David Leppan: «Compliance Has Grown Into a Monster»

In this interview with finews.com, the founder of World-Check reflects on the origins, growth, and complex legacy of his brainchild, now a central force in global banking compliance. He highlights the unintended consequences of his creation and shows that even well-intentioned tools can have adverse impacts—and that balancing vigilance with fairness remains an ongoing challenge.

Mr. Leppan, about 25 years ago, the world embarked on a fight against corruption and bribery which has deeply altered compliance for financial institutions…

… back then, as a sales representative for Thomson Financial Publishing, I was selling floppy disks with data on sanctions by the Office of Foreign Assets Control (OFAC) to Swiss banks. The term «compliance» barely existed.

Today, what is your assessment of that fight against corruption? What has it achieved?

It’s a tough reality to face, but I believe that the so-called «war on bribery and corruption» has largely failed. Despite enormous investment, with global compliance spending around $200 billion annually, corruption, bribery, and money laundering are still rampant. According to the United Nations, more money is laundered today than 25 years ago. More bribes are paid, and corruption remains pervasive.

What do you think went wrong?

I think part of the problem lies in the «big declaration» approach. The global community has taken on corruption and crime like the «war on drugs» or the «war on terror»—bold statements, but with limited real success. While these wars sound reassuring to the public, they haven’t effectively targeted or stopped the people truly responsible for financial crimes. Politicians and international institutions want to show they’re cracking down, but we haven’t seen meaningful results.

And what has been the cost of this approach?

The cost is enormous, not just financially but also in how the compliance landscape has evolved. For instance, in private banking, client onboarding can now take six to eighteen months because banks are drowning in compliance checks. Compliance teams have ballooned, with hundreds of staff dedicated to remediation—just trying to manage the vast amount of red tape. And still, the ROI on this $200 billion global compliance spend is depressingly low when we look at how little money is actually stopped or frozen.

«The so-called ‹war on bribery and corruption› has largely failed… more money is laundered today than 25 years ago.»

Bribery and corruption seem to persist. Can you explain how it happens today?

Serious bribery and money laundering today don’t typically occur within traditional banking systems that can be flagged through a World-Check-type database. The big players involved in corruption have become incredibly sophisticated. They layer transactions and hide money flows through various channels, particularly in commercial settings—like real estate, trade, and corporate acquisitions—that often fall outside banking oversight. A lot of this criminal money is moved through the acquisition of assets, such as buildings, hotels, and shopping centers, rather than through individual bank accounts.

So these large commercial channels aren’t getting flagged by the usual compliance measures?

Exactly. High-value assets or corporate transactions often bypass the kinds of controls we think of in banking compliance. Criminal organizations are highly motivated to avoid detection, and they’ve adapted accordingly. They’re not likely to use personal accounts in major banks. Instead, they move funds through complex corporate structures and international trade deals, where the money is layered and cleaned in ways that are far more difficult to trace. And so, even though World-Check has six million profiles on its database, the people who should be under scrutiny often aren’t showing up there. Many of these databases, rather than zeroing in on high-risk targets, have expanded indiscriminately, capturing millions of profiles, many of which pose no real risk.

It sounds like the system is inadvertently targeting the wrong people while missing the real criminals.

Precisely. The compliance infrastructure has grown into a monster, flagging every potential risk and swamping banks with false positives, while those truly involved in criminal networks are largely unaffected. Criminal enterprises are adept at staying out of these databases altogether, while ordinary businesspeople and even bank employees spend their days entangled in compliance checks that, frankly, don’t address the real issue.

Let’s talk about how World-Check came into this landscape. How did it all start?

Actually, it all began in Zurich about 25 years ago with a conversation at Julius Baer. They told me they needed an «early warning system» for individuals who might pose financial risks—not necessarily high-risk individuals, but people who could end up on sanctions lists. The idea was to spot potential problems before they became serious liabilities, like a radar system. They wanted something that would allow them to detect and manage risk before it was too late.

Did anything like that even exist back then?

Not really. We had sanction lists, but they came too late—by the time someone was added to a list, the damage was often done. So I thought, «Alright, let’s see if others are asking for something similar.» Sure enough, at other Swiss banks, I heard the same concerns. They wanted a way to flag «heightened risk» individuals before they became headline news.

This was during the time of the Abacha affair, wasn’t it?

Exactly. Sani Abacha, Nigeria’s military ruler, had stashed billions of illicit funds across Swiss banks. Financial institutions were starting to ask about «politically exposed persons,» or PEPs. But back then, the idea of tracking and categorizing these individuals was brand new. There were no standard definitions or procedures for assessing political risk or reputation risk.

This was the seed for World-Check.

Yes. I spoke with some authorities, including the financial intelligence unit in Switzerland. They told me such a database would help them as well because if banks were reporting suspicious activity, they needed a way to make sense of it. That’s when I saw the opportunity to create something that could benefit both sides—banks and regulators.

Continue reading to learn David Leppan's insights into how the compliance system went awry – and how those affected can defend themselves.