Introduction: When compliance isn’t the problem – culture Is.
Every compliance failure begins long before the breach.
It starts with a small compromise – a decision justified “just this once”, a silence mistaken for agreement, a shortcut disguised as pragmatism.
These aren’t lapses in process; they’re fractures in culture. And in 2025, that distinction has become the defining fault line of governance.
Across the UK’s regulatory landscape, the message is consistent: culture is not a soft issue. The Financial Conduct Authority’s latest plans and public speeches have both placed culture, conduct, and accountability among its top supervisory priorities. In its February 2025 speech, “Culture is Contagious”, the FCA warned that weak culture remains a root cause of serious conduct failings, urging firms to embed healthy challenge as a daily discipline rather than a compliance exercise.
Culture is now the next compliance crisis, not because firms ignore it, but because too many assume it’s under control.
Why Now: From Policy to Proof
The shift in regulatory tone is unmistakable.
After years of post-crisis focus on capital, liquidity and systems, attention has moved decisively towards behaviour.
The FCA’s ongoing review of non-financial misconduct, the Prudential Regulation Authority’s renewed scrutiny of governance and accountability, and the Financial Reporting Council’s updates to its Corporate Governance Code all converge on one point: how organisations behave matters as much as what they report.
Cultural governance has become a measurable expectation. Boards are expected to demonstrate how values translate into decision-making, how accountability is cascaded through the firm, and how psychological safety is maintained – particularly in hybrid or high-pressure environments.
For risk and compliance leaders, this means shifting from collecting evidence of activity to producing evidence of integrity.
The Drift Effect: How Complacency Becomes Risk
Culture rarely fails overnight; it drifts.
The erosion begins quietly with a tolerance for missed controls, a reluctance to challenge senior voices, a growing distance between written policy and lived behaviour.
In practice, this drift looks like compliance theatre: spotless paperwork masking weak oversight, or dashboards so crowded with metrics that no one spots the real signal.
It’s the same pattern seen in multiple recent enforcement cases. Not a lack of rules, but a lack of reflection.
Research from major consultancies and regulators through 2024 paints a consistent picture: while most UK financial firms claim to measure culture, few can explain how the results inform board decisions. Many equate low levels of whistleblowing with success, when in reality it may signal mistrust or fatigue.
Complacency isn’t always cynical, it’s cultural gravity. Left unchecked, it pulls standards slowly downward until normalisation becomes risk in disguise.
The Illusion of Ethical Comfort
There’s comfort in compliance.
Dashboards, reports and metrics create a sense of order. But the danger lies in mistaking silence for stability.
A quiet culture is not necessarily a healthy one. A lack of internal challenges or near-miss reporting can indicate disengagement, not strength. When staff no longer raise concerns, it’s usually not because everything is fine, it’s because they’ve stopped believing it will make a difference.
In 2025, regulators are increasingly attuned to this illusion. The FCA and FRC have both warned that positive survey results and polished conduct statements often mask weak behavioural evidence. The real question for boards isn’t “Do we have an ethical culture?” but “Can we prove it works under pressure?”
Culture by Design, Not Default
The strongest firms treat culture as a control environment – designed, maintained, and tested. They recognise that tone from the top matters only if it reaches the middle. Middle managers decide whether escalation feels safe, whether mistakes are surfaced or buried, and whether challenge is welcomed or penalised.
The FRC’s 2024 Annual Review of Corporate Governance Reporting warned that many boards are “overconfident” in their cultural oversight, relying on narrative statements rather than behavioural evidence. That’s the gap between culture as communication and culture as governance.
Getting it right requires clarity of ownership: culture isn’t an HR responsibility, nor purely a compliance one. It’s a collective discipline. It means alignment between tone and tolerance: the behaviours leaders ignore are as influential as those they reward. And it means measurement: using conduct MI, attrition trends, customer complaints, and speak-up health checks as hard data points, not anecdotes.
Boards that get this right don’t chase perfection; they create feedback loops. They reward learning from failure, not concealment of it.
What Good Looks Like
In the best-performing organisations, culture has become a living system.
Risk functions feed insights from audits and incidents directly into board discussions. HR and compliance teams collaborate to build “behavioural dashboards” that track trends over time.
Non-financial misconduct is treated with the same seriousness as financial breaches, underpinned by clear accountability under the Senior Managers and Certification Regime.
These firms don’t talk about embedding values, they test them.
They rehearse decision-making under pressure, challenge tone-from-the-top assumptions, and ensure integrity isn’t a poster value but a performance measure.
Crucially, they see culture not as cost, but as resilience – a competitive differentiator that protects both brand and licence to operate.
Final Word: The Quietest Risk of All
When governance breaks down, it rarely starts with data or controls.
It starts with deference. With fatigue. With the quiet acceptance that “this is how things are.”
The cost of complacency isn’t scandal, it’s erosion.
Erosion of trust, of judgment, and of the moral infrastructure that holds good governance together.
As regulatory scrutiny intensifies, the firms that thrive will be those that treat culture not as a compliance narrative, but as a strategic asset – something measured, managed and challenged with intention.
Why? Because culture is no longer the soft side of compliance.
It’s the hardest edge of risk.
Stay up to date with the latest stories from the world of governance, risk, audit and compliance >>>
