Personal liability for compliance failures is no longer theoretical. Kim trains MLROs and compliance teams for the regulatory environment that actually exists now.
UBS paid this in August 2026 for what regulators called "willful and repeated" AML failures — its second such penalty in under a decade.
None of it was the failure point. Kim's case library exists to show your team what actually was — the same underlying pattern, dressed differently by sector.
Its auditor signed off for ten years. When journalists found the fraud, the regulator investigated them, not the company. Every gatekeeper failed at once, in full public view.
$10 billion of client money moved into Greensill's funds on minimal due diligence, against warnings dating back to 2017. No Credit Suisse executive was ever formally held responsible.
Its founder pleaded guilty personally and paid $50 million. The company paid $4.3 billion — internal messages showed executives knew, and chose market share over compliance anyway.
Wilful blindness. Captured oversight. Risk defined by classification, not by reality. One playbook — banking, government, sport, crypto all run it.
Not one new rule — three, operating independently and simultaneously. This is Kim's own explanation, asked live rather than written as marketing copy.
Before ECCTA, pinning criminal liability on an MLRO required proving they were the firm's "directing mind and will" — a board-level standard that almost never applied below board level. Section 196 replaced it: a senior manager acting within their authority can now expose the firm directly, and an MLRO fits that definition comfortably.
A firm's defence requires reasonable, tested, board-owned fraud prevention procedures — not a policy that exists on paper. When that defence fails, the next question is who was responsible for those procedures, which points straight at the compliance function.
The FCA can pursue an MLRO personally — fines, prohibition from working in financial services — entirely independently of whether the criminal case against the firm succeeds. A weak prosecution of the company does not protect the individual.
The protection has not disappeared. What changed is the bar: it now tracks the quality of what an MLRO can demonstrate, not merely what they can point to as having existed.
Kim is not bulk tick-box training for a headcount return. It is judgement development for the people whose name goes on the SAR — or whose name gets named when the pattern is found too late.
Continuing Professional Development is not optional box-ticking for compliance staff — most professional bodies require it to keep a certification or membership current, with real evidence to show for it. Kim is built for that obligation directly: short scenario sessions your team returns to across the year, each one grounded in a real case, not a generic refresher.
Evaluate Kim free. Licensed deployment available for commercial use across your compliance function.