What ultimately determines whether a compliance programme succeeds or fails?

Op-eds What ultimately determines whether a compliance programme succeeds or fails? Untitled Design (3) Relevant News Christodoulides to present Cyprus Presidency results at Brussels European Council 15 June 2026 What ultimately determines whether a compliance programme succeeds or fails? 15 June 2026 Disability benefits to be increased across-the-board 15 June 2026 newsroom 15 June 2026 FacebookXWhatsAppEmailPrintViber By Kyriaki Stinga and Dorina Mastora* Most professionals would point to effective controls, robust governance, adequate resources, regulatory expertise, or technological sophistication. All of these are important. They also share a common characteristic: they can be designed, implemented, measured, and improved through structured processes. Yet organizations with similar policies, comparable controls, and access to the same regulatory guidance often achieve remarkably different outcomes. The difference often lies not in what organizations have, but in who they are. The answer, more often than not, is culture. In the fields of anti-money laundering, sanctions compliance, and financial crime prevention, culture has become one of the most frequently discussed concepts and perhaps one of the least understood. Regulators encourage it, boards discuss it, and organizations invest significant resources in strengthening it. Yet there is often surprisingly little agreement on what culture actually means. Too often, compliance culture is reduced to a culture of regulatory adherence. Policies are implemented, training is delivered, controls are strengthened, and awareness campaigns are launched. While these initiatives are valuable, they do not constitute culture in themselves. This misunderstanding stems from a tendency to view culture through a regulatory lens. Compliance professionals are trained to think in terms of frameworks, procedures, controls, and measurable outcomes. Culture, however, does not fit neatly into any of those categories. Culture is not the existence of rules. It is the collective attitude towards those rules. Understanding culture therefore requires us to look beyond regulation and consider insights from psychology, sociology, leadership, and organizational behaviour. Compliance, after all, is not merely concerned with rules; it is concerned with the people expected to apply them. Looking Beyond Compliance From a sociological perspective, culture consists of the shared values, norms, beliefs, and assumptions that shape behaviour within a group. From a psychological perspective, culture influences how individuals interpret situations, assess risk, exercise judgment, and respond to challenges. When discussing culture in the context of compliance, it is important to clarify that we are referring to positive culture. Every organization has a culture, but not every culture promotes integrity, accountability, responsibility, and ethical decision-making. A positive culture extends beyond compliance with rules and procedures. It reflects a shared commitment to doing the right thing, not merely because regulations require it, but because individuals genuinely believe it is the right thing to do. This is where culture becomes deeply human. It involves conviction rather than obligation. Purpose rather than mere compliance. Responsibility rather than supervision. And perhaps most importantly, it requires the courage to remain faithful to one’s principles when doing so is difficult, inconvenient, or commercially uncomfortable. The true test of culture is therefore not what people do when expectations are clear. It is what they do when competing priorities create uncertainty and difficult choices must be made. Why Culture Is So Difficult to Build One of the reasons culture remains misunderstood is that organizations frequently attempt to manage it using the same tools they use to manage compliance programmes. Values statements are published. Awareness campaigns are launched. Training sessions are conducted. Leadership messages are distributed. These initiatives undoubtedly have value, but they do not create culture on their own. Culture is shaped less by what organizations communicate formally and more by what people experience consistently in practice. Human beings learn socially. They observe those around them. They pay attention to how leaders behave under pressure, how mistakes are addressed, how success is rewarded, and how difficult decisions are made. Over time, these observations create shared expectations regarding what is genuinely valued within the organization. This explains why culture cannot simply be implemented. It can be encouraged. It can be nurtured. It can be reinforced. But ultimately, it must be experienced and reinforced through everyday actions. Employees quickly distinguish between values that are communicated and values that are genuinely practiced. When there is a disconnect between the two, trust begins to erode. When words and actions consistently align, culture gains credibility and becomes self-sustaining. This is why culture often proves more challenging than competence. Organizations can successfully teach technical knowledge, regulatory requirements, and operational processes. Yet attitudes, beliefs, and convictions are shaped through a far more complex combination of experience, relationships, and shared purpose. Culture as Collective Energy Much has been written about leadership and leading by example. While leadership undoubtedly plays a critical role, culture is influenced by something even more subtle. It is influenced by energy. Every organization possesses a distinctive emotional and behavioral climate. Some environments generate trust, curiosity, accountability, and purpose. Others foster fear, disengagement, complacency, or indifference. Employees sense this long before they fully understand the organizational structure or internal policies. For this reason, culture should not be viewed merely as a governance concept or a compliance objective. It is the living identity of an organization. It reflects not only what an organization says it values, but also what people experience every day. Over time, those shared experiences shape identity. Rethinking Compliance Culture Perhaps it is time to reconsider what compliance culture truly means. For many organizations, culture is still viewed through the lens of compliance itself: adherence to policies, observance of procedures, and respect for regulatory obligations. While these elements are important, they capture only part of the picture. A positive culture is not created when employees simply understand what the rules require of them. Nor is it created through training sessions, awareness campaigns, or periodic reminders about expected conduct. At its core, culture is about belonging. It is about whether individuals feel connected to a purpose, a set of values, and an identity greater than themselves. It is about whether they see their role as extending beyond the completion of tasks and the observance of rules. People rarely become passionate about policies. They become passionate about purpose. And when people genuinely believe in what an organization stands for, they begin to protect it, strengthen it, and uphold its values, not because they are instructed to do so, but because they want to. This is where culture begins. Culture begins when people stop seeing themselves as individuals following rules and start seeing themselves as custodians of a shared identity. Culture: The Collective Oxygen Perhaps the most useful way to think about culture is not as a framework, but as the collective oxygen of an organization. Like oxygen, culture is largely invisible, yet its presence is felt everywhere. Employees breathe it. Leaders breathe it. Clients and business partners experience it through every interaction. It influences how people communicate, how they respond to challenges, how they exercise judgment, and ultimately how they define success. A healthy culture fosters trust, accountability, purpose, collaboration, and a genuine commitment to doing the right thing. An unhealthy culture can just as easily normalize complacency, silence, fear, or indifference. Most importantly, culture is contagious. It spreads through behaviours, emotions, expectations, and shared experiences. People absorb it, often unconsciously, and then transmit it to others. For this reason, culture cannot be confined to a policy document or a corporate value statement. It ultimately reaches employees, clients, business partners, regulators, and the wider community. Organizations should therefore protect culture with the same seriousness that they protect their financial, operational, and reputational assets. Nurtured carefully, it can inspire individuals, strengthen institutions, and create a shared sense of purpose. Neglected, it can undermine trust, weaken integrity, and erode even the most sophisticated compliance framework. And perhaps this is precisely why culture remains the most critical element of any compliance programme. Everything else can be designed, implemented, measured, and improved. Culture must be lived. You can teach a regulation in a month. You cannot teach an attitude in a month. The difference between the two is culture. Because culture is not something people learn. It is something they breathe. *Kyriaki Stinga is an Advocate/Partner and Dorina Mastora is a Deputy Compliance Officer at Elias Neocleous & Co LLC Subscribe to our Newsletter Latest News Christodoulides to present Cyprus Presidency results at Brussels European Council Disability benefits to be increased across-the-board Broken-down lorry blocks Limassol-Paphos motorway at Erimi exit Things to do on Monday, June 15 CY-Alert island-wide system test on June 15 — what to expect One in six over-60s faces abuse globally, observatory warns Rescued barn owl found nesting with four chicks near Mammari Follow en.philenews on Google News and be the first to know all the news about Cyprus and the world.