Don’t Panic.Regulation is Cool.

To whom it may concern,

Ask a bank whether it is compliant, and time how long the answer takes.

It is a fair question. The bank holds your money under rules written for exactly that purpose. But the honest answer is not a number on a screen; it is a project. Someone has to find which rules apply, which policies cover them, which controls run and where the evidence sits, and most of that lives in spreadsheets, scattered systems and the memory of the people who built them. I have spent ten years on the technology that was meant to make this easy: first on the vendor side, in regulatory reporting, then seven years at a global trading platform, where I led the creation of its regtech department from scratch: buying tools, building others, and integrating, running and managing them. It was a rare privilege. A hypergrowth, global, innovative business taught me how a firm scales without losing its grip on the rules, and I learned it alongside some of the sharpest people in regtech. In all that time, I never saw a tool that could answer the question on the day it was asked.

The bill for that is enormous. The United States now employs 417,070 compliance officers, more than three times as many as in 2000. The standing body of US federal rules runs to 194,395 pages. In UK financial services, compliance, fines included, takes more than 13% of the average firm’s operating costs. The world’s financial institutions, from banks and insurers to asset managers, payment firms and brokers, spend roughly $6.5 trillion a year running themselves, by my count; 13% of that is about $850 billion. That is before the products launched late or never, and before the price of a damaged reputation. My estimate: more than $1 trillion a year. Twelve years and more than $90 billion of “regtech” investment later, not one of those lines has bent.

Here is what I think happens next. In 2027, the first regulated firms will hold a complete map of what they owe, drawn by machines from the rulebooks themselves and signed by the people responsible. In 2028, those firms will open a new country by changing a profile rather than hiring a department, and compliance teams that took a decade to build will start to be rebuilt around the system instead of the spreadsheet. Compliance will stop being the reason a launch waits. Software that reads every rulebook in every language at once will do most of what compliance officers do today: the mapping, the checking, the reporting, the explaining. People will keep the judgment and the signature. Everything in between goes.

Say this at a compliance conference and you will hear three answers. Compliance is judgment. Regulators will never accept it. We tried regtech, and look. I understand the reflex; I have lived inside the gaps between those tools, and five years ago I would have given the same answers.

But some of us have seen it coming. We are the ones who built the surveillance stacks and the reporting pipelines inside banks, brokers and platforms, who have read the same duty in the FCA Handbook, the FINRA rulebook and MiFID and know it is one duty wearing three outfits. I am not a lawyer, and not a compliance officer by title. I am one of the people who kept the tools running and watched what they could and could not do, with a long-standing LinkedIn slogan, Regulation is Cool, that got the smiles it deserved. What we saw coming was not another rule. It was a new kind of reader.

Every earlier wave of regtech automated a task: an alert, a report, a match against a sanctions list. Everything in between stayed with people, because what sits between a rulebook and a control is reading and writing, and machines could not do it well enough to matter. Now they can. In March 2023, a machine passed a simulated bar exam that its predecessor had failed, and in under two years the price of matching it on a standard benchmark fell more than 200-fold. What the machines learned was not judgment, and not responsibility. It was translation.

And their reach goes beyond text. The same machines now build production-ready, customised applications and agents from plain language, inside the client’s own environment, so projects that took months or years can take weeks or days. To unlock that, the architecture has to be redesigned and rebuilt inside the client’s perimeter, not bolted onto the old stack. Take the translation off the desks of 417,070 people, and compliance becomes something a company has rather than something it does.

That matters because compliance has a vocabulary problem, not a tooling problem. Every rulebook, policy, system and team describes the same duties in different words, so the connections between them live in people’s heads, and the heads keep leaving. Accounting solved this long ago. Hand two bookkeepers the same transactions and the same standards and they should produce the same balance sheet, every line traceable to an entry in the ledger. Hand two consultants the same firm and the same rulebook and you will get two different compliance programs, with no way to tell which one is right. Describe a company, run the procedure, get the program, every step traceable to its source: that is how it should work. It does not, because nobody has written the procedure down.

