Introduction
Compliance programmes built around one risk category, usually anti-bribery and corruption, are increasingly running into two key challenges: the risks companies actually face have multiplied, and the teams tasked with managing such third-party risks often do not talk to each other.
GTI’s recent webinar, “The New Enterprise Risk Map: Why Compliance Functions Can No Longer Operate in Silos,” brought together Murat Dagli, financial crimes lead at Remitly, Marc Bohn, compliance counsel at Ericsson, and Matthew Hunt, GTI’s Co-Founder and COO, to talk through what these challenges look like in practice and what compliance professionals can do about them. This piece sets out the main points from the discussion.
The Short Answer
Siloed compliance programmes fail because both the third-party sources of risk and the modern enforcement regimes increasingly do not respect the boundaries between risk categories that legacy compliance programmes have been built around. For example, a single third party, such as a Mexican cartel-linked entity, can trigger anti-money laundering rules, sanctions, terrorist organisation designations, and weapons of mass destruction classifications at once. If your sanctions team, your anti-corruption team, and your security team each check their own box without sharing what they see, you run the risk of missing the connections between them. The answer is not a larger compliance department. It is building connective functions (“bridges”) between teams, giving business owners accountability for the risk decisions in their own area, and embedding compliance staff with frontline operations instead of issuing policy from a distance.
What Is a Compliance Silo?
A compliance silo is a team or process that manages one type of risk in isolation, with little to no structured information-sharing with the teams managing adjacent risks. It is not about headcount or department size. A company can have one large compliance function that is still siloed internally, or several small teams that communicate well.
Common examples inside large organisations:
- A sanctions screening team that operates separately from the anti-corruption due diligence team
- A security function tracking regional violence and safety incidents with no formal link to the legal team tracking payment risk
- Data privacy compliance handled entirely apart from third-party risk management
- Product or business development teams that only involve compliance after a decision is already made
The risk is not that these teams exist separately. It is that the information one team holds never reaches the team that needs it to see the full picture.
Why Is the Compliance Risk Map Getting Wider?
From a Single Regulation to Overlapping Regimes
A compliance programme built around the Foreign Corrupt Practices Act (FCPA), the US law prohibiting bribery of foreign officials, used to cover most of what a company needed to worry about, with sanctions sitting alongside it. Since then a plethora of newer risks and accompanying legislation including data privacy, ESG and human rights in the supply chain, and now AI governance, has been added to the menu of third-party risks that overstretched compliance teams need to cover.
Murat Dagli made the point directly: “Thinking in silos embeds a lot of risk into enterprises, and a more holistic approach is warranted.” Marc Bohn’s own career illustrates the shift. He left a law firm where the focus was heavily anti-corruption and anti-bribery, and moved into in-house roles where Russia sanctions, forced-labour rules tied to Xinjiang cotton, and, most recently, now cartel-related terrorist designations kept expanding his remit. As he put it, companies that started with anti-corruption programmes and then added components piecemeal as regulations arrived “can end up having programmes that are a little bit disjointed and aren’t really holistic in terms of addressing risk.“
How One Risk Triggers Multiple Enforcement Actions
Mexican cartels were the panel’s clearest illustration of this shift – one underlying risk that now trips four separate regulatory wires at once:
- Anti-money laundering (AML) rules, because cartel proceeds move through financial systems
- Sanctions designations, where specific individuals or entities are named
- Foreign Terrorist Organization (FTO) status, a formal US State Department designation that expands the range of prohibited activity and the agencies with jurisdiction to enforce it
- Weapons of mass destruction classifications, now applied to fentanyl trafficking
One underlying risk, four separate regulatory hooks, each with multiple enforcement agencies focused on them. Murat also made the point that this is not accidental: the current US administration has taken a multi-agency approach, where rather than enforcing in silos across individual agencies, several agencies coordinate on the same underlying risk.
