Data protection, sustainability and anti-money laundering show the same transformation: compliance is ceasing to be a function focused exclusively on avoiding contingencies to become a cross-cutting tool for governance, risk management and competitiveness.
Organisations operating in Latin America face an increasingly complex regulatory environment. Local regulations are compounded by international standards, investor expectations, demands from financial institutions, customer requirements, and new conditions for accessing certain markets or value chains.
In this scenario, the challenge is no longer merely about identifying which regulation applies and formally complying with it. The relevant question is a different one: how to integrate those requirements into the business in a way that allows for better risk management, strengthens processes, and generates value?
That was one of the main conclusions of the webinar “Compliance in Latin America: how to transform regulatory requirements into business opportunities, organised by B-Conex Latam as part of the preparatory activities for the 2026 Latin American Legal Management Congress.
The conversation brought together Eugenio Rebolledo, Compliance Officer of EY Chile; María de los Ángeles Chévez, Senior Manager Compliance of Invenergy / Energía del Pacífico; y José Juan Gari, strategic consultant and Compliance Officer of Aiva, under the moderation of María Lucía Acosta, Director of B-Conex Latam.
From three areas -data protection, sustainability and the prevention of money laundering and terrorist financing (AML/CFT)- a cross-cutting conclusion emerged: compliance that truly adds value is that which manages to translate regulation, risk and market expectations into concrete, proportionate and functional processes for the operation.
Data protection: a cross-cutting governance challenge
Data protection is probably one of the best examples of how an issue initially perceived as niche ended up becoming a cross-cutting challenge for the entire organisation.
Today, companies process increasing amounts of information in operations that involve different areas, suppliers, technological platforms and jurisdictions. At the same time, regulatory frameworks present significant differences between countries and evolve at different speeds.
This makes it necessary to abandon an exclusively legal approach.
The first task consists of properly mapping the various regulatory and governance frameworks that affect an operation, but that mapping must be complemented by adaptability, since not all situations find an express regulatory response and, in many markets, grey areas or mismatches between legislation and its practical implementation persist.
Hence the importance of building a proper relationship with state agencies and regulatory bodies. Early communication can become an important tool for resolving uncertainties and preventing interpretation issues from turning into contingencies.
Anyway, regulation represents only part of the problem.
An effective data protection programme requires the early involvement of different areas of the organisation: legal, compliance, technology, information security, operations and the business. It also demands periodic reviews of the infrastructure, updated processes and an analysis of where vulnerability points actually lie.
Data protection thus ceases to be an operational cost or an obligation that must be managed defensively, and the way a company manages information directly affects its reputation and, above all, the trust it builds with clients, consumers, suppliers and others stakeholders.
Therefore, in the face of increasing regulatory complexity, the response cannot simply be more documentation or more controls. More sophisticated governance is needed, capable of determining what risks exist, where they are concentrated and what response is appropriate for each one.
Sustainability: complying to remain, managing to compete
The evolution of the sustainability agenda shows a similar transformation.
For years, many organisations associated it primarily with corporate reputation or social responsibility. Today, that approach is no longer sufficient.
Sustainability affects investment and financing decisions, market access, community relations, supply chains and, with increasing frequency, the very possibility of developing certain businesses.
This forces a diversity of issues to be put on the table and, in some cases, even requires a review of the company's purpose and the way it generates value for its various stakeholders.
The first relevant change is moving from a reactive logic to proactive management.
Community relations, environmental management or response to ESG expectations should not be activated solely when a contingency arises. Incorporating them early makes it possible to anticipate conflicts, improve operations and build stronger relationships with the various stakeholders stakeholders.
Furthermore, there is a second, even more important dimension: inadequate management of these risks can translate directly into a loss of business opportunities.
Financial institutions are progressively incorporating sustainability criteria into their evaluations; investors are analysing these variables; large companies are passing requirements down to their supply chains; certain jurisdictions or markets are demanding specific standards as a condition of access; to name just a few.
Consequently, complying adequately is no longer merely a matter of reputation, but can determine whether a company obtains financing, can participate in a value chain or can enter a given market.
This also changes the role of legal and compliance, as it is no longer enough just to explain what the legal obligations are. On the contrary, teams must be able to understand how those obligations, risks and expectations affect the business model, and then help translate them into concrete decisions.
