The Wall

The usual story is that compliance is drowning in new rules. The record is more awkward than that, and more interesting. The United States published 2,441 final rules in 2025, 46% fewer than in 2000. FCA fines came to £124 million in 2025, about a twelfth of the 2014 total. SEC case counts fell by 43% between fiscal 2015 and fiscal 2025. What rose was everything else: the money ordered in a single SEC year reached $8.2 billion in fiscal 2024 and $17.9 billion in fiscal 2025, $14.9 billion of it from one case; nine UK bodies list 124 live initiatives in one joint Grid; US states passed 150 AI laws in 2025 against one in 2016; the EU has pushed back its AI Act’s high-risk obligations to 2027 and 2028; one UK transposition of one directive came with ten separate cost lines and a verified equivalent cost of £148.5 million a year. The wall a regulated firm hits is not the number of rules. It is the number of parallel programs, written in different words by different bodies, that a firm must run at once, with a compliance workforce that in the United States has grown 4.9% a year since 2010.

In this piece: fewer rules, more regimes; what enforcement actually did; what one new regime costs; the AI rules arriving; why headcount cannot scale; the structure of the wall.

Fewer rules, more regimes

Start where the complaint starts, with the count. The Office of the Federal Register tallies every document it prints by category. In 2000 it published 4,491 final rules and 2,724 proposed rules. In 2025 it published 2,441 final rules and 1,498 proposed rules.¹ No year after 2004 has reached 4,000. The flow of new rule documents has fallen by roughly half in a quarter century.

Two things complicate the relief. First, the rules got longer. The same office counts pages: rule documents filled 24,423 pages in 2000, 5.4 per rule, and 45,028 pages in 2024, 13.9 per rule, before 16,461 pages in 2025, 6.7 per rule (averages computed for this article).¹ The standing Code of Federal Regulations grew over the period, from 138,049 pages in 2000 to 194,395 in 2024 (Article I).² Fewer, longer rules are not easier to read. Second, the big rules swing. The GW Regulatory Studies Center counts economically significant final rules, those with an annual effect on the economy of $100 million or more ($200 million for rules published between 6 April 2023 and 20 January 2025); its review of the new administration’s first year puts them at 129 in 2024 and 44 in 2025.² A firm planning its compliance budget in late 2024 and again in late 2025 was looking at two different worlds, which is the real point about pace: it is not steady, so it cannot be staffed for.

The FCA’s Handbook register does not publish a count of rules per year. It held 2,038 legal instruments on 20 October 2026, and the FCA’s own numbering had reached instrument 2026/64 by 25 September 2026.³ A better measure exists, and it was built by the UK authorities for exactly the reason this article is about. Nine UK bodies jointly publish a Regulatory Initiatives Grid so that firms can plan for what is coming from all of them at once. The December 2025 edition lists 124 live initiatives, down 13% on the previous edition, of which 34 are multi-sector and 37 are new since the edition before (summed for this article from the section counts).⁴

Read the Grid as a firm would. To be included, an initiative must be public and “expected to have a significant operational impact during implementation”, which the Grid explains as initiatives “believed to take up a substantial amount of firms’ time and resources during implementation”. A group with payments, lending, insurance and investment arms has to read the multi-sector section and at least four of the seven sector sections. The Grid’s own introduction says why the Forum exists: it “was launched to further strengthen coordination between its 9 members”, the Bank of England, the CMA, the FCA, the FRC, HM Treasury, the ICO, the PRA, the PSR and The Pensions Regulator, whose initiatives usually reach firms through each member’s own channels.⁴

What enforcement actually did

The thesis under test says enforcement keeps rising. The record says something different and worth stating plainly. The FCA publishes a page for each year listing the fines published in it. Added up, the stated totals of the thirteen pages from 2013 to 2025 come to £4.88 billion across 308 listed penalties (computed for this article). But the shape is a spike and a long tail: £1.47 billion in 2014 and £905 million in 2015, then a range between £22 million (2016) and £568 million (2021, of which £265 million was a court fine after an FCA prosecution rather than an FCA penalty).⁵ The 2025 total, £124 million, is below the thirteen-year median of £216 million (computed for this article).

