Regulatory compliance

The International Organization for Standardization (ISO) and its ISO 37301:2021 (which deprecates ISO 19600:2014) standard is one of the primary international standards for how businesses handle regulatory compliance, providing a reminder of how compliance and risk should operate together, as "colleagues" sharing a common framework with some nuances to account for their differences. The ISO also produces international standards such as ISO/IEC 27002 to help organizations meet regulatory compliance with their security management and assurance best practices. Some local or international specialized organizations such as the American Society of Mechanical Engineers (ASME) also develop standards and regulation codes. They thereby provide a wide range of rules and directives to ensure compliance of the products to safety, security or design standards. ==By nation==

Regulatory compliance varies not only by industry but often by location. The financial, research, and pharmaceutical regulatory structures in one country, for example, may be similar but with particularly different nuances in another country. These similarities and differences are often a product "of reactions to the changing objectives and requirements in different countries, industries, and policy contexts". Australia Australia's major financial services regulators of deposits, insurance, and superannuation include the Reserve Bank of Australia (RBA), the Australian Prudential Regulation Authority (APRA), the Australian Securities & Investments Commission (ASIC), and the Australian Competition & Consumer Commission (ACCC). These regulators help to ensure financial institutes meet their promises, that transactional information is well documented, and that competition is fair while protecting consumers. The APRA in particular deals with superannuation and its regulation, including new regulations requiring trustees of superannuation funds to demonstrate to APRA that they have adequate resources (human, technology and financial), risk management systems, and appropriate skills and expertise to manage the superannuation fund, with individuals running them being "fit and proper". the Clean Energy Regulator for "monitoring, facilitating and enforcing compliance with" energy and carbon emission schemes; and the Therapeutic Goods Administration for drugs, devices, and biologics; Australian organisations seeking to remain compliant with various regulations may turn to AS ISO 19600:2015 (which supersedes AS 3806-2006). This standard helps organisations with compliance management, placing "emphasis on the organisational elements that are required to support compliance" while also recognizing the need for continual improvement. Canada In Canada, federal regulation of deposits, insurance, and superannuation is governed by two independent bodies: the OSFI through the Bank Act, and FINTRAC, mandated by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, 2001 (PCMLTFA). These groups protect consumers, regulate how risk is controlled and managed, and investigate illegal action such as money laundering and terrorist financing. Other key regulators in Canada include the Canadian Food Inspection Agency (CFIA) for food safety, animal health, and plant health; Health Canada for public health; and Environment and Climate Change Canada for environment and sustainable energy. Canadian organizations seeking to remain compliant with various regulations may turn to ISO 19600:2014, an international compliance standard that "provides guidance for establishing, developing, implementing, evaluating, maintaining and improving an effective and responsive compliance management system within an organization". For more industry specific guidance, e.g., financial institutions, Canada's E-13 Regulatory Compliance Management provides specific compliance risk management tactics. European Union Regulatory compliance in the European Union (EU) is governed by a harmonized legal framework designed to ensure consistency across member states while allowing for national implementation. EU compliance regulations cover various industries, including consumer product safety, financial services, environmental protection, and data privacy. The General Product Safety Regulation (GPSR) establishes a unified safety framework for consumer products across the EU, requiring manufacturers to conduct risk assessments, maintain traceability documentation, and meet safety compliance standards before placing products on the market. The GPSR applies to all consumer products made available in the EU unless covered by sector-specific regulations, such as medical devices or food products. The regulation extends to products sold through e-commerce platforms, requiring online marketplaces to ensure that only compliant products are listed. Fulfillment service providers are also included as economic operators, making them responsible for product safety compliance in certain cases. For business compliance, the EU’s regulatory approach is guided by the New Legislative Framework (NLF) and various sector-specific directives and regulations. Businesses must comply with EU product conformity assessments and affix the CE marking to indicate compliance with essential safety and performance standards. Financial compliance is enforced through regulations such as the Markets in Financial Instruments Directive (MiFID II) and the General Data Protection Regulation (GDPR), which set strict requirements for financial transparency, consumer protection, and data security. The EU Legislation Compliance framework ensures that organizations operate within the legal boundaries of EU directives, helping public and private entities manage regulatory risks efficiently. Companies operating in the EU must stay updated on evolving compliance requirements, as non-compliance can lead to fines, product recalls, or restrictions on market access. The Netherlands The financial sector in the Netherlands is heavily regulated. The Dutch Central Bank (De Nederlandsche Bank N.V.) is the prudential regulator while the Netherlands Authority for Financial Markets (AFM) is the regulator for behavioral supervision of financial institutions and markets. A common definition of compliance is:'Observance of external (international and national) laws and regulations, as well as internal norms and procedures, to protect the integrity of the organization, its management and employees with the aim of preventing and controlling risks and the possible damage resulting from these compliance and integrity risks'. India In India, compliance regulation takes place across three strata: Central, State, and Local regulation. India veers towards central regulation, especially of financial organizations and foreign funds. Compliance regulations vary based on the industry segment in addition to the geographical mix. Most regulation comes in the following broad categories: economic regulation, regulation in the public interest, and environmental regulation. India has also been characterized by poor compliance - reports suggest that only around 65% of companies are fully compliant to norms. Singapore The Monetary Authority of Singapore is Singapore's central bank and financial regulatory authority. It administers the various statutes pertaining to money, banking, insurance, securities and the financial sector in general, as well as currency issuance. United Kingdom There is considerable regulation in the United Kingdom, some of which is derived from European Union legislation. Various areas are policed by different bodies, such as the Financial Conduct Authority (FCA), Environment Agency, Scottish Environment Protection Agency, Information Commissioner's Office, Care Quality Commission, and others: see List of regulators in the United Kingdom. Important compliance issues for all organizations large and small include the Data Protection Act 2018 and, for the public sector, Freedom of Information Act 2000. United States Corporate scandals and breakdowns such as the Enron case of reputational risk in 2001 have increased calls for stronger compliance and regulations, particularly for publicly listed companies. On October 12, 2006, the U.S. Small Business Administration re-launched Business.gov (later Business.USA.gov and finally SBA.Gov) which provides a single point of access to government services and information that help businesses comply with government regulations. The U.S. Department of Labor, Occupational Health and Safety Administration (OSHA) was created by Congress to assure safe and healthful working conditions for working men and women by setting and enforcing standards and by providing training, outreach, education, and assistance. OSHA implements laws and regulations regularly in the following areas, construction, maritime, agriculture, and recordkeeping. The United States Department of Transportation also has various laws and regulations requiring that prime contractors when bidding on federally funded projects engage in good faith effort compliance, meaning they must document their outreach to certified disadvantaged business enterprises. ==Challenges==

