Compliance.
aka regulatory compliance, corporate compliance, governance, risk and compliance
Following the rules, and being able to prove you did.
What it actually means
Compliance means a business following the laws, regulations, industry standards and internal policies that apply to it, and keeping the evidence to show it. It covers areas like data privacy, anti-money laundering, workplace safety, financial reporting and anti-bribery. It is also the name of the team that sets up the checks, trains staff and handles audits.
Compliance has two halves: doing the right thing and proving it. A company might genuinely protect customer data, but if it cannot show who has access, how long records are kept and what happens after a breach, regulators may still treat it as non-compliant. That is why so much compliance work is documentation: policies, training records, logs, sign-offs and regular reviews. The rules come from several layers. There are laws and regulations, such as data protection rules like the EU's GDPR, industry standards that customers or partners require, and the company's own internal policies, which are often stricter than the law.
What applies depends heavily on the country, the industry and the size of the business. A bank deals with anti-money laundering rules that require it to check who its customers are, often called know your customer (KYC) checks. A factory focuses on workplace safety. A software company selling to large clients may need to pass security audits. The nuance people miss is that compliance is not only a legal team problem. Most breaches start with ordinary actions, like emailing a spreadsheet of customer details to the wrong person.
Where you'll hear it
You can absolutely take the client to dinner, but anything over our gift limit needs to be logged and approved. If it's not on record, as far as an auditor is concerned, it wasn't checked.
Translation: the dinner is allowed, the paperwork is what keeps it clearly on the right side of anti-bribery rules.
Also in onboarding, where new hires complete mandatory training, in vendor reviews, where suppliers fill in security and privacy questionnaires, in fintech and crypto, where licensing and customer checks are a constant topic, and in news stories about fines after a company breaks data or financial rules.
The pop-culture version
At a big music festival you queue for ID checks, bag searches and wristband scanning before you get anywhere near a stage. It is slow, a little annoying, and on a hot afternoon nobody loves it.
But those checks are often part of the conditions the organizers agreed to for their licence. Age checks for alcohol, crowd limits and safety rules are usually set by local authorities, and the wristband scans create a record of how many people are inside. If something goes wrong, the organizers can show they followed the rules.
Skip the checks and the event might run more smoothly for a day, then lose its licence next year. Compliance at work is the same deal: a bit of friction at the gate in exchange for being allowed to keep operating.
The practical rule: if a process asks you to log, approve or record something, it is usually there to prove a rule was followed. When you are unsure whether something is allowed, ask compliance before you act, not after.
Say it like you mean it
“Before we launch the sign-up form, let's check with compliance on what consent we need and how long we can keep the data.”
It brings compliance in early, on a specific question, before the risk is already live.“We're a small team, so compliance stuff doesn't really apply to us yet.”
Many rules, especially on data privacy and workplace safety, apply regardless of size, even if some requirements scale with it.You will also hear GRC, short for governance, risk and compliance, used for the wider function, and "compliance by design", which means building rules into products and processes from the start instead of bolting them on later.
A roundup comparing fifteen free compliance and risk templates for 2026, covering policies, risk registers and audit checklists for growing businesses.
Decoded next
Decoded by the Kurums editorial team. Kurums Decoded translates the language of business for people who are new to it. Definitions are kept short on purpose; the serious version above goes deep. Nothing here is financial, legal or career advice.
