirely necessary. It is that they appear to be presenting a particular technology provider’s workflow as an ICAS mandated obligation without establishing that distinction or acting to minimum personal data collection principles.

Artificial intelligence (AI) will only amplify this challenge, just see how its blunt use has distorted recruitment processes. Automated onboarding, AI assisted due diligence and digital identity services will make it easier than ever to request more information from more people, more often adding complexity and ambiguity to what should be a relationship building exercise. Unless organisations consciously resist that temptation, they risk creating compliance systems that optimise for document collection rather than genuine risk understanding.

Perhaps the greatest incongruity is that many organisations now require customers to surrender far more personal information than the law appears to require because nobody inside the organisation feels sufficiently empowered to ask whether collecting it is either necessary or proportionate. One wonders how long it will be before frustrated customers begin making complaints or even reporting organisations to regulators such as the Information Commissioner’s Office (ICO), not for failing to protect personal data but for demanding excessive quantities of it without a clearly demonstrable lawful or proportionate basis. That would be a wonderfully modern twist, compliance departments finding themselves investigated for being too compliant.

Compliance was always intended to reduce risk not suspend judgement. Executives should ensure that the pursuit of regulatory assurance does not itself become the very source of unnecessary regulatory exposure and reminded their organisations and some of their technology suppliers, that the objective was always to know your customer, not simply to exhaust them.