Savvy Capital

James Downing’s career spans FINRA, JPMorganChase, Morningstar, and now JLL as Chief Compliance Officer. He’s been a regulator, an industry leader, and now an author of The Fundamentals of Compliance—a playbook for building compliance programs that balance legal expertise, data analysis, and collaboration across industries. Here's some of James' takes on the compliance profession and industry:

[1] Risk Assessments That Actually Work

“A bad risk assessment can ruin your credibility.”

Your risk register can quickly become a sea of red, e.g. at a bank where every single risk was flagged as “high” because the assessment was too complex. “I couldn’t even show it to anyone—it was useless.”

His approach?

- Focus on business-critical risks: transaction volumes, client profiles, and regulatory scrutiny.

- Document every decision: Regulators will ask “why,” and you’d better have an answer.

- Keep it adaptable: Risk assessments should evolve as your business and regulations change.

[2] How AI Will Change Compliance Monitoring Forever

James shared where he thinks AI will help and where it will break down:

What AI Does Well

- Spotting patterns: At Morningstar, James used AI to analyze massive datasets, cutting hours off manual reviews.

- Scaling efforts: AI can monitor thousands of transactions in real time, flagging risks humans might overlook.

Where It Falls Short

- Bias and testing: what AI is probably best at, unfortunately is making us believe it's correct. “You have to question AI outputs—it’s not infallible.” ask it to show you a left-handed guitarist if you're in any doubt

- Context matters: “AI can tell you there’s smoke but not if there’s fire,” James said. Without human oversight, false positives can derail efforts.

His takeaway? AI will speed up compliance monitoring but won’t replace critical thinking. Expertise in interpreting data and crafting governance frameworks will matter more than ever as departments go through scaling with AI.

[3] Winning Buy-In

Compliance isn’t about forcing rules—it’s about building trust. During his Dodd-Frank implementation days:

“When rolling out new workflows with sales teams, I didn’t just drop policies on them. I sat down, asked questions, and showed them how these changes would protect their clients and reduce risk.”

His tips for success:

- Lead with empathy: Acknowledge that compliance often adds work and explain why it matters.

- Make the why relatable: Frame policies around their real-world impact, like building client trust or avoiding reputation risks.

- Be a partner, not a dictator: Sitting next to your colleagues, not across from them, fosters collaboration and buy-in.

James’ insights go deeper in his book, The Fundamentals of Compliance—an essential read for anyone in the field.

Produced by regsage.com

MiCA's Industry Impact, with Head of Compliance @ AMLBot (ex Bitstamp & KPMG)

Mykola (Niko) Demchuk has spent years on both sides of crypto regulation helping companies get licensed at Bitstamp, auditing at KPMG, and now guiding compliance at AMLBot. He shared his take on how MiCA is reshaping the crypto industry

[1] MiCA: Consolidation or Innovation Killer?

MiCA simplifies Europe’s fragmented crypto regulation, making it easier for businesses to operate across the EU.

Passportable licenses: Get licensed in one country, operate in all 27.

Investor protection: Standardized rules make crypto safer for customers.

Lower compliance costs: Companies no longer need to navigate different laws in every country.

But MiCA’s strict requirements could drive small businesses out of the market. Many startups won’t survive the capital demands or operational oversight required. Estonia saw crypto licenses drop from 2,000 to just 45 after adopting tougher rules.

“It’s a win for safety, but the price might be less innovation,” Niko explains.

[2] Cybersecurity: Progress Comes at a Price

Crypto exchanges are no longer the easy targets they were five years ago.

Today, centralized exchanges have stepped up their game:

Only 5% of assets are stored in hot wallets for liquidity; the rest sits safely in cold storage.

MiCA mandates measures like penetration tests, making it nearly impossible for hackers to breach well-run exchanges.

But it’s not all good news.

DeFi protocols remain vulnerable. As Niko puts it, “DeFi is still the wild west, mixers, tumblers, and no regulation.”

Hackers adapt fast: Cybercriminals are constantly refining their tactics, from deepfakes to advanced laundering techniques.

Niko’s take on Tornado Cash: “It’s write code, release it, launder million... until OFAC ruins your coding career.”

[3] Jurisdiction Shopping: Who Wins in the MiCA Era?

Before MiCA, crypto businesses flocked to countries like Poland and Czechia for easy licensing.

- Poland: Two weeks to register and start operations.

- Czechia: No real application review process.

MiCA changes everything. Startups now need to consider:

- Speed and clarity of regulatory approvals.

- Availability of compliance professionals.

- Local governments’ willingness to engage with crypto.

Countries like Lithuania and Malta could become new crypto hubs. “Jurisdictions that adapt fast will attract the most businesses,” Niko predicts.

