Compliance moved from cost line to risk register. We map the regulatory shape and what an audit-ready posture means in practice.