The European Union and the G7’s imposition of sanctions on Russian diamonds in January 2024 have illuminated a recurring challenge for the global compliance community: regulators establishing stringent requirements without dictating specific verification methodologies, thereby thrusting the onus of practical standard-setting onto technology vendors. This dynamic, observed across various regulated sectors, places the responsibility for defining what constitutes "compliance" into the hands of private companies, raising questions about accountability, standardization, and the long-term implications for regulatory oversight. Gordon Feller, contributing writer for Corporate Compliance Insights (CCI), examines the benefits and inherent risks of outsourcing compliance infrastructure, using the intricate diamond industry as a prism.
The regulatory script, now familiar to compliance professionals across industries, unfolded in January 2024. Importers of qualifying polished diamonds were mandated to submit due diligence statements confirming the non-Russian origin of their goods. However, the directives from Brussels and the G7 capitals stopped short of prescribing a singular verification method, assigning no specific government agency with the authority to audit these claims, and notably, failing to establish a unified registry capable of definitively confirming diamond origins.
This regulatory void has predictably attracted a wave of private technology companies, each vying to present itself as the definitive solution to the ambiguity of "compliance." The pattern is not unique to the jewelry trade. Similar scenarios have played out with the proliferation of consent-management platforms designed to meet the stringent requirements of the General Data Protection Regulation (GDPR), the emergence of reporting software for the EU’s Corporate Sustainability Reporting Directive (CSRD), and the attestation tools financial institutions employ to document their Sarbanes-Oxley (SOX) controls. In each instance, a regulatory body defines a mandate, leaving the implementation mechanism undefined. A commercial marketplace, often fueled by venture capital or private equity and driven by competitive pressures and investor demands rather than direct public accountability, steps in to fill the void. The practical outcome, regardless of regulatory intent, is that the operative definition of "compliant" effectively becomes delegated to these vendors.
Leanne Kemp, founder and CEO of Everledger, a prominent firm in diamond traceability, and a former chief entrepreneur of Queensland, Australia, anticipates that the current regulatory focus on diamond origins will eventually broaden to encompass more comprehensive Environmental, Social, and Governance (ESG) disclosures for luxury goods. She posits that the current vendor competition is, in essence, a race to establish the default infrastructure for future regulatory frameworks. "The endgame is a unified digital registry," Kemp stated, underscoring the potential for vendor dominance to shape future compliance standards.
The Competitive Landscape of Defining "Compliant"
Regulators themselves have, to some extent, acknowledged the inherent tension between regulatory mandates and the proprietary solutions offered by the private sector, even as they rely on these entities to build the necessary operational infrastructure. In a 2017 speech at a regtech conference in London, Patrick Armstrong, a senior official specializing in financial innovation at the European Securities and Markets Authority (ESMA), cautioned that while regulatory technology can facilitate delegation of tasks, it cannot abdicate responsibility. Armstrong emphasized that the ultimate obligation remains with the regulated firm, irrespective of how much verification work is outsourced to a vendor. This crucial distinction, however, becomes increasingly difficult to enforce when numerous platforms, each employing distinct methodologies, all claim to offer the definitive solution.
The diamond industry provides an unusually clear case study of this phenomenon. Its relatively contained size allows for real-time observation of vendor competition, and the stakes—sanctions evasion and the financing of illicit activities—are starkly defined, rather than buried within obscure regulatory footnotes.
The Gemological Institute of America (GIA), the industry’s preeminent certification body, has publicly stated that the vacuum is not merely regulatory but scientific. In a statement to CCI, the GIA explained that despite over 50 years of dedicated research, "no scientific method has been developed to determine a diamond’s country of origin with certainty by examining rough or polished diamonds." Consequently, the institute asserts that "audited and verified documentation is at this time the best way to meet the demands of consumers and governments." This effectively means that paper trails, rather than immutable scientific analysis, are currently the primary determinant of origin for regulatory purposes. The GIA itself operates two origin verification services, both predicated on document review, and has begun integrating blockchain-sourced origin data from Tracr, a leading diamond traceability platform, into its grading reports.
Kemp identifies two primary camps emerging to fill the void in diamond origin regulation: "producer-led ecosystems and independent verifiers." She categorizes Tracr and Sarine, a company specializing in physical mapping that has recently integrated with Tracr, into the first group. Tracr, she notes, offers "massive scale," while Sarine contributes "physical ‘DNA’ mapping of a diamond’s internal structure." Kemp places her own company, Everledger, alongside providers like iTraceIt, in the independent verifier category.
