The payments podcast
from Bottom Line.
Welcome to the payments podcast. I'm your host,
Bottom Line managing editor Owen McDonald.
Everquotable
JPMorgan
Chase CEO, Jamie Dimon, once said this,
good regulation should be conducive to business and
to customer protection.
Well said.
Given the growing regulatory burden on b two
b payments, we were captivated by a recent
piece of research
from PWC
called the Global Compliance Survey 2025.
It's a treasure trove of compliance sentiment data.
To give us an idea of how compliance
innovation can improve outcomes, we're very glad to
have with us Rob Stevenson,
director of risk at PWC.
Rob Stevenson, welcome to the payments podcast.
Hi, Owen. Thank you for having me.
We're glad you could be here, Rob. In
this episode, we're examining the growing regulatory compliance
burden.
PWC's
global compliance survey 2025
took the pulse of over 1,800 professionals in
six major verticals.
Rob, what did you learn about how regulatory
load or perhaps overload is impacting businesses?
In broad strokes, what are the very top
compliance trends you observed?
Yeah. I think,
broadly speaking, what we found during the survey
is that there's definitely an overwhelming sense that
the regulatory burden has intensified.
Compliance has become significantly more complicated across virtually
every sector that we spoke to.
And in fact, 85% of the respondents said
compliance requirements have grown more complex in just
the last three years, and that rises to
90% in financial services.
Based on the current geopolitical landscape as well,
I think this is gonna be a continuing
trend.
But what's interesting, Owen, is that it's not
just the volume of issues,
I e more rules that is causing the
real challenges. It's about the complexity and the
velocity of regulation at the moment.
It's also about the overlapping, sometimes conflicting regulations
coming
at organizations
faster than they can adapt. And that creates
real pressure on leadership's time, resourcing, and confidence
in decision making,
which can cripple an organization's strategic ambitions.
It also impacts the organizations
commercially,
slowing down digital transformation, delaying product launches, and
limiting expansions into new markets.
77%
of the responders said that they've already experienced
negative effects in five or more key business
growth areas.
But we are seeing, you know, some firms
that aren't standing still.
We're seeing a more forward thinking group emerge,
what we've called in our report as the
compliance pioneers.
They're using compliance not just to manage risk,
but to accelerate change, drive efficiency, and support
strategic aims.
They're embedding technology, centralizing functions, and treating compliance
as a capability, not just a control function,
and really moving compliance from the background to
the boardroom.
And that's a really important mind shift that
we're starting to see.
Cybersecurity
and data protection slash data privacy tied for
the number one compliance concern among respondents across
industries.
51%
of your sample called the two related functions,
key priorities.
Rob, are these the areas you see getting
the most attention in the near term? And
if so, why? And that's cybersecurity
and data protection slash data privacy.
Yeah. Absolutely.
I think it's because these risks are existential.
So
a cyber attack or a data breach today
doesn't just cause regulatory problems. It erodes trust,
derails operations, and can spark a chain reaction
with regulators, investors and the public.
And that priority came through very clearly in
the research and has done in much of
our research,
that PwC has conducted in the recent years.
Cybersecurity and data protection, as you say, were
named top priorities and over half of the
respondents,
claimed that.
They were number one across every sector except
energy, where environmental compliance edged slightly ahead, but
that's probably for obvious reasons.
And I think there's probably a few
things driving that response around cybersecurity
and, and data protection. First, the threat landscape
has evolved massively.
Cyberattacks are getting more and more sophisticated.
They're more targeted and can have much wider
reaching consequences,
of just financial but reputational as well.
Secondly, the regulatory bar has been raised. So
GDPR,
DORA,
or other data protection roles around the world,
companies are under serious pressure to get this
right. And it varies country by country, so
it's not a simple thing.
Thirdly, for me, it's still an unknown entity
that evolves at pace. And as as humans,
we're inherently worried about the unknown. So for
a lot of business leaders, the technical expertise
just just isn't there yet, and they're reliant
on a small population of, you know, experts
within their organisation who understand the risks. So
it always comes out top whether we're talking
to CEOs or compliance professionals.
And lastly, it's about trust. I think customers,
investors, regulators expect organizations
to treat their data responsibly
and protect it rigorously. So, yeah, I think
these areas are gonna get a lot of
attention,
today, but also going into the future, not
just as compliance issues, but also as strategic
imperatives.
You you preempted me
a moment ago. So I I liked that
stat about the 85%
across all vertical said compliance has become more
complex,
even higher for financial services at 90%.
And in the report, the complexity of cross
border payments was also called out specifically. So,
Rob, give us a glimpse of how PWC
is advising clients who want to avoid regulatory
fatigue,
especially as that relates to payments.
Yeah. Cross border payments has become a real
flashpoint, I think, for for the clients we
speak to.
And companies face layers of AML sanctions, tax,
and financial reporting obligations. And these, again, differ
widely country to country. So
that complexity is draining on resources, trying to
keep up to speed,
and, you know, frankly exhausting teams as they
do this. So again, it comes down to
applying technology to these kind of time and
resource burdensome activities.
It's a much smarter approach reducing the manual
effort and embedding compliance into processes.
So for example, you know, automating sanctions, screening,
integrating
regulatory alerts into workflows,
and using dashboards to monitor exposure in real
time.
So not only does that reduce the burden
and speed up the process,
it allows those resources to spend more time
on the more value add activities, so supporting
the commercial imperatives of the organization as well.