The count fell as well. The FCA listed 47 penalties in 2013 and 40 in 2014; since 2016 no year has exceeded 27. The share of individuals rose, which is a change of kind rather than volume: in 2013, 19 of the 47 rows named individuals; in 2025, 14 of the 23 rows are people, not firms (counted for this article).⁵

The SEC tells the same story twice over. Total enforcement actions were 807 in fiscal 2015, peaked at 868 in 2016, and fell to 583 in 2024 and 456 in 2025, a decline of 43% from 2015 (computed for this article).^{6 7} Money ordered went the other way. For seven years it sat near $4 billion; in 2022 it was $6.439 billion, and in 2024 $8.2 billion, at the time "the highest amount in SEC history", of which about 56% came from one judgment against Terraform Labs and Do Kwon. In fiscal 2025 the Commission reports $17.9 billion; its addendum attributes $14.9 billion of that ($5.9 billion in penalties and $9 billion in disgorgement) to a single case, SEC v. Stanford International Bank, and puts every other case together at $3 billion.⁷

FINRA, the self-regulator for US broker-dealers, imposed between $39.5 million and $90.1 million a year in fines from 2018 to 2025, with the low in 2019 and the high in 2021.⁸

One line in the SEC’s fiscal 2025 addendum shows how enforcement and regime-building feed each other. From fiscal 2022 into early fiscal 2025 the Commission imposed $2.3 billion in penalties for off-channel communications, that is, business messages sent on personal devices and not retained; $71 million of it fell in early fiscal 2025, and the current Commission describes the campaign as an inappropriate use of enforcement resources.⁷ The recordkeeping duty behind those cases is old. Announcing the first group settlement, with 16 firms in September 2022, the SEC’s chair said: “Since the 1930s, such recordkeeping has been vital to preserve market integrity.” The settlements turned that duty into a program inside each firm: the 16 agreed to retain compliance consultants to review their policies for communications on personal devices and how they deal with employees who break them. The penalties stopped. The programs did not: in April 2025 the Commission refused to release the firms covered by sixteen later settlements from undertakings that included an independent compliance consultant for about two years and two years of reports to the Commission on employee discipline.⁷

So the honest reading is this. In the US and UK records examined here, the number of enforcement actions is falling, and the money is lumpy: one or two cases can set a year’s total, as Terraform Labs did in fiscal 2024 and Stanford International Bank in fiscal 2025. That cuts against a simple "enforcement keeps rising" claim, and it supports a harder one. A firm cannot staff against enforcement risk by extrapolating last year, because last year’s total can turn on one or two cases. What it can do is keep every program ready for inspection at once, and that is a function of how many programs it runs, not how many fines were levied.

What one new regime costs

Regulators estimate the cost of what they impose, and the estimates are instructive less for their totals than for their shape. When HM Treasury transposed the second Markets in Financial Instruments Directive, the independent Regulatory Policy Committee verified an equivalent annual net direct cost to business of £148.5 million.⁹ The opinion does not present the cost as one figure. It sets it out area by area, ten of them: trading obligations (one-off €59 million, €46 million a year), transaction reporting (€59 million, €1.4 million a year), data reporting services (€30 million, €3.75 million a year), information and reporting obligations (€29 million, €6 million a year), execution-quality publication (€20 million, €6.6 million a year, for about 130 venues), organised trading facility authorisation (€20 million, €5 million a year, for 50 OTFs), emissions allowance trading (€15 million, €4.5 million a year, for about 150 firms), telephone recording (£7.2 million, £6.8 million a year), investment advice (€2.2 million, €31 million a year) and algorithmic trading reporting (€6 million in total, for around 1,500 firms).

Each line is a separate program inside the firm: a different system, a different owner, different data, a different go-live. The directive is one text; the firm experiences it as ten projects. None of the ten cost lines is for connecting them, and none needs to be, because from the regulator’s side there is nothing to connect. From the firm’s side, the connection is the job.

The European Commission’s impact assessment for the Digital Operational Resilience Act, as summarised by the European Parliament’s research service, estimated incident-reporting costs for financial institutions at between €9 million and €18 million one-off and €18 million to €36 million recurring, plus €25 million to €50 million for threat-led penetration testing at 100 institutions, against ICT-incident losses it put at US$2 billion to US$27 billion.¹⁰ Whether those estimates held is not a question this article can answer from official sources, and it does not try. What can be said is that DORA, like MiFID II, lands as its own program: its own register of ICT providers, its own incident taxonomy, its own testing cycle, running beside the operational-risk rules that already existed.¹⁰

The FCA’s Consumer Duty came in two dates, 31 July 2023 for open products and 31 July 2024 for closed ones.¹¹ Its cost-benefit analysis is not quoted here. The phasing is the point: a regime is not a day; it is a schedule, and schedules move. The clearest example is the one in the next section.

