From CompliNEWS | Financial Services Intelligence Watch

The Volkov Group reports that KPMG’s 2026 Global Chief Ethics and Compliance Officer Survey, based on responses from 725 CCOs, points to a significant expansion in the role of compliance. Operational resilience is no longer being treated as a separate concern for IT or business continuity teams, but as part of the core compliance agenda. The survey found that 75% of CCOs identified cybersecurity and data privacy as key areas for additional investment, while 77% cited data analytics as a primary investment driver. At the same time, 33% said new regulatory requirements would be their top compliance challenge over the next two years, highlighting the pressure on compliance functions to manage traditional regulatory change while also taking on broader resilience responsibilities.

The structural shift is equally important: 81% of CCOs reported confidence in collaborating with cybersecurity teams, 68% with resilience and business continuity functions, and 67% in assessing compliance synergies across legal, HR, investigations, internal audit and operations. The message is that modern compliance programmes can no longer operate effectively in isolation. Cyber risk, third-party dependencies, incident response, data governance and business continuity increasingly need to be considered as interconnected parts of the same control environment, with compliance involved from the planning stage rather than only after an incident has occurred.

The survey also suggests that compliance functions are adopting AI in a measured rather than indiscriminate way. Sixty-eight percent of CCOs described their view of AI as mixed but leaning positive, indicating that firms are seeing tangible benefits while remaining alert to governance and implementation risks. The most common use case is compliance risk assessment and management, cited by 50% of respondents, followed by data visualisation and predictive analytics at 44% and employee training and awareness at 44%. These figures suggest that firms are concentrating AI investment where it can enhance established compliance activities: identifying patterns across large data sets, improving risk dashboards and management information, and delivering consistent training at scale.

The broader implication for 2027 planning is that compliance budgets and operating models will increasingly need to reflect a mandate that extends beyond policy, monitoring and training into resilience, analytics and cross-functional risk management. The Volkov Group argues that the most effective approach is not to adopt AI simply because it is available, but to target specific use cases where the technology can demonstrably improve compliance outcomes. Taken together, the findings point to a new baseline for the compliance function: one that is expected not only to mitigate regulatory risk, but also to strengthen operational resilience, support better decision-making and contribute measurable value to the wider organisation.

Read the Full report by The Volkov Group here