When a regulatory enforcement matter emerges, a firm’s stance is often fixed within three days, well before most teams have pieced together what actually happened.
According to Sherlocq, the trigger is usually unremarkable: a phone call, an internal alert or a whistleblower complaint arriving late on a Friday.
What follows is frequently chaotic. Firms that have invested years in their compliance programmes suddenly find themselves improvising, gathering scraps of data from disconnected systems, manually researching rules that have not been reviewed in months, and drafting sensitive correspondence to regulators without the clarity the situation demands.
Those first three days can carry more weight than everything that comes after. In many enforcement scenarios, the opening period determines the direction of the whole matter, from the tone adopted with the regulator to the breadth of the internal investigation and the decision on what, if anything, to disclose. Each of these choices depends on what the firm knows and how fast it can find out.
The real issue is rarely a shortage of information. Most firms are overwhelmed by it. Compliance, legal, operations and the front office each hold separate pieces of the puzzle.
The relevant rules and guidance sit across multiple sources, while prior enforcement cases showing how regulators have handled similar facts are buried in public records nobody has time to compile quickly. The weakness is retrieval: surfacing the right material at the right moment.
The warning signs are well known. Document collection becomes excessively broad as a defensive reflex. Early messages to regulators turn cautious and vague, which can later look evasive. Investigations are scoped around whatever data is simplest to extract rather than what matters most. Together, these signal to regulators that the firm has not yet taken control of its own situation.
Firms that handle these moments well tend to be those able to establish the facts and their regulatory exposure quickly, while the response could still be shaped. That depends less on headcount and more on answering three questions at speed.
First, which rules and precedents does the issue trigger across relevant jurisdictions? This is where RegTech platforms such as Sherlocq come in, returning sourced, traceable answers in minutes rather than days of manual research. Second, what does the firm’s own documentation reveal, and where are the gaps against the applicable standard? Third, what investigation scope can the firm credibly defend?
The benefits compound. Swift mapping of issues to rules makes early communications controlled and credible. Data-driven scoping reduces later surprises. Prompt, visible remediation is often treated by regulators as a genuine mitigating factor, and firms reaching negotiated settlements rather than drawn-out contested actions frequently demonstrated that control early.
Crucially, this capability cannot be built in the moment. It must exist before the call arrives. Most regulated firms will eventually face their own 72-hour test, and increasingly, outcomes hinge not only on what happened but on how capably the firm responded.
Nikos Patsiogiannis, Member of the Board of Advisors, Sherlocq, said, “When a regulator calls, the question is rarely whether the firm has the information. It is whether the firm can find it in time. In the first 72 hours, speed of retrieval is what separates a controlled, credible response from a defensive one, and that capability cannot be assembled in the moment. It has to be built before it is needed.”
Bhavin Shah Founder and CEO, Sherlocq, added, “In an enforcement matter, the first three days set everything that follows. The firms that come through well are not the ones with the biggest legal teams – they are the ones that could see their own regulatory position clearly, fast.”
Read the full Sherlocq post here.
By Daniel Willis, Editor of RegTech Analyst
Copyright © 2026 FinTech Global
