Following the Rules

What happens when regulators become so close to the industries they oversee that they stop questioning the assumptions those industries make?

It's a risk that goes well beyond lobbying or conflicts of interest. Regulators can gradually adopt the perspectives of the firms they're supposed to scrutinise, until protecting the industry's interests starts to feel indistinguishable from serving the public interest.

It's known as cultural capture. And with UK financial regulators under mounting pressure to support growth and competitiveness, the question of how they maintain independent judgement is particularly pressing.

Joining me are Alex Chesterfield, a former Principal Behavioural Scientist at the Financial Conduct Authority and former Group Head of Behavioural Risk at UK lender NatWest, who is now researching regulatory culture and AI at the London School of Economics.

And Professor Tom Reader, also of the London School of Economics, whose research focuses on organisational culture, risk and institutional failure.

We discuss whether the FCA's pro-growth agenda could influence supervisory decisions, the dangers of regulators “flip-flopping” between political priorities, and how cultural capture contributed to failures before the global financial crisis.

We also explore whether AI could help uncover the early warning signs of regulators becoming too close to the industries they oversee and what it takes to ensure they remain capable of challenging the firms they're there to hold to account.

Today’s episode is a special one. It’s brought to you in partnership with Smarsh, the technology firm that helps regulated organizations of all sizes, including financial institutions, capture, govern, and monitor their communications.

This episode forms part of a Following the Rules series, focused on practical guidance for firms navigating legal, regulatory and technological change.

Today we're examining how artificial intelligence is transforming communications compliance, and why the biggest challenge for financial institutions may no longer be the technology itself, but how they put it to work.

After years of regulatory scrutiny over off-channel communications, firms are now confronting a much broader challenge. AI is creating new forms of communication that need to be governed, while offering opportunities to make surveillance more effective, reduce false positives and extract greater value from the data firms already hold.

So how can compliance teams distinguish genuine AI innovation from hype? What does it take to deploy these tools responsibly? And how might AI fundamentally change the role of compliance?

Joining me to discuss this is Kim Crawford Goodman, Chief Executive Officer of Smarsh.

We explore the company's own AI transformation, the barriers to smarter surveillance, and what compliance leaders should be doing now to prepare their programmes for the next five years.

Today’s guest warns that financial services’ boards that place too  much emphasis on compliance risk making their firms less well governed, by crowding out strategic debate and encouraging executives to focus on proving they have ticked the right boxes rather than exercising good judgment.

She also makes the case for preserving the UK’s Senior Managers and Certification Regime, arguing that dismantling it now could ultimately damage the market, even as she calls for parts of the regime to be streamlined.

And, as AI and better data transform both financial firms and their regulators, she considers whether technology could eventually support a simpler rulebook, with greater reliance on judgment and individual accountability.

Sally Dewar’s has spent her 35-year career working across regulation, financial services and corporate governance. A former senior regulator at the Financial Services Authority, she went on to lead international regulatory affairs at JPMorgan Chase before spending six years as CEO of A&O Consulting, the law firm’s regulatory advisory business. Since 2024, she has advised firms, boards and senior executives across the industry, on governance, culture, conduct and regulatory risk as a director at Adelstow Advisory.

The UK crypto industry is approaching a fundamental regulatory shift. Firms that have operated under relatively limited oversight by the UK’s Financial Conduct Authority are preparing to become fully regulated financial services businesses, bringing much broader expectations around governance, consumer protection, capital and conduct.

Today’s episode is part of a Following the Rules series delivering practical guidance on legal, regulatory, technological and cultural change.

In this episode, we explore what the FCA will really be looking for when its crypto authorisation gateway opens, including why using AI to produce policies and controls won’t compensate for senior managers who don’t understand them, and why the FCA’s growth objective will not mean lowering the authorisation bar.

Joining me is Dominic Cashman, the FCA’s Director of Authorisations and one of the people at the heart of determining which firms meet the regulator’s standards for entry. He spent 25 years in senior operational and transformation roles across major financial firms, including TP ICAP, Nomura and Deutsche Bank, before joining the FCA in 2022

We discuss how the FCA will judge whether firms are genuinely ready for regulation, the red flags that can reveal deeper problems with culture and leadership, and why Cashman believes a young crypto industry needs to prepare for the existential crises it has yet to face.

Today’s guest cautions that regulators face a growing gap in understanding and managing the scale and complexity of AI risks and asks whether traditional, technology-neutral regulation can keep pace as adoption accelerates.

He also discusses how Dubai International Financial Centre is weathering conflict in the Middle East. Firms and capital continue to flow into the Centre, but he says that the impact could become more pronounced as businesses reprice a conflict many expected to be short-lived.

And, amid disruption to cloud infrastructure in the region, he discusses operational resilience, technology concentration, and whether regulators themselves fully understand their exposure to critical infrastructure.

Mark Steward is one of the most experienced international regulators of his generation. He previously held senior roles at the Australian Securities and Investments Commission and Hong Kong’s Securities and Futures Commission, before spending seven years at the UK’s Financial Conduct Authority, where he led Enforcement and Market Oversight and latterly also oversaw its International Division.

Since May 2025, he has been Chief Executive of the Dubai Financial Services Authority (DFSA), leading the regulator for one of the world’s fastest-growing financial centres.

He spoke with Following the Rules on 26 August.