The Regulatory Risk Explosion: Why Compliance Is Now a Strategic Function

 

FATF, the OECD, the EU, the IMF, and a generation of domestic regulators are all tightening simultaneously. The Caribbean’s compliance landscape has been fundamentally transformed in the past decade — and the transformation is not complete. Organisations that treat regulatory compliance as a back-office cost centre are misreading the risk environment. Compliance is now a strategic function, and the boards that have not yet understood this are governing in the dark.

CARISK™ Series — Article 5 of 10  |  April 2026

CARISK™ CARIBBEAN REGULATORY RISK LANDSCAPE — DOMAIN 3 DEEP DIVE

Regulatory Risk Driver	Regional Status	Trajectory	Most Exposed Sectors
FATF AML/CFT Compliance	HIGH	ACCELERATING	Financial services, real estate, legal & advisory, gaming, CBI operators
OECD/EU Tax Transparency (CRS/FATCA/BEPS)	HIGH	ACCELERATING	IBC/offshore structures, financial institutions, multinational enterprises
EU Non-Cooperative Jurisdictions List	MODERATE	INTENSIFYING	Offshore financial centres, professional services, correspondent banking
Data Protection & Privacy Regulation	MODERATE	ACCELERATING	BPO, financial services, healthcare, e-commerce, digital platforms
Environmental & ESG Reporting Requirements	MODERATE	ACCELERATING	Energy, tourism, manufacturing, financial sector (lender ESG obligations)
Domestic Tax Enforcement Intensification	HIGH	INTENSIFYING	All sectors; transfer pricing, beneficial ownership, and withholding tax focus
Sector-Specific Financial Services Regulation	HIGH	INTENSIFYING	Banks, credit unions, insurance, securities dealers, money services businesses
Beneficial Ownership & Corporate Transparency	MODERATE	ACCELERATING	All incorporated entities; private equity, family offices, holding structures

 

There is a defining moment in the compliance journey of every Caribbean organisation — the moment when the board realises that what they understood as a back-office administrative function has become a strategic risk of the first order. For some boards, that moment arrives when a regulatory enforcement action lands. For others, it arrives when a correspondent bank terminates a relationship, or when an international investor raises compliance concerns during due diligence, or when a key member of staff resigns because they are unwilling to operate in an environment of regulatory ambiguity. For the boards that are paying attention, that moment arrives before any of these events — because they are reading the regulatory landscape with the same rigour they apply to their financial and market intelligence.

This article, the fifth in the CARISK™ series, examines the regulatory and compliance risk domain that sits at the intersection of every country risk assessment we have examined in this series. Whether we are assessing Jamaica, Trinidad and Tobago, Barbados, or the OECS states, the regulatory risk dimension has emerged as one of the most dynamic, rapidly evolving, and consequential risk factors facing Caribbean enterprises today. The CARISK™ Regulatory & Compliance Risk domain rates as MODERATE to HIGH across virtually every territory in our assessment universe — and in every territory, the trajectory is accelerating, not stabilising.

Understanding why this is happening, what it means in practice for Caribbean organisations, and what the governance disciplines required to manage it look like — that is the purpose of this article.

The Architecture of Caribbean Regulatory Transformation

The regulatory transformation of the Caribbean over the past fifteen years has been driven by a convergence of international and domestic forces that, together, have fundamentally altered the compliance environment in which Caribbean businesses and institutions operate. To understand where the Caribbean regulatory landscape is today, it is necessary to understand the four engines that have driven this transformation.

Engine 1: The FATF AML/CFT Regime

The Financial Action Task Force — the global standard-setter for anti-money laundering and counter-terrorism financing — has been the single most powerful driver of regulatory change in the Caribbean over the past decade. The FATF’s mutual evaluation process, which assesses countries against the FATF Forty Recommendations and rates their technical compliance and effectiveness, has produced a series of assessments of Caribbean jurisdictions that have identified significant gaps in AML/CFT frameworks and triggered sustained programmes of legislative and institutional reform.

The consequences of FATF grey-listing — placement on the list of jurisdictions under increased monitoring — have been severe for the jurisdictions that have experienced it. Trinidad and Tobago’s 2018 grey-listing accelerated regulatory reform but simultaneously contributed to correspondent banking de-risking that reduced the availability and increased the cost of international banking services for T&T financial institutions. Jamaica’s 2020 FATF mutual evaluation identified significant gaps in the effectiveness of its AML/CFT regime. Belize has navigated its own FATF engagement. Haiti has faced some of the most severe FATF-related financial exclusion consequences in the region.

