CHALLENGES OF COMPLIANCE RISK MANAGEMENT IN THE GEORGIAN BANKING SECTOR

58 Norwegian Journal of development of the International Science No 167/2025 ECONOMIC SCIENCES CHALLENGES OF COMPLIANCE RISK MANAGEMENT IN THE GEORGIAN BANKING SECTOR Kodelashvili L. Doctoral Candidate East European University, Tbilisi, Georgia https://doi.org/10.5281/zenodo.17492573 Abstract Risk management in the financial sector has increasingly expanded to include non-financial risks, especially compliance risk, due to complex regulatory environments and rising expectations on institutions. However, in Georgia, compliance risk remains underexplored. There is a notable scarcity of academic research examining how compliance risk is defined, regulated, assessed, and managed within the country’s banking sector. This gap hinders both theoretical insight and practical progress in enhancing the regulatory framework and institutional practices. Building upon this context, the study seeks to analyze Georgia’s national regulatory framework, its international obligations, and current practices in the banking sector related to compliance risk management. Accordingly, the study aims to identify potential deficiencies in both the scope of the regulator’s mandate and the implementation of established regulatory requirements by commercial banks. This research adopts a qualitative empirical approach grounded in document analysis, drawing upon existing reports, regulations, and policy documents as primary sources of real-world data. The methodology includes case studies and comparative analysis techniques to highlight key differences and uncover shortcomings. The document analysis encompasses the national regulatory framework, standards, and guidelines issued by internationally recognized organizations, relevant academic literature, and other pertinent sources, along with publicly available financial and managerial disclosures of commercial banks operating in Georgia. Although a formal regulatory structure is in place, significant challenges remain in its effective implementation. As the findings demonstrate, gaps exist within local regulations, and banks often fail to comply due to the absence of detailed guidance, such as manuals and instructions, as well as weak enforcement mechanisms on the part of the supervisory authority. To accurately assess rising compliance risk levels within banks and understand their quantitative impact on profit, loss, and capital, the regulator must establish clear compliance risk management guidelines, including a defined risk assessment methodology. Keywords: Compliance Risk, Risk management, Corporate Governance, Compliance Risk Assessment Introduction Risk management in the financial sector has increasingly expanded to include non-financial risks, especially compliance risk, due to complex regulatory environments and rising expectations on institutions. Compliance risk, as it is defined by [1], [2], [3] is a risk of non-compliance of legal or regulatory sanctions, financial loss, or reputational damage resulting from non-compliance with laws, regulations, codes of conduct, or self-regulatory standards. Compliance risk is inherent to all businesses due to the obligation to follow laws, regulations, and standards across jurisdictions. To maintain competitiveness, efficiency, and profitability, companies may face compliance dilemmas, but organizations are nonetheless expected to uphold legal obligations alongside principles of transparency, accountability, and ethical conduct [4]. The context of compliance risk was first incorporated into the Georgian financial sector legislative framework in 2008. However, in Georgia, compliance risk and its management remain underexplored. There is a notable scarcity of academic research examining how compliance risk is defined, regulated, assessed, and managed within the country’s banking sector. This gap hinders both theoretical insight and practical progress in enhancing the regulatory framework and institutional practices. Building on this foundation, the study aims to analyze Georgia’s national regulatory framework, its international obligations, and current practices in the banking sector related to compliance risk management. Accordingly, the study aims to identify potential gaps in the scope of the regulator’s mandate and the implementation of established regulatory requirements by commercial banks. This research adopts a qualitative empirical approach grounded in document analysis, drawing upon existing reports, regulations, and policy documents as primary sources of real-world data. The methodology includes case studies and comparative analysis techniques to highlight key differences and uncover shortcomings. The document analysis encompasses the national regulatory framework, standards, and guidelines issued by internationally recognized organizations, relevant academic literature, and other pertinent sources, along with publicly available financial and managerial disclosures of commercial banks operating in Georgia. Literature Review Academic literature often uses the terms compliance, compliance management, and compliance risk management interchangeably, though important distinctions exist [4]. Compliance management refers to a broader framework that involves establishing and maintaining adherence to legal and internal standards [5] [6]. In contrast, compliance risk management is a Norwegian Journal of development of the International Science No 167/2025 59 more focused subset that aims to identify, assess, and mitigate risks arising from non-compliance [7], thereby protecting the organization’s integrity, reputation, and regulatory standing [2]. Compliance risk management, as a specialized tool within the broader framework of Compliance Function, is a key pillar of corporate governance, ensuring that organizations operate within legal and ethical boundaries while fostering trust and long-term sustainability among stakeholders [8]. In the study titled “The Compliance Function: An Overview,” J.P. Miller does not specify the precise timeline for the development of the compliance function, but links its evolution to the growing regulation of corporate governance in response to events that undermined public trust. These include the collapse of Enron, which led to the enactment of the Sarbanes-Oxley Act (SOX) in 2002, and the 2007–2009 financial crisis, which prompted a wave of reforms such as the Dodd-Frank Act of 2010 [9]. SOX was introduced to address large-scale corporate fraud, exemplified by the Enron and WorldCom cases, and aimed to enhance the accuracy, transparency, and accountability of corporate financial reporting to restore investor confidence [10]. As a result, the primary focus of the reform was to prevent corporate fraud in publicly traded companies by assigning responsibility for financial reporting to senior executives, strengthening internal controls, increasing transparency for investors and regulators, addressing conflicts of interest, enhancing ethical standards, and enforcing both corporate and criminal liability for misconduct [11]. While the Sarbanes-Oxley Act (SOX) primarily targeted corporate financial reporting and executive accountability, Dodd-Frank expanded the regulatory scope by addressing structural weaknesses in the financial sector and introducing more comprehensive compliance obligations [12]. The aim was to strengthen financial system resilience, enhance regulatory oversight, and protect consumers and investors. Its key provisions focus on reducing systemic risk, improving transparency in financial markets, and reinforcing accountability across the financial sector [13]. Accordingly, the main goal of the compliance function is to manage the risks of noncompliance by ensuring that the organization's operations, policies, and procedures align with applicable laws, regulations, and ethical standards. In parallel with the US regulatory reforms, such as the Sarbanes-Oxley Act and the Dodd-Frank Act, international standard-setting bodies also advanced their oversight frameworks. The Basel Committee on Banking Supervision significantly enhanced global expectations for risk governance by transitioning from Basel II to Basel III [14]. Basel framework emphasized the importance of robust internal control systems and effective risk management practices, reinforcing the critical role of the compliance function in ensuring regulatory adherence and safeguarding financial stability [2], [15]. Complementing these developments, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) updated its internal control framework in 2013 to place greater emphasis on risk-based thinking, accountability, and the integration of compliance into enterprise-wide governance structures [16], [17]. Additionally, the introduction of the ISO 37301:2021 standard established globally recognized requirements for compliance management systems, highlighting the importance of leadership, continuous improvement, and a risk-based approach [18]. Collectively, these frameworks have reshaped the regulatory landscape, reinforcing the strategic role of the compliance function in promoting ethical conduct, ensuring adherence to regulatory requirements, and safeguarding institutional integrity through effective compliance risk management. Research Questions, Methodology, and Research Procedure Building on the reviewed literature and international standards, this study aims to examine Georgia’s regulatory framework, international obligations, and the current compliance risk management practices of commercial banks operating within the country. The research is particularly focused on identifying gaps in (1) the scope of the regulator’s mandate, and (2) the implementation of regulatory requirements by financial institutions. Research Questions: To address these issues, the study is guided by two key research questions (RQ): RQ1: What gaps and weaknesses exist in the regulatory framework governing compliance risk management in the Georgian banking sector? Objective 1: To analyze the regulatory framework relevant to compliance risk management in Georgia’s banking sector. RQ2: Do commercial banks in Georgia effectively comply with existing compliance risk management regulations? Objective 2: To examine current compliance risk management practices within Georgian commercial banks. Methodology: Based on the research question, a qualitative empirical