There is a whole industry built on other people's obligations, and most people outside it have no idea how big or how varied it is. One privacy-software company, OneTrust, reached a 5.3 billion dollar valuation selling tools that help firms manage data protection.1 Around it sit certification bodies, RegTech platforms, ratings agencies, training vendors and advisory firms, all selling compliance in one form or another. Understanding how they make money is useful whether you buy compliance, build a compliance business, or simply want to see the machine you are part of.
The four families
Strip the industry down and there are four basic ways to make money from compliance. Certify and assure: bodies like BSI and DNV inspect you and issue a certificate that others trust, selling the credibility of an independent stamp. Software: firms like OneTrust and Workiva sell platforms that turn a compliance obligation into a workflow, charging a subscription that recurs forever because the obligation does. Data and intelligence: companies like Chainalysis, EcoVadis and the sanctions-screening providers sell the information you need to comply, blockchain forensics, supplier ratings, watchlists. And train and advise: from security-awareness vendors like KnowBe4 to consultancies, selling the knowledge and the people.
The solution, as a pattern map
The four ways to make money from compliance
| Model | What you sell | Why it recurs |
|---|---|---|
| Certify & assure | An independent, trusted stamp | Certificates expire and must be renewed |
| Software (SaaS) | A workflow for an obligation | The obligation is permanent, so the subscription is too |
| Data & intelligence | The information needed to comply | The data goes stale daily and must be refreshed |
| Train & advise | Knowledge and people | Rules change and staff turn over, so it never ends |
The best compliance businesses combine two, for example software plus data, so the product is sticky and the moat is deep.
Why compliance is such a good business to be in
The uncomfortable truth is that compliance is a wonderful business precisely because obligations do not go away, they multiply. Every new regulation creates demand that recurs, because you do not comply once, you comply continuously. That is why the strongest compliance business models are subscriptions and renewals rather than one-off sales. The obligation is the annuity. A firm that sells you a tool for a rule that will exist for the next twenty years has sold you twenty years of subscription, and both sides know it.
What this tells you as a buyer
If you buy compliance, the patterns are a map of who is incentivised to do what. A certification body is selling trust, so it guards its credibility fiercely and will not bend for you, which is exactly what makes its stamp worth having. A software vendor is selling recurring workflow, so it wants you embedded and reluctant to leave, which means you should check how you get your data out before you get in. A data provider is only as good as its data, so ask how fresh it is. Knowing which model you are buying from tells you where the value is and where the trap is.
Questions to ask about any compliance vendor
- Which of the four models are they really, certify, software, data or advice?
- What exactly recurs, and is it worth the recurring price?
- For software, how do we get our data out and leave?
- For data, how fresh and how sourced is it?
- For certification, is the stamp actually trusted by the people we need to convince?
The compliance industry is not one business, it is four, and the clever firms combine them. Certification sells trust, software sells recurring workflow, data sells the information you need, and training sells the knowledge and the people. Every one of them is powered by the same engine: obligations that never end and only grow. Whether you are buying from this industry or thinking of building in it, the patterns are the map. Read them, and you will know where the money is, where the moat is, and where you are the annuity rather than the customer.
Notes and sources
From the book
The Compliance Business Model NavigatorFifty business-model patterns behind the compliance industry, each explained in plain language and carried by a real, named company.