For Caribbean financial institutions, professional service firms, real estate operators, and Designated Non-Financial Businesses and Professions (DNFBPs) — which include lawyers, accountants, notaries, real estate agents, dealers in precious metals and stones, and trust and company service providers — FATF compliance has moved from a theoretical regulatory obligation to an operational imperative with direct consequences for the ability to maintain banking relationships, attract institutional clients, and operate without regulatory sanction. The standard is no longer whether the laws exist on paper; it is whether the controls are implemented in practice, whether they are proportionate to the actual risk, and whether they are demonstrably effective.

Engine 2: OECD/EU Tax Transparency Architecture

The OECD’s Base Erosion and Profit Shifting (BEPS) project and the EU’s Code of Conduct on business taxation have combined to produce a sustained restructuring of the international tax planning environment that directly affects Caribbean jurisdictions that have historically competed for mobile capital on the basis of low or zero tax rates and minimal information exchange.

The Common Reporting Standard (CRS) — under which over 100 jurisdictions now automatically exchange financial account information with each other — has eliminated the effective secrecy that formerly characterised offshore financial structures in many Caribbean jurisdictions. FATCA has imposed US reporting requirements on Caribbean financial institutions that hold accounts for US persons. The OECD’s Pillar Two framework — which establishes a global minimum corporate tax rate of 15 percent — is progressively narrowing the tax rate differential that motivated some offshore structuring in the first place.

The EU’s list of non-cooperative jurisdictions for tax purposes has created a compliance and reputational pressure point for Caribbean offshore financial centres: jurisdictions that appear on the EU blacklist face EU-wide defensive measures that can include enhanced withholding taxes on payments to entities in those jurisdictions, which significantly affects their attractiveness as holding or financing locations for European-owned structures. The process of achieving and maintaining removal from this list has consumed significant regulatory and legislative capacity across Caribbean governments and has driven fundamental reforms to tax incentive frameworks, economic substance requirements, and information exchange commitments.

“The OECD tax transparency architecture has not simply changed the rules for offshore structures. It has changed the underlying logic of what makes a Caribbean jurisdiction valuable as a business location — from secrecy and low tax rates to genuine substance and regulatory credibility.”

Engine 3: Correspondent Banking De-Risking

One of the most significant and underappreciated regulatory risk consequences for Caribbean economies has been the progressive withdrawal of correspondent banking relationships by major international banks. Correspondent banking — the arrangements through which Caribbean banks access the international financial system for cross-border payments, trade finance, and foreign currency transactions — has been dramatically restructured as major US, UK, and European banks have assessed the compliance cost and regulatory risk of maintaining these relationships against the revenues they generate.

The decision by major international banks to reduce or terminate correspondent banking relationships with Caribbean financial institutions has not been driven by any specific regulatory action against Caribbean banks. It has been driven by the risk management calculus of the correspondent banks themselves: in an environment where regulators impose multi-billion dollar penalties for AML/CFT failures — as US regulators have done with multiple major international banks — the compliance cost of maintaining correspondent relationships with smaller, higher-risk-profile jurisdictions has been assessed as exceeding the commercial return.

The consequences for Caribbean economies have been material. Reduced correspondent banking access has increased the cost and complexity of international transactions, created gaps in trade finance availability, and in some cases forced Caribbean businesses to route international payments through multiple correspondent relationships at significantly higher cost. For Caribbean financial institutions themselves, the loss of correspondent relationships — or the threat of losing them — has created a compliance imperative that supersedes almost every other business consideration: maintaining the correspondent relationships upon which the ability to operate internationally depends requires demonstrably high AML/CFT compliance standards, regardless of the cost.

Engine 4: Domestic Regulatory Maturation

Alongside the international compliance drivers, domestic regulatory frameworks across Caribbean territories have themselves been maturing in ways that create increasing compliance obligations for Caribbean enterprises. Tax administration authorities in Jamaica, Trinidad and Tobago, Barbados, and other territories have invested in analytical capabilities — data matching, risk profiling, transfer pricing analysis, and beneficial ownership databases — that enable more sophisticated and more effective identification of non-compliance. The era in which a Caribbean business could operate with significant informal practices and face minimal detection risk is ending.

