From Tasks to the Map

Compliance has grown for twenty-five years by adding people. The United States employed 417,070 compliance officers in May 2025, more than three times the number in 2000, and the wage bill for that one occupation has nearly tripled since 2010 in current dollars. KPMG counts more than $90 billion of venture capital, private equity and M&A deals in regtech between 2014 and 2025, and the headcount curve did not bend. The argument here is that the tools automated tasks while the map of what a firm owes stayed in people’s heads. In 2023 OpenAI reported a model scoring around the 90th percentile on a simulated bar exam, and the price of that model’s level of performance on a general-knowledge test fell more than 200-fold in under two years. A test run for this article (see “An experiment with the map”, below) applied a keyword extractor and matcher to six real rulebook texts from three jurisdictions: at its standard settings it finds the UK and EU twins and not a single US one. That gap suggests why the tools automated the tasks and did not produce the map. This wave has to do both, and the map is the part still missing.

In this piece: counting the rules; counting the people; counting the money; what the tools automated; what changed in 2023; an experiment with the map; the extrapolation.

Counting the rules

Start with the volume of rules. The Code of Federal Regulations, the standing body of US federal rules, ran to 138,049 pages in 2000 and 194,395 in 2024, a 41% increase.¹ The Federal Register, the daily gazette in which new rules, proposals and notices appear, has published between 61,584 and 107,262 pages in every year from 2000 to 2025.² The gazette does not shrink in quiet years; it only grows more slowly.

Page counts are a crude ruler. Pages do not map to duties, and a firm is bound by only part of the whole. But the ruler points one way. The CFR page count fell in only four of the 24 years since 2000 (2003, 2014, 2018 and 2022), each time by less than 1%, and the flow of new material has stayed above 60,000 pages a year for 26 years running.

No equivalent page series is drawn here for the UK or the EU. The experiment later in this piece gives a different kind of measure: six texts from three rulebooks, on two narrow topics, run to 556 provisions.

Counting the people

Rules are followed by people, and the people are counted. The US Bureau of Labor Statistics publishes annual estimates for an occupation now called Compliance Officers (code 13-1041). In 2000 it counted 126,840 of them. In May 2025 it counted 417,070, earning a mean $88,400 a year.³

Two things about this chart deserve care. The occupation was redefined in 2010: the new classification gave transportation security screeners, some of whom had been counted here, a code of their own, and the bar drops between 2009 and 2010, so the growth rates here start in 2010. And BLS pools three years of survey data into each estimate, which smooths the line. Even so, from 2010 to 2025 the count rose every year, by an average of 4.9% a year, through the recovery from the financial crisis, a pandemic and a deregulatory administration. If that rate held, the count would pass half a million in 2029.

Multiply employment by the mean wage and you get a narrow estimate of what US employers pay this one occupation in wages: $12.7 billion in 2010 and $36.9 billion in 2025, not adjusted for inflation.³ That excludes benefits, contractors, consultants, lawyers, the technology, and everyone who does compliance work under a different title.

For a sense of the whole rather than one occupation, one published figure is LexisNexis Risk Solutions’ survey-based estimate of what financial institutions worldwide spend on financial-crime compliance alone: $206.1 billion in its 2023 report.¹² Financial crime is one chapter of the rulebook, so the figure leaves out the rest.

Counting the money

Here is the puzzle. Over the same years, capital went into fixing exactly this. KPMG’s Pulse of Fintech, using PitchBook data, counts global regtech funding (venture capital, private equity and M&A deal value) at $3.9 billion in 2014, a peak of $21.3 billion in 2022, and $4.9 billion in 2025.⁴ Taking each year from the latest H2 edition that prints it, the twelve years add up to $91.9 billion.

Lay the funding chart over the headcount chart and the puzzle is plain. The money went in; the people kept being hired. Either the money was wasted, or it bought something other than fewer people. The argument of the next section is that it bought something real, and that it was the wrong thing.

