Small and medium sized financial institutions are a vital part of the financial system, yet they often present disproportionately higher AML and financial crime risk. This risk is rarely driven by poor intent. Instead, it stems from structural and budgetary constraints that limit investment in compliance infrastructure, including people, systems, and governance.

While regulators recognise proportionality, they are clear that expectations do not reduce simply because an institution is smaller. Where controls are under-resourced or poorly governed, the likelihood of undetected money laundering, supervisory criticism, and enforcement action increases significantly.

Resource Constraints and the Reality of Compliance Delivery

In many small and medium sized institutions, compliance functions operate with minimal staffing and limited technology support. One or two individuals may be responsible for AML, sanctions, fraud, training, regulatory reporting, internal policy development, and regulator engagement.

This concentration of responsibility creates operational fragility. Compliance teams have limited capacity to perform proactive risk assessments, thematic reviews, or control testing. Work becomes reactive, deadlines are constant, and quality assurance is often deprioritised in favour of keeping pace with daily operational demands.

Technology constraints further exacerbate the issue. Manual processes, spreadsheets, and basic monitoring tools struggle to detect complex typologies or provide defensible audit trails. As transaction volumes or product complexity increase, these weaknesses become more pronounced and more visible to both criminals and regulators.

Blurred Lines Between Line 1 and Line 2 Responsibilities

A common structural issue in smaller institutions is the erosion of the three lines of defence. Due to resource constraints, compliance teams are frequently required to perform Line 1 activities, including:

• Customer onboarding
• Collection and review of KYC documentation
• Periodic customer file updates
• Initial transaction reviews

While this may appear efficient, it creates material risk. When compliance both executes and oversees controls, independence is compromised. The ability to provide effective challenge, escalate issues objectively, or evidence independent oversight is weakened.

This risk is compounded where compliance reports directly to the CEO or Managing Director, who is typically focused on Line 1 objectives such as growth, revenue, and operational delivery. Even with strong leadership intent, this structure can suppress challenge, delay escalation, and prioritise commercial considerations over risk management.

Impact on Compliance Professionals

These structural weaknesses have a direct and often severe impact on compliance professionals working within small and medium sized institutions.

High workloads, limited support, and constant regulatory pressure create elevated stress levels. Compliance officers are expected to manage complex regulatory obligations while simultaneously performing operational tasks traditionally owned by the business.

Compensation often does not reflect this burden. In many cases, compliance professionals in smaller institutions receive lower pay than peers in larger organisations, despite carrying broader responsibility, higher personal accountability, and increased regulatory exposure.

The result is high turnover, burnout, and loss of institutional knowledge. When experienced compliance staff leave, already fragile frameworks weaken further, increasing risk and perpetuating a cycle of underinvestment and regulatory vulnerability.

Why Regulators Pay Close Attention

Supervisors increasingly focus on smaller institutions not because of their size, but because of their susceptibility to exploitation. Criminal networks actively target firms where controls are manual, oversight is weak, and compliance functions lack independence.

Regulators are explicit that budgetary constraints are not an acceptable defence. Institutions are expected to make conscious, risk based decisions about how resources are allocated and how governance is structured.

Effective compliance does not require the infrastructure of a global bank, but it does require intentional design. Smaller institutions can materially reduce risk by:

• Preserving clear separation between Line 1 execution and Line 2 oversight
• Ensuring compliance has direct access to the board or independent committees
• Leveraging external expertise or managed services where appropriate
• Investing selectively in scalable, defensible technology
• Protecting compliance capacity from being consumed by operational tasks

Most importantly, leadership must recognise that overloading compliance is itself a risk.