Transformation by Mandate
Compliance, done perfectly, produces parity — and parity, by definition, differentiates no one.
Executive Summary
A quiet inversion has taken place in how large financial institutions decide what to change. A decade ago the transformation agenda was, at least in its aspiration, an expression of strategy — the markets a firm meant to enter, the customers it meant to serve better, the cost base it meant to reshape. Increasingly, that agenda is written not in the boardroom but in the supervisor’s consultation paper. Compliance has become the primary driver of transformation, and mandatory change is steadily crowding out the change an organisation would choose for itself.
This essay treats that shift as a structural phenomenon rather than a passing inconvenience. It argues that the drift toward compliance-led transformation is not a failure of individual leadership but the predictable output of a system in which the consequences of falling behind the regulator are immediate and personal, while the consequences of falling behind the market are diffuse and deferred. Given finite change capacity, that asymmetry does its work quietly and completely: the mandatory always wins the argument for the next pound of investment, because it is the only claimant that can threaten the licence to operate.
The cost is not that compliance work is wasteful — much of it is overdue. The cost is subtler. Transformation conscripted entirely by mandate optimises for what the examiner can see rather than what the customer can feel; it builds the controls that will be inspected rather than the capabilities that would compound; and, over several cycles, it lets the organisational muscle for chosen change quietly atrophy. A firm can be busier than it has ever been with transformation and less capable than ever of transforming itself.
The essay engages the strongest case for the compliance-led agenda — that regulation imposes a discipline institutions would never impose on themselves — and accepts much of it, before showing where it breaks. It closes on the tide now visibly rising as the credit crisis deepens: the regulatory response gathering through 2008 will, if the pattern of the last twenty years holds, be larger than the shock that provoked it, and the institutions that fare best will be those that learn to route mandatory work through the capabilities they would have wanted anyway — rather than treating each new rule as a fresh act of compliance to be survived and forgotten.
The Meeting Where the Roadmap Changes
The moment is familiar to anyone who has sat on a change board in the last few years. The transformation portfolio is up for its half-yearly review. On the wall is the roadmap that was agreed with such conviction eighteen months ago: the current-account proposition rebuilt around the customer rather than the product silo; the branch and telephone channels finally joined so a customer stops having to explain themselves twice; the tangle of legacy systems behind the mortgage business simplified at last.
Then the head of risk speaks, and the room’s centre of gravity shifts. There is the small matter of the new capital regime bedding in, and the data it demands that the firm cannot yet produce cleanly. There is the anti-money-laundering remediation the supervisor asked about pointedly at the last meeting. There is the markets directive that came into force in the autumn and whose reporting obligations are still being met by heroic manual effort every month. Each of these has a date attached, and behind each date stands the regulator.
By the end of the session the roadmap has been quietly rewritten. Nobody has voted against the customer. Nobody has stood up to argue that serving people better matters less than filing returns on time. The customer programme has simply been moved — for the third planning round running — into next year, where it will meet the same fate. The transformation that was chosen has given way, once again, to the transformation that was required.
I have watched this happen often enough to be confident it is not a story about weak leaders or timid boards. The people in that room are neither. It is a story about a structure, and structures are more durable than the people inside them. The purpose of this essay is to take that structure seriously — to ask why compliance has become the engine of transformation, what that does to the gap between what firms say they want from change and what change actually delivers, and whether anything can be done about it other than lament.
How Compliance Became the Driver
It is worth being precise about what has changed, because the claim is easy to overstate. Financial institutions have always been regulated, and prudent ones have always spent on controls. What is new is the share of the discretionary change budget — the “change the bank” money, as distinct from the “run the bank” cost of keeping the lights on — that is now spoken for before the strategy conversation even begins.
Consider a mid-sized retail and commercial bank of the kind common across the sector. Three planning cycles ago its change portfolio might have divided its investment roughly two ways: a little over half to growth, proposition and efficiency, a little under half to mandatory and regulatory work. By this year the ratio has inverted and then some. Something close to seventy pence in every discretionary pound now goes to change the firm did not choose — the new capital and reporting regime, the conduct and anti-money-laundering remediation, the markets rules, the drumbeat of thematic reviews. The strategic third that remains must cover everything the institution actually wants to become.
That is the arithmetic beneath the meeting described above, and it explains why the outcome is so reliable. When mandatory work consumes two-thirds of the available capacity, the contest for the final third is not a contest between good and bad ideas. It is a contest among the survivors of a prior triage that the strategy has never been allowed to see.
