The recent imposition of sanctions on Russian diamonds by the European Union and the G7 in January 2024 has illuminated a recurring dynamic within the global compliance landscape: regulators establish broad requirements without dictating specific verification methodologies, thereby delegating the practical definition of compliance to technology vendors. This approach, increasingly observed across various regulated industries, places the onus on private companies to develop the infrastructure and standards that operationalize governmental mandates. Corporate Compliance Insights (CCI) contributing writer Gordon Feller examines the benefits and inherent risks of this trend through the lens of the diamond industry.
The core of the EU and G7 sanctions mandates that importers of qualifying polished diamonds must submit a due diligence statement affirming the non-Russian origin of their goods. However, the regulatory framework stops short of specifying how this attestation should be verified. No singular method is mandated, no governmental body is explicitly tasked with auditing these claims, and crucially, no unified, official registry exists to definitively confirm a diamond’s provenance. This regulatory vacuum has predictably led to a surge of private technology companies stepping forward, each proposing its proprietary solutions as the definitive answer to what constitutes "compliance" in this new environment.
This scenario is far from novel for compliance professionals operating outside the jewelry sector. A similar pattern unfolded with the widespread adoption of consent-management platforms to address the General Data Protection Regulation (GDPR). The evolution of software solutions for the EU’s Corporate Sustainability Reporting Directive (CSRD) and the attestation tools financial firms utilize to document Sarbanes-Oxley (SOX) controls echo this familiar script. The process typically begins with a regulator enacting a rule, leaving the practical implementation unspecified. Subsequently, a commercial marketplace, often fueled by venture capital or private equity, emerges. These vendors, driven by competition for customers and accountable to their investors rather than the public, begin to fill the operational void. The practical consequence, whether intended or not, is that the operative definition of "compliant" effectively becomes outsourced to these private entities.
Leanne Kemp, founder and CEO of Everledger and former Queensland Chief Entrepreneur, anticipates that the regulatory focus on diamond origins will eventually expand to encompass broader Environmental, Social, and Governance (ESG) disclosures for luxury goods. She posits that the current competition among vendors is, in essence, a race to become the default infrastructure for future regulatory frameworks. This competition carries significant implications for who ultimately shapes the standards and definitions of compliance.
Competing for the Definition of "Compliant"
While regulators acknowledge the inherent tension between prescriptive rules and the flexible solutions offered by the private sector, they increasingly rely on these entities to build the necessary operational frameworks. Patrick Armstrong, a senior official in financial innovation at the European Securities and Markets Authority (ESMA), cautioned in a 2017 speech at a regtech conference that while regulatory technology can facilitate task delegation, it cannot absolve firms of their underlying responsibility. The ultimate obligation for compliance, he stressed, remains with the regulated entity, regardless of how much verification work is outsourced to vendors. This distinction, however, becomes increasingly difficult to enforce when dozens of platforms, each employing its own distinct methodology, all claim to offer the definitive solution.
The diamond trade provides a particularly transparent case study of this dynamic due to its relatively concentrated nature, allowing for real-time observation of vendor competition. Furthermore, the compliance stakes—ranging from sanctions evasion to the financing of conflict—are starkly defined, avoiding the obfuscation often found in regulatory footnotes.
The Gemological Institute of America (GIA), the industry’s preeminent certification body, highlights the dual nature of this regulatory gap: it is not only regulatory but also scientific. In a statement to CCI, the GIA asserted that despite over 50 years of research, "no scientific method to determine a diamond’s country of origin with certainty by examining rough or polished diamonds" exists. Consequently, the GIA concludes that "audited and verified documentation is at this time the best way to meet the demands of consumers and governments." This effectively means that the crucial question posed by regulators is currently answered by paper trails, not by immutable scientific evidence. The GIA itself operates two origin services that rely on document review rather than direct physical analysis and is incorporating blockchain-sourced origin data from Tracr, a diamond traceability platform, into its grading reports.
Two distinct approaches have emerged to address the void in diamond origin regulation. Leanne Kemp categorizes these as "producer-led ecosystems and independent verifiers." She places Tracr, a platform for tracing diamond origins, and Sarine, a specialist in physical mapping that has recently integrated with Tracr, in the former camp. Tracr is noted for its "massive scale," while Sarine contributes by providing physical "DNA" mapping of a diamond’s internal structure. Kemp positions her own company, Everledger, along with providers like iTraceIt, within the independent verifier category.
