The Programme That Was Only Ever Meant to Comply
A regulatory programme is the only kind of change an organisation reliably finishes; the question is never whether it will deliver, but what it will leave behind.
Executive Summary
Every regulatory programme begins with a framing decision, usually taken in the first fortnight and rarely revisited: is this a thing we must survive, or a thing we could build with? The answer is almost always the first, and almost always by default — nobody argues for it, it is simply assumed. This essay is a reflection on the cost of that default, taken not from a single programme but from the pattern that emerges when one has watched a good many of them, across a decade in which regulation has become the steady background weather of organisational life rather than the occasional storm.
The case I want to make is that the mandatory change programme is the most powerful transformation vehicle an organisation possesses, and the one it most reliably squanders. It arrives pre-funded, pre-sponsored, and licensed to reach across functions that would otherwise never share a plan — conditions a discretionary transformation would give a great deal to command. And yet the reflex to do the minimum, to comply and disband, throws that advantage away programme after programme, leaving the organisation to buy the same access, the same sponsorship, and the same disruption again the next time.
The minimalist case for doing exactly that deserves a fair hearing, and it gets one here, because it is not stupid. But the longer view — across many programmes rather than one — exposes what the single-programme view cannot: that the difference between extracting from a compliance programme and accreting through it is the difference between an organisation that ends a decade of regulation more tangled than it began and one that ends it materially stronger, having paid, in the end, roughly the same bill.
The meeting where the ambition is set
The most consequential moment in a regulatory programme is not the go-live and not the audit. It is a meeting near the beginning, often not recognised as consequential at all, in which the programme’s ambition is quietly fixed.
The obligation is on the table — a new directive, a revised capital regime, a reporting standard with a date. The room is deciding how to respond, and two framings are available. One says: scope this tightly, deliver exactly what the rule requires, touch as little as possible, and stand the programme down the moment we are compliant. The other says: we are about to be handed money, sponsorship, and permission to change things that badly need changing; what could we responsibly build while we are in here?
In my experience the first framing wins the room almost without a contest, and it wins for reasons that feel like prudence. The date is frightening. The penalty for missing it is real. Scope is the enemy of deadlines, and everyone in the room has been burned by a programme that grew ambitious and missed its date. So the ambition is set low, the programme is chartered as a compliance exercise, and the larger opportunity is not so much rejected as never seriously raised.
What makes this moment so easy to miss is that nothing appears to be lost. The programme will succeed on its own terms. It will hit the date, clear the audit, and disband to quiet satisfaction. The loss is invisible precisely because it is the loss of something that was never attempted.
The expensive decision in a regulatory programme is made in the first fortnight, by people who do not know they are making it, and it is almost never the decision to spend too much. It is the decision to attempt too little.
The vehicle an organisation would kill for
To see what is being declined, look honestly at what a regulatory programme is as a delivery vehicle, stripped of the grumbling that usually surrounds it.
Anyone who has tried to mobilise a discretionary transformation knows how much of the effort goes not into the work but into earning the right to do it — securing the funding, holding the sponsorship, and winning the cross-functional cooperation without which nothing enterprise-wide can move. A regulatory programme arrives with all three already granted:
- It is funded before it is justified. Mandatory spend does not queue behind the year’s other priorities; it is carved out ahead of them. The business case that a strategic programme must fight for across successive planning rounds is, for a compliance programme, a formality.
- Its sponsorship cannot be outranked. The board is attentive because the board is accountable. For once, the change agenda has a sponsor whom no revenue line and no rival initiative can quietly overrule.
- It holds a cross-functional writ that nothing else does. Risk, operations, technology, finance, and the front office will sit at one table and accept a shared plan because the regulator has made the matter everyone’s problem at once. That convening power is the rarest thing in a large organisation, and a compliance obligation confers it for free.
- It will actually finish. This is the quiet miracle. Discretionary programmes are cancelled, deferred, and de-scoped; regulatory programmes complete, because the alternative to completing is not an option anyone in the room can choose.
Set those four conditions down together and they describe the ideal circumstances for enterprise change — conditions a strategic transformation would give almost anything to command and almost never assembles. The regulatory programme assembles them as a matter of course. That is the opportunity. The tragedy is how routinely it is spent on the narrowest possible version of the task.
“A regulatory programme is the only kind of change an organisation reliably finishes; the question is never whether it will deliver, but what it will leave behind.”
The honest case for doing the minimum
It would be too easy to treat the minimalist framing as mere timidity. It is not, and the argument for it deserves to be put at its strongest, because any practitioner who has not felt its pull has not been close enough to a hard deadline.
The minimalist reasons as follows, and much of it is sound. Scope creep is the most reliable killer of programmes, and “transformation opportunity” is how scope creep introduces itself in polite company. Every strategic ambition loaded onto a compliance programme is another thing that can go wrong before a date that must not be missed, another dependency, another argument, another reason the auditor finds you short. The obligation is non-negotiable; the enhancement is discretionary; and mixing a non-negotiable outcome with discretionary ambition is how you put the non-negotiable one at risk. Better, says the minimalist, to comply cleanly and cheaply, protect the date absolutely, and pursue the strategic prize through a proper transformation with its own governance, where it can be weighed on its merits rather than smuggled in under a deadline.
This is not a weak argument. In a single programme, viewed in isolation, it is often the right one. If the choice is genuinely between a clean compliance delivery and a bloated hybrid that misses the date and fails the audit, the minimalist is correct and the ambitious framer is dangerous.
