Ask any regulated entity about its compliance and you'll get the same answer every time: yes, we're compliant. Ask again in six months and you'll probably hear the same thing. But ask a sharper question, what is your compliance quotient right now, today, and the confidence tends to disappear.
I've asked myself that question more times than I can count, first as a banker, later as Group CEO of a bank in Tanzania, and now as chair of risk and audit committees. The gap between those two answers is worth sitting with, because it explains almost every major compliance failure I've seen in 37 years of banking.
The Problem Isn't Non-Compliance. It's Proof.
The large banks getting penalized by regulators, in India and in the more mature Western markets, are not run by careless people. They are complied. What they struggle to do is demonstrate that they remain complied, continuously, as the ground shifts under them.
Last year alone, over 100 cooperative banks were wound up for non-compliance. Not because nobody in those institutions understood the rules. Because nobody had a system that could tell them, in real time, where the organization actually stood against its obligations.
Compliance Teams Are Drowning in Disconnected Tools
I've walked into enough compliance departments to recognize the pattern instantly. A KYC solution here, an AML tool there, an information security platform somewhere else, a PCI-DSS tracker bolted on for payments. Each one does its job in isolation. None of them talk to each other.
The result is a compliance function that is always reacting. Teams scramble to pull together evidence whenever an examiner shows up, a board meeting looms, or an auditor asks a question they should have had a ready answer to. Try and get time with any compliance team on a given week and you'll likely hear the same excuse: busy preparing for an exam, busy responding to the last one.
This fragmentation is the real risk, more than any single missed obligation. When your KYC status, your AML posture, and your cyber controls live in three separate systems that were never designed to speak to one another, nobody in the organization, not even the CEO, can answer a simple question with any real confidence. I asked myself that same question every year as Group CEO. The honest answer was that I didn't fully know.
What Regulators Actually Want
There's a subtlety here that gets lost. Regulators rarely write rules in the form of a checklist. What they publish is intent, a signal about how they expect the institution to behave and where they expect it to stay within bounds. Interpreting that intent is left to the regulated entity, and interpretation is inherently subjective. Ten compliance officers reading the same circular will produce ten slightly different readings of what it requires.
That interpretive gap, between what the regulator meant and what the organization understood, is where most of the friction lives. In my experience, the regulator isn't looking for perfection on day one. They're looking for two things above almost everything else: that you maintain adequate regulatory capital, and that you operate within the boundary they've defined for your license. Everything downstream of that, KYC, AML, cyber, data protection, exists to demonstrate that you're staying inside that boundary, consistently, over time.
From Checkbox to Confidence Score
This is the shift that matters to me, and it's the reason I built Finnulate the way I did. A checklist tells you whether a box was ticked once. It says nothing about whether the organization will still be compliant next quarter, next year, or after the next regulatory update lands.
A health score works differently. It gives you a real-time read on compliance status at every level, by circular, by department, by individual, by the entire enterprise, and pairs it with a confidence measure that tells leadership how much they can trust that score. That distinction, between being compliant and being confidently, demonstrably, continuously compliant, is the entire difference between a tracking tool and a compliance operating system.
When that kind of visibility reaches the boardroom, the conversation changes. Directors stop asking "are we compliant" and start asking the more useful question: where exactly are we falling short, is it a skills gap, a staffing gap, a technology gap, and what do we need to close it. That's the conversation regulators want to see happening. It's also the conversation that keeps an institution off the list of the next 100 banks wound up for non-compliance.
Dinesh Arora is the Founder of Finnulate AI and has spent nearly four decades in banking, including as Group CEO of a leading East African banking group and as a Board Advisor and Risk Committee Chair for banking subsidiaries in the region.