Knowledge of the regulatory context was uneven among the respondents who answered the question. Of 795 answers, 548 named at least one law, regulation, guidance document, or regulatory concept, collectively covering all 150 engagements. The other 247 answers (31.07%) were “I do not know.” All 247 came from individual contributors on 126 engagements. Coverage of every engagement by at least one named reference does not establish that every delivery team member knew the relevant obligations.
The references concerned model risk, anti-money laundering, outsourcing and third-party risk, data protection, operational resilience, and conduct. They combined laws, supervisory guidance, and broader concepts rather than a uniform set of verified legal obligations.
The study did not test legal applicability or compliance. These answers identify the regulatory references respondents believed were relevant to their engagements. They do not establish which requirements legally governed a particular practice or whether the financial institution or vendor complied with them.
“the issue is if anyone ever asks how the number was arrived at, the answer involves a decision that i made on a tuesday afternoon because nobody else would.” -Individual Contributor, KPO, Corporate and back-office functions
1 Regulatory Items Named by Respondents
Model risk governance was the most frequently named regulatory reference, appearing in 219 answers on 58 engagements. Anti-money laundering and know-your-customer requirements (“AML and KYC”) appeared in 192 answers on 48 engagements, and third-party and outsourcing risk guidance in 189 answers on 52 engagements. Respondents named 40 distinct references in total. Seven others appeared in 173 or 174 answers each, including Office of the Comptroller of the Currency (OCC) outsourcing guidance, supervisory letter SR 11-7, California and other state privacy laws, the General Data Protection Regulation (GDPR), the Digital Operational Resilience Act (DORA), European Banking Authority (EBA) outsourcing guidelines, and the European Union (EU) AI Act.
Reference named | Answers | Engagements |
|---|---|---|
Model risk governance | 219 | 58 |
“AML and KYC” | 192 | 48 |
Third-party and outsourcing risk guidance | 189 | 52 |
OCC outsourcing guidance | 174 | 48 |
SR 11-7 model risk guidance | 174 | 48 |
CCPA and state privacy laws | 174 | 48 |
GDPR | 173 | 47 |
DORA | 173 | 47 |
EBA outsourcing guidelines | 173 | 47 |
The emerging EU AI Act | 173 | 47 |
Operational resilience requirements | 140 | 40 |
MAS and local regulator outsourcing rules and local data protection laws | 120 | 31 |
Note: The table selects the most frequently named references from the 40 identified in 548 answers that named at least one. An answer may name several references. Counts reflect respondent descriptions rather than verified legal applicability. CCPA means California Consumer Privacy Act. MAS means Monetary Authority of Singapore. Other abbreviations are expanded in the preceding paragraph. Labels identifying guidance, legislation, and broader concepts do not give them equivalent legal status.
All 150 engagement managers and all 29 portfolio directors who answered named at least one regulatory reference. Among the 615 individual contributors who answered, 247 reported “I do not know” (40.16%). Individual contributors also reported manual alteration most often (Table 5.6). The juxtaposition identifies a difference in reported knowledge and practice by role, without establishing that individual contributors’ work breached an obligation.
2 Relationship to the Work Subject to Manual Alteration
The regulatory references named by respondents concerned work addressed by all five manual alteration methods. They included data and privacy, model outputs and validation, outsourced processes and dependencies, and decisions supported by those processes. This overlap establishes the relevance of regulatory knowledge to the reported work, rather than the legal applicability of every reference to every manual alteration.
Explicit descriptions of regulatory exposure were less frequent than descriptions of uncertainty about accountability. Sixteen written answers from 14 respondents on 12 engagements linked a practice, gap, or incident to a breach or risk of breach. Unclear liability or regulatory accountability for agent errors was described in 83 answers from 80 respondents on 57 engagements. These statements report respondents’ assessments, not legal findings.