Bank chief compliance officers need to adjust their risk tolerance

• Key insight: In a shifting regulatory environment, CCOs must move from a posture of constraint toward becoming entrepreneurial strategic leaders.
• Supporting data: Supporting data: Roughly 85% of banks report some level of AI deployment, and approximately half of U.S. risk and compliance leaders surveyed in 2025 indicated involvement in enterprise AI decision making.  But roughly 15% of the executives said they considered themselves to be at the leading edge of AI use.
• What's at stake: CCOs and compliance are losing resources just as banking risk is getting infinitely more complex. 

The role of the chief compliance officer and the compliance function itself are at an inflection point. For most of the past two decades, CCOs could count on higher budgets and more staff to help them wade through the 15-year tsunami of banking regulation that followed the 2008 global financial crisis. But since the beginning of 2025, the flood has subsided and global regulation is no longer in sync, with the United States reducing oversight, loosening rules, and lowering capital buffers while Europe is moving to standardize its rule mix.

With most compliance leaders reporting reduced or frozen compliance budgets and headcounts, CCOs and compliance are losing resources just as banking risk is getting infinitely more complex. 

Global regulatory fragmentation is only one of many strategic challenges facing CCOs and compliance. Banking must also wrestle with the adoption of artificial intelligence and the growth of digital assets, as well as intensifying competition from nontraditional players — all of which are introducing new potential hazards that are harder to detect, interpret and control.  

If anything, CCOs should be viewed as more vital than ever. Next-generation CCOs need to be entrepreneurial strategic leaders helping banks safely take advantage of the expansion of their new operating freedoms, as well as reconciling the increasing fragmentation of global regulation.

To do this, the role of CCO must move from a posture of constraint toward one of enablement — a fundamental shift from solely policing rules, minimizing risk, and operating at the periphery toward translating ambiguity, optimizing opportunity, and influencing core activities. This current regulatory easing provides a rare window of opportunity for CCOs to redefine their mandate and reposition compliance as an indispensable partner in shaping business strategy.  

As part of this reinvention, compliance must become a strategic function, with the CCO at the center, combining regulatory savvy with operational acumen to drive innovation, guide institutions through transformation, and preserve trust, integrity, and control. CCOs will also need to work smarter and with more tolerance for risk, reaching beyond the borders of compliance even as their resources are cut.

Reinvention of the role and function, the foundational dimensions of which still harken back to changes spurred by the financial meltdown two decades ago, is essential for an industry trying to digest so much change all at once. 

First, all global banks must contend with more fragmented regulatory frameworks across jurisdictions. This can force CCOs to retool controls to match the regulatory regime of a particular region, which can be costly and destabilizing. 

Next, the changing shape of the industry is forcing traditional banks to get ahead of heightened competition from digital-first players, including fintechs and big tech entrants. Specialized nonbank financial institutions are also raising customer expectations for speed, accessibility and personalization. In the U.S. alone in 2025, there were more than 30 filings from fintechs and other nontraditional applicants for de novo charters, bank acquisitions or conversions.

In addition, like other industries, banking is trying to navigate the new opportunities and risks posed by artificial intelligence as well as cryptocurrencies and other new technologies. Here again, the CCO can play a significant role in anticipating risk, as new AI-based tools are built for compliance and enterprise-wide and uses for stable coins and crypto are adopted. 

Read more:

• Bitcoin's Overton window of opportunity is closing
• Maybe Wells Fargo's unions need a blockchain
• Iran built its own financial system, and has created a cyberfront in the war
• Fed meetings are about to get really awkward

For most financial institutions, the adoption of AI began in targeted use cases where benefits were clear, improving accuracy and reducing noise in such areas as anti-money-laundering alerts, sanctions screening, and transaction monitoring. But recent data reinforces a mixed but accelerating trajectory. Roughly 85% of banks report some level of AI deployment, and approximately half of U.S. risk and compliance leaders surveyed in 2025 indicated involvement in enterprise AI decision making.  

Yet, despite the proliferation, only about 15% of the executives said they considered themselves to be at the leading edge of AI use, highlighting a significant gap between experimentation and true transformation. These new endeavors will require CCOs to drop their traditional low tolerance for risk and adopt a more entrepreneurial mindset — just one with guardrails. 

Ultimately, CCOs need a new blueprint for how their role should evolve and function to become a true strategic partner for the C-suite. We have identified five new postures that will help create a next-generation CCO.

First, CCOs must move from being rule-followers to becoming regulatory navigators, guiding companies through an increasingly fragmented, unpredictable and litigious regulatory landscape. Design and navigation of legal entity structures and regulatory dynamics are important strategic levers that CCOs are best suited to pull.

Second, the new and improved CCO and compliance department must act as partners to other key executives, helping to develop banking's growth agenda. This will force them out of their former low-tolerance risk posture to become enablers of innovation, finding ways to make sure new programs and new products will be compliant without slowing them down.

A third step in the CCO evolution is connected to this new posture on innovation: Forward-looking CCOs must take a leading role in both AI adoption and governance, recognizing not only the scale of opportunity, but also the magnitude of the risks. AI is also likely to force changes in compliance, reinforcing the need for proactive CCOs. 

Step four involves the reality of shrinking budgets and headcounts. CCOs must fundamentally rewire the compliance engine, making it more efficient, adaptable and innovation driven If they are to become more strategic. 

Appropriately, the final step in our blueprint involves CCOs not losing sight of compliance fundamentals and reinforcing them even as they expand beyond a narrower perception of their function. At the end of the day, it will always be up to CCOs to build and maintain resilient cultures committed to compliance.  

While some CCOs may be uncomfortable with this new identity, the forces reshaping banking today demand a compliance function that is more forward-looking. Those CCOs that hesitate to move toward a more strategic role now, during the current regulatory easing, may find the reinvention harder to accomplish in a more aggressive regulatory environment.