When the rules change, your staff records are the slowest thing to fix

If it were, it would not be worth writing about. But look at the last two years in fintech and the pattern is hard to miss.

DORA became applicable to European financial entities in January 2025, bringing ICT risk management, incident reporting, resilience testing and third-party risk into scope, with compulsory digital-operational-resilience training for relevant staff. The EU AI Act is phasing in across several years: AI literacy duties have applied since February 2025, transparency obligations apply from August 2026, and the high-risk rules covering recruitment and worker-management systems apply from August 2027. New York City also regulates certain automated employment decision tools through bias-audit and notice requirements.^[2],[3],[4]

None of these are the same regulation. All of them do the same thing to your organisation: they change who is in scope, what those people must be able to demonstrate, and what you have to be able to produce on request.

So the useful question is not how to handle the current change. It is what condition your records need to be in so that the next one is administrative rather than existential.

Strip the legal language off almost any supervisory change and it resolves into three demands about individuals.

Who holds which role, and since when. Not the job title on the contract. The actual function, the reporting line, the authority to approve or execute, and the date it started. Regulators care about roles because obligations attach to functions rather than to people.

What was assessed before they took it on. Fit-and-proper, competence, background verification, conflicts. And crucially, the evidence of the assessment rather than the fact of it. “We checked” is a claim. A dated record showing what was checked, by whom, against what criteria, is evidence.

What they have been trained on, and whether they understood it. This is where most organisations discover a gap they did not know they had, because a training completion record and evidence of comprehension are different artifacts. A completion log proves attendance. It does not answer the question a supervisor is actually asking, which is whether the person can be relied on to act correctly.

Three demands, all of them about the past, and that is the whole problem.

Here is why the people side is the one that catches organisations out, and it is not because it is complicated.

Capital can be raised. Painful, sometimes expensive, and it can be done in weeks if the business is viable.

Systems can be built. Six months, maybe twelve, and you can spend money to compress it. Hire contractors, buy instead of build, run parallel workstreams.

Records of the past cannot be created. If a person was trained in 2023 and nobody recorded what they were trained on, no amount of money produces that record in 2026. If somebody has held a role for two years without a documented assessment, you cannot assess them retroactively as of the date they started. You can assess them now, which leaves a two-year hole that a supervisor will notice.

This is the only category of readiness that money cannot accelerate. It compounds in the wrong direction: every month you operate without recording things properly, the historical gap gets one month wider, and the cost of the eventual remediation goes up rather than down.

A long regulatory runway can look generous for capital and systems. For evidence it is a trap, because the record needed later has to start now.

The demand that catches companies most often is the first one, and it looks the most trivial.

Regulatory change almost always redefines the perimeter. A function that was outside scope is now inside it. A threshold moves. A new category of activity is named. And to work out what your new perimeter contains, you need to know what each role in your company can actually do.

Most fintechs do not know this in any retrievable form. They know it informally, in the heads of the people who granted the access, and they know it in scattered systems: an access management tool, a permissions table, a set of tickets, someone’s spreadsheet.

So when the rules change, determining who is now in scope requires auditing every person individually. That is weeks of work, it produces a snapshot that decays immediately, and it has to be repeated the next time something moves.

The alternative is unglamorous and cheap: record the classification when the role is created and when the person is hired, rather than reconstructing it when someone asks. What can this role access. What can it approve. What obligations attach. Four minutes per requisition, and it converts a recurring audit into a query.

This matters more in fintech than elsewhere because exposure tracks access rather than seniority. A junior developer debugging a failing payment flow may be looking at live transactions, national identification numbers and bank details in their first month. A team lead two levels above them may never open production. Seniority is a poor proxy, and job title is a worse one.

Not a compliance programme. Five things, none of which requires a regulatory trigger to justify.

The honest argument is not that regulation is coming, although in fintech it reliably is.

It is that all five of those things are useful anyway. Knowing what a role can access improves your access management. Assessment evidence makes hiring decisions reviewable. Comprehension evidence tells you which training is not working, which is information you want regardless of who asks for it. Expiry tracking prevents the quiet lapse. And an export a stranger can read is what you need for a customer security review, an investor diligence process or an insurance application, all of which arrive more often than regulators do.

The regulatory case is the one that gets it funded. The operational case is why it does not feel like waste when no supervisor turns up.

Pick one employee who has been with you two years and holds a role that touches something sensitive.

Produce, in ten minutes: what their role can access, what was assessed before they took it, what mandatory training they have completed, when it expires, and evidence that they understood it rather than clicked through it.

If that takes ten minutes, the next regulatory change is a project. If it takes an afternoon and three people, it is a risk. And the difference between those two situations is not how well you understand the rules. It is whether your records were built to be read by somebody else.