When Compliance is Just Theatre
A familiar fairytale told through the lens of AML
Everyone in the room could see the emperor had nothing on. Nobody said so. Sound familiar?
There is a moment most compliance professionals will recognise. You are sitting in a room. A policy is being presented. The slide deck is immaculate. The framework has a name. The boxes have been ticked. And somewhere in the back of the room, quietly, someone is thinking: this does not actually work.
Nobody says so.
The emperor walks on.
Two swindlers arrived in town claiming to weave the finest cloth imaginable. Cloth invisible to anyone who was incompetent or unfit for their position. The emperor commissioned a suit. His advisers inspected the loom. They saw nothing. But they said nothing.
The story is usually read as a tale about vanity. It is actually a story about institutional silence. About the cost of nobody being willing to say the thing that is obviously true.
In AML, we call this compliance theatre.
What compliance theatre looks like
Compliance theatre is not the absence of compliance. It is compliance that performs rather than protects. It has all the right costumes.
The firm-wide risk assessment required by Regulation 18 MLR 2017 has been produced.
The policies and procedures under Regulation 19 are documented.
Training under Regulation 24 has been completed and recorded.
The independent audit required by Regulation 21 has been commissioned and filed.
Suspicious activity reports have been submitted to the NCA in sufficient numbers to demonstrate activity under section 330 POCA 2002 - without necessarily demonstrating thought.
The swindlers in the story were skilled. They produced something that looked, to every observer invested in not seeing the problem, exactly like a suit. It had structure. It had process. It satisfied the people who needed to sign off. The emperor was able to walk through the streets confident that the framework was in place.
Until a child said: 'He has nothing on.'
The child had no position to protect. No performance review to worry about. No relationship with the swindlers to preserve. The child just said what was true.
In compliance, the 'child' in this Dark Tale, is a whistleblower, an external reviewer, or a regulator. Occasionally it is a junior member of staff who has not yet learned that you do not say that in this room.
Why it happens
Nobody sets out to build compliance theatre. But institutional pressure is powerful. When an organisation needs to demonstrate compliance, the metric often becomes the demonstration itself rather than the underlying effectiveness. The SAR volume. The Regulation 24 training completion rate. The Regulation 21 audit score. The customer due diligence checklist completed under Regulation 28.
And when those metrics are what is being rewarded, and when raising concerns about the underlying reality carries a professional cost, the incentive is clear. Say nothing. The emperor looks magnificent.
The swindlers understood this perfectly. They did not rely on deception alone. They relied on the fact that everyone around the emperor had something to lose by being the person who pointed out the obvious. The cloth was not invisible to the foolish. It was invisible to everyone. But only the 'foolish' would admit it.
The AML question this raises
How much of what your organisation calls compliance is actually protective? And how easy is it, honestly, for someone in your organisation to say so if the answer is: not enough?
The three lines of defence model exists precisely because the emperor cannot audit his own suit. Regulation 21 MLR 2017 requires that the audit function be independent for exactly this reason. But a second line that does not want to challenge the first, and a third line that reports to a board that commissioned the cloth in the first place, can produce a very convincing performance of oversight without any of its substance.
The child in the story was not wrong. The child was just unprotected by the usual incentives to stay quiet.
Effective compliance culture is not the one where everyone agrees the emperor is dressed. It is the one where it is safe to say he is not.
A closing thought
The swindlers were never caught in the original story. The emperor processed his embarrassment. The procession continued. Life went on.
In financial crime, the story rarely ends so gently. The cost of compliance theatre is not embarrassment. It is the money that moves under sections 327 to 329 POCA 2002, the harm that follows, and the institution left explaining to their regulator, or the NCA, why nobody said anything.
There was a 'child' in the crowd the whole time.
The question is whether anyone was listening.
Need support?
At Alexander Christian, we provide independent AML services to small London law firms. But to tell you honestly what we find, including the difficult things.
AML File Review
An independent review of how AML obligations are actually being applied on your files - client risk assessments, matter risk assessments, CDD, and source of funds.
The gap between policy and practice, examined honestly.
Regulation 21 Independent Audit
A formal, documented assessment of your entire AML framework, fulfilling the statutory independent audit obligation under Regulation 21(1)(c) MLR 2017, with findings, recommendations, and follow-up monitoring.
The first step is a confidential scoping session. Fixed fee. No obligation to proceed. You will leave knowing exactly what an engagement would involve, what it would cost, and whether it is the right starting point for where your firm is now.
Mondays and Tuesdays by pre-arranged appointment only.
The content of this article is provided for information purposes only and does not constitute legal advice. Please read our full disclaimer.