For this, internal processes for effective monitoring, useful metrics and mechanisms that make it possible to verify whether policies are actually being implemented are necessary.
One of the frequent risks is precisely the gap between policy and operations. In sustainability, many corporate statements continue to be more aspirational than operational.
The real challenge appears when the time comes to answer more uncomfortable questions: who is responsible, how is it measured, what information is produced, how is it documented, what happens when the process does not work?
There again appears an element that is often relegated within the ESG agenda: the “G” for governance.
Without clear decision-making structures, defined responsibilities, oversight mechanisms and accountability processes, environmental or social agendas can hardly be implemented consistently.
Therefore, the professionalisation of corporate governance is also a key tool for sustainability.
AML/CFT: neither checklists nor overregulation
The third pillar of the conversation (the prevention of money laundering and terrorist financing) raised another key challenge: how to build robust controls without turning compliance into an unnecessary source of friction for the business.
The image of “medicine dosage” is particularly illustrative.
An inadequate system exposes the organisation, but an overly complex, bureaucratic or disproportionate system can also generate negative effects: it consumes resources, slows down operations, shifts the focus towards low-value controls and can end up weakening the very effectiveness of the programme.
Sophistication, therefore, does not consist in accumulating procedures, but rather consists in identifying where the risk truly lies and allocating time, technology, controls and human capacity there.
This explains why the traditional checklist-based approach is proving increasingly insufficient. Having policies, forms and documentation is necessary, but it does not demonstrate on its own that a system works. Organisations must ask themselves whether processes are effective in practice: how they are implemented, who executes them, how they are monitored and what evidence exists of their operation.
Documentation thus acquires central importance. Not only must there be compliance, but it must be possible to demonstrate how compliance was achieved, what controls were applied and how the organisation reacted to the identified risks.
At the same time, technology and artificial intelligence are opening up new possibilities.
Certain monitoring, review or analysis tasks can be automated, allowing resources to be freed up for decisions that require judgment, business knowledge and human evaluation.
The right question then ceases to be “how many controls do we have?” and instead becomes: in which processes are we investing our time, our focus, and our value, and which ones could be carried out more efficiently?
Another relevant point is the need to align the entire organisation.
Prevention does not belong solely to the compliance officer. It requires involving those who make decisions, manage teams, hire third parties, or participate in sensitive operations. The growing attention on the liability of employers and directors reinforces precisely that dimension: systems work when the organisation takes ownership of the risk rather than delegating it exclusively to a single department.
GRC: integrate governance, risk and compliance
The three blocks ultimately converge on a single concept: GRC – Governance, Risk & Compliance.
Governance defines how decisions are made and who is accountable for them. Risk management makes it possible to identify what can affect the organisation's objectives. Compliance, on the other hand, establishes the necessary mechanisms to operate within the regulatory framework and assumed standards.
Managed separately, these three components can generate parallel structures, duplication of controls and loss of information. Integrated, they allow the construction of much more consistent systems.
That is why modern compliance increasingly demands a cross-functional perspective. It cannot be developed exclusively within the legal sphere nor remain isolated from the business. It needs to interact with technology, finance, operations, human resources, sustainability, audit and senior management.
The role of compliance thus shifts from solely answering “what we cannot do” to taking part in a more strategic conversation: “how we can do it safely, sustainably and competitively”.
From obligation to competitive advantage
Data protection, sustainability and AML/CFT present distinct regulatory frameworks, risks and challenges. However, the conversation helped to identify a common logic.
The most mature organisations are not necessarily those that accumulate the most policies or controls. They are those capable of: understanding their risks, prioritising them, translating them into concrete processes, monitoring their performance and adapting them to the business reality.
That shift in focus also redefines the role of lawyers and compliance professionals. Their contribution is no longer measured solely by their ability to avoid a penalty, but also by their capacity to anticipate scenarios, facilitate decisions, preserve market access, strengthen relationships with stakeholders and help the organisation to operate with greater confidence.
In a context of growing regulatory complexity, the competitive edge can lie precisely there.
Compliance is not about doing more. It is about doing better: with sound judgment, proportionality, evidence and a deep understanding of the business. When that logic is incorporated into the organisation's governance, compliance ceases to be merely an obligation and becomes a true tool for value creation.