The AI rules arriving

A firm that puts models into marketing, client communications, surveillance or operations takes on obligations with each of them, and those obligations are multiplying faster than any other category of rule this article could find. Stanford’s AI Index counts AI-related laws passed by US state legislatures: "fewer than 10 in 2020" and 150 in 2025.¹³ For a firm licensed in several states, each is one more text to check for applicability. Where a state law on automated decision-making or on disclosure of AI use in consumer interactions reaches a bank’s chatbot, it does so in vocabulary of its own: the financial regulator speaks of model risk, suitability and fair treatment; the state legislature speaks of algorithmic discrimination, consequential decisions and notice. The duty overlaps; the words, the definitions and the enforcing authority do not. Each such law therefore lands as a fresh applicability review, a fresh policy and a fresh control, even where the firm already does the thing the law requires.

At national level the pace is slower but the same in kind. The Index records no AI-related law in any G20 country in 2016; by the end of 2025 fourteen of them had passed 96 between them, led by the United States with 25 and South Korea with 17; France and Japan passed 10 each, Italy 9, the United Kingdom 6, Germany and Russia 5, and China and India 1 apiece.¹³ US federal AI-related regulatory actions numbered 58 in 2025, against 1 in 2016.

The European Union is the test of whether a single, deliberately horizontal rule can simplify matters. Regulation (EU) 2024/1689 entered into force on 1 August 2024 with a staged timetable. On 8 July 2026 the Union adopted Regulation (EU) 2026/1744, in force from 27 July 2026, which moved the high-risk obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems.¹² The recital gives the reason in the legislators’ own words: the standards, common specifications, guidance and national authorities that the regime depends on were not ready. A financial firm that built its AI governance to the original date of 2 August 2026 now holds a program for rules that apply in 2027 and 2028, beside the model-risk, consumer-protection and data-protection rules that already govern the same models today.

Sources: Regulation (EU) 2024/1689, Article 113; Regulation (EU) 2026/1744, Article 4, recital 40 and the amended Article 113. ¹²

Why headcount cannot scale

The response to all of this, for twenty-five years, has been people. The US Bureau of Labor Statistics counted 126,840 compliance officers in 2000 and 417,070 in May 2025; from 2010, when the occupation was redefined, the series has grown 4.9% a year.¹⁶ Between fiscal 2000 and fiscal 2024 the full-time equivalent staff of the federal government’s economic regulators (finance and banking, industry-specific and general business regulation), the agencies that write and enforce these rules, grew from 32,646 to 40,682, or 25%.¹⁷ The regulated side has added people at several times the rate of the regulating side, while the count of new rules fell. Whatever the extra people are absorbing, it is not the flow of rules.

Put the two official series side by side and the mismatch is stark. In 2000 there were 28 US compliance officers for every final rule published that year; in 2025 there were 171 (computed for this article from BLS employment and the Federal Register count).^{1 16} Compliance officers work in every industry, not only finance, and a rule published in one year is enforced for decades, so the ratio is an illustration rather than a productivity measure. But it rules out the simplest explanation. The people were not hired to read new rules. There are not enough new rules to occupy them.

The arithmetic suggests what. Suppose a firm’s obligations were a single list, and each new rule added items to it. Then staff could grow with the list, and a 4.9% growth rate against a falling count of final rules would have caught up long ago. The evidence above says the obligations are not one list. They arrive as regimes: 124 live initiatives in one country from nine bodies, ten costed workstreams inside one directive, an AI regime whose dates have moved, 150 state laws in one year. Each regime is staffed, tooled and evidenced on its own. A firm that adds a jurisdiction does not add a few duties to a list; it adds another set of regimes, most of which restate duties it already has in words it does not already use. The cost grows with the number of regimes multiplied by the number of places, not with the sum of rules, and no hiring rate tracks a product.

It is also a cost that hiring cannot buy down. A compliance officer in one program knows that program. The knowledge that two programs in two regimes impose the same duty on the same process lives, if anywhere, in the person who happens to have worked in both. The BLS line is counting those people. It is not counting the connections between them, because nobody has written the connections down.

The structure of the wall

Count the bodies. The Financial Stability Board describes itself as 70 member institutions covering 25 jurisdictions.¹⁴ IOSCO, the association of securities regulators, has 134 ordinary members and says its membership regulates more than 99% of the world’s securities and derivatives markets in more than 130 jurisdictions.¹⁵ In one country alone, nine bodies publish a joint calendar.⁴ These counts measure membership, not exposure: they do not say how many of these bodies a given firm answers to, or how many rulebooks they write between them.

