Unified compliance: one foundation for every risk
05 May 2026Compliance has been built by stacking for years. Every new regulation added its own project, its own controls, its own tools, its own reporting lines. The result is familiar to everyone who works in the field: a system that is fragmented, costly, difficult to steer, and only partially effective. Unified compliance is the shift that turns this patchwork into one coherent foundation.
💡 Key takeaways
- Compliance built by stacking (one layer per regulation) produces redundancy, blind spots, and an illusion of control.
- Unified compliance organises every framework, from AML/CFT and Sapin 2 to GDPR, DORA and CSRD, around a single reference object: the legal entity.
- Data collected once can be enriched, reused, and consolidated into a shared view of risk across functions.
- The compliance question shifts from "have we covered every text?" to "do we truly understand each counterparty?"
- Fragmentation is a risk in its own right. Unified compliance turns disparate signals into decisions that are explainable, auditable, and actionable.
Compliance by stacking: the default model
Most organisations still think in terms of obligations. For every new regulatory framework, a familiar sequence kicks in: a dedicated project, specific procedures, proper controls, ad hoc tools or modules, and a set of indicators to prove the box has been ticked.
The underlying logic is simple. "We have an obligation, we need a mechanism to cover it." This approach answers one question on the surface, which is whether the organisation is compliant with every text. But it leaves another question wide open. Do we truly understand the risk carried by the entities we work with?
The same object, split across silos
Behind every obligation, the object being analysed is the same. A counterparty. A third party. A legal entity embedded in a network of relationships, flows, contracts and dependencies.
Whether it is a client under AML/CFT, a supplier or intermediary under Sapin 2 and DORA, a subcontractor under GDPR, or an actor in the value chain under CSRD and ESG frameworks, the underlying question is always the same. Who is this entity, and what risk does it carry, viewed from different angles?
The structural shift is to acknowledge this openly. Compliance should not be centred on the texts. It should be centred on the entity.
The EU AML Package: how compliance becomes a strategic function
Digital Operations Resilience Act (DORA regulation) impact on financial institutions
CSRD impact on financial institutions
The hidden cost of an obligation-based model
A model organised around obligations produces three predictable side effects.
- It creates redundancies. The same data is collected multiple times. The same controls are replicated in parallel systems. The same analyses are redone with slightly different angles, by different teams, under different deadlines.
- It creates blind spots. Each team looks at a slice of the risk without ever rebuilding the whole picture. An entity can be judged acceptable under AML/CFT, risky under Sapin 2, and neutral under GDPR, with none of these views ever brought into the same conversation.
- It creates an illusion of control. The organisation ticks the regulatory boxes, produces credible reports, passes audits, and still cannot answer one simple question. What is the overall risk profile of this entity for us?
The more obligations stack up, the more this fragmentation becomes a risk in itself.
The emergence of unified compliance: the entity-centric model
Unified compliance is a model in which every regulatory framework draws from a single, shared description of the legal entity, rather than each framework building its own parallel view. The entity is modelled once, enriched continuously, and used across AML/CFT, Sapin 2, GDPR, DORA, CSRD and any future regulation, so that every compliance decision rests on the same foundation of knowledge. That is the heart of the entity-centric approach.
In the most advanced practices, this shift is already underway. Automation and AI no longer just execute isolated tasks. They structure decision-making itself, by aggregating multiple data sources, orchestrating processes, and producing analyses that are both explainable and auditable.
The value shifts with the model. It is no longer about executing controls. It is about the capacity to understand, prioritise, and arbitrate. The question is no longer "have we put all the required measures in place?" The question is "can we produce a consolidated, actionable understanding of the risk carried by each entity?"
Fragmentation as a risk in its own right
In an environment where data multiplies, external signals become denser, and regulatory requirements keep tightening, fragmentation stops being a minor inconvenience. It becomes a risk category of its own.
Separate teams, disjointed processes, and non-integrated tools produce a partial view of reality. The organisation holds a lot of information and very little shared meaning. The consequences are concrete:
- Risks cannot be consolidated at the entity level.
