For UK and EU firms, cross-jurisdiction compliance is no longer just a legal or operational challenge, it is a strategic one. Since Brexit, businesses operating across both markets have had to manage increasing regulatory divergence while still maintaining consistent governance, strong customer outcomes, and effective risk controls. The result is a more complex compliance environment, where firms must stay alert to what is aligned, what is changing, and where local expectations now differ.
This matters most to Compliance Officers, Money Laundering Reporting Officers (MLROs) and Chief Risk Officers (CROs) who are under pressure to maintain oversight across multiple regulatory frameworks without creating duplication, inconsistency, or unnecessary cost. The central question is straightforward: how can firms build a compliance framework that works effectively across both the UK and EU while keeping pace with regulatory change?
The answer is to create a compliance model that is centrally governed, but locally responsive, one that identifies core obligations common across jurisdictions, tracks variance in a structured way, and embeds accountability for jurisdiction-specific requirements where they matter most.
Why cross-jurisdiction compliance is becoming more difficult
Many firms assumed that UK and EU compliance frameworks would remain broadly aligned after Brexit, at least in the short to medium term. In practice, while there is still substantial overlap in regulatory intent, the detail is increasingly diverging.
This divergence affects firms in several ways:
- Different regulatory timetables can create pressure on implementation planning, especially where UK and EU reforms are introduced at different times.
- Variation in supervisory expectations means the same control framework may be viewed differently by regulators in each jurisdiction.
- Differences in consumer protection, AML, governance, and operational resilience rules can create gaps if firms rely too heavily on a single “one-size-fits-all” approach.
- Inconsistent ownership across group structures can lead to blurred accountability between head office, branches, and local entities.
For firms operating in both jurisdictions, the risk is not simply non-compliance. It is fragmented compliance where policies, reporting, controls, and decision-making become harder to coordinate and defend.
What we are seeing in practice
Many firms have invested heavily in creating group-wide compliance frameworks, but those frameworks are increasingly being tested by regulatory divergence rather than regulatory change itself.
The challenge is rarely that firms lack policies. More often, they struggle to demonstrate where a group standard is sufficient, where local requirements need additional controls, and who is accountable for maintaining that distinction.
As divergence continues, firms that build governance around jurisdiction-specific differences are likely to be better placed than those relying on a single global framework.
What does effective cross-jurisdiction compliance look like?
The strongest frameworks balance consistency with flexibility. An effective approach does not mean building two entirely separate compliance frameworks. Nor does it mean forcing every jurisdiction into a uniform standard that ignores local rules. Instead, firms should aim for a model with a common control foundation supported by clearly defined local enhancements.
In practice, this means firms should be able to answer five key questions.
1. Do you know where UK and EU requirements are aligned, and where they are not?
Many firms have a reasonable grasp of major regulatory differences but less clarity on how those differences affect day-to-day compliance operations.
This is especially important in areas such as:
- AML and financial crime controls.
- Consumer and investor protection.
- Governance and Senior Management accountability.
- Operational resilience and outsourcing.
- Data protection and cross-border data handling.
- Payments, prudential requirements, and reporting obligations.
Without a structured comparison of obligations, firms often rely on assumptions that can lead to controls that are compliant in one jurisdiction but incomplete in another.
A practical starting point is to maintain a regulatory obligations map that identifies where group standards apply consistently, where UK specific requirements need to be reflected, and where EU member state rules or supervisory expectations require local adaptation. This gives firms a clearer basis for prioritising regulatory change, designing controls and evidencing how jurisdiction-specific obligations are being managed.
2. Is your governance model clear across entities and jurisdictions?
Cross-jurisdiction compliance often breaks down where governance is unclear. A group compliance team may set policy centrally, while local teams are expected to implement it. However, unless responsibilities are explicitly defined, there is a risk that important local obligations fall between the gaps.
Firms need a governance structure that makes clear:
- Who owns regulatory horizon scanning at group and local level.
- Who decides when a group policy is sufficient, and when local augmentation is needed.
- Who is accountable for regulatory engagement in each jurisdiction.
- How issues are escalated across boards, committees, and senior management functions.
This is particularly relevant where UK and EU entities share systems, controls, and oversight functions. Shared infrastructure can support efficiency, but accountability must still be jurisdictionally clear.
A robust model usually includes central standards, local attestations, and formal governance forums where regulatory changes and implementation decisions are reviewed consistently.
3. Are your policies and controls designed for divergence?
A common weakness in international compliance frameworks is the assumption that a group-wide policy is enough on its own. In reality, group policies often set the baseline, but they need supporting standards, procedures, or local addenda to reflect jurisdiction-specific rules.