Data protection legislation, modelled variously on the EU’s General Data Protection Regulation (GDPR) and the UK Data Protection Act, has been enacted or is in progress across multiple Caribbean jurisdictions. These frameworks create compliance obligations for any organisation that collects, processes, or stores personal data of individuals in the jurisdiction — including requirements around data subject rights, data breach notification, data transfer restrictions, and documentation of processing activities. For BPO operators, financial institutions, healthcare providers, and e-commerce businesses, data protection compliance has moved from an anticipated future obligation to a current legal requirement in most of the territories in which they operate.

The Six Compliance Risk Pressure Points That Every Caribbean Board Must Understand

From the CARISK™ assessment of regulatory risk across all fifteen primary Caribbean territories, six specific compliance risk pressure points emerge as the most material and most broadly applicable across sectors and jurisdictions. These are the issues that Caribbean boards need to own — not delegate entirely to management and legal counsel — because their strategic implications extend well beyond the compliance function.

1. AML/CFT Programme Effectiveness

The standard for AML/CFT compliance in the Caribbean has shifted decisively from technical compliance — having the policies, procedures, and forms in place — to demonstrated effectiveness: evidence that the programme actually identifies suspicious activity, that it is proportionate to the risk, that it is applied consistently by trained staff, and that it is actively monitored and improved. The FATF’s effectiveness assessment methodology evaluates eleven immediate outcomes, and a programme that scores well on technical compliance but poorly on effectiveness will produce an adverse assessment.

For Caribbean financial institutions and DNFBPs, the practical implications are significant. Customer due diligence must be risk-based and documented, not formulaic. Beneficial ownership must be identified to the ultimate natural person level. Suspicious activity reporting must be genuine and timely, not a compliance formality. Staff training must be current, relevant, and evidenced. And the compliance function must have the seniority, independence, and resources to function effectively — not as a box-ticking exercise but as a genuine risk management discipline. Boards should regularly receive reporting on AML/CFT programme effectiveness, not merely confirmation of policy existence.

2. Beneficial Ownership Transparency

The drive toward beneficial ownership transparency has been one of the most significant structural changes in the Caribbean compliance landscape. Multiple Caribbean jurisdictions have established or are establishing beneficial ownership registers — databases that record the ultimate natural person beneficial owners of companies, partnerships, trusts, and other legal entities incorporated or registered in the jurisdiction. These registers are increasingly accessible to law enforcement and tax authorities, and are progressively moving toward broader transparency in jurisdictions that have committed to public registers under international agreements.

For Caribbean businesses and their advisors, beneficial ownership transparency requirements create specific compliance obligations: the obligation to identify and record beneficial owners accurately, to update registrations when ownership changes, and to maintain documentation that supports the beneficial ownership information provided. Structures that were designed with opacity as a feature — whether for legitimate privacy reasons or for less legitimate purposes — face a fundamental regulatory environment that is progressively less accommodating of opacity, regardless of intent.

3. Tax Compliance in the Transfer Pricing Era

Caribbean jurisdictions with significant cross-border business activity — Jamaica, Trinidad and Tobago, Barbados, and others — have enacted transfer pricing regulations that require related-party transactions to be priced on an arm’s length basis and documented in contemporaneous transfer pricing studies. The enforcement of these regulations has been uneven in the early years of implementation, but the trend is unmistakably toward more active audit and enforcement as tax authority capacity develops and international cooperation mechanisms improve.

For Caribbean enterprises with related-party transactions — whether between local entities, with offshore holding companies, with regional affiliates, or with parent companies in other jurisdictions — the absence of current, documented transfer pricing policies is a compliance gap that creates audit risk and potential penalty exposure. Transfer pricing disputes can be expensive, time-consuming, and reputationally damaging, and they are more likely to arise in the current enforcement environment than at any previous point in Caribbean tax administration history.

4. Data Protection Compliance

The data protection compliance landscape in the Caribbean is at a critical inflection point. Several jurisdictions have enacted comprehensive data protection legislation; others are in the legislative process; and most Caribbean businesses that handle personal data of EU or UK individuals are already subject to GDPR or UK GDPR requirements regardless of where they are incorporated. The combination of domestic and international data protection obligations creates a compliance environment that is more demanding than most Caribbean boards currently appreciate.

The minimum compliance requirements under modern data protection frameworks include: a lawful basis for every category of personal data processing; documentation of processing activities in a Record of Processing Activities (ROPA); data breach notification procedures capable of meeting 72-hour notification requirements; data subject rights response procedures; data protection impact assessments for high-risk processing; and contractual data protection obligations with processors and sub-processors. For many Caribbean businesses — particularly in BPO, financial services, healthcare, and education — full compliance with these requirements represents a significant programme of policy development, system configuration, and staff training.

