The problem is not a lack of data. It is that the data is being interpreted separately.
Conduct, Operational Resilience and Financial Crime are governed through different frameworks, yet they repeatedly touch the same customers, products, journeys, services, suppliers and controls. A material issue can therefore build across several apparently acceptable positions before any single dashboard turns red.
By the time the individual dashboard turns red, the enterprise may already be behind the problem. The operating-model question is whether the firm can connect and triangulate signals quickly enough to understand what is changing, who is affected, why it is happening and what action will alter the outcome.
The next material regulatory issue may emerge across several domains before any one of them turns red. Firms that can connect regulatory evidence to products, journeys, customers, services and controls can understand impact and cause earlier, and turn regulatory capacity into strategic capacity.
The signals are already there. The enterprise view isn’t.
The evidence sits in different publications because regulation is still organised by domain. The business reality is not. The same customer, product, journey, service, supplier and control can appear across Conduct, Operational Resilience and Financial Crime at the same time.
UK adults showing at least one characteristic of vulnerability.
Complaints received by financial-services firms in H2 2025.
More than half of closed complaints were upheld.
Responding firms already using AI.
Median use cases expected to more than double over three years.
Risk and compliance AI implementations that were third-party.
Technology and systems failures across nine major banks and building societies.
Accumulated outage time reported across those firms.
Systemic Risk Survey respondents citing cyberattack among their top five risks.
Almost £1.3bn was stolen through fraud in the UK in 2025.
Authorised Push Payment fraud losses in 2025.
Estimated annual UK financial-services regulatory compliance cost.
Read separately, these are statistics. Read together, they are signals that the regulatory operating model needs to become connected.
Conduct is becoming a connected-evidence problem
Consumer Duty, DISP and Vulnerability are often governed and reported through different frameworks. The customer experiences one journey. That distinction matters because the strongest signal may sit in the relationship between datasets rather than in any single metric.
A complaint rate can remain inside tolerance while one customer cohort starts to experience poorer outcomes at one point in a journey. Vulnerability data may explain who is affected. Complaint themes may explain how. Consumer Duty outcomes tell the firm whether the result is acceptable.
In September 2026, the FCA highlighted stronger vulnerability practice where firms understood the characteristics in their customer base, identified and recorded them consistently across journeys, monitored outcomes and used MI and governance to drive improvement. From January 2027, the unified complaints return adds explicit vulnerable-customer data. Sources [3] and [4].
The move is subtle but important: from three compliance lenses to one connected view of the customer outcome.
A signal is simply a change in evidence that may matter, for example a complaint theme rising, a journey completion rate falling, repeat contact increasing, a vulnerable cohort being affected differently, or an operational incident touching a critical service. A signal is a reason to investigate; it is not automatically proof of a problem.
AI makes connection possible, if the data has a common map
AI increases the amount of evidence a firm can interrogate, but AI alone does not create intelligence. If complaints, vulnerability, services, products, controls and obligations have no shared relationship model, AI is still searching disconnected islands.
The foundation is therefore a connected data model. That sounds technical, but the idea is straightforward.
Why it matters: it lets a complaint, outage or fraud event be related to the same product, journey, customer population and regulatory expectation without manually reconciling separate reports.
This does not mean putting every dataset into one giant warehouse. It means knowing what the data represents, where it sits, and what it connects to. The relationship can be modelled even when the underlying data stays in existing systems.
AI is very good at finding patterns. A connected model gives those patterns business and regulatory meaning. It also makes AI safer to use because the firm can trace which data, rule, product, journey or control sits behind an answer.
AI should read across the seams. The data model tells it where the seams are.
Freshness note: the Bank of England and FCA launched their 2026 AI Survey in June 2026; the figures above are the latest published joint survey results available at the date of this paper. Source [6].
Harm can arrive before the label
An operational incident does not stay operational just because the incident log says it is. A payment outage, supplier failure or unavailable contact centre can change a customer outcome before it is recognised as a Conduct issue.
That is why the useful architecture connects the event to the service, the journey, the customer population and the outcome.
The important word is chain. It gives the firm somewhere to investigate. Which service failed? Which journeys depended on it? Which customers used those journeys? What changed in contact, complaints and outcomes after the event? Did the pattern recover when the service was restored?
That moves resilience from incident reporting towards evidence of customer impact.
The same customer. The same channel. A different control team.
Financial Crime is often treated as another specialist control environment. Operationally, it intersects with the same customers, products, digital channels, journeys, suppliers and data used elsewhere in the firm.
A fraud intervention can alter a customer journey. A control can create friction. An outage can weaken a control. A vulnerable customer may experience a protective intervention differently. Those relationships matter if the firm wants to understand both risk reduction and customer impact.
The £33.9bn compliance-cost estimate is not an argument for weaker controls. It is evidence that the operating model is economically material. Duplicated mapping, repeated interpretation and manual reconciliation all consume capacity that could be directed at higher-value risk decisions.
Do not ask each domain to build a better silo. Build a shared relationship model underneath them so each domain can contribute signals to the same enterprise picture.
The prize is not cheaper compliance at any cost. It is stronger regulatory alignment at a lower operating cost.
From disconnected metrics to enterprise intelligence
A signal-driven architecture is an operating model in which changes in one area can be related quickly to the products, journeys, customers, services, controls and obligations they may affect. The point is not to collect more data. It is to give existing evidence a common business and regulatory context.
