Compliance by design: Automation and systems thinking
The following is a guest editorial courtesy of Eric Odotei, Group Head of Regulatory Reporting at Finalto.
Digitalisation often introduces new layers of complexity that require corresponding policies, controls, and workflows. This complexity is not merely operational; at its core, it is regulatory. European, UK and similar regulatory frameworks, like EMIR, MIFID II/MIFIR and ASIC just to name a few, place explicit demands on firms to manage, standardise and reconcile this ever-intricate data flows. Globally, regulators express the need for greater transparency, tighter controls and consistency across jurisdictions.
Hidden complexity
Counterintuitively, many of these complexities arise from the apparent simplicity of digital solutions. Processes become automated and the finished result appear instantaneous, while the underlying decision-making becomes less visible.
However, in terms of the MIFID II/MIFIR and surveillance obligations under the Market Abuse Regulations, firms are required to go beyond implementation and actually explain. All decisions, trade execution processes and even alert generation must be reconstructed to remove ambiguity. Ultimately arriving at the answer is not good enough, firms must provide a clear auditable account of how each outcome came to be.
Owning the decision
It follows that everyone using automated systems needs to understand, and be able to articulate, the logic by which decisions are made. Which inputs were considered and why, what rules were applied, and, ultimately, how the outputs are generated.
I am not saying that all employees need to be engineers or take correspondence courses in data science. Rather, decisions need to be explainable and traceable. When the regulator asks how a decision was made, you can’t just point to a black box and shrug. Firms need to consider the implications especially when considering regimes such as Consumer Duty in the UK, where the emphasis shifts from process alone to proof of outcome. Firms must go beyond the fact that a documented process was followed; they need to evidence that, in practice, those processes consistently lead to a fair and appropriate outcome for clients.
Algorithms in charge
In recent years, automation has been sold to firms on the basis that it frees up human capacity and reduces human error. But the AI revolution promises a paradigm shift, whereby algorithms are doing the deciding, rather than simply speeding up the rate at which human inputs become actionable outputs. This evolution brings with it a new depth of regulatory scrutiny. Under frameworks such as DORA, firms are expected to put in place meaningful governance over algorithmic systems. AI models must be validated with embedded operational resilience and clearly defined accountability for automated decision making.
Regulatory scrutiny
In fact, regulators across the world are paying closer attention to how AI is used. The expectation is not simply that firms adopt these technologies, but that they remain in control of them, maintaining clear oversight, ensuring decisions can be understood, and preventing automation from slipping into opacity.
But this, in turn, prompts a broader organisational question: do these technologies truly enhance outcomes, or are we caught in an unavoidable trade‑off between operational speed and increasing opacity? From a regulatory perspective, that trade-off would not be an acceptable option. Speed cannot come at the expense of accuracy, completeness, or timeliness. Faster systems, do not reduce risk, they are more likely to amplify the consequences of failure if not properly governed.
Regimes such as EMIR and MiFIR place clear emphasis on addressing errors in reporting, breaks in reconciliation, and gaps in surveillance. Left unchecked, these issues do not simply create operational inefficiencies, they can also lead to regulatory breaches, financial penalties, and lasting reputational damage
Foundational questions
Fortunately, this apparent trade off can be resolved. It all comes down to how these systems are designed. Specifically, whether principles of transparency and accountability are embedded from the beginning. As head of regulatory reporting, I’m naturally focused on ensuring that our outputs are transparent and our processes accountable. But the point is broader and applies across organisations.
This is where “compliance by design” becomes more than a concept. Requirements like EMIR reconciliation controls, MiFIR data lineage, and DORA resilience cannot be added later, they need to be built in from the start. That shift is important. Instead of treating compliance as an endpoint, it becomes a functional part of how the system works. Data lineage is defined early, control frameworks are embedded, and governance checkpoints create space to validate and refine. Exception management, when structured well, moves beyond a safety net and becomes a way to continuously improve. Compliance should not be an external constraint, but a functional part of the system to produce the desired outcome.
Transparency is a strategic advantage
Yes, the regulator demands accuracy and traceability, but any financial services firm needs precision and clarity throughout its operations. Whether you’re producing a report for a client, presenting to the board, or designing departmental strategy, you need reliable data and outputs that support better decision making. And while we’re now able to build new solutions at warp speed, that only heightens the need for purposeful design from the beginning.
Financial services providers need to ensure that innovation doesn’t outstrip the governance required to keep data, decisions, and workflows transparent. In that sense, regulatory reporting is more than a compliance exercise. It should be a core control function that underpins trust in the financial system. Operating across multiple jurisdictions, firms must navigate differing regulatory expectations while maintaining consistent standards of transparency, accuracy, and accountability.
It’s why Finalto’s BI and development teams are working so hard to embed best practice in data management, and why governance is now as central to our thinking as the technology itself. In a regulated environment, transparency should not be a feature of the system, but a core attribute is not the product itself.
All opinions, news, research, analysis, prices or other information is provided as general market commentary and not as investment advice and all potential results discussed are not guaranteed to be achieved. The information may have been derived from publicly available sources, company reports, personal research, or surveys. Past performance is not indicative of future performance. Trading carries risk of capital loss. Service available to professional clients only.
