Validating Regulatory Assumptions Before Committing Compliance Capital

Start by separating what you know from what you assume

Before you can validate, you have to be honest about what you are actually working with. Most compliance investment cases rest on a mix of three things: published regulatory text, supervisory signals interpreted through your team's judgement, and inferences about what the regulator will do next. The first is fact. The second and third are assumptions dressed as fact.

Write them down separately. On a single page, list every load-bearing assumption behind the proposed spend. Typical examples: 'The FCA will treat this as a Consumer Duty priority in the next supervisory cycle,' or 'The PRA expects Tier 1 firms to have this capability by year-end,' or 'Our peers are building to this standard.' If you cannot cite the specific speech, letter, or Dear CEO communication that supports each one, it is an assumption, not a fact.

This exercise alone usually kills 20 to 30 per cent of the proposed scope. Good.

Rank assumptions by cost of being wrong

Not every assumption needs the same level of validation. Focus your testing effort on the ones where being wrong costs the most. Two questions to ask of each:

1. If this assumption is wrong, how much of the investment becomes wasted or needs redoing?
2. How reversible is the decision it drives?

An assumption that shapes a £15m technology build with a three-year implementation is worth serious validation effort. An assumption that shapes a policy document you can revise in a quarter is not.

Choose validation methods that match the assumption type

Direct regulatory engagement

The most underused method. Firms often assume the regulator will not engage on specifics before a formal submission. In practice, supervisors will discuss interpretation of expectations, particularly where you are proposing material investment aligned to their priorities. Frame the conversation around your understanding of their expectations and invite correction. Do not ask them to bless your solution. Ask whether your reading of the problem matches theirs.

What most firms get wrong: they send the head of compliance alone. Send a business owner too. Supervisors respond differently when they see commercial accountability in the room.

Structured peer intelligence

Not the trade association lunch version. Set up two or three confidential conversations with counterparts at comparable firms, ideally at the level below the CRO. Ask specific questions: what scope have you set, what did your supervisor push back on, what did you cut. Compare the pattern, not any single data point. If four firms are all building to the same standard and you are building to something different, that is signal.

Ex-regulator input, used carefully

Former supervisors are useful for interpreting tone and precedent. They are less useful for predicting current supervisory priorities, which shift faster than most consultancies admit. Use them to pressure-test your reading of past enforcement patterns, not to forecast the next Dear CEO letter.

Alumni and horizontal scanning

Read every speech, portfolio letter, and enforcement notice from the past twelve months in your area. Not summarised. In full. Look for the words that keep appearing in different contexts. Regulators telegraph priorities through repetition long before they codify them.

Build a pre-mortem into the business case

Before final approval, run a structured session where the investment has failed. Two years in, £8m spent, the regulator is unimpressed and the business is frustrated. What went wrong? The answers almost always point back to one of the original assumptions. Fix those before you sign, not after.

What good looks like at approval

By the time the paper reaches the board, every material assumption should carry three things: the evidence base, the validation method used, and the residual uncertainty. 'We tested this assumption through direct engagement with our supervisor, peer benchmarking with three comparable firms, and analysis of the last four enforcement actions. We remain uncertain about X, which we will monitor through Y.'

That is a defensible position. 'The regulator expects this' is not.

Your next move

Before the next investment committee, pull the current business case and mark every assumption in yellow. Count them. If more than a third are unvalidated and the spend exceeds your reversibility threshold, the paper is not ready. Send it back.