- Global decisions are hard to justify under audit.
- The traceability of arbitrations erodes. Truly critical cases cannot be prioritised against the noise.
The outcome is an institution that is over-equipped in compliance and under-equipped in understanding.
The principles of unified compliance
Unified compliance does not mean dropping specific obligations. It means organising them around one common foundation: knowledge of the legal entity.
Three principles hold the model together.
- The first is a cross-functional view of the entity. Every data point, whatever its initial purpose (KYC, corruption risk, data protection, ESG, ICT resilience), contributes to one shared understanding. The entity is no longer sliced up according to the texts. It is described once, along several dimensions.
- The second is pooled controls. The same checks are no longer repeated in different silos. They are performed once, enriched over time, and reused across regulatory purposes.
- The third is integrated decision-making. Compliance is no longer limited to producing alerts and indicators per device. It becomes a system that qualifies risk, prioritises actions, and documents trade-offs at the entity level. In this model, a poorly understood entity is not just an incomplete record. It is an operational, regulatory, and strategic risk.
Conclusion
The question is no longer whether every obligation has been covered, text by text. The question is whether the organisation truly understands the entities it interacts with, and whether it can justify the decisions it makes about them. That is where the effectiveness of compliance now lives.
A model centred on obligations can satisfy the texts while leaving the underlying risk poorly controlled. Unified compliance turns that architecture into a knowledge and decision system, one that holds up under audit, supports the business, and keeps up with the next regulation already on the horizon.
Frequently asked questions about unified compliance
What is unified compliance?
Unified compliance is a model where every regulatory requirement draws from a single, shared description of the legal entity, rather than each framework building its own parallel controls. The entity is modelled once and reused across AML/CFT, KYC, KYB, ESG, DORA, CSRD and other regulations. The practical result is one consolidated view of risk at the counterparty level, with decisions that can be justified across frameworks.
How does unified compliance differ from obligation-based compliance?
Obligation-based compliance starts from the regulation and builds a dedicated process, tool, and dataset for each text. Unified compliance inverts the logic by starting from the entity and using each regulation as a different lens on the same underlying knowledge. Less duplication, fewer blind spots, and a shared foundation that new regulations can be added to rather than built alongside.
Is unified compliance the same as a GRC platform?
Not quite. Traditional GRC (governance, risk and compliance) platforms centralise policies, controls, and audit evidence across the organisation. Unified compliance goes one level deeper by centralising the counterparty itself as the reference object, so that AML/CFT, Sapin 2, GDPR, DORA and CSRD all operate on the same living profile of each entity, rather than on parallel records stitched together after the fact.
Why is fragmented compliance a risk in its own right?
When teams, processes, and tools are disconnected, the organisation cannot consolidate risk at the entity level or justify a global decision under audit. Critical cases get lost in the noise, arbitrations lose their traceability, and the institution ends up over-equipped in controls and under-equipped in understanding. Fragmentation, in other words, does not just slow compliance down. It creates its own regulatory and operational exposure.
Which regulations fit into a unified compliance model?
Every framework that targets a legal entity fits. AML/CFT, KYC, KYB, Sapin 2, GDPR, DORA, CSRD, sanctions and PEP screening, ESG due diligence, and third-party risk management all describe the same counterparty from different angles. A unified compliance model is designed to absorb future regulations on the same foundation, without rebuilding the data layer every time a new text enters into force.
How does Harmoney support unified compliance?
Harmoney models the legal entity as a reference object and orchestrates every control, data enrichment, and decision around it. The platform is modular, API-first, and configurable through JSON, so institutions can start with one framework and extend to others without rewriting the foundation. Every decision is logged with full traceability, which makes audits and regulatory reviews straightforward.
Harmoney offers a cutting-edge digital platform that streamlines intricate onboarding and compliance procedures, featuring automated screening functionalities. Interested in discovering more about our innovative solution? Reach out to us for further details or stay in touch via our newsletter ⬇️.