[4] Inside a Real Crypto AML Investigation

Time to action is possibly the only way to recover funds for victims.

Mixers and tumblers are the real challenges as they obscure fund movement, and victims responding too slowly to prevent further laundering.

“Once the money hits a mixer, recovery becomes exponentially harder,” Niko says.

Kamil Jaworski, ex-Citi, BNP, EY, and now driving compliance innovation at Provenance, has seen it all when it comes to KYC.

From manual KYC headaches to AI-powered eKYC, he breaks down the industry’s transformation, what works, and what still keeps compliance officers awake at night.

[1] We’ve Come a Long Way (Remember the 90s?)

Back in the 90s, KYC was a disaster. Paper everywhere, certified docs snail-mailed, and compliance teams drowning in repetitive tasks.

Kamil remembers risk assessments being hilariously simple: “If you were from a high-risk country, you were high risk. No nuance.”

Then came the 2000s and the risk-based approach (RBA), well sort of .... “By 2013, some firms swore they were using RBA. Spoiler: they weren’t.” - Kamil.

[2] eKYC: Faster, Smarter, Cheaper

Manual KYC? RIP. eKYC is the ultimate efficiency hack. What used to take 100 people now takes 20. Costs? Down by millions. Turnaround time? From weeks to minutes.

A fund administrator once spent €48 million annually on account opening, with teams slogging through Excel spreadsheets. Today, OCR tech and AI handle everything—from extracting data off passports to flagging anomalies—automatically.

E.g. “AI flagged a forged passport last week,” Kamil says. “It noticed the machine-readable zone didn’t match the gender. A human wouldn’t have caught that without hours of digging.”

eKYC isn’t just faster—it’s smarter. Integrated with global databases, it checks addresses, validates IPs, and reduces errors to almost zero. It’s like swapping a flip phone for an iPhone overnight.

[3] What Can/Will Go Wrong With KYC Implementations Today?

1. Dodgy Vendors: “Pick your provider carefully,” he warns. He recalls a firm stuck in limbo when their eKYC system crashed, and the vendor ghosted them for a week. “Cheaper isn’t always better.”

2. “Don’t fire the humans just yet,” - AI is great, but it’s not Sherlock Holmes. Subtle red flags—like tone or behavior—need human eyes. Kamil quips.

3. “Your system needs to be as sharp as their tricks” - Deepfakes and AI-powered scams mean fraudsters are always one step ahead.

Despite the risks, Kamil believes eKYC is non-negotiable for survival. “The future isn’t just paperless—it’s fraud-proof. But only if you do it right.”

Paul Munson, MLRO & CCO at Rippling UK, ex-HMRC investigator, Serious Fraud Office corruption lead, and FCA financial crime expert, shares what’s naughty and nice in AML, crypto regulations, and compliance tech.

Here's what we covered:

[1] It’s Not All Christmas Cheer For Regulators When It Comes To Crypto

UK authorities can now seize crypto, but storing volatile assets safely? That’s a logistical nightmare.

Crypto and AI don't often intersect, but they do for fraudsters riding the AI powered crypto scams wave, keeping compliance teams up at night.

The FCA’s stricter promotion rules are the Christmas crackers forcing crypto firms to improve their practices.

[2] A Festive KYC Overhaul

SAR Overload: 900,000 reports a year? Santa has fewer letters to read. Let’s trim the list and focus on the big-ticket cases.

Blockchain as the North Star: Reusable blockchain-based IDs could guide compliance teams to faster, more secure checks.

Zero-Knowledge Proofs: A Christmas miracle for privacy, verifying identities without exposing personal data—but wallet ownership? Still a puzzle.

[3] UK vs. EU: Diverging Paths

How Brexit shaped two very different approaches to compliance.

UK’s Full Regulation: FCA demands robust controls, ensuring safety but potentially stifling innovation.

Europe’s AMLA Bet: A unified approach promises efficiency but faces hurdles in harmonizing local practices.

The ID Advantage: Europe’s ID systems streamline KYC, leaving the UK playing catch-up.

Produced by regsage.com

What regulators don't get about staking - it's not about yield, it's about security.

I recently had Matt McGuire, partner at Arktouros pllc and former Shopify regulatory lead, on the podcast to unpack the challenges of crypto compliance, the evolving role of DeFi, and why regulators need to rethink staking and cross-chain compliance strategies.

Here are the highlights from our discussion:

[1] The Regulatory Lag in Crypto Compliance

"Blockchain is inherently transparent, but regulators haven’t adapted to its global, borderless nature" - Matt

Legacy frameworks designed for geographically-bound finance struggle to keep pace with decentralized systems.

