The collapse of FTX in November 2022 did not happen because rules were missing. Disclosure requirements were in place, and regulators in multiple jurisdictions were already watching the exchange closely.
According to Sherlocq, what failed was not oversight itself, but the ability to connect the warning signs already sitting in public filings, regulatory correspondence and industry chatter before billions of dollars vanished.
Sherlocq recently discussed the compliance intelligence failure at the centre of the next crisis.
This pattern is not new. The 2008 financial crisis saw supervisors flag consumer lending risks, liquidity concerns and firm-level exposures separately, but nobody joined the pieces together in time. India’s IL&FS collapse in 2018 followed the same script: audit qualifications, liquidity strain and governance red flags sat across various disclosures for months before default, with a later RBI report revealing non-performing assets had been understated for years.
In each case, the information existed. What was missing was the connective work needed to turn scattered signals into a coherent warning.
That connective work has a name: compliance intelligence. It’s distinct from a regulatory newsletter or a quarterly checklist review. Genuine compliance intelligence means actively tracking what regulators across jurisdictions are saying, changing and enforcing, then mapping that directly onto a firm’s own products, customers and exposures. It asks not just “are we within the rules today?” but “where are the rules heading, and are we ahead of that shift?”
Cross-border blind spots compound the problem. A global institution operating across the EU, US, UK and Asia faces genuinely different supervisory postures in each region, and failing to track where they’re diverging can quietly build systemic risk long before any single rule is broken.
Fixing this isn’t primarily a headcount problem. It requires a proper regulatory intelligence function with real ownership and a genuine seat at the table when business decisions are made, so shifts get flagged before they become enforcement actions. That means centralising the tracking of enforcement decisions, consultations and thematic reviews rather than leaving it fragmented across legal and compliance teams, and then explicitly mapping regulatory direction onto specific products and controls.
Tools such as Sherlocq are built for exactly this, pulling together enforcement trends and supervisory guidance across jurisdictions into a single sourced view a firm can weigh against its own risk exposure.
Ultimately, regulatory intelligence needs to sit inside governance, informing risk appetite discussions and board packs, not circulating as a bulletin nobody acts on. The firms best placed ahead of past crises weren’t necessarily the sharpest; they were the ones treating regulatory signals as a genuine risk input rather than housekeeping.
The next crisis is unlikely to stem from a missing rule. It will more likely stem, again, from dots that were never joined.
Vinit Shah, former general manager, VARA; Strategic Advisor, Sherlocq, said, “Major compliance failures rarely occur because regulations do not exist. More often, the signals are already available across regulatory guidance, consultations, enforcement actions, and public disclosures, but organizations lack the capability to connect them into a coherent picture before risks materialize.
“In digital assets, where regulatory expectations evolve across multiple jurisdictions and at different speeds, compliance can no longer be treated as a periodic exercise or a box-ticking function. It must operate as a continuous intelligence capability. The greatest risk is often not what firms know, but what they fail to see until it is too late”.
Bhavin Shah, founder and CEO, Sherlocq, added, “Every major financial crisis of the past two decades had one thing in common: the warnings were already on the record. The 2008 collapse, IL&FS, FTX, in each case the post-mortem found signals that had been missed, siloed, or treated as background noise rather than actionable intelligence.
“The next crisis will follow the same pattern, unless firms build the infrastructure to connect regulatory signals to business decisions before they harden into enforcement. That connective work is precisely what Sherlocq was built to do: pulling together what regulators have actually said across jurisdictions, in minutes, so that the dots can be joined while there is still time to act.”
Read the full Sherlocq post here.
By Daniel Willis, Editor of RegTech Analyst
Copyright © 2026 FinTech Global