So we are writing it down. CLHEAR is the open standard we are building to describe a compliance program in one language that both machines and people can easily understand: the exact words of the rules, the duties inside them, the roles, documents, systems and processes each duty requires, and the profile of the firm that owes them. The vision is a public reference any firm, regulator or software maker can read: describe an organisation, and see the program it needs, every line traced to the clause it came from.

It will be open because the goal is adoption, not ownership. The languages finance already runs on, FIX for orders, ISO 20022 for payments, the LEI for identity, belong to no single vendor, and firms adopt them because no competitor can change them or switch them off. A compliance language needs that and more. It has to be trusted by regulators, auditors and the executives who sign under it, and none of them will put their name to a vocabulary they cannot inspect. And no single company can cover every rulebook in every jurisdiction; an open standard lets the practitioners who know each rulebook improve the part they know. Reg42 will earn its living running programs on the standard, not owning its words.

On top of the standard, Reg42 is building the system to run the program. Map what the rules require. Compare it with what the firm actually does. Comply by closing the gaps: software does the work, accountable people sign off. One intelligent system for the entire compliance program, in the firm’s own cloud, for financial services first and every regulated industry after. Our targets: cut a firm’s total compliance cost by 80%, know its compliance score at any moment, and answer any compliance question in 60 seconds. The vision past the targets is a compliance program that runs itself, and can prove it.

In the book our name comes from, a civilisation builds a computer to find the answer to everything, waits seven and a half million years, and gets 42, only to learn that nobody ever knew the question. Compliance is the reverse. The answers are published every working day, in a gazette that has not had a year under 60,000 pages this century. What the industry has never agreed on is the question: what is good enough, how do you build it, and how do you show it, as a complete program, on demand? Answer it and you sleep soundly, with confidence and certainty. Leave it open and you live in a fog, your blood pressure rising at every routine question from a regulator or an auditor. Answering that question is the whole product.

I could be wrong about the dates. I have watched enough roadmaps to know which way they slip. What I do not think I am wrong about is the direction, and the evidence is in the six articles below, each written to stand alone, each with its own sources and charts. Part VI argues against me; start there if you are a sceptic. I hope you are.

1. IFrom Tasks to the MapThe US employs 417,070 compliance officers, more than three times the 2000 count, and more than $90 billion of regtech investment did not bend the line. The tools automated tasks; the map of what a firm owes stayed in people’s heads. Since 2023 the price of GPT-4-level performance has fallen more than 200-fold, and a keyword test on six real rulebook chapters shows where the old approach breaks.
2. IIThe WallA firm cannot hire its way over the wall: parallel regimes for the same duties, new AI rules on both sides of the Atlantic at once, and no shared map between them.
3. IIIOne Common LanguageThe same duty, written three ways: what a word matcher finds across UK, EU and US rulebooks, what it misses, and what other industries learned when they built a common language.
4. IVProof Before AutonomyNobody should trust automated compliance until it can prove itself: accountable people, agents that earn their tasks, evidence that runs both ways, data that stays home.
5. VWhat We Are BuildingWhat Reg42 is building, and where we start: AI rules across the US, EU and UK at once, because adding a country should not multiply the program.
6. VIWhat Could Prove Me WrongSeven ways the prediction could fail, each with a public signpost and a date to watch.

If you run compliance at a bank, a broker, an insurer or a payments firm, come and map your program with us. If you have spent a career inside a regulator, help make the standard worth trusting; it will not be trusted on my word. If you build software, the hard parts are unbuilt and the data is public. If you fund what comes next, you know where to find me.

A note on sources. Every figure in these pages comes from public data or from tests run on public rulebooks, and where a number is my own estimate, it says so. The judgments come from ten years of conversations with the people who do this work. Sources for this letter are listed at the end; each article carries its own. Nothing here comes from any client.

And a note on the title. Don’t panic, because what is coming is good news: trust is what lets a stranger hand you their savings, and proving you deserve it is about to get cheap. Regulation is cool, because rules are how a society writes down what it expects of the people it trusts, and running them well at scale is the most interesting problem I know. It took me ten years to be sure of that. I am now.

Don’t panic. The answer is 42.

Avner YoffeFounder, Reg42 · Tel Aviv, October 2026

For everyone who signs their name under a compliance program. They were never the problem.