The result? A compliance paradox where Web3 companies are forced to hold sensitive user data they don’t want, increasing liability without improving security.

[2] Staking: Misunderstood and Overregulated

Staking’s primary purpose is securing blockchain networks, but it’s being mischaracterized as a yield-based investment.

"This isn’t a traditional investment contract—it’s a core security mechanism," - Matt

Missteps in regulation could stifle innovation, especially as staking adoption grows across the ecosystem.

[3] Cross-Chain Compliance: A Need for Unified Standards

The fragmented regulatory landscape is holding back interoperability, the backbone of DeFi’s future.

Technologies like zero-knowledge proofs could enable privacy-preserving compliance by verifying identities without exposing personal data.

"Crypto offers unprecedented transparency, yet we’re still trying to apply legacy financial compliance models to it." - Matt

Produced by regsage.com

42 years in compliance with names like Citigroup, GE Capital, and Flagstar Bank—Ross Marrazzo shared the tea on the real challenges facing AML compliance teams and what’s likely happening at TD Bank right now:

[1] Boards Are Dropping The Ball

“You can have the best compliance officer in the world, but if the board and CEO aren’t aligned, the whole thing fails,” Ross said.

Boards often lack the expertise to make sense of compliance reports.

Everyone’s focused on short-term profits, not long-term risk.

SAR filings? Mostly a box-ticking exercise—no one’s digging into what they really mean.

[2] Data Is A Total Mess And Undermining AML Efforts

"Every bank has data issues," Ross explained. Without solid data, compliance teams are flying blind.

Junk data floods systems with false positives, overwhelming teams.

IT teams don’t understand AML, so systems are misaligned with real-world risks.

Upgrades? Rare and often botched because banks skimp on funding.

[3] Fines Hurt Employees, Not Culture

"Fines hit employees harder than the bank itself," Ross said, calling out a major flaw in enforcement actions.

Banks go on hiring sprees after fines, but it’s more about optics than fixing problems.

Those new hires? Gone once the crisis cools down, leaving compliance weaker than before.

Meanwhile, boards and execs face zero personal accountability.

Here's the full conversation with Ross on The Compliance Report, link in comments.

Produced by regsage.com

I spoke to Kash, Chief Compliance Officer at Charles Schwab UK, to dig into the real-world impact of blockchain in the investment space. We covered real-time settlements, tokenization of assets, stablecoins vs. CBDCs, and how next-generation data feeds could revolutionize investment strategies.

[1] Can TradFi and DeFi Find Common Ground?

One of the biggest headaches we unpacked? How DeFi’s pseudonymous setup butts heads with TradFi’s strict KYC rules.

Kash summed it up perfectly: “Blockchain’s transparency is a game-changer, but anonymity in wallets? That’s a compliance nightmare.”

While tools like AI-driven wallet monitoring are making strides, the lack of global regulatory alignment keeps the risks, especially in cross-border transactions, very real. The tech is racing ahead, but the rulebook? Still trying to catch up.

[2] Tokenization: A Gateway to Accessible and Liquid Markets

Kash highlighted the potential of tokenizing real-world assets, from real estate to equity portfolios, to democratize markets and boost liquidity. "Tokenization could open previously exclusive markets to new investors," he said. But he also flagged risks like fraud and governance challenges.

[3] Stablecoins and CBDCs: Stability or Trade-Offs?

We dug into the stablecoin debate, where Kash noted both promise and pitfalls. "Stablecoins aim to reduce crypto’s volatility, but recent collapses show their reliability isn’t guaranteed," he said. CBDCs, while potentially more stable under government control, could erode privacy and decentralization.

Regulators and developers must strike a balance between centralization and the ethos of decentralization.

[4] Instant settlements - An AML headache

Blockchain’s ability to enable near-instant transaction settlements could revolutionize trading, but Kash flagged compliance challenges - "Speed is critical for cross-border transactions, but it also shortens the time for fraud detection and AML checks".

Institutions need to rethink oversight mechanisms to keep up with these rapid changes or risk gaps in control systems.

[5] How real-time blockchain data feeds can transform investing

“High-quality data streams could fix pricing inefficiencies and boost fraud detection” - Kash

This kind of transparency has the potential to make smarter, faster investment decisions the norm. But there’s a flip side. Without strong governance, these feeds could introduce new risks. Data accuracy and accountability need to be top priorities, or we risk trading one inefficiency for another.

Is Crypto Sacrificing Its Superpower to Join the TradFi Club?Here’s the TLDR from my conversation with Sebastian Heine, Chief Compliance Officer at MANTRA, with a career spanning Credit Suisse, KPMG, and eToro.