Here is why that, and not volume, is the structural wall. The FCA’s Handbook, the EU’s MiFID II and FINRA’s rules each require that communications to clients be fair and not mislead them (Article I quotes the three texts). The rules are different texts, in different structures, enforced by different bodies on different schedules, and they are the same duty. Article I measured how much the texts share: between the UK and the EU, where one was transposed from the other, a word-overlap matcher finds the twins; between the United States and either, it finds none at any threshold. The evidence in this article shows the same pattern from the regulators’ side. The UK Forum was launched, in its own words, “to further strengthen coordination between its 9 members”. MiFID II arrived in ten cost lines, one for each area of the directive. The AI Act’s high-risk dates moved because the standards, common specifications and guidance that would have told firms how to meet the high-risk requirements, and the national authorities that would supervise them, were not ready in time. In each case the missing thing is not a rule; it is a shared description of what the rules require, in terms that survive the crossing from one regime to the next.

Without that description, every regime is a separate program with its own policy set, its own control library, its own evidence store and its own staff, and the firm’s total effort is the sum of all of them. The same duty is met several times under several names and inspected several times by several bodies. Where a regulator cuts its output, as the Federal Register has in documents and the UK Forum has in live initiatives (down 13% in one edition), the firm’s cost does not fall, because the programs are already built and each still has to be kept alive; a withdrawn initiative removes a future project, not an existing one. Where a new regime arrives, the cost rises by a full program, however much of the regime restates what the firm already does. That asymmetry, rising with every addition and not falling with any subtraction, is the wall, and it is a property of how the obligations are described, not of how many there are.

The letter this article accompanies proposes an open common language for rules, duties, roles, documents, systems and processes as the alternative: one description of a duty, with every regime’s wording hanging off it. Whether that works is a question for Articles III and IV, and the honest reading of this one is narrower. The data do not show a flood of rules. They show partly overlapping regimes arriving in parallel, 124 live initiatives from nine UK bodies and 150 state AI laws in a single year, each written in its own words, with no shared map among them. People have been the map. At 4.9% a year, they are an expensive one, and the evidence here is that the problem they are being hired to solve does not grow at a rate people can match.