“So if you go wrong in one area, you’re gonna receive enforcement from multiple actors.” Murat Dagli
Marc added an important qualification. “I think it would be a mistake to suggest that the FTO and cartel has totally eclipsed the FCPA,”. He pointed to the United States DOJ’s July 2026 resolution with Scoular. The case began as an FCPA matter about payments made at the border to customs officials. In bringing it, prosecutors highlighted that, unbeknownst to the company, a range of those payments had gone on to benefit cartel members.
In this case, one enforcement action covered two regulatory regimes, because the alleged underlying conduct touched both. Marc expected the pattern to continue: FCPA actions would keep coming, but increasingly be leveraged and driven by the cartel and FTO priority alongside them.
What Goes Wrong When Compliance Teams Work in Isolation?
Marc set out a blind spot that sometimes catches out companies operating in higher-risk markets. Security teams track violence levels and safety incidents in a given region. Legal teams separately track the payment risk. When the two are not connected, the places showing no safety incidents are not necessarily the safe ones. Instead, they can be the places where payments are being made to keep things quiet with criminal groups, and the absence of incidents is the signal. As he put it, if you operate in these silos and do not share that data across different teams, “you’re going in half blind.”
Murat pointed to a second kind of silo, the functional one. Sitting in the second line of defence, he described how advisory functions can end up removed from the reality of their operational teams and from the customer experience, reading regulations day in and day out and issuing requirements without seeing how they land in practice.
Whether the silo is between data sets or between functions, the fallout tends to look the same across industries:
- Risk indicators are missed because no single team holds the full picture
- Controls are built for the risk a team already understands, while adjacent risks go unaddressed
- Business teams treat compliance as something to work around rather than with
- Duplicate screening and reporting processes waste resources without reducing actual risk
Asked whether Ericsson had solved the problem, Marc was straightforward. “I wouldn’t say solved.” With upwards of 100,000 employees and operations in 185 countries, he described it as something you stay aware of and keep working at rather than something you fix once, made easier by a clear directive from the top.
How Do You Break Down Silos in a Compliance Programme?
Build Bridge Functions, Not Bigger Departments
“How do you break down a silo? You build a bridge.” Murat Dagli
At Remitly, this takes the form of dedicated product compliance and geo-compliance teams that act as the connecting layer. Product compliance tells the financial crimes team what is coming in the pipeline and asks what risks to socialise with the business. The financial crimes team comes back with the risks identified, the minimum requirements for launch, and how those requirements change once the product scales beyond a given number of customers. Ahead of Remitly’s Brazil launch, that meant weekly meetings with the geo-compliance team for a year before going live.
Murat’s point was that these people do not need to be subject matter experts in every compliance area. They need compliance knowledge and a product owner mindset. It sits behind one of Remitly’s mantras, in his words: “compliance has to be an enabler of business, not a blocker of business.”
Move Compliance Closer to Operations
Murat’s advice, “get out of your ivory tower and actually interact day in and day out with your operations teams”, was blunt. Marc agreed, and noted that getting people out of their ‘ivory tower’ had been a mantra at Ericsson when he joined four years ago.
In practice, Murat recommended sitting in on customer service calls and paying attention to what information people volunteer without being asked. No regulation specifies that a customer will happily give a home address but balk at producing an ID within 24 hours. That kind of detail only surfaces by being present in operations, and it is what tells you where a control can be added earlier, or where one is creating friction it does not need to.
Make Business Owners Accountable for Risk
Ericsson has shifted over the past couple of years towards making the business owner responsible for the risk decisions in their area, with compliance and legal advising. The seniority of the approver is determined by the risk level of the relationship, and the highest-risk relationships go to a committee of business, compliance and legal leaders. At lower levels, if compliance advises against something and the business owner still wants to proceed, it escalates rather than stops. Marc argued that this removes the us-versus-them framing and makes the business part of compliance.
Murat made the same case from experience. The organisations he had seen work best were the ones that make business owners the owners of the risk. He gave the example of a business unit wanting to move into a new higher-risk market faster than compliance is comfortable with. Rather than blocking it outright, you set the guardrails, explain the typologies, and make the business owner accountable for the outcome. The result, according to Murat, was that they asked sharper questions before the next launch instead of after it, and come to the specialists first rather than waiting to be told.
