Typically the company would always have its own in-house compliance organization and executive, even if there is extensive, on-site federal regulation (like ban

Typically the company would always have its own in-house compliance organization and executive, even if there is extensive, on-site federal regulation (like banking sector). So that would probably look like the company having its own CISO, but some of the technical decisions/changes being approved by or required by a regulatory agency.