For example, a firm may have one financial crime policy across the group, but still require:
- Local reporting procedures.
- Jurisdiction-specific customer risk factors.
- Different escalation thresholds.
- Country-specific training content.
- Entity-level management information.
This is where firms need discipline. If every jurisdiction creates its own documents without coordination, the framework becomes fragmented and inconsistent. Conversely, if everything is forced into one global document, local specificity gets lost.
The best approach is to define a policy architecture:
- Group policies for core principles and minimum standards.
- Control standards that translate policy into operational requirements.
- Local procedures or addenda for jurisdiction-specific obligations.
- Periodic review mechanisms to keep alignment under scrutiny.
That structure allows firms to maintain consistency without ignoring divergence.
4. Can you evidence compliance in a way each regulator will accept?
Being compliant is only part of the challenge. Firms must also be able to demonstrate compliance clearly and credibly to multiple regulators, often with different expectations around evidence, documentation, and management information.
This means firms should consider whether they can readily produce:
- A clear inventory of applicable regulations by entity.
- Board and committee reporting tailored to local obligations.
- Evidence of control testing and assurance.
- Records of regulatory change assessment and implementation.
- Decision logs where the firm chose one control approach over another.
Where evidence is weak, even well-designed frameworks can come under pressure during reviews, inspections, or thematic work.
This is one reason cross-jurisdiction compliance should not sit only within policy ownership. It also needs support from assurance, risk, and operational teams to ensure that the framework is documented, tested, and defensible.
5. Are you managing compliance strategically rather than reactively?
Firms with the strongest cross-jurisdiction compliance models are usually those that treat compliance as a strategic capability, not just a regulatory response function.
This means moving beyond periodic updates and asking broader questions, such as:
- Which regulatory changes are likely to increase divergence over the next 12 to 24 months?
- Where do we need more local expertise or local oversight?
- Which controls could be standardised further across the group?
- What reporting does senior management need to make timely decisions?
A more strategic approach helps firms avoid repeated remediation cycles and reduce the operational cost of complying across multiple regimes.
Common pitfalls for UK and EU firms
Even well-resourced firms can struggle if their framework evolves in an ad hoc way. Some of the most common pitfalls include:
- Assuming equivalence means sameness. Similar regulatory themes do not always translate into identical obligations.
- Over-centralising decision-making. Efficiency is valuable, but local nuance matters.
- Under investing in regulatory change management. Divergence is rarely a one-off exercise, it needs ongoing monitoring.
- Creating duplicated controls. Separate local responses can multiply documentation and testing unnecessarily.
- Failing to join up compliance, risk, legal, and operations. Cross-jurisdiction issues often cut across all four.
These issues can leave firms exposed not only to regulatory scrutiny, but also to slower product launches, inconsistent customer outcomes, and avoidable operational friction.
Practical steps firms should take now
For firms reviewing their cross-jurisdiction compliance framework, there are some practical actions that can make an immediate difference:
- Map core regulatory obligations across the UK and relevant EU jurisdictions.
- Identify areas of divergence that require different controls, reporting, or governance.
- Review policy architecture to ensure group standards and local requirements work together.
- Clarify accountability between central and local compliance teams.
- Assess the quality of management information and evidence available for regulatory review.
- Build regulatory change processes that track divergence on an ongoing basis rather than through one-off projects.
These steps can help firms move from fragmented compliance activity to a more mature and scalable model.
How fscom can help
At fscom, we support firms in building compliance frameworks that are practical, proportionate, and robust across multiple jurisdictions. We understand that UK and EU firms need more than high-level regulatory interpretation, they need workable solutions that reflect real operational structures, governance arrangements, and supervisory expectations.
We can help by:
- Assessing your current compliance framework to identify gaps, overlaps, and areas of regulatory divergence.
- Mapping UK and EU obligations into a clear, usable control structure.
- Reviewing governance and accountability arrangements across entities and senior management functions.
- Strengthening regulatory change processes so that new requirements are identified, assessed, and implemented effectively.
- Providing practical compliance advisory support on AML, conduct, governance, and broader risk issues.
Cross-jurisdiction compliance does not need to become a patchwork of disconnected local fixes. With the right structure, firms can create a compliance model that is both efficient and defensible, one that supports growth, protects customers, and stands up to regulatory scrutiny.
A good starting point is to assess whether your current compliance framework genuinely reflects regulatory divergence – or whether it has evolved into a collection of disconnected local solutions.
This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.