The difficulty is not that the argument is wrong within its frame. It is that the frame is too small. The minimalist case is airtight for one programme and quietly ruinous across many — and regulation, in this era, does not come one programme at a time.
The longer view: extraction versus accretion
Here is what the single-programme view cannot see and the longer view makes plain.
No regulated organisation faces one regulatory programme. It faces a decade-long procession of them — a capital regime, then a reporting standard, then a client-protection rule, then a market-conduct regime, each with its date, each mobilising, delivering, and disbanding. Watch that procession over years and two very different histories become possible from the same sequence of obligations.
In the first history — call it extraction — each programme is scoped tightly, complies, and stands down. Each builds the narrow thing its rule requires: a reporting extract here, a bolted-on control there, a point solution optimised for one obligation and blind to the next. Because each programme touches the same underlying systems in a different narrow way, the estate does not simplify; it silts up. The organisation arrives at the end of the decade having run a dozen successful programmes and owning a more tangled, more brittle, more expensive architecture than it started with — each increment defensible, the sum indefensible. And every new obligation costs more than the last, because it must be threaded through the accumulated mess the previous ones left behind.
In the second history — call it accretion — each programme still complies, still hits its date, still clears its audit. But each is asked, within the limits of its deadline, to build its mandated capability in the place the enterprise actually needs it. The reporting rule funds a reference-data service rather than an extract. The capital regime funds a data-quality foundation the next programme can reuse rather than rebuild. The conduct rule funds a customer-classification capability that three later obligations will lean on. Nothing heroic happens in any single programme; each simply leaves behind an asset rather than a liability. And over the decade those assets compound. The fifth programme is cheaper than the first, because it inherits foundations the earlier ones deliberately laid. The organisation ends the procession genuinely transformed, having paid, in total, not dramatically more than the extractive firm paid — and arguably less, once the cost of perpetually rebuilding is counted.
| Dimension | Extraction (minimum to comply) | Accretion (comply and build) |
|---|---|---|
| What each programme leaves | A point solution scoped to one rule | A reusable capability the estate needs |
| Effect on the architecture | Silts up; grows more tangled | Simplifies; foundations accumulate |
| Cost of the next obligation | Rises — threaded through old mess | Falls — inherits prior foundations |
| State after a decade | Many wins, worse estate | Compounded capability, materially stronger |
The two histories run the same programmes against the same obligations and arrive in different worlds. That divergence is invisible inside any single programme, where extraction always looks like the prudent choice. It is only the longer view — the decade rather than the deadline — that reveals extraction for what it is: a series of locally rational decisions that are collectively expensive, and a habit of buying the same sponsorship and access over and over because each programme insists on throwing them away at go-live.
What lets a programme become transformation
If accretion is the better history and yet extraction is the default, the practical question is what conditions tip a programme from one to the other. Across enough of them, a few factors separate the organisations that compound from those that merely comply.
- Someone owns the tail, not just the date. The default programme is governed entirely to the go-live; every incentive expires at the audit. Accretion requires a role — held by someone senior enough to matter — whose success is judged by what the enterprise still owns and reuses a year after the programme disbands. Without that accountability, the deadline optimises for itself and leaves nothing standing.
- The target architecture exists before the obligation does. Organisations that build capability out of compliance are the ones that had already decided where their reference data, their customer view, their control points should live. When the obligation lands, they do not invent a solution under time pressure; they fund a component of a design already drawn. The firms that improvise under the deadline build extracts; the firms with a standing blueprint build foundations.
- The marginal cost of “right place” is calculated, not assumed. The minimalist reflex assumes that building in the strategically correct place is expensive. Usually the expensive part — mobilising the programme, disturbing the systems, securing the mandate — has already been paid by the obligation itself, and the increment to do it properly is smaller than anyone guesses. But it must be calculated, obligation by obligation, or the assumption of cost wins by default every time.
- The portfolio is governed as one, not the programme as many. Extraction is what you get when each programme is chartered, run, and closed in isolation. Accretion needs someone looking across the whole procession — sequencing the obligations so that each leaves foundations the next can use, and refusing to let programme five rebuild what programme two should have made reusable. This is a portfolio discipline, not a programme one, and its absence is why so many organisations run excellent individual programmes and end up with a worse whole.
None of these is exotic, and that is rather the point. The barrier to turning compliance into transformation is not capability or even cost; it is framing and governance — the willingness to treat a mandatory programme as an asset-building opportunity rather than a threat to be survived, and to govern the procession of them as a portfolio rather than a queue of unrelated fires.
The longer view, in the end
Regulation is not going to relent. For a regulated organisation the coming years hold not a pause but a steadier drumbeat of obligation, and each new rule will arrive wearing the familiar costume of a threat — a date, a penalty, a reason to scope tightly and survive. Taken one at a time, each will make the minimalist’s case sound like wisdom.
The longer view asks for something harder than either resentment or resignation. It asks the organisation to see the procession whole, and to recognise that it is being handed, again and again, the best-funded and best-sponsored change vehicle it will ever have — and that the only real question is whether it will keep spending that vehicle on the narrowest possible cargo. The firms that understand this do not love regulation any more than anyone else does. They have simply stopped wasting it.
The programme that was only ever meant to comply will comply. It always does. What it leaves behind is not decided by the regulator, who is indifferent to the state of your architecture, but by the organisation itself — in that quiet meeting near the beginning, where the ambition is set and the longer view is either taken or, as usual, quietly declined.