Data retention is a part of regulatory compliance that is proving to be a challenge in many instances. The security that comes from compliance with industry regulations can seem contrary to maintaining user privacy. Data retention laws and regulations ask data owners and other service providers to retain extensive records of user activity beyond the time necessary for normal business operations. These requirements have been called into question by privacy rights advocates. Compliance in this area is becoming very difficult. Laws like the CAN-SPAM Act and Fair Credit Reporting Act in the U.S. require that businesses give people the right to be forgotten. In other words, they must remove individuals from marketing lists if it is requested, tell them when and why they might share personal information with a third party, or at least ask permission before sharing that data. Now, with new laws coming out that demand longer data retention despite the individual’s desires, it can create some real difficulties. Money laundering and terrorist financing pose significant threats to the integrity of the financial system and national security. To combat these threats, the EU has adopted a risk-based approach to Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) that relies on cooperation and coordination between EU and national authorities. In this context, risk-based regulation refers to the approach of identifying and assessing potential risks of money laundering and terrorist financing and implementing regulatory measures proportional to those risks. However, the shared enforcement powers between EU and national authorities in the implementation and enforcement of AML/CFT regulations can create legal implications and challenges. The potential for inconsistent application of AML regulations across different jurisdictions can create regulatory arbitrage and undermine the effectiveness of AML efforts. Additionally, a lack of clear and consistent legal frameworks defining the roles and responsibilities of EU and national authorities in AML enforcement can lead to situations where accountability is difficult to establish. Financial compliance The U.K. Corporate Governance Code (formerly the Combined Code) is issued by the Financial Reporting Council (FRC) and "sets standards of good practice in relation to board leadership and effectiveness, remuneration, accountability, and relations with shareholders". All companies with a Premium Listing of equity shares in the U.K. are required under the Listing Rules to report on how they have applied the Combined Code in their annual report and accounts. (The Codes are therefore most similar to the U.S.' Sarbanes–Oxley Act.) The U.K.'s regulatory framework requires that all its publicly listed companies should provide specific content in the core financial statements that must appear in a yearly report, including balance sheet, comprehensive income statement, and statement of changes in equity, as well as cash flow statement as required under international accounting standards. It further demonstrates the relationship that subsists among shareholders, management, and the independent audit teams. Financial statements must be prepared using a particular set of rules and regulations hence the rationale behind allowing the companies to apply the provisions of company law, international financial reporting standards (IFRS), as well as the U.K. stock exchange rules as directed by the FCA. It is also possible that shareholders may not understand the figures as presented in the various financial statements, hence it is critical that the board should provide notes on accounting policies as well as other explanatory notes to help them understand the report better. ==See also==