I've sat on both sides of this problem. As Group CEO of a bank in Tanzania, I signed off on capital adequacy numbers and answered to regulators directly. Now, as chair of risk and audit committees at two banks, I watch other institutions wrestle with the exact same question I once asked myself. And as a founder building a company meant to solve this, I've had to get precise about what the actual problem is, because getting it wrong would mean building the wrong product.
Here's what I've concluded after 37 years in this industry: the headline is always "bank fined for non-compliance." The real story underneath is almost never that simple.
Every Fined Bank Was, in Some Sense, Compliant
Look at the pattern globally, not just in India. Cooperative banks getting penalized by central banks. Big brand names in the banking sector, the kind with entire floors dedicated to compliance, getting reprimanded by regulators. This isn't a regional problem or a small-institution problem. It happens in the more mature Western markets too.
If these institutions were genuinely, fundamentally non-compliant, they wouldn't have survived long enough to be fined. They would have collapsed under their own risk exposure years earlier. So the uncomfortable truth is that they were complied, at some point, in some fashion. What they couldn't do was prove they remained complied as circumstances, regulations, and interpretations shifted underneath them.
As a founder, this distinction changed everything about how I thought about the product. I wasn't building something to help banks become compliant. I was building something to help them stay demonstrably compliant, on a continuous basis, which is an entirely different engineering problem.
The Gap That Nobody Talks About
Regulators don't hand you a checklist. They issue circulars that express intent, a directional signal about how they want the institution to behave. They can't spell out every scenario in black and white, so they don't try. What they convey is the spirit of the requirement and trust the regulated entity to interpret it faithfully.
That's where the trouble starts. Ten people reading the same circular will produce ten different interpretations. When an examiner eventually walks in and says "you haven't done this the way we expected," the institution's honest response is usually "we thought it meant something else." That's not evasion. That's a genuine, structural disconnect between regulatory intent and organizational interpretation, and it happens everywhere, in every country, in every regulated sector I've looked at.
I learned this the hard way as a CEO, long before I thought about starting a company. I used to ask my own team, are we complied, and the candid answer was often that we didn't fully know. Not because we were negligent. Because there was no system connecting what the regulator expected to what we were actually doing on the ground.
What I Got Wrong Before I Got It Right
When I first came back to India after decades abroad, I made the mistake many first-time founders make. I rushed. I invested a substantial part of my own money into a reconciliation and business continuity solution before I'd properly understood the ecosystem I was stepping into. I wasn't acting like the banker I'd spent four decades becoming. I was acting like someone excited to be a participant in the startup world, and I paid for that excitement.
It took joining a fintech and blockchain cohort, building a real network, and slowing down before I understood the lingo and the landscape well enough to build something worth building. That early misstep taught me something I now treat as a founding principle: don't float a solution because the market expects one. Float a solution because you've actually diagnosed the problem.
Most compliance vendors, in my observation, skip that step. They build point solutions, a tool for KYC, a tool for AML, a tool for cyber, each competent on its own, but none of them designed to answer the one question that actually matters to a board: are we, as an enterprise, complying with our obligations right now, and can we prove it.
Building for Continuity, Not for a Moment in Time
This is why I think about compliance the way I do at Finnulate. It isn't a tracking tool, and it isn't a workflow product bolted together from templates. It's a philosophy that follows every obligation from the moment a regulation is issued to the moment compliance is proven, and keeps following it after that, because the moment you stop watching is the moment drift creeps in.
The banks that get fined aren't villains. They're institutions that lost sight of the gap between what the regulator intended and what they actually did, usually because no system was watching that gap for them. Closing it isn't about hiring more compliance staff or buying another point solution. It's about building the connective tissue that was missing the whole time, the layer that turns "we think we're compliant" into "here's the proof, updated as of this morning."
That's the problem I spent nearly four decades circling before I finally decided to build the solution myself.
Dinesh Arora is the Founder of Finnulate AI and has spent nearly four decades in banking, including as Group CEO of a leading East African banking group and as a Board Advisor and Risk Committee Chair for banking subsidiaries in the region.