The recent imposition of sanctions on Russian diamonds by the European Union and the G7, effective January 2024, has illuminated a recurring dynamic within the global compliance landscape: regulatory bodies establishing broad requirements without mandating specific verification methodologies. This approach invariably creates a vacuum, compelling technology vendors to step in and define practical standards, thereby outsourcing the operational definition of compliance. This phenomenon, starkly visible in the diamond industry, offers a prism through which to examine the benefits and inherent risks of relying on private sector solutions for regulatory adherence, a pattern observed across diverse sectors from data privacy to corporate sustainability reporting.
The sanctions, aimed at disrupting Russia’s revenue streams from its significant diamond exports, necessitate that importers of qualifying polished diamonds submit a due diligence statement attesting to the non-Russian origin of their goods. However, the regulatory frameworks established by both the EU and G7 nations are notably devoid of a singular, mandated verification method. Furthermore, no specific government agency has been empowered to rigorously audit these declarations, nor has a unified, authoritative registry been established to definitively confirm the provenance of individual diamonds. This regulatory ambiguity has paved the way for a burgeoning market of private technology companies, each vying to present its proprietary solution as the definitive answer to what constitutes "compliant" in this new environment.
This scenario is not novel for compliance professionals operating outside the jewelry trade. The same pattern has been observed with the proliferation of consent-management platforms for the General Data Protection Regulation (GDPR), the sophisticated reporting software developed to meet the demands of the EU’s Corporate Sustainability Reporting Directive (CSRD), and the attestation tools financial institutions employ to document their compliance with the Sarbanes-Oxley (SOX) Act. In each instance, a regulator articulates a rule, leaving the implementation mechanism open-ended. A commercial marketplace, often fueled by venture capital or private equity and driven by competition for customers and accountability to investors rather than the public interest, subsequently emerges to fill this void. The practical consequence, whether by design or default, is that the operative definition of "compliant" becomes delegated to these private vendors.
Leanne Kemp, founder and CEO of Everledger, a firm specializing in diamond traceability and a former Queensland chief entrepreneur, foresees the eventual emergence of a unified digital registry as the ultimate objective. She predicts that the current regulatory focus on diamond origins will broaden to encompass more extensive Environmental, Social, and Governance (ESG) disclosures for luxury goods. If her assessment proves accurate, the current competition among vendors is, in essence, a race to establish the de facto infrastructure of the future, with profound implications for who ultimately shapes the regulatory landscape.
The Competitive Arena for Defining "Compliance"
Even as regulators increasingly rely on the private sector to construct the essential "plumbing" for compliance, they have acknowledged the inherent tension between regulatory intent and vendor-driven solutions. In a 2017 speech at a regtech conference, Patrick Armstrong, a senior official within the European Securities and Markets Authority (ESMA) with expertise in financial innovation, cautioned that regulatory technology can delegate tasks but not ultimate responsibility. He emphasized that the fundamental obligation remains with the regulated firm, irrespective of the extent to which verification processes are outsourced to third-party vendors. This crucial distinction, however, becomes increasingly challenging to enforce when dozens of platforms, each employing its own distinct methodology, all claim to offer the definitive solution.
The diamond industry provides a particularly transparent case study of this dynamic. Its relatively contained size allows for real-time observation of vendor competition, and the compliance stakes—preventing sanctions evasion and curbing conflict financing—are articulated with stark clarity, rather than being buried within obscure regulatory footnotes.
The Gemological Institute of America (GIA), the industry’s preeminent certification body, has openly stated that the current void is not solely regulatory but also scientific. In a statement provided to Corporate Compliance Insights (CCI), the GIA articulated that despite over five decades of dedicated diamond research, "no scientific method has been developed to determine a diamond’s country of origin with certainty by examining rough or polished diamonds." Consequently, the Institute asserts that "audited and verified documentation is at this time the best way to meet the demands of consumers and governments." This underscores that, at present, paper trails, rather than inherent physical properties, are the primary means of addressing regulatory inquiries into diamond origins. The GIA itself operates two origin services that rely on document review rather than direct scientific measurement and has begun integrating blockchain-sourced origin data from Tracr, a leading diamond traceability platform, into its own grading reports.
Kemp identifies two primary camps that have emerged to address the regulatory gap in diamond origin determination: "producer-led ecosystems and independent verifiers." She categorizes platforms like Tracr and Sarine, a specialist in physical mapping that recently integrated with Tracr, within the former. She notes that "Tracr offers massive scale, while Sarine provides physical ‘DNA’ mapping of a diamond’s internal structure." Her own company, Everledger, along with providers such as iTraceIt, fall into the latter category.