Notes and sources

1. Office of the Federal Register, Federal Register statistics: category document statistics and category page statistics, read 20 October 2026. Counts of documents in the "Rules" category by calendar year (from 2009, corrections are counted within the category of the document corrected); 2026 is a partial year and is excluded. Proposed rules: 2,724 in 2000 and 1,498 in 2025. Pages of rule documents: 24,423 in 2000, 45,028 in 2024 and 16,461 in 2025; total pages: 77,219 in 2000, 107,262 in 2024 and 61,584 in 2025. Pages per rule document computed for this article.
2. GW Regulatory Studies Center, Reviewing the Second Trump Administration’s First Year with RegStats (Sayam Palrecha, 4 March 2026), read 20 October 2026: economically significant rulemaking fell "from 129 to 44 rules" between 2024 and 2025. The commentary does not say whether these are calendar or presidential years; the Center’s presidential-year series (February to January) on the Reg Stats page shows 124 for 2024 and 42 for 2025. The Reg Stats page defines economically significant rules as those with "an annual effect on the economy of $100 million or more", with "a higher threshold of $200 million" for rules published between April 6, 2023, and January 20, 2025, under Executive Order 14094. Code of Federal Regulations pages from the Center’s CFR pages by calendar year file: 138,049 in 2000 and 194,395 in 2024.
3. FCA Handbook, Legal instruments, read 20 October 2026: "Displaying 1 - 20 of 2038 Legal Instruments". The highest 2026 instrument number visible on the first page was FCA 2026/64 (Conduct of Business (Interactive Pension Simulations) Instrument 2026, published 25 September 2026). The register does not publish per-year counts.
4. Financial Services Regulatory Initiatives Forum, Regulatory Initiatives Grid, 9th edition, December 2025, read 20 October 2026: "This edition features 124 live initiatives, a reduction in the total number of live initiatives since the last edition of 13%." Section counts as printed: multi-sector 34 (11 new), banking, credit and lending 30 (8 new), payments and cryptoassets 15 (2 new), insurance and reinsurance 13 (4 new), pensions and retirement income 12 (6 new), wholesale financial markets 11 (2 new), investment management 6 (2 new), retail investments 3 (2 new); the last two sections give "a total of" 11 and 3 initiatives. The 37 new initiatives, and the check that the sections sum to 124, were computed for this article. "The ‘Multi-sector’ section covers initiatives that span more than one sector." Forum members: Bank of England, CMA, FCA, FRC, HM Treasury, ICO, PRA, PSR and The Pensions Regulator; the Forum "was launched to further strengthen coordination between its 9 members". Inclusion criteria and the note that stakeholders are usually informed through "Forum members’ regular channels of communication" are from the introduction (page 3).
5. FCA, fines pages for each calendar year, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024 and 2025, read 20 October 2026. Stated totals: £474,263,738; £1,471,431,800; £904,959,378; £22,216,446; £229,515,303; £60,467,212; £392,303,087; £183,671,618; £567,765,219.95; £215,834,156; £53,354,600; £176,045,385; £124,221,367.45. The 2021 total includes a £264,772,619.95 fine imposed by a court on National Westminster Bank after an FCA prosecution. The 2016 total excludes the £13,130,000 additional penalty on Shay Jacob Reches, as the page states. The 2020 stated total equals the listed fines minus the £8,963,200 fine on Charles Schwab UK (computed for this article). The 2025 page describes its figure as the total "so far" and excludes court fines. Row counts, and the rows naming individuals (19 of 47 in 2013, 14 of 23 in 2025), were counted for this article.
6. US Securities and Exchange Commission, press releases on enforcement results: FY2015 (807 actions, "approximately $4.2 billion"), FY2016 (868, "more than $4 billion"), FY2017 (754, "more than $3.789 billion"), FY2018 (821, "more than $3.945 billion"), FY2019 (862, "more than $4.3 billion"), FY2020 (715, "approximately $4.68 billion"), FY2021 (697; $3.852 billion as printed in the FY2022 release), FY2022 (760, $6.439 billion, comprising civil penalties, disgorgement and prejudgment interest), FY2023 (784, $4.949 billion), FY2024 (583, $8.2 billion, "the highest amount in SEC history" at the time; "Approximately 56 percent" is attributable to the judgment against Terraform Labs and Do Kwon). Read 20 October 2026.
7. SEC, press release 2026-34 (7 April 2026) and its addendum, read 20 October 2026: 456 total enforcement actions in fiscal 2025 (303 standalone, 69 follow-on administrative proceedings, 84 delinquent filings) and monetary relief "totaling $17.9 billion" (addendum table: $17,968 million, of which penalties $7,208 million and disgorgement $10,760 million). The addendum attributes penalties of $5.9 billion and disgorgement of $9 billion, "for a total of $14.9 billion", to SEC v. Stanford International Bank Ltd.; excluding that case, penalties of $1.3 billion and disgorgement of $1.7 billion, "for a total of $3 billion" ($2.7 billion excluding certain offsets and certain penalties). From FY 2022 through the early part of FY 2025, $2.3 billion in penalties for failing to maintain and preserve off-channel communications, $71 million of it in early FY 2025, which the Commission "views as representing an inappropriate use of enforcement resources by the prior Commission". Also: SEC press release 2022-174 (27 September 2022), 16 firms charged; employees "routinely communicated about business matters using text messaging applications on their personal devices"; the firms "agreed to retain compliance consultants"; Chair Gensler: "Since the 1930s, such recordkeeping has been vital to preserve market integrity." And SEC Release No. 34-102860 (14 April 2025), Order Denying Motions to Modify or Amend and Stay Settled Orders: respondents to sixteen orders issued between September 2023 and September 2024 had asked to remove requirements to engage an independent compliance consultant "for an iterative process over approximately two years" and to report employee discipline to the Commission for two years.