5. Environmental and ESG Reporting

Environmental and ESG reporting obligations are the newest and most rapidly growing compliance risk category for Caribbean enterprises. Driven by a combination of investor demands, lender requirements, international standard-setting (particularly the ISSB sustainability reporting standards and the EU Corporate Sustainability Reporting Directive), and emerging domestic regulation, the expectation that Caribbean businesses will measure, report, and credibly disclose their environmental and social performance is moving from a voluntary aspiration to a regulated obligation on a faster timeline than most Caribbean boards have recognised.

For Caribbean enterprises seeking international financing — whether from development finance institutions, green bond markets, or international private lenders — ESG reporting is already a practical prerequisite rather than a future aspiration. The IDB, CDB, IFC, and other major DFIs require environmental and social due diligence and ongoing reporting as conditions of financing. International private lenders are increasingly incorporating ESG covenants into loan agreements. And the tourism sector’s major international partners — hotel brands, tour operators, and booking platforms — are applying progressive ESG performance requirements to their Caribbean partners.

6. Sector-Specific Financial Regulation

Caribbean financial regulators — in banking, insurance, securities, and credit union supervision — are all intensifying their supervisory expectations in ways that create compliance challenges for regulated institutions and strategic implications for the businesses that depend on them. Capital adequacy requirements are being progressively aligned with Basel III standards. Liquidity requirements are tightening. Board governance standards — including fit and proper requirements for directors, board diversity expectations, and board risk committee requirements — are being elevated. And the supervisory intensity of examination programmes is increasing as regulators invest in the analytical and examination capacity required to apply more sophisticated oversight.

For regulated financial institutions in the Caribbean, this supervisory intensification requires board-level engagement with the compliance programme that many boards have not yet provided. The regulatory expectation is not simply that management will manage compliance; it is that the board will actively oversee the compliance function, receive regular compliance reporting, and be able to demonstrate to supervisors that board-level governance of compliance risk is genuine and effective.

 

The CARISK™ Caribbean Regulatory Compliance Readiness Assessment

The following matrix assesses the compliance readiness of typical Caribbean organisations across the six pressure points identified above, distinguishing between the three major organisation categories that characterise the Caribbean compliance landscape.

Compliance Pressure Point	Large Financial Institution	Mid-Market Enterprise	SME / Professional Firm
AML/CFT Programme Effectiveness	MODERATE	HIGH	VERY HIGH
Beneficial Ownership Transparency	LOW-MOD	MODERATE	HIGH
Transfer Pricing Compliance	LOW-MOD	HIGH	MODERATE
Data Protection Compliance	MODERATE	HIGH	VERY HIGH
ESG Reporting Readiness	MODERATE	HIGH	VERY HIGH
Sector-Specific Financial Regulation	MODERATE	HIGH	HIGH

 

The pattern in the table above is consistent with Dawgen Global’s advisory experience across the Caribbean: compliance readiness is inversely correlated with organisation size, and the mid-market and SME segments — which account for the majority of Caribbean employment and economic activity — carry the highest aggregate compliance risk. Large financial institutions have invested in compliance infrastructure over many years under regulatory pressure; mid-market and smaller organisations have typically not.

“The compliance gap in the Caribbean is not primarily in the largest organisations. It is in the vast mid-market and SME segment that collectively accounts for the majority of regional economic activity and the least compliance infrastructure.”

Why Compliance Has Become a Strategic Function

The conventional understanding of compliance as a cost centre — a necessary overhead that reduces risk without generating return — is increasingly outdated in the Caribbean regulatory environment. There are four specific mechanisms through which compliance capability now generates direct strategic value.

First, compliance quality determines access to capital. International development finance institutions, green bond markets, and institutional lenders apply progressively more demanding compliance standards to borrowers. An organisation with a demonstrably robust AML/CFT programme, current data protection framework, documented transfer pricing policy, and emerging ESG reporting capability is a fundamentally more attractive borrower than one without these attributes — and the cost differential in financing terms can be material.

Second, compliance quality determines access to markets and partnerships. International hotel brands, tour operators, retail buyers, franchise partners, and joint venture counterparties are all applying compliance due diligence standards to their Caribbean partners that would have been exceptional a decade ago and are now routine. A Caribbean business that cannot demonstrate compliance with the partner’s minimum standards — whether AML/CFT, data protection, ESG, or anti-bribery — will simply not be selected as a partner, regardless of its commercial proposition.

