After every major failure, the regulatory response follows a familiar pattern. Controls are strengthened. Reporting requirements expand. Supervisory expectations are clarified. Assurance thresholds rise. From the outside, this looks like learning. The system appears to be correcting itself.
In one sense, it is. Many post-crisis reforms have materially improved baseline discipline. Capital is stronger. Governance is clearer. Obvious abuses are harder to conceal. Few would argue for a return to the regulatory minimalism of the past.
And yet a paradox persists. Despite increasingly sophisticated regulatory regimes, failures continue to arrive as surprises. Warning signs are visible in hindsight, but not acted upon in time. Each crisis produces more structure, but not necessarily more foresight.
The problem is not regulatory intent. It is regulatory logic.
Modern regulation is overwhelmingly oriented towards control. It asks whether risks have been identified, frameworks established, responsibilities assigned, and processes followed. These are legitimate questions. They are also retrospective by design. They work best when the risk is already understood.
What they struggle to do is surface what does not yet fit.
This creates an inherent tension. As regulatory regimes mature, they become better at demanding evidence of diligence. Organisations respond rationally by optimising for demonstrability. Risk functions grow. Documentation improves. Escalation pathways are formalised. The system becomes increasingly legible to supervisors.
At the same time, the space for ambiguity narrows.
Weak signals are, by definition, unclear. They arrive as fragments, doubts, inconsistencies, or discomfort rather than as fully articulated risks. They do not sit neatly within taxonomies. They cannot easily be evidenced. In highly regulated environments, raising such signals carries cost without obvious payoff.
The result is a quiet but consequential shift. Information that can be defended travels well. Information that cannot is delayed, softened, or resolved prematurely. This is not suppression in any crude sense. It is adaptation.
Consider how organisations prepare for supervisory engagement. Considerable effort goes into ensuring that narratives are coherent, issues are framed within accepted categories, and remediation plans are clearly articulated. This is sensible. But it also means that uncertainty is often resolved before it is examined.
Over time, the organisation learns what “good” looks like. So does the regulator.
This mutual learning creates stability. It also creates blind spots. When both sides become accustomed to the same forms of reassurance, challenge converges rather than diversifies. Novel risk appears less frequently not because it has disappeared, but because it is harder to express.
The financial crisis illustrated this starkly. Prior to 2007, institutions complied with capital rules, model validation standards, and disclosure requirements. Regulators reviewed these diligently. What failed was not rule adherence, but collective understanding. Model assumptions converged. Correlations were misunderstood. Systemic fragility was invisible within institution-by-institution supervision.
Post-crisis reform addressed many of these weaknesses. But it also reinforced a tendency to equate robustness with specification. The more detailed the requirement, the safer the system was assumed to be.
This dynamic is not unique to financial services. Similar patterns appear in healthcare, infrastructure, and public administration. After failure, reporting intensifies. Oversight becomes more granular. Professional judgement is increasingly constrained by procedural expectation. The system becomes more cautious, but not necessarily more perceptive.
The irony is that regulation designed to prevent surprise can end up institutionalising it. When success is measured by compliance with known expectations, attention naturally shifts away from what cannot yet be articulated. Organisations become better at answering questions they anticipate, and worse at asking questions they do not.
This places regulators in a difficult position. They are accountable for visible failure. They operate under political and public scrutiny. They need defensible standards. Asking them to tolerate ambiguity is not straightforward.
But the consequence of not doing so is clear. A system optimised for control assurance will always lag a system driven by emergence and interaction. The stronger the emphasis on specification, the weaker the signal environment becomes.
None of this argues for less regulation. It argues for different regulation.
Specifically, it suggests the need to distinguish more clearly between controls that stabilise known risks and mechanisms that surface unknown ones. Between assurance that confirms what is already believed, and challenge that tests whether those beliefs still hold.
Until regulatory architectures explicitly recognise this distinction, the pattern will persist. Controls will strengthen. Signals will weaken. Surprise will continue to be explained after the fact.
The real regulatory challenge is not how to eliminate uncertainty, but how to govern in its presence without prematurely neutralising it.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 9 February 2026 on my Substack.