When Compliance Becomes Theatre: The Risk of Symbolic Regulation

In April 2026, a panel convened by the Huggard Consulting Group in Washington reached a damning verdict on the global fight against money laundering. This was no gathering of fringe critics. It included two former directors of the United States Financial Crimes Enforcement Network (FinCEN), among them William Fox, alongside the President of the Bank Policy Institute and a former chief of the Justice Department's money laundering section. The panel concluded the system had become overly focused on procedure at the expense of its core mission. One panelist said it had shifted toward policing compliance rather than preventing crime. The phrase they reached for was compliance theatre.

Their own remedy was lighter-touch reform, a complaint that the regime over-polices procedure rather than under-enforces it. That is not the argument of this article. But the diagnosis underneath is one both critics and reformers now share. A regulatory framework can be elaborate, well-funded and widely admired, and still drift from outcomes toward procedure. When that happens, regulation stops being an instrument of control and becomes a performance. It signals virtue without delivering protection. The risk is not that rules are absent. It is that rules have become symbolic.

The gap between the rule and the result

The numbers expose the gap. The Institute of Compliance notes that the UK operates one of the most developed AML regimes in the world, with supervised sectors, mandatory training, transaction monitoring and a vast suspicious activity reporting machine. The Financial Action Task Force (FATF) assessed the UK regime as robust and effective in its 2018 mutual evaluation. Yet the National Crime Agency judges it a realistic possibility that the scale of money laundering impacting the UK runs to hundreds of billions of pounds each year. The system produces millions of suspicious activity reports, many filed less to stop crime than to prove a firm has done its part.

This is the signature of symbolic regulation. Activity is abundant. Outcomes are scarce. The machinery runs at full capacity while the illicit flows it was built to interrupt continue undisturbed. A framework measured by the reports it generates will always look busy. Looking busy is not the same as working.

When enforcement loses its edge

A rule without credible enforcement is an announcement, not a deterrent. Here the UK position has grown hard to defend. The Bureau of Investigative Journalism reported in March 2026 that fines from the Financial Conduct Authority (FCA) had fallen to what critics called pitiful levels, with the £124 million imposed in the most recent year representing a 78 per cent decline over five years. The largest penalties had shrunk on the same trajectory. The Bureau raised pointed questions about the effectiveness of the agency charged with stamping out economic crime.

The FCA rejected the framing, telling the Bureau that fines are only one tool among several and that since 2021 it had imposed fourteen penalties on banks and building societies totalling almost £345 million. The defence has merit. Yet it concedes the underlying tension. When the visible signal of enforcement weakens, the expressive content of the rule weakens with it. Firms calibrate their investment to the probability and severity of consequence. If that probability falls, the rational response is not better controls. It is cheaper ones that still pass inspection.

This is the quiet logic that drives compliance toward theatre. The point is no longer to prevent the harm. The point is to survive the audit.

The expressive theory and its limits

Law does more than threaten punishment. In The Expressive Powers of Law, the legal theorist Richard McAdams argues that law shapes behaviour partly by coordinating expectations and signalling shared norms, supplementing rather than replacing deterrence and legitimacy. A well-drafted standard can change conduct simply by announcing what responsible firms are expected to do.

The danger arises when the expressive function stands in for the instrumental one. A rule that expresses disapproval of money laundering, that creates the appearance of vigilance, that lets a jurisdiction tell international assessors it has acted, can satisfy everyone while changing nothing. Legal scholars have warned for decades about symbolic statutes that perform commitment without securing results. The financial crime regime is now vulnerable to precisely this pathology. The architecture is impressive. The question is whether it bites.

The case for the defence

There is a serious objection to all of this, and it deserves a hearing. Prevention leaves no trace. A laundering scheme deterred, an account never opened, a transaction abandoned because the controls made it too risky, none of these appears in any statistic. The headline figure counts the failures and ignores the successes, because the successes are by their nature invisible. On this view, judging the regime by what slips through is like judging a vaccine by the people who still fall ill.