Several forces converged to produce this. The Basel II capital framework, now moving from theory into live operation, turned risk measurement from a specialist backwater into an enterprise data problem, and most institutions discovered that the data simply was not there in the form required. The markets directive that took effect last autumn extended obligations across trading, reporting and client classification that touched systems few had modernised in a decade. The long shadow of the corporate scandals earlier in the decade — and the controls legislation they produced on both sides of the Atlantic — had already normalised the idea that internal control was a board-level, personally-attested concern rather than an operational detail. And layered over all of it is the supervisory temperament of the moment: with a credit crisis unfolding, with the first run on a British bank in more than a century still fresh, and with a major American investment house rescued from collapse only this spring, no supervisor is inclined toward patience, and no board is inclined to test them.
The strategic third that remains is not what strategy asked for. It is what survived a triage the strategy was never allowed to see — the residue of capacity left after every claimant that could threaten the licence to operate had taken its share first.
The Structural Forces That Sustain It
If this were merely a bad season — an unlucky bunching of deadlines — it would correct itself. It does not correct itself, and that is the tell that we are looking at structure rather than weather. Four forces hold the pattern in place.
The first is the asymmetry of consequence. Fall behind the regulator and the consequence is immediate, visible and personal: a censure, a skilled-persons review, a capital add-on, a public finding, a named executive. Fall behind the market and the consequence is diffuse and deferred: a slow erosion of share that can be explained away for years and never lands on a single individual’s desk in a single quarter. A rational executive population, facing that asymmetry, will systematically over-invest in the visible near-term threat and under-invest in the invisible long-term one. No individual is behaving foolishly. The aggregate is nonetheless a portfolio bent out of shape.
The second is the hardness of the deadline. Mandatory change comes with a date that is not negotiable and not yours. Discretionary change comes with a date that is aspirational and entirely yours to move. When the two compete for the same scarce engineers, the same scarce change-capable managers, the same scarce weekends, the immovable object wins every time — not because it matters more but because it cannot be deferred and its rival can.
The third is the legibility of compliance to the board. A regulatory programme is wonderfully easy to govern: there is an external authority defining “done,” a deadline defining “when,” and a binary defining “success.” A customer transformation offers none of these comforts. Its definition of done is contested, its benefits are probabilistic and lag by years, and its success is a matter of judgement. Boards under pressure gravitate toward what they can hold cleanly in their hands, and compliance is eminently holdable.
The fourth is the funding mechanics. Mandatory work is increasingly ring-fenced — a protected line that cannot be raided — while discretionary work sits in the contestable pool that absorbs every overrun and every surprise. Ring-fencing the mandatory is prudent in isolation. Its systemic effect is to guarantee that when anything goes wrong anywhere in the portfolio, it is always the discretionary that pays.
- Consequence is asymmetric: regulatory failure is immediate and personal, market failure is diffuse and deferred.
- Deadlines are asymmetric: the mandatory date is fixed and external, the discretionary date is soft and internal.
- Legibility is asymmetric: compliance offers a clean definition of done that customer change never can.
- Funding is asymmetric: mandatory spend is ring-fenced, so every shock is absorbed by the discretionary pool.
Notice that none of these four is a mistake to be corrected by exhortation. Each is individually defensible. Told to “be more strategic,” the executives in our meeting would agree sincerely and then, next quarter, do exactly the same thing, because the structure that shaped their choice would be entirely unchanged. This is why speeches about balance achieve so little. You cannot lecture your way out of an incentive.
What Mandatory Change Cannot Buy
Suppose the compliance work is done well — on time, to standard, without drama. What has the institution actually bought?
It has bought permission. It has bought the continued right to operate, the absence of censure, the supervisor’s guarded nod. These are not small things; a firm that loses them loses everything else with them. But permission is a floor, not a destination. No customer ever chose a bank because its regulatory reporting was punctual. No competitive advantage was ever built on a control that every rival is equally obliged to hold. Compliance, done perfectly, produces parity — and parity, by definition, differentiates no one.
This is the heart of the intent-reality gap. When leaders describe what they want from transformation, they reach for the language of advantage: to be easier to deal with, faster, cheaper to run, more trusted, better at turning data into decisions. When transformation actually happens, it increasingly delivers the language of adequacy: compliant, remediated, attested, closed. The words do not match because the money did not go where the words pointed. An institution can run its transformation engine at full capacity for three years and emerge more compliant and no more competitive — busier than ever, and no closer to what it said it wanted to become.