It's also true where we see organizations
centralizing compliance oversight.
So especially for global businesses,
improving that consistency,
enhancing the visibility,
and again reducing the the load of, on
the local teams to allow them to be
more business enabling is is becoming really important.
But, ultimately, it's about, I guess, reducing the
noise and helping organizations
move from
reactive firefighting to a more streamlined, coordinated,
proactive, I think is one of the key
words,
compliance model that supports rather than hinders commercial
agility.
So that kind of providing a breadth of
business insights that no other function really has
access to, and I think
compliance being at the center of that is
is what we talk about in the report.
And,
we talk about the strategic compliance officer really
coming to the fore.
One of the things I loved in the
report was this idea of winning through compliance
innovation.
How does PwC define compliance
innovation, Rob? What is that? I think compliance
innovation is really about transforming
compliance from that reactive
resource heavy
to something much more proactive, something on the
front foot that's efficient and really adds value
back into the organization.
It's, again, predominantly driven by technology, data, and
reimagining processes,
but it's also about the human ecosystem.
So be it the new skills required of
compliance teams such as data analysts, behavioral scientists,
storytelling,
but also the culture across the organization, that
kind of shared accountability for compliance and ethics.
So
if we take we talk about compliance by
design in the report as well. And if
we if we take that as a concept,
it's really about
instead of bolting compliance on at the end
of a process, you embed it at the
outset. So
teams engaging with compliance at the concept stage
of a new product rather than than at
the sign off stage.
Obviously saves time, reduces rework, builds quality and
governance into the process. So
what the report showed is that organizations
that are doing this well,
embedding compliance early and integrating tools, centralizing
data,
are really gaining agility in their operations. They're
able to spot risks much faster,
make quicker, better decisions, and accelerate transformation.
And that's the essence, I think, of compliance
innovation.
And the publication as we talk about is
it's about reinventing compliance to speed up, not
trip up.
Risk mitigation
ranked as the top three influencer of compliance
investment
behind being able to respond to regulatory
issues and regulatory changes at 4442%
respectively.
Rob, how does compliance innovation
lower risk in a volatile market?
It's a great question. I think it's it's
not just about lowering risk. It's it's probably
more about navigating risk as well. So through
that, the early detection, that that visibility and
an insight that you might have across the
organization
gives you that ability, I guess, to see
around corners. So with technology scanning,
AI highlighting red flags, and dashboards showing
risk trends and themes over time, this means
you can you can move much more from
that reacting to problems and into navigating them,
which obviously helps business maintain their momentum and
not be slowed down. So
this is, as we say, the only way
that companies can really stay ahead of the
risks associated
with all the regulatory
changes and issues
that we have now, that we've had in
the recent recent months, and that we will
continue to have that are disrupting the market.
Saving AI for last.
PwC found that 36%
of respondents are already piloting or using AI
for fraud detection,
whereas 32%
are not currently
piloting or using AI for any compliance activities.
With one in three saying they are not
using AI for compliance or even testing it
and a slightly higher number saying they are,
Rob, why is business so bifurcated
about using AI
for fraud detection?
Generally, you know, people argue, is it a
good thing? It's a bad is it a
bad thing? I think the the real question
is it's a thing, and we're just gonna
have to we're gonna have to adopt it
and get on with it. So,
that finding really stood out.
But that that and also the the finding
that the majority of respondents believe AI will
have a net positive impact overall on compliance.
But you're you're right. We're seeing a kind
of two speed world where when it comes
to the adoption of that. And some firms,
particularly in the financial services and the tech
sector, are forging ahead with AI, probably not
unsurprisingly, but especially in fraud detection, predictive analytics,
whereas others are taking a more cautious approach
to that.
And there's probably valid reasons,
and it's it's the usual reasons that many
organizations are still grappling with fragmented data,
legacy systems,
a multitude of different systems.
And then you add on to that the
the concerns around the governance and the control
around that that data and the use of
AI and some of the risks that we
know come with AI.
So I think eight 89%
of survey respondents said they were worried about
data privacy and security risks with AI. So,
you know, that's quite a clear message that
the hesitation is is there and it's it's
probably understandable. But
the the potential is huge.
AI can help spot fraud patterns at scale,
reduce all of the false positives that you
might see previously,
and help speed up investigations,
just through the data analytics approach.
But to do it well, as we said,
you need you need the right data foundation,
and a robust
AI governance framework around it.
So the divide probably comes
down not to desire or willingness,
but probably more the readiness,
technically and culturally.
So I think, you know, what we see
some companies doing is almost testing the water,
doing small pilot initiatives,
building up a bit of confidence, getting the
data right. And then as
as that becomes part of the broader compliance
and risk strategy, you just slowly add additional
risks and new datasets and things like that
and increase the breadth of what you're doing.
But it's it's not just about adopting the
technology.
It's about, obviously, doing doing it responsibly as
well.
Agreed.
Compliance
innovation.
It's a smart new tonic for the old
problem of regulatory
fatigue.
As b two b payments face more regulations
in the months and years to come, we
strongly suggest reading the PWC
global compliance survey 2025,
especially if you wanna know what adjacent verticals
are doing.
Our thanks to a great guest, Rob Stevenson,
director of risk at PwC.
To our audience, the smartest people in b
two b payments, thanks for listening. Hit subscribe.
Catch us again on your favorite podcast platforms,
including Apple and Spotify.
Bye for now.
The payments podcast,
from Bottom Line.