[1] Compromises That Could Undermine Crypto’s Core Principles

The collision of TradFi and crypto isn’t just about operational hurdles—it’s at times forcing crypto to compromise its foundational promises—a permissionless and anonymous transaction method. Regulators aren’t budging, and that’s creating friction.

[2] Realizing Crypto’s Speed Promise in the Real World

Crypto’s biggest flex—speed—is starting to be realized in real-world use cases. We've all seen how a basic SEPA transfer can take over a day, while a crypto transaction will clear in minutes.

[3] Real-World Applications of Tokenization Face Blockers

Tokenizing real-world assets like real estate is one of crypto’s most promising use cases, but the road isn’t smooth. While the UAE is a leader in enabling seamless real estate tokenization, countries like Germany remain bogged down by bureaucracy. Without scalable liquidity solutions, tokenized assets could remain a niche rather than a mainstream breakthrough.

[4] Staking Regulation: A Confusing Patchwork

Staking remains a regulatory gray zone, with wildly different rules depending on where you are. Sebastian discussed how the SEC’s crackdown on staking at Kraken exposed inconsistencies in the U.S., while Singapore’s ban on retail staking left compliance teams guessing.

[5] Dubai: A Front-of-House Leader in Crypto

Dubai’s proactive approach to crypto regulation is positioning it as a global leader. However, while Dubai excels in front-of-house efforts like regulation and promotion, it still needs more developer talent to solidify its role as a true crypto powerhouseFor the full conversation on tokenization, staking, and how compliance teams are navigating this evolving landscape, check out the full episode in the comments.

When I spoke with Ignacio González-Páramo, Head of Global Compliance at Papaya Global, one thing stood out: compliance professionals are wearing more hats than ever, and they’re doing it at a breakneck pace. Despite the growing demands—regulatory data overload, cross-border headaches, and the need to master tech on top of law and strategy—the core mission of safeguarding our financial ecosystem remains front and center. Honestly, it’s bloody brilliant to see this energy to combat the bad actors in finance.

Here's the TLDR from our conversation:

[1] We're operating in the era of outcome-based compliance

Compliance teams are under constant pressure to adapt to changing demands. Ignacio highlighted a major shift—regulators are moving from prescriptive rules to outcome-focused frameworks. Instead of rigid checklists, compliance now requires creativity and adaptability to meet goals without sacrificing ethics or efficiency.

[2] How to turn compliance into a growth driver

Gone are the days when compliance was seen as just a “necessary evil.” Ignacio stressed how it’s becoming a competitive advantage—helping scale-ups build trust, expand into new markets, and even drive product innovation. Compliance done right isn’t a blocker; it’s a booster.

[3] AI and automation aren’t just nice-to-haves

Automation has evolved from being a helpful tool to a regulatory expectation. From transaction monitoring to horizon scanning, advanced tech like AI and machine learning are revolutionizing how compliance teams handle massive data loads while minimizing false positives. It’s efficiency at scale.

[4] Today’s compliance pros are like Swiss army knives

Ignacio didn’t mince words: Modern compliance leaders need to juggle law, tech, and business strategy—a hybrid role that demands agility. It’s not just about knowing the rules anymore; it’s about driving value and making compliance a growth enabler.

[5] Taming the regulatory avalanche with tech

With handbooks that run into the thousands of pages, regulatory overload is real. Ignacio’s advice? Leverage tools like horizon scanners to cut through the noise, so teams focus on what actually matters—and keep their sanity intact.

What are the real blockers for crypto in the TradFi world? We got Marcus Molleskov, Chief Risk Compliance Officer at Januar, to give us his no-nonsense take on how the industry can break into traditional finance and what’s standing in the way. Here’s what we covered:

[1] Banks Just Don’t Want to Know
Even fully compliant crypto firms are hitting a wall with banks. Marcus explains why risk-averse banks don’t want to touch them, no matter how legit they are.

[2] MiCA: The Good, the Bad, and the Booted
Europe’s MiCA regulations aren’t just weeding out the bad players; they’re also targeting those who simply aren’t up to snuff. Marcus breaks down why good intentions just don’t cut it anymore.

[3] Denmark’s DeFi Playbook
Denmark’s approach to DeFi regulation might be a game-changer. Instead of cracking down on the tech itself, they’re going after interfaces, and Marcus thinks it’s a smart way to balance innovation with compliance.

[4] Tokenization’s GDP Game Changer
Tokenized assets could reshape economic growth by speeding up settlement times. Marcus explains how faster liquidity could mean more money moving through the economy and why he’s excited about it.

[5] Digital ID and the Future of KYC
Imagine one digital ID across Europe, ending the hassle of repetitive KYC checks. Marcus sees it as a potential breakthrough, but we’re not there just yet.