There is a further, more insidious effect. Compliance-led transformation optimises for examinability. The measure of success is whether the control satisfies the reviewer, and so effort flows toward what the reviewer will see: the documented process, the evidenced approval, the reconcilable report. This is not the same as effort flowing toward what works. A control built to be examined and a capability built to perform look similar in a steering pack and behave very differently under load. Over time an organisation optimised for examinability accumulates an impressive apparatus of demonstrable control and a quietly hollowing core of actual capability — a distinction that tends to reveal itself, expensively, at precisely the moment of stress the controls were meant to guard against.
The Strongest Case for the Compliance-Led Agenda
It would be too easy to stop there, and dishonest. There is a serious argument on the other side, and it deserves to be put at its strongest rather than knocked down as a straw man.
The argument runs like this. Left to themselves, institutions do not build the unglamorous foundations — clean data, honest risk measurement, disciplined controls, a reconciled view of their own positions. These things win no customers and no bonuses, so they are perennially deferred in favour of the visible and the exciting. Regulation exists precisely to force the discipline that management, left to its own incentives, will always postpone. On this view the compliance-led agenda is not a distraction from good management; it is a substitute for the good management that was absent. And look, the argument continues, at what the current crisis has exposed: firms that could not value their own books, that had pushed risk off their balance sheets into vehicles they did not understand, that trusted a triple-A stamp in place of judgement. If ever there were proof that institutions cannot be trusted to impose discipline on themselves, it is unfolding in the markets this very spring. Much of what the coming regulation will demand — that you can measure your risk, aggregate your exposures, and see your own firm clearly — is exactly what a well-run institution should have built anyway.
I find this argument largely correct, and that is what makes it dangerous. It is correct that the foundations were neglected. It is correct that the crisis has exposed exactly the failures of self-discipline it describes. It is correct that a great deal of mandated work is genuinely worth doing. If the argument were wrong, the problem would be easy; we could simply resist the regulation. The difficulty is that the argument is right about the destination and wrong about the vehicle.
Here is where it breaks. Regulation forces the appearance of the discipline, defined by the regulator, evidenced to the regulator, on the regulator’s timetable — and appearance and substance diverge under exactly that pressure. A firm compelled to demonstrate that it can aggregate its exposures will build the aggregation the review requires; whether it builds the aggregation the business could actually use for decisions is a separate question the review does not ask. The discipline that regulation installs is real, but it is aimed at the supervisor’s objectives, and it stops precisely where the supervisor’s gaze stops. The well-run institution the argument invokes would indeed have built these foundations — but it would have built them for itself, shaped to its own decisions, and it is exactly that firm which the compliance-led agenda fails to produce. Mandate can compel the artefact. It cannot compel the ownership that turns an artefact into a capability. And without that ownership, each new rule lands as a fresh imposition to be survived, rather than an addition to something the firm is deliberately building.
“Mandate can compel the artefact. It cannot compel the ownership that turns an artefact into a capability.”
The Capability That Atrophies
The deepest cost of the compliance-led agenda is not visible in any single year. It shows up over cycles, and it is the slow atrophy of the organisation’s capacity for chosen change.
Consider what a run of mandatory-dominated portfolios does to the people who deliver change. The best change leaders, the ones who can hold ambiguity and shape a proposition and carry an organisation through a genuine reinvention, find themselves running remediation programmes instead — competent, necessary, and profoundly unlike the work that built their judgement. The reward structures follow the money, so the title that carries weight becomes Programme Director for Regulatory Change, and the customer transformation lead, if the role survives at all, becomes the junior partner in every conversation. Over a few years the institution’s definition of “good at change” quietly narrows to “good at delivering to an external deadline against a fixed specification.” That is a real skill. It is not the skill of transformation, and it is not recovered quickly when it is finally needed.
Meanwhile the organisation forgets how to make the harder kind of choice. Mandatory change requires no strategy, because the objective is given; it requires only delivery. An institution that has not had to decide what it wants to become, and back that decision with real money against real resistance, for several years running, loses the muscle for doing so. The machinery of prioritisation seizes. When at last a genuine strategic threat arrives — a new competitor, a shift in how customers want to be served, a structural change in economics — the firm reaches for a capability it has not exercised in years and finds it stiff.
A firm can be busier than it has ever been with transformation and less capable than ever of transforming itself. The engine runs at full capacity; it has simply forgotten how to be pointed anywhere but at the next deadline.