The progression is simple:
New language, in plain English
Why it matters: it tells the firm where to look.
Why it matters: when complaints, vulnerability, journey, service or control evidence points in the same direction, the firm has a stronger basis for investigation.
Why it matters: it turns a signal into an enterprise question rather than an isolated metric movement.
Why it matters: it moves the conversation beyond coincidence and correlation.
Triangulation turns signals into an investigation
One signal rarely tells a firm enough. A rise in complaints may matter, but it does not explain the cause. A vulnerability measure can show who is affected differently, but not why. An operational event may provide the trigger, but not the customer consequence.
Triangulation means testing several independent signals against the same business context.
A complaint trend says something changed. Vulnerability tells us who may be affected differently. Journey data shows where it is happening. An operational event may explain what changed. Control or Financial Crime evidence may expose a further consequence. When those signals converge around the same product, customer group, journey, service and period of time, the firm has evidence of impact, and a route to understanding cause.
Connection is not causation. It is what makes causation testable.
Connected data can show that two things happened together. Senior decision-makers need more: evidence that explains how and why one event contributed to an outcome. A joined-up model creates the evidence trail needed to test that explanation.
An outage begins at 10:02. A particular payment journey degrades immediately. The customers using that journey show a sharp rise in repeat contact. A vulnerable cohort is disproportionately affected. Complaints with the same root cause rise. The pattern falls back after service restoration. No single fact proves causation on its own; together they form a much stronger causal case.
The firm does not need to copy every operational dataset into one platform. A relationship and metadata layer can connect what each dataset means, where it resides and which obligations, products, journeys, services or controls it supports. The source data can remain where it is managed today.
From impact and cause to strategic resolution
The value of triangulation is not simply a better diagnosis. It is the ability to turn evidence into an enterprise decision.
Enterprise Regulatory Intelligence (ERI) is the connected view of regulatory obligations, the business and the evidence that allows a firm to understand its regulatory position across domains: not as separate compliance reports, but as one decision context.
Enterprise Regulatory Intelligence creates Enterprise Intelligence.
In practical terms, that means progressing through three levels of intelligence:
What changed? Which metric, complaint theme, service event, customer behaviour or control result moved?
Why did it change? Who was affected, what dependencies were involved, what evidence converges and what contributed to the outcome?
So what does the firm do? Which action changes the outcome, where should investment go, where does risk constrain the business, and where does stronger evidence create capacity to move?
Connection alone is not Enterprise Intelligence. Connecting data tells the firm what relates to what. Triangulating signals shows whether independent evidence is converging. Causal investigation explains what drove the outcome. Impact analysis establishes who and what is affected. Enterprise Intelligence translates that evidence into a decision.
Strategic resolution is more than remediation
The answer is not always “fix a control”. Depending on the evidence, the strategic resolution may be to redesign a journey, change a supplier, increase operational capacity, alter a product, strengthen customer support, remove duplicated controls, accept a known risk, delay a change, or accelerate growth because the evidence shows the firm has capacity to move.
The technology underneath may be sophisticated. The operating idea is simple: give the firm a common map of its regulation, business and evidence, then use signals from across the organisation to understand what is happening, why it matters and what to do next.
Regulatory capacity is becoming growth capacity
The four signals in this paper point to one conclusion. Better regulatory intelligence is not only about proving compliance. It changes how confidently the firm can make strategic decisions.
Connected complaints, vulnerability and outcomes show where customers are experiencing change.
Service, dependency and incident evidence shows where delivery capacity is fragile.
Customer, transactional, channel and control evidence shows where risk is building.
When those views share the same underlying business and data model, the firm can distinguish between a genuine regulatory constraint, an evidence gap and a control weakness. Triangulation shows where signals converge. Impact analysis establishes what matters. Causal investigation explains why. Strategic resolution determines what the firm should do next.
Board agenda
Signal. Triangulation. Impact. Cause. Strategic resolution.
That is the route from regulatory evidence to Enterprise Intelligence, and from regulatory capacity to growth capacity.
This paper combines published regulatory and industry evidence with Profylr interpretation of the operating-model implications. The architecture, terminology, triangulation framework and causal-analysis model are explanatory models for Profylr Intelligence Forum, not claims attributed to the source organisations.
- FCA · Financial Lives Survey 2024: Key findings
- FCA · Aggregate complaints data: 2025 H2 (28 Apr 2026, updated 15 May 2026)
- FCA · Payments firms: delivering good outcomes for consumers in vulnerable circumstances (17 Sep 2026)
- FCA · Reporting complaints: new complaints return (updated 25 Sep 2026)
- Bank of England and FCA · Artificial intelligence in UK financial services 2024 (21 Nov 2024)
- Bank of England · PRA Regulatory Digest, June 2026: 2026 AI Survey launched 5 Jun 2026
- UK Parliament Treasury Committee · More than one month of IT failures at major banks and building societies (6 Mar 2025)
- Bank of England · Systemic Risk Survey Results 2026 H1
- UK Finance · Fraud remains a national security threat as criminals steal almost £1.3 billion (2026 Fraud Report)
- TheCityUK and PwC UK · Reducing the cost of compliance (5 Nov 2025)
- FCA · Annual work programme 2026/27 (26 Mar 2026)