Third, compliance quality is increasingly a determinant of talent attraction and retention. The most capable compliance, finance, legal, and technology professionals are increasingly unwilling to work in organisations that they assess as carrying unmanaged compliance risk. The reputational risk to an individual professional of association with a compliance failure — in an environment where regulatory actions are public and professional licences are at stake — creates a talent market dynamic where compliance quality influences the organisation’s ability to attract the skills it needs.

Fourth, and most directly, compliance quality reduces the expected cost of regulatory enforcement. The organisations that receive enforcement actions, correspondent banking terminations, and supervisory sanctions are disproportionately those with undocumented, understaffed, or ineffective compliance programmes. Investment in compliance capability is investment in the reduction of a cost that, when it arrives, typically arrives at multiples of what prevention would have cost.

Building Compliance as a Strategic Function: The Governance Standard

For Caribbean boards that are ready to elevate compliance from a management function to a board-governed strategic discipline, the CARISK™ framework identifies five governance standards that distinguish organisations where compliance is genuinely strategic from those where it remains a formality.

• Board-level compliance oversight: The board receives a structured compliance report at every meeting — not a management summary that everything is fine, but a report that presents the compliance risk register, tracks open regulatory findings, monitors key performance indicators for compliance programme effectiveness, and flags emerging regulatory developments that require board attention. The board asks questions, challenges management, and holds the compliance function accountable for performance against measurable standards.
• Dedicated compliance resource proportionate to risk: The compliance function is staffed with qualified professionals who have the seniority, independence, and resource to operate effectively. In regulated financial institutions, this means a Chief Compliance Officer with direct board access. In mid-market enterprises, it means a compliance function or engagement with external compliance advisors that is funded at a level proportionate to the organisation’s regulatory risk profile — not at the minimum that management believes it can get away with.
• Annual compliance risk assessment: The organisation conducts a formal annual compliance risk assessment that identifies its compliance obligations across all applicable regulatory frameworks, assesses its current compliance status against each obligation, identifies gaps, and produces a remediation plan with timelines, ownership, and resource requirements. This assessment is reviewed by the board and forms the basis of the compliance work plan for the following year.
• Regulatory change monitoring: The organisation maintains a structured process for monitoring regulatory developments across all jurisdictions in which it operates, identifies the enterprise impact of regulatory changes, and ensures that management response to regulatory change is timely and effective. In an environment where regulatory change is occurring at the pace documented in this article, reactive compliance — discovering requirements after they have been breached — is not a sustainable approach.
• Compliance culture from the top: The board and senior leadership team model the compliance behaviours they expect from the organisation. They do not create pressure — implicit or explicit — to compromise compliance standards in pursuit of commercial outcomes. They celebrate compliance achievements and take seriously the cultural signals that their own behaviour sends about the organisation’s compliance values.

 

The Caribbean regulatory landscape will continue to tighten. The international forces driving that tightening — FATF, OECD, EU, and the correspondent banking community — show no signs of relaxing their standards. The domestic forces — tax authorities, financial regulators, and data protection commissioners — are all investing in the capacity to enforce more effectively. The organisations that have built genuine compliance capability now will be the ones that navigate the next wave of regulatory intensification with confidence rather than crisis.

In Article 6 of this series, we turn to the risk domain that is perhaps the most geographically inescapable for Caribbean enterprises: Climate Risk. From quantifying physical asset exposure to assessing the emerging obligations of climate disclosure, we examine what it means to manage climate risk as a business imperative rather than a government concern.

 

REQUEST YOUR CARISK™ COMPLIANCE RISK ASSESSMENT Plan effectively with Dawgen Global’s expert analysis on the regulatory and compliance risk factors affecting your Caribbean strategy. From AML/CFT programme effectiveness reviews to transfer pricing documentation, data protection gap assessments, and ESG readiness evaluations, our multidisciplinary Compliance Risk service provides the tools to anticipate regulatory risk before it becomes a regulatory event. Request a complimentary CARISK™ Compliance Risk Briefing today. [email protected]

Next in the Series

Article 6 — Climate Risk Is Business Risk: Quantifying Caribbean Exposure. From physical asset vulnerability to TCFD disclosure obligations and the repricing of Caribbean property insurance markets post-Melissa — we quantify what climate risk actually costs Caribbean enterprises and what the governance response must look like.

 

About Dawgen Global