What the tools automated

Compliance technology has moved in steps. Rules engines turned detection scenarios into alerts, and later models ranked the alerts. Screening tools matched names against sanctions lists. Reporting platforms packaged transactions for regulators. Horizon-scanning services clipped the Federal Register into daily emails.

Each step made one task faster, and each task sat inside a program that nobody had written down as a whole. What a firm owes, why it owes it, which policy, control, system and person serves each duty, and whether the evidence exists: that picture was built by people, in the specific sense that it lived in them. Lawyers read the rules, consultants mapped them, compliance teams turned the maps into policies, controls and spreadsheets. When the rules changed, they did it again. When they left, the firm hired a replacement, and the BLS line counts the compliance officers among them.

The tools automated the tasks. The map stayed manual. A faster screening engine does not tell you whether the screening duty is met for the Lithuanian branch under the rules that took effect in March. So the firm hires someone to know that, and someone to check them.

What changed in 2023

Map-making is reading and writing. Read a regulation, write the obligation. Read the obligation, write the policy. Read the policy, write the control. The first change is capability. In March 2023, OpenAI reported that GPT-4 scored around the 90th percentile on a simulated Uniform Bar Exam; its predecessor, GPT-3.5, scored around the 10th.⁶ On LegalBench, an academic suite of 162 legal reasoning tasks, GPT-4 applied rules to facts correctly 82% of the time.⁷

The scores have kept climbing. Harvey reports base-model scores on its BigLaw Bench rising from 60% (GPT-4o, Claude 3.5, Gemini 1.5) to 90% (GPT-5, Claude 4.5, Gemini 3),⁸ and on Vals AI’s LegalBench leaderboard the top accuracy was 88.56% on 13 October 2026, against 64.37% for GPT 3.5.⁹ No compliance program should be built on a benchmark score. But the direction, on tests designed by lawyers, is not ambiguous.

The second change is price. Epoch AI tracks the cheapest model that matches a given score on a benchmark. For GPT-4’s score on MMLU, a general-knowledge test, the price fell from $37.50 per million tokens in March 2023 to $0.18 in February 2025, more than 200-fold.⁵ For GPT-3.5’s score, it fell from $20 in November 2022 to $0.07 in October 2024. A million tokens is about 15 times the length of the six rulebook texts in the baseline test below, which come to 68,629 tokens with GPT-4’s tokenizer (counted for this article).

The third change is adoption. The Thomson Reuters Institute surveys legal, tax and accounting, corporate risk and government professionals each year. The share who say their organisation is using generative AI went from 12% in 2024 to 22% in 2025 to 40% in 2026.¹⁰ Corporate risk departments are the lowest of the six groups in 2026, at 32%, against 47% for corporate legal departments. The lawyers next door are using the tools; the risk team, on this evidence, is behind them.

An experiment with the map

The numbers so far are other people’s. The following test was run for this series. It uses a deliberately simple, fully deterministic pipeline built from functions published in the open CLHEAR repository: find the duties in a text by their modal verbs, remove near-duplicates, and match duties across jurisdictions by the share of words they have in common. No language model anywhere. The question is how far that gets you.¹¹

The test took six texts on two narrow topics, client communications and best execution, from three rulebooks: the FCA Handbook (COBS 4 and COBS 11.2A), FINRA (Rules 2210 and 5310) and MiFID II (Articles 24 and 27, with Articles 44 to 47 and 64 to 66 of the delegated regulation). The texts were read from official websites (the FCA Handbook, finra.org, ESMA’s Interactive Single Rulebook and EUR-Lex) on 15 October 2026 and split into 556 provisions.

The keyword extractor found 223 duties among the 421 binding provisions. A manual reading of 40 of them found 4 whose own text imposes no duty: two scope provisions and two disclosure items caught by a descriptive “may not”. Within each jurisdiction, 5 duties were near-duplicates of another (all 5 in the FCA texts), leaving 218 distinct duties: 99 British, 59 American, 60 European.