Wesley Tucker, the recently retired CEO of Tracr, argues that self-declaration alone is insufficient to meet the weight of regulatory expectations. He posits that any robust traceability system "must go beyond self-declaration and toward deeper, technology-driven verification" to withstand the rising global demand for transparency. Tracr’s methodology, which involves matching diamond scans captured at the mine and again at the manufacturing stage with data logged to a blockchain, has reportedly yielded over a million rough-to-rough matches since its broader industry rollout in 2023. Tracr’s strategic move towards third-party equity ownership is framed by the company as a measure to enhance its neutrality—an implicit acknowledgment that the credibility of a for-profit intermediary hinges, in part, on its perceived independence from the very industry it scrutinizes.
Private Sector Solutions Versus Public Sector Capacity
The question of whether this outsourced compliance model represents a positive or negative development is one that compliance professionals are uniquely positioned to assess, given its increasing prevalence in their own vendor selection processes. There are compelling arguments for the private sector’s role. Public agencies in many jurisdictions often lack the requisite capacity, funding, or technical expertise to develop and manage complex verification infrastructure independently. Furthermore, a competitive vendor market can often respond to regulatory needs with greater agility than bureaucratic governmental bodies.
Edward Bankoloh Koroma, acting executive director of Transparency International Sierra Leone, has witnessed the challenges of establishing robust public oversight firsthand. His organization’s research has highlighted pervasive issues of corruption, transparency, and accountability within the diamond sector, particularly concerning tracing diamonds from the mines. This includes instances of mining compliance officers accepting bribes to under-report discoveries and national minerals agencies operating with insufficient staffing to effectively monitor their own sites. This demonstrated weakness in public capacity is precisely the gap that private vendors claim they can fill.
However, a significant counterargument exists. When a regulator delegates the definition of compliance to a select group of competing, investor-backed platforms, it effectively outsources the standard itself. This delegation also carries with it a diffusion of accountability that should ultimately flow back to the public. The diamond sector in Angola serves as a stark illustration of what can occur when weak state capacity intersects with value chains dominated by vested financial interests. Decades of documented human rights abuses have been inextricably linked to profits that, in an earlier era, fueled a devastating civil war. It is crucial to recognize that traceability technology alone does not inherently solve such systemic problems; its effectiveness is contingent upon who controls the technology and who possesses the authority to audit its implementation.
A compliance officer evaluating any regtech vendor—whether in diamonds, data privacy, or ESG reporting—is implicitly making a judgment about whether that vendor’s incentives are aligned with rigorous adherence to regulations or with the preservation of a paying customer relationship. The likelihood of either outcome for any given platform remains a subject of ongoing, unresolved debate. Compliance professionals are therefore right to continue questioning the underlying motivations and operational integrity of these technology providers.
The EU’s own regulations offer a glimpse into the limited nature of the mandated mechanism. Since March 2025, importers introducing mixed-origin rough diamonds into the EU for the first time are required to present a Kimberley Process certificate, which lists every country of origin within the shipment. This requirement, however, pertains to a paper-based certificate, not a technological verification. Diamonds already verified under the G7 scheme are exempt from this specific mandate. Crucially, the regulation does not mandate the type of scanning, matching, or blockchain logging that companies like Tracr, Sarine, and Everledger have built their businesses upon. The law, in essence, calls for a documented attestation and leaves the determination of its rigor to the market.
The Unoutsourcable Answer
Regardless of the purported rigor of market-based compliance solutions for diamond importers or any other regulated businesses, it is the companies themselves that remain accountable to regulators. "A firm can outsource the work. It cannot outsource the answer," stated Lillian Freiberg, head of North America at Clarity AI, a provider of financial intelligence, risk, and regulatory reporting solutions. "When a regulator asks how a number was produced, ‘our provider calculated it’ has never been sufficient. The firms that hold up under examination are the ones that understood the methodology well enough to defend it as their own." Freiberg emphasizes that the critical question in any vendor selection process is not merely whether the tool is compliant, but whether the user can comprehensively explain its operational processes and underlying logic. "The consequences land on the company, not on the vendor. That is why the expertise behind the technology matters as much as the technology."
This gap between the minimal requirements stipulated by regulations and the comprehensive solutions offered by vendors is a space where compliance professionals find themselves navigating, irrespective of their specific industry niche. The pressures and complexities now evident in the diamond industry represent merely the latest manifestation of this persistent challenge. As regulators continue to delegate the "how" of compliance to the marketplace, the imperative for businesses to deeply understand and be able to defend the technologies they employ only intensifies.