Wesley Tucker, the recently retired CEO of Tracr, argues that self-declaration alone is insufficient to bear the weight of regulatory expectations. He posits that any traceability system "must go beyond self-declaration and toward deeper, technology-driven verification" to remain credible as "expectations around transparency continue to rise." Tracr’s methodology, which involves matching diamond scans captured at the mine and again at the manufacturing stage with results logged onto a blockchain, has reportedly yielded over a million rough-to-rough matches since its broader industry rollout in 2023. Notably, Tracr is in the process of transitioning to third-party equity ownership, a move framed by the company as an enhancement of its neutrality—an implicit acknowledgment that the credibility of a for-profit gatekeeper is partly contingent on its perceived independence from the industry it serves.
Navigating the Landscape: Public Sector Limitations and Private Sector Innovations
The question of whether this burgeoning reliance on private sector solutions represents a positive or negative development is one that compliance professionals are increasingly positioned to answer, as similar vendor selection processes unfold within their own organizations. There is a compelling argument for the private sector’s role. Public agencies in many jurisdictions demonstrably lack the necessary capacity, funding, or technical expertise to independently develop and operate robust verification infrastructure. A competitive vendor market, by its nature, can often adapt and innovate more rapidly than bureaucratic regulatory bodies.
Edward Bankoloh Koroma, acting executive director of Transparency International Sierra Leone, has witnessed the alternative firsthand. His organization’s research into the diamond sector in various African nations has revealed significant challenges with corruption, transparency, and accountability in tracing diamonds from their source mines. This includes instances of mining compliance officers accepting bribes to under-report discoveries and national minerals agencies being too understaffed to effectively monitor their own sites. These weaknesses in public capacity precisely mirror the void that private vendors claim they can fill.
However, a robust counter-argument exists. When a regulator effectively outsources the definition of compliance to a limited number of competing, investor-backed platforms, it risks outsourcing the standard itself. This delegation also diminishes the direct accountability that should ultimately run back to the public. The diamond sector in Angola serves as a stark illustration of what can occur when weak state capacity intersects with a value chain dominated by powerful vested interests. Decades of documented human rights abuses have been linked to profits that, in an earlier era, contributed to funding a protracted civil war. It is critical to recognize that traceability technology alone cannot rectify such deeply entrenched issues; its effectiveness hinges entirely on who controls the technology and who possesses the authority to audit its operations.
Consequently, a compliance officer evaluating any regulatory technology (regtech) vendor—whether in the diamond trade, data privacy, or ESG reporting—is implicitly making a judgment about whether that vendor’s incentives align with rigorous adherence to regulations or with the retention of a paying customer. The likelihood of either outcome for any given platform remains an active, unresolved debate, not a settled conclusion. Compliance officers tasked with vendor selection are therefore well-advised to continue probing these critical questions.
The European Union’s own regulations provide insight into the relative thinness of the mandated mechanisms. As of March 2025, importers bringing mixed-origin rough diamonds into the EU for the first time are required to present a Kimberley Process certificate that meticulously lists every country of origin for the shipment—a paper-based attestation, not a technological verification. Diamonds already verified under the G7 scheme are exempt from this specific requirement. Crucially, no provision within the regulation mandates the scanning, matching, or blockchain logging that companies like Tracr, Sarine, and Everledger have built their businesses around. The law simply requires a documented attestation, leaving the market to determine the rigor of that attestation.
The Enduring Responsibility of the Regulated Firm
Regardless of the purported rigor of market-based solutions for diamond importers or any other regulated businesses, it is the companies themselves that ultimately face scrutiny from regulators. Lillian Freiberg, head of North America at Clarity AI, a provider of financial intelligence, risk, and regulatory reporting solutions, emphasizes this point: "A firm can outsource the work. It cannot outsource the answer." She further elaborates, "When a regulator asks how a number was produced, ‘our provider calculated it’ has never been sufficient." The firms that withstand regulatory examination are those that have cultivated a profound understanding of the underlying methodology to the extent that they can confidently defend it as their own. Freiberg’s advice to compliance professionals is clear: "The question in any vendor selection is not whether the tool is compliant. It is whether you can explain what it did."
The ultimate consequences of non-compliance, she stresses, "land on the company, not on the vendor. That is why the expertise behind the technology matters as much as the technology itself." This fundamental gap between the explicit requirements of a regulation and the comprehensive solutions offered by vendors places compliance professionals in a critical intermediary position, irrespective of their specific area of expertise. The pressures currently being felt within the diamond industry serve as the most recent, yet far from the only, illustration of this pervasive challenge. The ongoing evolution of global trade and regulatory frameworks ensures that the dynamic interplay between mandated compliance and technologically enabled verification will continue to shape the operational realities of businesses worldwide.