Is a Risk-Based Approach Better Than Blanket De-Risking?
The panel also discussed the merits of a risk-based approach vs wholesale de-risking, which entails avoiding an entire market, customer segment, or product line because it carries higher compliance risk, rather than building controls to manage that risk. A risk-based approach means allocating resources in proportion to actual risk levels, applying more scrutiny to genuinely high-risk relationships and less to low-risk ones.
Regulators are largely discouraging blanket de-risking. FinCEN‘s proposed changes to Bank Secrecy Act and anti-money laundering (BSA/AML) rules indicate that companies will not be penalised for shifting resources away from low-risk areas towards high-risk ones. Regulators want to see not just that a programme exists, but that it is applied where the risk actually sits. Murat’s caveat was that the picture is not uniform. For example, recent US Treasury language on Iran effectively asks companies to divest entirely, which is a call for de-risking, so the judgement still has to be made market by market.
On cost, Murat framed the trade-off plainly: “every single company in the world has residual risk they need to manage. You cannot be completely risk-proof.” His argument for justifying the spend internally was to treat proper controls as insurance and to build the cost of failure into the business case. That cost is not just the fine. It includes:
- The regulatory penalty itself
- Legal fees tied to disclosures and remediation
- Reputational damage, particularly for publicly traded companies
- Strained relationships with banking and business partners
Murat cited a compliance multiplier estimate putting the real cost of a violation at roughly five times the headline penalty once these factors are included. Framed that way, the internal budget case for screening and due diligence tools becomes considerably easier to make.
Where Does Human Intelligence Fit Into a Cross-Functional Compliance Programme?
Everything covered above is about internal structure. But the same principle applies to how a company gathers information on the third parties it screens. As Matthew put it to the panel, in jurisdictions where public registers are unreliable and the press is not open enough to establish who owns what and who is connected to whom, you need human source work, and that can be expensive to scale. Marc’s answer was that in most jurisdictions there are ways to navigate the risk, but that the analysis has to be made market by market.
That is the layer in-country human experts exist for: not a replacement for automated screening, but the escalation point once automated screening reaches the edge of what is publicly available. It’s the same underlying lesson as the panel’s discussion: that no single source, internal or external, gives you the full picture on its own.
If you would like to watch the replay of the webinar, please click here.
Do Not Let Your Due Diligence Sit in a Silo Either
The same logic applies to how due diligence gets bought. When screening sits with one vendor, enhanced due diligence with another, and on-the-ground enquiry with a third, the silo has been rebuilt outside the organisation, and context is lost at every handover. That is where a lot of the cost sits too, in overlapping subscriptions that flag a great deal and verify very little.
GTI runs it as one programme. Controlled AI workflows handle speed, volume and pattern recognition. Analysts drawn from a network of more than 2,500 in-country experts verify the findings that need human judgement. A case escalates from screening through to investigation without changing supplier or starting the file again, under a single annual fee that typically lands well below fragmented vendor spend. Every finding traces back to a named, verifiable source, so when a red flag is challenged by a regulator, an auditor or your board, the answer is documented rather than reconstructed. The risk matrix, the scoping and the delivery are built around your risk appetite rather than a template, and the risk findings can be shared uniformly across company functions and teams.
That is what a due diligence programme you can stand behind looks like.
Book an introductory call and we will walk through how it would work against your own risk profile and third-party population.
_________________________________________________________________________
Key Takeaways
- Compliance silos happen when teams focus only on their specialist risk categories without sharing information, regardless of team size.
- Enforcement now routinely stacks multiple regulatory regimes and enforcement agencies onto a single underlying risk, particularly around cartel and sanctions-adjacent conduct.
- FCPA enforcement has not been replaced by FTO and cartel enforcement. The two increasingly overlap in the same cases.
- Fixing silos means building connective bridge roles, embedding compliance with operations, and giving business owners accountability for their own risk decisions.
- The true cost of a compliance violation runs well beyond the headline fine.