Then the interesting part. At a strict threshold, 60% shared words, 19 of the 218 duties have a counterpart in another jurisdiction. At a loose threshold, 30%, the number is 39. Every one of those matches is between the UK and the EU, and the reason is historical rather than clever: the FCA’s rules in these sections derive from MiFID, so COBS 4.5A.9 and Article 46(5) of the delegated regulation share 93% of their words.

And the United States? At either threshold, zero. No American duty shares more than 13.8% of its words with a European or British duty; only at a 10% threshold do 17 of the 59 find a weak match. Yet the three epigraphs at the top of this piece are the same duty. FINRA says fair and balanced; Europe says fair, clear and not misleading; everyone means that you may not mislead the customer. A reader sees that in a second. A word-matcher does not, at any threshold tested here: the FINRA clause shares 3% of its words with the FCA rule and 7% with Article 24(3). Even the FCA rule and Article 24(3) share only 7%, because the FCA rule carries its scope provisions in the same clause.

That is the finding, and it cuts both ways. It suggests why keyword tooling has not produced the map: across the Atlantic, the words are different. And it is why the map is now possible: reading two differently worded sentences and saying whether they mean the same thing is a reading task, and reading is where the new models have improved. The next version of this experiment is to replace the word-matcher with a model, keep the clause-by-clause lineage, and put a person’s signature on every match. The match rate is the number to watch; if it stays near 9%, this chapter is wrong.

The extrapolation

Put the series side by side and extend them.

• Rules. The CFR grew about 1.4% a year from 2000 to 2024. Carried forward, it reaches about 209,000 pages in 2029. The gazette keeps publishing.
• People. Compliance officers in the US grew 4.9% a year from 2010 to 2025. Carried forward: about 505,000 in 2029, with a wage bill of about $44.6 billion at the 2025 mean wage.
• Machines. Epoch’s price lines fell between 9-fold and 900-fold a year, depending on the performance milestone. Even at the slow end, a price of $37.50 in 2023 would be below one cent by 2029.
• Adoption. The professional-services usage line nearly doubled two years running. It cannot keep doubling from 40%, but it does not need to.

The first two lines are the old world continuing, and they can continue a long time; nothing in them breaks on its own. The second two are what breaks them. When reading the rulebook costs cents and a machine can say which clauses mean the same thing, the map stops being a thing people carry around in their heads and becomes a thing a firm owns, in a file, with a lineage. Once it exists, every application, role and control in the firm can be judged by one standard: the obligation it serves. That is the shift. Earlier tools automated tasks. This time the map itself gets automated, and the headcount line has a reason to bend.

The projection assumes the lines are independent. They are not; a bent headcount line will change what regulators ask for, and that will change the rules line. Part VI is about the ways this goes wrong. Part II is about why, even without any of this, the current model was already hitting a wall.