The objection is fair, and it is the strongest case the regime has. It also cuts the other way. If prevention is invisible, neither side can prove its case from the outcomes alone, which is precisely why the structure of the incentives matters more than any single statistic. Deterrence depends on a credible threat, and a threat is only credible if it is occasionally carried out. The expressive power McAdams describes is real, yet it decays as the gap between the announced standard and the enforced one grows. A regime can claim invisible prevention only while its visible enforcement stays plausible. The argument here is not that the regime has demonstrably failed. It is that the incentives are pointing the wrong way, and that the trend, not the snapshot, is the warning.

Same activity, same risk, same rules

International standard-setting reflects the same tension between ambition and execution. In June 2025, the FATF adopted a substantial revision of Recommendation 16, the payment transparency standard often called the travel rule. The FATF stated that the revision clarifies responsibilities across the payment chain and strengthens transparency for cross-border payments above USD or EUR 1,000. The principle was elegant: same activity, same risk, same rules, extending the standard to instant payments, card-based cross-border transactions and digital wallets.

Yet the FATF set a compliance deadline of the end of 2030, a marked departure from its usual practice of immediate effect, with implementation guidance promised only in late 2026. A deadline that distant can mislead compliance teams into treating the present as a waiting period. The operational signal is immediate. The formal one is years away. A standard announced in 2025 but not assessed until the next decade carries a real expressive charge and a deferred instrumental one. The gap between the two is exactly where symbolic compliance takes root.

The audit and the everyday

Symbolic regulation has an internal counterpart inside firms, and it wears the same costume. Practitioners describe a pattern in which controls are polished for examination and neglected the rest of the year. Internal Audit 360 captured the dynamic in late 2025, describing organisations where procedures are followed to the letter, but only because someone is watching. Once the audit concludes, attention drifts and execution slips.

This is control existence without control effectiveness. The policy exists. The procedure is documented. The training was completed. None of it guarantees that a suspicious transaction is caught on an ordinary Tuesday when no inspection is scheduled. Appearance is optimised. Function is assumed.

Measure what is prevented, not what is filed

The answer is not to do less. It is to measure differently. A compliance function judged by the existence of policies and the volume of reports will optimise for exactly those metrics and nothing beyond them. A function judged by outcomes, by detection rates, by the usefulness of intelligence shared with law enforcement, by the speed of remediation, will build controls that work when unobserved.

The supervisory direction supports the shift. The FCA's consolidation of its Financial Crime Guide treats financial crime compliance as a single discipline held to a single standard of evidence. Regulators across the EU and UK, as Encompass observed in early 2026, no longer want comfort from the existence of controls. They want proof that controls work. Firms that can show operational realism rather than audit comfort will be the ones whose frameworks survive the scrutiny now arriving. The exposed will be those whose compliance was always, at bottom, a performance.

The cost of the performance

Theatre has its uses. A regime that expresses society's condemnation of financial crime is not worthless, and the expressive power of a clear standard can genuinely shape conduct. The error is to mistake the performance for the protection. A rule that signals seriousness while hundreds of billions of pounds wash through the system every year is not a control. It is a costume worn by the absence of one.

The credibility of the regime depends not on the volume of its activity but on the visibility of its results. Reports filed, policies drafted and standards announced are inputs, not outcomes. If the regime is measured by what it prevents, the performance becomes protection. If it is measured by what it performs, the show goes on and the audience learns the only lesson theatre can teach. Compliance is not the act of looking ready. It is the act of being ready when no one has bought a ticket.

Is your compliance framework built to stop crime, or to survive the audit?

At OpusDatum, we help firms close the distance between control existence and control effectiveness, building financial crime frameworks that withstand scrutiny because they work in practice, not merely on paper. Our work focuses on operational realism: controls that perform when no one is watching. Contact us to find out how we can help you with your compliance framework.