This is the quiet tragedy of the pattern. It is not that any individual programme is wrong. Each mandatory programme is defensible, often admirable. It is that the sum of a hundred individually-defensible mandatory programmes is an institution that has outsourced its change agenda to its supervisor and lost the habit of authorship. And an organisation that cannot author its own change is not, in any meaningful sense, in charge of its own future.
Holding Both
If the structure is as durable as I have claimed, then the honest conclusion is not that firms should simply “resist compliance and be more strategic.” That advice is useless because it ignores the incentives that make the pattern rational. The question worth asking is subtler: given that mandatory work will dominate the portfolio for the foreseeable future — and given that the crisis now unfolding will only deepen that dominance — how does an institution keep the mandatory from wholly consuming the strategic?
I do not offer a method here, because this is a reflection and not a manual, but three dispositions distinguish the firms that manage it from those that merely endure.
The first is to route mandatory work through strategic foundations rather than around them. The new capital regime demands better risk data; a firm can build the narrowest reporting solution that satisfies the letter of the requirement, or it can build the risk-data foundation it would have wanted anyway and satisfy the requirement as a by-product. The first is cheaper this year. The second is the only version that turns compliance spend into lasting capability. The discipline is to ask, of every mandated programme, what durable capability this obligation could be made to build — and to accept the near-term premium of building it properly.
The second is to protect a floor for the chosen, explicitly and structurally, rather than leaving discretionary change to fight for whatever the mandatory leaves behind. If the strategic portfolio is the residual, it will always be raided; the only remedy is to ring-fence a minimum for it with the same seriousness the mandatory enjoys, and to defend that floor precisely when it is most tempting to breach it. This is uncomfortable, because it means telling the risk committee that some strategic capacity is not available for the next remediation. That discomfort is the point; a floor that yields under pressure is not a floor.
The third is to govern the two differently. The clean, deadline-driven governance that suits compliance actively harms strategic change, which needs patience, tolerance of ambiguity, and judgement about probabilistic benefits. Institutions that run their whole portfolio through the compliance governance model — because it is tidy and the board likes it — slowly strangle the discretionary work by holding it to a standard of certainty it can never meet. The two kinds of change are different animals and need different keepers.
| Discretionary transformation | Mandatory transformation |
|---|---|
| Objective is chosen, and contested | Objective is given, and fixed |
| Benefits are probabilistic and lag by years | Benefits are the avoidance of a defined penalty |
| “Done” is a matter of judgement | “Done” is defined by an external authority |
| Deadline is soft and internal | Deadline is hard and external |
| Builds differentiation | Builds parity |
| Governance needs patience and judgement | Governance needs discipline and evidence |
The Tide Now Rising
I write in the spring of 2008, and it would be a strange essay on this subject that ignored the storm outside the window. The credit markets have seized; a British bank has been taken into public ownership; an American investment house has been rescued from failure; and the machinery of supervision, across every major jurisdiction, is stirring toward a response.
I do not know the shape that response will take, and anyone who claims to is guessing. But the pattern of the last twenty years is suggestive, and it points in one direction. After the operational-risk scandals of the mid-nineties came a wave of control reform. After the corporate-governance failures at the start of this decade came a wave of attestation and internal-control legislation whose cost the industry is still absorbing. Each regulatory wave arrived after the crisis that justified it, ran wider than the specific failure that provoked it, and settled into the permanent cost base long after the original alarm had faded. There is little reason to expect the response to this crisis — plainly the largest of the three — to break the pattern. If anything, the scale of what is now unfolding suggests a regulatory response larger than the shock itself, and one that will dominate the transformation portfolios of financial institutions for years rather than seasons.
That is not, in itself, cause for despair. Much of what is coming will be worth doing, and some of it is overdue. The danger is not the regulation. The danger is the reflex — the habit, hardened over successive waves, of meeting each new obligation as an isolated act of compliance to be survived and forgotten, rather than as material from which something durable might be built. An institution that meets the coming wave with that reflex will spend enormously and end the decade compliant, exhausted, and no more itself than when it began. An institution that meets it deliberately — routing the mandatory through the foundations it actually wants, protecting a floor for the change it actually chooses, and governing the two as the different things they are — may yet emerge from the storm both compliant and transformed.
The choice between those two futures will not be made in any single dramatic decision. It will be made, quietly and repeatedly, in rooms like the one this essay began in — in the small, reasonable, defensible moment when the roadmap is rewritten one more time and the customer is moved, once again, into next year. Whether that moment is a surrender or an act of authorship is, in the end, the only question about transformation that matters. Everything else is delivery.