Welcome to my latest blog series, where we’ll be exploring the compliance landscape, from Compliance 1.0 through 2.0 and into the current era of Compliance 3.0.
Over the next four installments, we'll dissect each stage of evolution, drawing insights from frontline compliance experts navigating the challenges of financial crime prevention and regulatory expectations. Together, we'll unravel why strategies effective yesterday fall short today. Our journey will include a step-by-step guide to constructing a Compliance 3.0 solution, considerations for building or buying your crime-fighting toolkit, and a compelling real-world example of how Griffin, an API-first UK Bank and full stack BaaS platform, partnered with Cable to spearhead Compliance 3.0.
During the era of Compliance 1.0, the landscape was dominated by physical branch-centric operations and characterized by manual compliance controls and testing.
I remember having a savings account at a local building society when I was a kid. Every time I wanted to deposit a check from my grandparents after Christmas, or to withdraw money to buy something, I had to take my little blue book, wait in line to meet a branch manager, and provide documentation to prove I was the account owner - it was a manual, slow and painful process. All financial crime checks were conducted on the spot, introducing inherent vulnerabilities to human errors during data entry and document verification. It would not have taken much for someone to steal my little blue book and do away with my savings.
Looking back, it's evident why this manual approach could lead to compliance gaps.
Fast forward to the early-2010s, when the advent of challenger banks and fintechs marked a pivotal shift in the consumer experience. We found ourselves in a technological transformation, where API integrations and automation were competitive advantages and customer experience was everything. Compliance 1.0 wasn’t designed for this new digital world, where the entire customer lifecycle was completed online or through a smartphone: everything from KYC of the onboarding process, to ongoing transaction monitoring and AML. It was time for a transformative change, leading us into Compliance 2.0 - a stage marked by the adoption of automated compliance controls.
In my 4.5 years as Head of Financial Crime at Monzo, operating in the era of Compliance 2.0, I witnessed the transformative power of automation in compliance control systems; digital identity verification and screening for onboarding decisions, and digital-first tools to identify ongoing fraud and AML.
However, my time there also revealed a crucial gap—yes we had automated compliance and financial crime controls, but we still had a manual approach to testing, understanding and evidencing effectiveness.
When I looked around for an automated effectiveness testing solution, there simply was not one. Every Compliance Officer I spoke to followed the same playbook:
The Compliance 2.0 world is like taking part in a Formula 1 race without any feedback from the car - imagine driving a Ferrari around a track with no onboard computer telling you the engine has a fault or the brakes have a problem or your tyre degradation is high. You are not aware of any impending risks. I am a huge F1 fan, but I would not want to get in a car like that.
So why are we running compliance like this, when there’s trillions of dollars, billions of customers, and significant reputational damage at stake?
Ramp Network, an FCA-registered crypto asset business, exemplifies the industry's challenges. Their compliance coverage was around 1%, managed through manual processes, spreadsheets, and ad hoc communications. Limited and sporadic manual testing meant comprehensive oversight was nearly impossible, leading to low confidence in compliance outcomes.
Just as Compliance 1.0 had to become Compliance 2.0, we now urgently need the next paradigm shift to Compliance 3.0.
My goal in introducing Compliance 3.0 is to provide a technological solution for automating compliance effectiveness testing. This empowers companies and compliance teams to test 100% of their controls in real-time, ensuring continuous confidence in their functionality. No longer should companies wait for audits or reviews to identify issues—now, they can catch and address them proactively.
Cable tackles the growing problem of meeting regulatory demands that have shifted from 'in place' to 'in action.' Compliance 2.0 is no longer sufficient, necessitating evolution. Take a look at our other blog posts to show why regulators are taking action now!
Compliance 3.0 is not just about having controls in place; it's about actively proving their effectiveness in real-time. The journey from Compliance 1.0 to 2.0 marked the digital evolution, and now, with Cable, Compliance 3.0 ushers in a new era of digital evolution that brings with it automated testing and proactive risk management. We now have the tools to move:
Here is a useful table to visualize and understand the distinctions and benefits through the compliance evolution:
In the next blog I will unpack real-insights from a recent webinar we hosted ‘Adapting to a New Era: Architecting a Modern FinCrime Tech’ (You can watch now for a sneak peak about what I will cover in the next blog), to help you build the ultimate Compliance 3.0 compliance effectiveness testing solution.
.jpg)
Why Banks and Fintechs Need Good Compliance Programs: Understanding Consent Orders and Their Impact
Will AI + Automated Testing Eliminate the Third Line of Defense?
