Regulators and the resulting internal legal & compliance folks sometimes create some really perverse incentives. Mostly they are in the business of telling peo

Regulators and the resulting internal legal & compliance folks sometimes create some really perverse incentives. Mostly they are in the business of telling people what NOT to do. Rarely can you get them to approve in writing a course of action of what TO DO. A lot of "just asking questions" vibes. I once worked on a phone app which would give internal users the ability to make certain transactions while away from the desk. It was the mobile version of something they had on their work PC. Compliance's concern was it could be used while overseas where subject to other regulators. It was pointed out to compliance that these same users were using these same phones to make voice calls to execute the same transactions, for decades. Having to enter the information in electronically rather than over a phone call is demonstrably better from a record keeping & being compliant perspective. It turned into a case of bringing existing practices more "into the light" was actually considered worse than the status quo.