Wesley Tucker, the recently retired CEO of Tracr, argues that self-declaration alone is insufficient to meet the weight of regulatory expectations. He contends that any traceability system "must go beyond self-declaration and toward deeper, technology-driven verification" to withstand the escalating demands for transparency. Tracr’s methodology involves matching diamond scans captured at the mine and again at the manufacturing stage with results logged onto a blockchain. Since opening its process to the wider industry in 2023, Tracr reports over a million rough-to-rough matches. Significantly, Tracr is also transitioning towards third-party equity ownership, a move framed as enhancing its neutrality. This strategic shift implicitly acknowledges that the credibility of a for-profit gatekeeper is partly contingent on its perceived distance from the industry it evaluates.
Public Sector Answers vs. Private Sector Solutions
The extent to which this reliance on private sector solutions is beneficial or detrimental is a question that resonates deeply with CCI’s readership, as similar vendor selection processes are commonplace across their own operations. A compelling argument for private sector involvement rests on the practical limitations of public agencies worldwide. Many government bodies simply lack the requisite capacity, funding, or technical expertise to develop and manage verification infrastructure independently. In contrast, a competitive vendor market can often respond and adapt more rapidly than bureaucratic regulatory bodies.
Edward Bankoloh Koroma, acting executive director of Transparency International Sierra Leone, has witnessed firsthand the challenges of establishing robust tracing mechanisms. His organization’s research into the diamond sector in Angola revealed significant issues with corruption, transparency, and accountability at the mining stage. This includes instances of mining compliance officers accepting bribes to under-report discoveries and national minerals agencies operating with insufficient staffing to effectively monitor their own sites. The weakness of public capacity, therefore, represents precisely the vacuum that private vendors aim to fill.
However, a counter-argument also exists. When regulators delegate the definition of compliance to a limited number of competing, investor-backed platforms, they effectively outsource the very standard of compliance itself. This delegation also entails a partial abdication of the accountability that should ultimately extend back to the public. The diamond sector in Angola serves as a stark illustration of what can occur when weak state capacity intersects with value chains dominated by vested financial interests. Decades of documented human rights abuses have been linked to profits that, in an earlier era, contributed to funding a civil war. While traceability technology alone cannot rectify such systemic issues, its efficacy hinges entirely on who controls the technology and who possesses the authority to audit it.
For any compliance officer evaluating a regtech vendor—whether in the diamond sector, data privacy, or ESG reporting—the implicit judgment is whether that vendor’s incentives align with rigorous adherence to standards or with the imperative of retaining paying customers. The likelihood of either outcome for any given platform remains a live, unresolved debate. Compliance professionals are therefore well-advised to continue scrutinizing these vendor relationships with critical diligence.
The EU’s own regulations underscore the limited nature of the mandated verification mechanisms. Since March 2025, importers bringing mixed-origin rough diamonds into the EU for the first time are required to present a Kimberley Process certificate that lists every country of origin within the shipment. This requirement, notably, pertains to a paper-based certificate, not a technological verification. Diamonds already verified under the G7 scheme are exempt from this specific mandate. Crucially, no aspect of the regulation compels the scanning, matching, or blockchain logging that companies like Tracr, Sarine, and Everledger have built their businesses around. The law simply asks for documented attestation, leaving the market to determine the rigor of that attestation.
The Irreducible Responsibility of the Regulated Entity
Regardless of the perceived rigor of market-based solutions for diamond importers or any other regulated businesses, it is the companies themselves that must ultimately answer to regulators.
"A firm can outsource the work. It cannot outsource the answer," stated Lillian Freiberg, head of North America at Clarity AI, a provider of financial intelligence, risk management, and regulatory reporting solutions. "When a regulator asks how a number was produced, ‘our provider calculated it’ has never been sufficient. The firms that hold up under examination are the ones that understood the methodology well enough to defend it as their own. The question in any vendor selection is not whether the tool is compliant. It is whether you can explain what it did."
Freiberg elaborated, "The consequences land on the company, not on the vendor. That is why the expertise behind the technology matters as much as the technology."
This inherent gap between the minimal requirements stipulated by regulations and the comprehensive solutions offered by vendors places compliance professionals in a critical intermediary position, irrespective of their specialized field. The pressures currently evident in the diamond industry serve as the latest manifestation of this persistent challenge. The ongoing evolution of regulatory frameworks, coupled with the rapid development of technological solutions, necessitates a continuous and informed dialogue between regulators, vendors, and the businesses tasked with upholding compliance. The ultimate responsibility for ensuring integrity and transparency, however, will always reside with the entities directly subject to governmental oversight.