Notes and sources

1. GW Regulatory Studies Center, Reg Stats, Total Pages Published in the Code of Federal Regulations (data file). The file notes that post-1974 figures include printed pages plus unrevised volumes, and gives GovInfo as the source for 2024 and the Office of the Federal Register’s statistics for earlier years.
2. Office of the Federal Register, Federal Register page statistics. The 2002 total includes 6,653 pages for a single document; from 2009, corrections are counted within the category of the document corrected.
3. US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, occupation 13-1041, Compliance Officers: employment and annual mean wage from the national estimates files for 2000 to May 2025, listed on the OEWS tables page. BLS has published estimates for this code since its 1999 survey. Until May 2009 the occupation was titled "Compliance Officers, Except Agriculture, Construction, Health and Safety, and Transportation"; from May 2010 it is "Compliance Officers", as BLS moved to the 2010 SOC (May 2010 and May 2011 used a hybrid of the 2000 and 2010 systems). The 2010 SOC gave transportation security screeners, previously classified in several occupations including this one, a code of their own (33-9093). Each estimate pools three years of survey data. The 2000 to 2002 estimates have fourth-quarter reference periods, not May.
4. KPMG, Pulse of Fintech, H2 2019 through H2 2025 editions, global regtech charts (VC, PE and M&A), "data provided by PitchBook". Earliest edition used: H2’19; latest: H2’25. The chart uses the most recent H2 printing of each year: H2’19 for 2014 to 2016, H2’20 for 2017, H2’21 for 2018, H2’22 for 2019, H2’23 for 2020, H2’24 for 2021 and H2’25 for 2022 to 2025; the twelve values sum to $91.9 billion. Values are restated between editions; for example, 2023 was printed as $2.6 billion in H2’23, $4.4 billion in H2’24 and $9.0 billion in H2’25.
5. Epoch AI, LLM inference prices have fallen rapidly but unequally across tasks, 12 March 2025, table of lowest prices at fixed performance (data updated 20 November 2025): "The rate of decline varies dramatically depending on the performance milestone, ranging from 9x to 900x per year." The Stanford AI Index 2025 reports the GPT-3.5-level fall, from $20.00 per million tokens in November 2022 to $0.07 by October 2024, as "a more than 280-fold reduction".
6. OpenAI, GPT-4 Technical Report, March 2023, Table 1: Uniform Bar Exam 298/400 (about 90th percentile) for GPT-4 against 213/400 (about 10th percentile) for GPT-3.5.
7. Guha et al., LegalBench: A Collaboratively Built Benchmark for Measuring Legal Reasoning in Large Language Models, 2023, Table 3: GPT-4 rule-application correctness 82.2%.
8. Harvey, Introducing BigLaw Bench (August 2024) and Expanding BigLaw Bench (February 2026), which reports base-model scores "going from 60% (GPT 4o | Claude 3.5 | Gemini 1.5) to 90% (GPT-5 | Claude 4.5 | Gemini 3)". A vendor-published benchmark.
9. Vals AI, LegalBench leaderboard, updated 13 October 2026 ("Evaluating language models on a wide range of open source legal reasoning tasks"): top accuracy 88.56% (Claude Fable 5); GPT 3.5 64.37%.
10. Thomson Reuters Institute, 2026 AI in Professional Services Report: "Four-in-ten respondents say their organizations are using GenAI, up from 22% last year." In the same report (Infographic 1), corporate risk respondents are lowest of six organisation types at 32%; corporate legal is at 47%. The 2025 report gives 22% in 2025 against 12% in 2024. Surveys of legal; tax, audit and accounting; corporate risk and fraud; and government professionals; 1,514 respondents in 27 countries for 2026.
11. The experiment: the six texts were read from the FCA Handbook, finra.org, ESMA’s Interactive Single Rulebook and EUR-Lex on 15 October 2026 and split into 556 provisions. Binding provisions (FCA rules and evidential provisions, FINRA rule text and supplementary material, EU articles) were passed through a deterministic keyword extractor (version deterministic-v6 in the open repository below) that detects duties from modal verbs and is written to exclude definitions, scope and procedure clauses, then through a dedupe step (0.92 word overlap within a jurisdiction) and two cross-jurisdiction word-overlap matchers (0.60 and 0.30). No language model was involved at any step. This is a baseline: the repository’s deterministic functions run without the model steps its full pipeline adds (triage, structure repair, review and concept drafting). A manual reading of 40 of the 218 distinct duties (every fifth) found 4 whose own text imposes no duty: two scope provisions (COBS 4.1.1R and FINRA Rule 2210(c)(2)(B)) and two disclosure items caught by a descriptive “may not”. At a 0.10 threshold, 17 of the 59 US duties find a weak UK or EU match; no US duty shares more than 13.8% of its content words with a UK or EU duty. Code: github.com/Reg42-ai/clhear, app/clhear/l2.
12. LexisNexis Risk Solutions, True Cost of Financial Crime Compliance Report, press release of 26 September 2023: financial institutions bear “a total cost of U.S.$206.1 billion”, from a survey of 1,181 financial crime compliance professionals across the US and Canada, APAC, EMEA and LATAM. The 2021 edition gave a projected total of $213.9 billion (1,015 respondents) and the 2020 edition $180.9 billion (898 respondents); the editions use different samples, so they are not a strict time series.