If your team found 300 pages tomorrow with your brand on them that you didn’t know existed, would that be a gift or a burden?
That question came out of a candid afternoon with a dozen compliance and marketing leaders from banks, fintechs, card issuers, and lenders. There were no slides, no pitch, and no selling, just the people who run real programs talking about what’s working, what isn’t, and what’s keeping them up at night. In this episode of COMPLY, Ashley Cianci walks you through the four themes that came out of the room and why each one applies, whether you lead compliance at a bank or you’re launching a fintech campaign by Friday.
Key Takeaways
- Enforcement decentralized. State attorneys general, state regulators, and advocacy groups are filling the gap left by federal pullback.
- Complaint benchmarking is on you. Leaders are building their own view from first-party complaints, Better Business Bureau data, social sentiment, and app reviews.
- AI is rewriting the funnel and the risk. You’re now accountable for what AI systems say about your products, not just what you publish.
- Strong compliance teams play offense. Automated monitoring and risk-based routing help marketing move faster.
- Buy the infrastructure, don’t build it. Teams that built their own tools ended up pulling engineers off revenue work to maintain them.
Show Notes:
- Connect with Ashley Cianci on LinkedIn: https://www.linkedin.com/in/ashley-cianci/
- Subscribe to PerformLine to stay connected to resources and updates: https://lp.performline.com/subscribe-to-performline
Subscribe to COMPLY: The Marketing Compliance Podcast
About COMPLY: The Marketing Compliance Podcast
The state of marketing compliance and regulation is evolving faster than ever. On the COMPLY Podcast, we sit down with the biggest names in marketing, compliance, regulations, and innovation as they share their playbooks to help you take your compliance practice to the next level.
This podcast is for informational and educational purposes only and does not constitute legal advice; consult your own compliance or legal counsel.
Episode Transcript:
Ashley Cianci:
Hey there, COMPLY Podcast listeners, and welcome to this week’s episode. I’m Ashley Cianci, and today we’re gonna do something a little bit different from our usual Regulatory Roundup. Last month, we put a dozen compliance and marketing leaders from major banks, fintechs, card issuers, and lenders in one room for an afternoon. No slides, no pitch, no showcase, no selling, just the people who run real programs talking candidly about what’s working, what isn’t, and what’s keeping them up at night.
I’m not gonna tell you who was in the room. That was part of the deal. And it’s why the conversation was so honest.
I’m gonna walk you through the four big themes that came out of that day, because every one of them applies, whether you’re a chief compliance officer at a bank or a marketer at a fintech trying to launch a campaign by Friday.
Before we get into them, here’s a question from that room I haven’t stopped thinking about: If your team found 300 pages tomorrow that you didn’t know existed, pages with your brand on them, would that be a gift or a burden? Hold on to your answer, and we’re gonna come back to it.
So grab your coffee, and let’s get into it.
First takeaway: Enforcement didn’t slow down. It decentralized.
And this is something that we have continuously come back to on the Regulatory Roundup. There is a comfortable story going around that federal enforcement has pulled back, so compliance teams can breathe. Every leader in that room said the same thing: That story is wrong. Enforcement has not disappeared; it’s moved.
The expertise that used to sit inside one federal agency is now spread across the state attorneys general, state regulators, and advocacy organizations. And the states are not just issuing press releases. One state has ordered a full audit of every fee its licensed entities charge. Seven-plus states now have their own all-in pricing laws, each with slightly different definitions. And one new state law passed in December was already showing up in live multistate litigation by March. Three months from statute to lawsuit. Legal observers expected that to take years.
And here’s the kicker: The courts took away the safety net at the same time. After the Loper Bright decision, federal agencies don’t get automatic deference on what rules mean. Courts decide, which means federal preemption, the thing a lot of institutions have leaned on for decades, is now something you litigate, not something you count on.
So the question in the room became: Do you build for the Ferrari compliance program, buttoned up in all 50-plus jurisdictions, or do you take a middle-of-the-road approach and accept some calculated risk?
There’s no universal answer, but the advice that stuck with me was this: Whatever the environment feels like today, operate as if a new administration starts January 1st, 2027. Because lookback risk on the decisions you’re making right now runs four, five, six years. And the innovation window is real. So the window is closing.
Takeaway number two: The industry’s early warning system went dark.
The second theme, and this one surprised me with how much energy it generated. For years, the public consumer complaint database was the industry’s early warning system. Complaint volume was the single best predictor of who got examined next. Smart compliance teams watched their numbers, watched their peers’ numbers, and fixed problems before a regulator made them a priority. The public data is gone now, and the room’s reaction was not relief; it was concern.
Because here’s what one leader put perfectly: Knowing your own complaints was never the point. The point was knowing how you stack up. You might think your complaint volume is fine, but fine compared to what? Without a benchmark, you’re flying blind on the exact signal regulators use to pick their targets.
