UK regulators should scrap individual accountability for compliance chiefs, a former Goldman Sachs executive has said, warning that the senior managers regime places unrealistic responsibility on control functions.
Mark Taylor, the bank’s former Emea head of financial crime compliance, has called on the UK to rework the framework that holds City bosses accountable for how their businesses are run, so that compliance bosses’ and money laundering reporting officers’ personal liability shifts to chief executives and business leaders.
“When you are making a difficult decision, that tension isn’t the compliance officer’s tension, it’s tension put on them by the business,” Taylor told the Following the Rules podcast. “The CEO and management should bear that.
“If you’re the [money laundering reporting officer] of Mega Bank, are you really responsible for all the things that sit under that role?” said Taylor, who now runs consultancy Ibex Compliance. “It’s not realistic.”
His comments come as the Financial Conduct Authority and Prudential Regulation Authority today set out initial reforms to the Senior Managers and Certification Regime, as part of a broader push by government and regulators to support UK growth.
The changes focus on streamlining the accountability rules and reducing the regulatory burden they place on firms. But the regulators said they also plan “to consult on wider changes” to the regime later this year.
For Taylor, “there’s work to do” to make the accountability regime as effective as possible.
While he says the framework “focuses the mind of the office holder”, he complains that it also encourages overly “brittle” decision-making and misses “the nuance” needed to facilitate lasting cultural change within City businesses.
In the absence of more fundamental reform, he argues that smaller firms should increase pay for compliance professionals subject to the rules.
“If you are working for a hedge fund and you’re being paid £90,000, you’re not being paid enough to take on that responsibility,” he said.
Taylor also warned that banks are still failing to meet basic data management requirements, despite decades of regulatory tightening.
“Firms still struggle with very basic things. Lots of firms can’t get their data right,” he said, adding that he has found examples of inconsistent or missing client data in businesses across the finance sector.
“If you don’t record the client name accurately, or at all, then you really are in trouble,” he said. “That’s why you get sanctions breaches, financial crime and client problems.”
To be sure, regulators are alive to this issue. In 2025, the FCA warned that weak data governance and record-keeping can leave firms exposed to unresolved compliance breaches.
Even so, Taylor said firms’ data quality was not getting the attention needed to fix the issue. “It needs elbow grease,” he said.
Inadequate resourcing and a lack of diversity in firms’ compliance teams are contributing to weaknesses in the function, he added.
“Compliance is hard,” he said. “You should always recruit people who are better than you.”
This is an abridged version of Lucy McNulty’s Following the Rules podcast.
Your career spans four decades. What is the industry still not getting right?
Mark: Firms still struggle with very basic things. Lots of firms can’t get their data right. I go into a firm and I can find missing data around the client.
If you don’t record the client name accurately, or at all, then you really are in trouble running the business.
Any firm that has merged with multiple parties is going to have a problem. Any firm with legacy systems is going to have a problem.
That’s why you get sanctions breaches, financial crime and client problems, because if you’ve got multiple different ways of collecting data, or you’ve merged different systems, then you’ll have a problem when you’re doing any kind of screening.
There are technologies that can improve that. But if you’ve got rubbish data and you don’t correct it, then it’s a problem. And I’ve encountered that problem in all areas of business and the market.
What is the solution?
Mark: It’s dull. That’s the trouble. So it doesn’t get the focus it should.
Solving a historical data problem requires a huge amount of work.
You need to have good controls to make sure that what goes in is good, continued maintenance and constant periodic review. It needs elbow grease.
So it’s not where people start. It’s often where you end up, though, when things go wrong.
What regulatory shifts concern firms?
Mark: The governance and use of AI is problematic. I use AI a lot. It empowers you. Also, I’m interested in crypto.
The speed with which these things are happening means it is very hard for regulators to keep up. The job of regulators is passive. You’re sitting outside the business. It’s a real skill to keep up to date. If you’re not constantly interacting with people, you’re going to slip behind. That is the problem.
Regulators might miss opportunities because of the speed of change.
To avoid that, you need to engage with the firms and the technologies. The FCA is open to talking about technology. But any regulator can easily slip behind.
You have to engage with these developments, particularly if you are a government, a regulator or a business leader. And some people might be missing a trick now.
What aspects of the financial rule books in the EU and UK would you like to see amended or simplified?
Mark: I’ve always worried, as a holder of senior management roles, about making individuals responsible for things. I can see why the public like it. In a lot of cases, it’s not realistic.
The senior management regime focuses the mind. But if you’re the MLRO of Mega Bank, are you really responsible for all the things that sit under that role?
Accountability and governance need to be looked at. There’s a lot of bureaucracy being piled on these businesses. And there are people who need to be protected. So there’s work to do.
Challenging something won’t work if you are being brittle. The senior management regime can make you brittle and the rules miss some of the nuance.
The other way of solving the problem is to pay MLROs and compliance staff more. If you are working for a hedge fund and you’re being paid £90,000, you’re not being paid enough to take on that responsibility.
They should get rid of the senior management role for compliance and the MLRO. The CEO and management should bear that because, when you are making a difficult decision, that tension isn’t the compliance officer’s tension, it’s tension put on them by the business.
What does good judgment look like in compliance?
Mark: Make sure that everybody can talk to the person next to them, so there is good information sharing.
When you need to go against the commercial grain, you have to make sure that you’ve got all the information you need.
Goldman had a trading system that used to vibrate when anything in the market was off-key. You need that with compliance. If your antenna says something is wrong, you need an environment where everybody is able to talk about any concerns they have.
Sometimes it will be stupid or wrong. Regardless, the person who is discussing the completion of the KYC documentation needs to know that, when they call you up with a problem, you’ll deal with it, and your deputy needs to be empowered to do that too. Every conversation is important.
And you need a diverse team because you need to have multiple ways of thinking on the team.
All teams have some aspects of their culture that could be improved. We need to be able to call that out so that your protection is coming from all members of your team.
What makes a great compliance hire?
Mark: Compliance is hard because you’re slightly away from the guts of the business. You need to understand how systems work. That’s a huge investment of time.
Most people can’t answer the third question. But if you’re in compliance, you need to be able to ask the third, fourth and fifth questions. That is hard.
I’ve worked in financial crime compliance for a long time. If someone comes back with a transaction from an unexpected jurisdiction, you need to find out how that came about. Sometimes compliance departments aren’t asking those questions hard enough.
Are compliance teams inadequately resourced?
Mark: They are inadequately resourced because they don’t have enough diverse thinking or depth of understanding, and there is often a lack of management skills. Technical people are not given enough help to be good managers, and that makes them protective of their jobs. You should always recruit people who are better than you.
Mark Taylor
Title: Founder/partner of a two-partner firm
Which line of defence do you typically interact with, and which division? Second
Something most people wouldn’t know about you: I have sung on stage with Boney M.