20 October 2026

Introduction to

Compliance Law

If the expression “Compliance Law” ¹ were to be described as “all those regulations by virtue of which an undertaking would be required to assess, adopt, and enforce, within its business and trade, an overriding public interest as if it were one of its own governance or profit-making purposes”, certainly the industry and the public, particularly in common law jurisdictions, would always react with a considerable amount of surprise, if not outright challenge and scrutiny.

In fact, as it would certainly be observed, in its essence “compliance” would not amount to anything other than the mere “act of obeying a law or rule, especially one that controls a particular industry or type of work”, as specified by the Cambridge Dictionary - and further illustrated with the rather powerful example of: “this cake was made in strict compliance with its recipe” - from which the industry, thereafter, went to frame its own understanding of the term as the “specific requirements applicable to a service or product intended to be made available to the public or in a public market” or even more broadly, expanding into the field of due diligence, as “all the actions meant to assure and protect the business against any unforeseen risks whatever their nature.

That just as civil and commercial law were to stand as the law of individuals, prescribing and proscribing their actions and behaviour, “compliance law”, in turn, would stand as the law of products and services, thereby requiring, to name but a few examples, lawyers to offer their legal services in accordance with applicable professional ethics (conflict of interest, independence, probity, good faith, etc.), manufacturers to offer their toys, electrical devices, cosmetics, or medicines only after properly ensuring that they would be void of any hazards to the public (product compliance) or even after been submited to regulatory homologation and approval, or financial institutions to concede their loans or undertake their investments without breaching their applicable minimum capital requirements and, therefore, risking their own clients solvency.

Yet, ² as all of such statements cannot be denied and, therefore, conceded that, at least by default, compliance law must also be acknowledged as the legal regime governing the public marketing of certain products and services (the "law of the regulated markets", as some may say) — it must equally be outlined that at the same time, such a narrow description of the term does nonetheless fail to express the true substance, legal purpose, and fundamental structure that is now lying at the heart of many compliance regulations, as soundly demonstrated by legal requirements such as “risk assessment”, “risk-based approach”, “risk ownership”, or even, most extraordinarily, as by the criminal offense recently enacted in the UK, of “failure to prevent” a designated offense.

As a result, if compliance would be - or had become into - the mere action of following a standard - as if baking a cake - what risk would, therefore, be there to exist? Why would compliance regulations ask us to assess a given risk if all that we are required to do is simply to adopt, follow and conform with a given standard or parameter?