Navigating Compliance and Regulatory Trends in Banking as a Service: Key Insights from Natasha Vernier and Konrad AltWelcome to my latest blog series, where we’ll be exploring the compliance landscape, from Compliance 1.0 through 2.0 and into the current era of Compliance 3.0.
Over the next four installments, we'll dissect each stage of evolution, drawing insights from frontline compliance experts navigating the challenges of financial crime prevention and regulatory expectations. Together, we'll unravel why strategies effective yesterday fall short today. Our journey will include a step-by-step guide to constructing a Compliance 3.0 solution, considerations for building or buying your crime-fighting toolkit, and a compelling real-world example of how Griffin, an API-first UK Bank and full stack BaaS platform, partnered with Cable to spearhead Compliance 3.0.
During the era of Compliance 1.0, the landscape was dominated by physical branch-centric operations and characterized by manual compliance controls and testing.
I remember having a savings account at a local building society when I was a kid. Every time I wanted to deposit a check from my grandparents after Christmas, or to withdraw money to buy something, I had to take my little blue book, wait in line to meet a branch manager, and provide documentation to prove I was the account owner - it was a manual, slow and painful process. All financial crime checks were conducted on the spot, introducing inherent vulnerabilities to human errors during data entry and document verification. It would not have taken much for someone to steal my little blue book and do away with my savings.
Looking back, it's evident why this manual approach could lead to compliance gaps.
Fast forward to the early-2010s, when the advent of challenger banks and fintechs marked a pivotal shift in the consumer experience. We found ourselves in a technological transformation, where API integrations and automation were competitive advantages and customer experience was everything. Compliance 1.0 wasn’t designed for this new digital world, where the entire customer lifecycle was completed online or through a smartphone: everything from KYC of the onboarding process, to ongoing transaction monitoring and AML. It was time for a transformative change, leading us into Compliance 2.0 - a stage marked by the adoption of automated compliance controls.
In my 4.5 years as Head of Financial Crime at Monzo, operating in the era of Compliance 2.0, I witnessed the transformative power of automation in compliance control systems; digital identity verification and screening for onboarding decisions, and digital-first tools to identify ongoing fraud and AML.
However, my time there also revealed a crucial gap—yes we had automated compliance and financial crime controls, but we still had a manual approach to testing, understanding and evidencing effectiveness.
When I looked around for an automated effectiveness testing solution, there simply was not one. Every Compliance Officer I spoke to followed the same playbook:
The Compliance 2.0 world is like taking part in a Formula 1 race without any feedback from the car - imagine driving a Ferrari around a track with no onboard computer telling you the engine has a fault or the brakes have a problem or your tyre degradation is high. You are not aware of any impending risks. I am a huge F1 fan, but I would not want to get in a car like that.
So why are we running compliance like this, when there’s trillions of dollars, billions of customers, and significant reputational damage at stake?
Ramp Network, an FCA-registered crypto asset business, exemplifies the industry's challenges. Their compliance coverage was around 1%, managed through manual processes, spreadsheets, and ad hoc communications. Limited and sporadic manual testing meant comprehensive oversight was nearly impossible, leading to low confidence in compliance outcomes.
Just as Compliance 1.0 had to become Compliance 2.0, we now urgently need the next paradigm shift to Compliance 3.0.
My goal in introducing Compliance 3.0 is to provide a technological solution for automating compliance effectiveness testing. This empowers companies and compliance teams to test 100% of their controls in real-time, ensuring continuous confidence in their functionality. No longer should companies wait for audits or reviews to identify issues—now, they can catch and address them proactively.
Cable tackles the growing problem of meeting regulatory demands that have shifted from 'in place' to 'in action.' Compliance 2.0 is no longer sufficient, necessitating evolution. Take a look at our other blog posts to show why regulators are taking action now!
Compliance 3.0 is not just about having controls in place; it's about actively proving their effectiveness in real-time. The journey from Compliance 1.0 to 2.0 marked the digital evolution, and now, with Cable, Compliance 3.0 ushers in a new era of digital evolution that brings with it automated testing and proactive risk management. We now have the tools to move:
Here is a useful table to visualize and understand the distinctions and benefits through the compliance evolution:
In the next blog I will unpack real-insights from a recent webinar we hosted ‘Adapting to a New Era: Architecting a Modern FinCrime Tech’ (You can watch now for a sneak peak about what I will cover in the next blog), to help you build the ultimate Compliance 3.0 compliance effectiveness testing solution.
