Why do financial institutions struggle to improve compliance outcomes without increasing operational cost?

Why This Matters for Security Teams

Financial institutions are under constant pressure to demonstrate stronger compliance outcomes without adding headcount or slowing the business. The problem is not simply too little effort. It is that many programmes still rely on manual review, repeated evidence collection, and disconnected control owners, which drives cost into administration rather than into better risk decisions. The NIST Cybersecurity Framework 2.0 is useful here because it frames outcomes, not just activities, which is the right lens for reducing waste.

In compliance-heavy environments, the cost curve rises when onboarding, screening, entitlement review, transaction monitoring, and audit response operate as separate workstreams. Each team may be doing something defensible, but the institution still pays multiple times for the same underlying assurance problem. That is especially visible in AML and fraud-adjacent processes, where poor data quality or duplicate checks create more cases, not better decisions. The core challenge is governance: controls need to be tied to specific risk outcomes so that exceptions, not routine cases, consume the most attention. In practice, many security teams encounter this only after audit findings and analyst burnout have already exposed the inefficiency.

How It Works in Practice

Improving compliance economics requires consolidating control intent across the lifecycle, then automating the low-risk paths while preserving human review for higher-risk exceptions. A useful starting point is to map obligations to a shared control model, such as NIST SP 800-53 Rev 5 Security and Privacy Controls, and then align evidence collection to the few signals that actually change risk decisions. That typically means fewer duplicate attestations, fewer one-off spreadsheets, and stronger linkage between identity, access, and transaction data.

Operationally, institutions tend to get better results when they separate three layers:

• Policy and obligation mapping, so the business knows which rules apply and where evidence must exist.
• Control execution, so onboarding, screening, access review, and monitoring draw from shared identity and case data.
• Exception handling, so analysts focus on anomalies that alter exposure rather than re-checking routine records.

Identity quality is often the hidden cost driver. If customer or workforce identity data is inconsistent, compliance tools generate false positives, duplicate cases, and manual remediation. For that reason, current guidance often places strong value on the assurance layer defined in the NIST SP 800-63 Digital Identity Guidelines, particularly where verification strength and identity proofing outcomes influence downstream KYC, access, or fraud decisions. Where institutions also operate under formal management systems, ISO/IEC 27001:2022 Information Security Management and ISO/IEC 27002:2022 Information Security Controls help anchor accountability, evidence, and continual improvement in a repeatable way.

These controls tend to break down when legacy core banking, outsourced operations, and inconsistent identity data prevent a shared view of who was screened, who approved what, and which control actually reduced risk.

Common Variations and Edge Cases

Tighter compliance often increases short-term process overhead, requiring institutions to balance stronger assurance against analyst capacity and customer friction. That tradeoff is real, especially where regulations require conservative review thresholds or where the cost of a false negative is materially higher than the cost of an extra review. Best practice is evolving toward risk-based orchestration rather than blanket automation, and there is no universal standard for this yet.

Different business models need different control designs. A retail bank with high-volume onboarding may prioritise automated identity checks and exception sampling, while a cross-border payments firm may need stronger sanction screening, beneficiary validation, and audit trails. In both cases, compliance gains come from reducing duplicate decisions, not from eliminating oversight. Financial crime contexts also benefit from alignment to the FATF Recommendations, because they connect customer due diligence and ongoing monitoring to risk-based obligations rather than pure checklist completion.

Where institutions are implementing shared service platforms, agentic automation, or third-party managed workflows, identity and privilege governance becomes part of the cost problem as well. If tools, operators, and automated agents all hold broad access, the organisation pays more to control the same process twice. The practical answer is not maximal automation, but controlled automation with clear approval boundaries, strong evidence retention, and periodic testing of whether each control still changes an outcome.

Related resources from NHI Mgmt Group

• When does NHI compliance become an operational security issue?
• How should security teams govern non-human identities for compliance?
• How should security teams govern non-human identities for SOC 2 compliance?
• Why do non-human identities create compliance risk even when policies exist?