And the leaders who are the furthest ahead are not waiting for the data to come back. They’re building their own picture: first-party complaints, the Better Business Bureau data, social sentiment, app reviews, all of it aggregated and analyzed. One team told us they used to be able to manually review about 500 complaints. And with AI, they now analyze 100,000. Same team, 200 times the visibility.
And that’s the new reality. It’s a data race. State regulators are hiring, and they have the same AI tools you do. The institutions that can see their own emerging problems faster than a regulator can are the ones that stay off the front page.
Takeaway three: AI is rewriting the marketing funnel faster than the rulebook.
The third theme, artificial intelligence. And no, it’s not the “AI is coming” conversation. These leaders are way past that. The funnel is already changing underneath them. Search traffic is declining as consumers shift to asking AI assistance instead. One leader shared that affiliate marketing went from 90% of their acquisition spend to 30% in two years. Not because they wanted to shift, because consumer behavior moved and the economics followed.
The room is now preparing for agentic commerce and what one member called “zero-screen applications”: a consumer telling an AI assistant to find and apply for a product on their behalf. No website visits, no landing page, no funnel as we know it.
Now put your compliance hat on and think about what that means. Your product is being described, compared, and recommended by AI systems that you don’t control, trained on content you may never even know existed. We talked about a real incident where an AI assistant answered a routine question about a loan product with a phishing phone number. The institution found out from a viral Reddit thread.
That’s the new risk surface: not just what you publish, but what machines say about you.
And inside the building, the AI question is just as live. These leaders are deploying AI agents in their own workflows, and the governance principle the room landed on is one you can steal today: Treat AI output like the work of an unlicensed law clerk. It can do real work, good work, fast, but a licensed human reviews it and signs. No agent signs off on anything. If you build that principle in now, while the use cases are simple, you’ll have the muscle when they’re not.
Takeaway four: The best compliance teams have stopped playing defense.
And the last theme, and it’s my personal favorite, because it flips the whole premise of how most companies think about this function. The most striking stories in the room came from leaders who stopped treating compliance as the “department of no” and started treating it as an infrastructure for speed.
One marketing leader described the old world: couple reviewers, everything manual, every asset through the same gauntlet. Marketing wanted to scale video, landing pages, new channels, and compliance was drowning. And the fix wasn’t more reviewers. It was automated monitoring as the always-on safety net, risk-based routing, so a blog post doesn’t get three legal reviews, and senior people are freed up for the judgment calls that actually need them.
The result: Marketing moves faster, not slower. Because here’s the line that stuck with me: The monitoring is what made it possible to go faster. Manual review would never have kept up.
And the same pattern showed up on build versus buy. A few members had tried building internal tools, and the story was always the same. The demo was great, and then the model endpoints changed. Then engineering got pulled from revenue work to maintain a compliance tool. And capital allocation logic won out: Put your engineers on your core business and buy the infrastructure, the same way you would never build your own CRM system.
But the deepest shift was about ownership. The strongest program in the room put content review directly in the frontline team. Not compliance checking marketing’s homework after the fact. Marketing owning the control, with compliance setting the standards and testing that the system works. When the people creating the risk own the tool that manages it, compliance stops being a bottleneck, and it becomes a strategic advantage.
So, four themes. Enforcement decentralized, and it’s moving fast. And this echoes what we’ve been talking about on the Roundup for many months now. The complaint data went dark, and benchmarking is now on you as the institution. AI is rewriting the funnel and the risk surface at the same time. And the winners are the ones treating compliance as the thing that lets them go fast, not the thing that slows them down.
But here’s what I actually took away from that afternoon. Banks, fintechs, card issuers, lenders: completely different institutions, different charters, different risk appetites. And every one of them, their challenges converged on the same place. Nobody has a full picture alone. Not us, not them, not the regulators. The whole reason we put these leaders in a room is so that you can see a lot more of this landscape together than any one of us can see by ourselves. That conversation is not a one-time thing; it is a standing table now. And what we heard is already shaping what we build next at PerformLine.
If that question from the top of the show stuck with you, the gift or the burden, and your honest answer was burden, that is worth sitting with. The visibility is coming either way. The only choice is whether you build the muscle to act on it before someone else finds those 300 pages first.
If any of this hits home for you or your program, you can find more on everything we covered, from state enforcement trends to AI and marketing, on our blog at performline.com. And I would encourage you to subscribe to the Regulatory Roundup while you’re there, so you never miss what’s moving.
You can follow PerformLine on LinkedIn for news and content in between episodes. And if this episode sparks something, a question, a disagreement, a topic you want us to dig into, I definitely want to hear it. Reach out at performline.com, or you can connect with me personally on LinkedIn.
Thank you so much for listening, and I’ll see you next time.