8. FINRA, Report on Use of Fine Monies for 2018 ($61.0 million), 2019 ($39.5 million), 2020 ($57.0 million), 2021 ($90.1 million), 2022 ($48.1 million), 2023 ($85.5 million), 2024 ($59.8 million) and 2025 ($74.2 million), read 20 October 2026. The 2021 to 2025 reports state that the figure excludes disgorgement awards ($12.9 million, $6.4 million, $2.9 million, $6.2 million and $3.4 million respectively), which FINRA’s Annual Financial Report treats as fines; the 2018 to 2020 reports do not mention disgorgement.
9. Regulatory Policy Committee, opinion RPC16-3301(3)-HMT on HM Treasury’s impact assessment of the Markets in Financial Instruments Directive II, 9 March 2017, read 20 October 2026: "The RPC verifies the estimated equivalent annual net direct cost to business (EANDCB) of £148.5 million." The opinion lists one-off and ongoing costs for nine areas as charted (eight in euros; telephone and electronic recording in sterling; the department used "an exchange rate of €1=£0.87") and a tenth, algorithmic trading, for which around 1,500 firms "will incur total costs in the UK of €6 million", with no one-off and ongoing split.
10. European Parliamentary Research Service, Strengthening digital operational resilience in the financial sector, Initial Appraisal of a European Commission Impact Assessment, briefing PE 654.210, December 2020, on the Commission’s impact assessment SWD(2020) 198: incident-reporting "one-off costs for financial institutions at between €9 million and €18 million", "recurring costs for managing incidents and reporting at between €18 million and €36 million", testing costs for "100 financial institutions not currently participating in threat-led penetration testing" estimated "at between €25 million and €50 million", and ICT-incident impacts "in the EU financial sector to be in the range of US$2 billion to US$27 billion". The register, incident classification and testing cycle are in DORA itself, Regulation (EU) 2022/2554: a register of information on contractual arrangements with ICT third-party service providers (Article 28(3)), classification of ICT-related incidents (Article 18) and threat-led penetration testing "at least every 3 years" (Article 26). Read 20 October 2026.
11. FCA, PS22/9: A new Consumer Duty, 27 July 2022, read 20 October 2026: the rules come into force on 31 July 2023 for new and existing products or services that are open to sale or renewal, and on 31 July 2024 for closed products or services. The cost benefit analysis in CP21/36 Annex 2 is not quoted in this article.
12. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), OJ L, 24 July 2026, read 20 October 2026. Under its Article 4 it enters into force on the third day following its publication (27 July 2026). It amends Article 113 of Regulation (EU) 2024/1689 so that Chapter III, Sections 1, 2 and 3 apply from 2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and from 2 August 2028 for those classified pursuant to Article 6(1) and Annex I. Recital 40 gives the reason: "the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities lead to challenges that jeopardise the effective entry into application of those obligations". Earlier dates from Article 113 of Regulation (EU) 2024/1689, published 12 July 2024 and in force on the twentieth day following publication.
13. Stanford Institute for Human-Centered AI, AI Index Report 2026, chapter 8, Policy and Governance, and the report’s public data (chapter 8 files fig_8.4.3.csv, fig_8.4.4.csv and fig_8.4.10.csv), read 20 October 2026. Chapter text: across all US states, AI-related bills passed "increased from fewer than 10 in 2020 to 150 in 2025" (figure 8.4.4); "In 2016, there were no AI-related laws on record among G20 countries" (figure 8.4.3); US AI-related regulations "increasing from one recorded action in 2016 to 58 in 2025" (figure 8.4.10). Per-year state values (1, 1, 9, 15, 9, 23, 27, 49, 132 and 150 for 2016 to 2025) and the country sums are from the public data; the published state and federal charts label only their 2025 values.
14. Financial Stability Board, Annual Financial Report, 1 April 2025 to 31 March 2026, published 4 September 2026: "The FSB is comprised of 70 member institutions" and "The membership covers 25 jurisdictions". Read 20 October 2026.
15. IOSCO, About IOSCO, read 20 October 2026 (the address of IOSCO’s fact sheet, iosco.org/about/pdf/iosco-fact-sheet.pdf, now redirects to this page): ordinary members (134), associate members (34), affiliate members (78); the membership "regulates more than 99% of the world’s securities and derivatives markets in more than 130 jurisdictions".
16. US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, Compliance Officers (13-1041), Table 1 of the May 2025 release (417,070), the May 2010 release (204,000) and the 2000 release (126,840, under the title "Compliance officers, except agriculture, construction, health and safety, and transportation"), read 20 October 2026. The May 2010 estimates were "the first set of estimates based in part on data collected using the 2010 SOC system", so the 2000 figure is not strictly comparable; see Article I, note 3. The 4.9% a year figure is the compound growth rate from 2010 to 2025, computed as (417,070 / 204,000)^(1/15) minus 1.
17. GW Regulatory Studies Center, Reg Stats, Regulators’ Budget: full-time equivalent personnel by fiscal year, read 20 October 2026: "economic regulation" agencies, 32,646 in FY2000 and 40,682 in FY2024. The Regulators’ Budget report (Mark Febrizio and Melinda Warren, Weidenbaum Center and GW Regulatory Studies Center, July 2020) divides economic regulation into finance and banking, industry-specific regulation and general business, so the category is not finance alone.