approach is used as the methodology, grounded in document analysis and drawing upon existing reports, regulations, and policy documents as primary sources of real-world data. The methodology includes case studies and comparative analysis techniques to highlight key differences and uncover shortcomings. The document analysis encompasses the national regulatory framework, standards, and guidelines issued by internationally recognized organizations, relevant academic literature, and other pertinent sources, along with publicly available financial and managerial disclosures of commercial banks operating in Georgia. Research Procedure: To address RQ1 and identify gaps and weaknesses within the regulatory framework governing the Georgian banking sector, relevant legislative acts were identified using the official website of the Legislative Herald of Georgia (www.matsne.gov.ge). The search was conducted by applying all available search functionalities-title-based, full-text, and advanced search. A set of predefined keywords was employed to guide the process, including compliance, compliance risk, risk management, compliance officer, corporate governance, and compliance risk assessment. Additional academic 60 Norwegian Journal of development of the International Science No 167/2025 papers, studies from international organizations, reports, conference proceedings, and other pertinent sources were sourced from the official websites of the National Bank of Georgia (NBG) (www.nbg.gov.ge), the Basel Committee on Banking Supervision (www.bis.org), the International Organization for Standardization (www.iso.org). To answer RQ2 and examine current compliance risk management practices, this study examined commercial banks’ annual financial and management reports from 2010 to 2023. Given that the NBG places particular emphasis on systemically important banks, including concerning corporate governance, the systemic nature of banks was defined as the primary selection criterion. Accordingly, the study focused on three banks designated by the NBG as systemically important since 2017: (1) JSC TBC Bank (hereinafter, TB), (2) JSC Bank of Georgia (hereinafter, GB), and (3) JSC Liberty Bank (hereinafter, LB). To ensure consistency in the analysis, data from the same banks were reviewed retrospectively for the years before their formal designation as systemically important. Notably, all three banks are publicly listed on stock exchanges, which ensures a higher degree of transparency and access to relevant disclosures. To address the main RQ2, two supplementary questions were formulated and used to guide the analysis of information contained in the annual reports of commercial banks: (RQ2.1) What methods does the bank use to assess compliance risk? If the answer was positive to the first question, the following question was defined: (RQ2.2) Does the bank manage compliance risk? A standardized evaluation table was developed to support the analysis and ensure consistency in data processing. Each evaluation question was answered based on the analysis of the reports, with answers categorized as “Yes,” “No,” or “Cannot be determined.” The analysis covered the following reports:  TB: 14 annual financial reports and 6 management reports  GB: 13 annual financial reports and 6 management reports (The 2014 financial statements are not published on the NBG website).  LB: 13 annual financial reports and 6 management reports (The 2011 financial statements are not published on the NBG website). Reporting year Q2.1 Does the bank manage compliance risk? Q2.2 What methods does the bank use to assess compliance risk? Note Research limitations: This study does not examine the full scope of compliance management functions, but rather focuses specifically on compliance risk management and the methods used for its assessment. This limitation is intentional and reflects the study’s aim to address gaps in the regulatory framework and practical implementation of compliance risk management in the banking sector, where risk assessment practices remain underdeveloped and insufficiently studied. Main Findings Results for RQ1: The legal basis for compliance began with the NBG's Order N71 on Risk Management in Commercial Banks in 2008. The regulation defined compliance risk as “the risk of legal and regulatory sanctions, financial losses, or reputational damage resulting from non-compliance”. Banks were required to identify and analyze risk factors that could increase their exposure to compliance risk with potential quantitative impacts on profitability, capital, or financial stability. In parallel, banks were obligated to implement effective mechanisms for managing compliance risk as part of their broader risk management systems. Chapter 10 of the Regulation elaborated on compliance risk management expectations. Banks were mandated to identify and assess risk factors, such as the complexity of their operations, noncompliance incidents, and legal claims, that could adversely affect their financial stability. They were also expected to manage these risks through dedicated policies, procedures, skilled staff, and robust controls. [19]. Order No. 71 was repealed and replaced by Order No. 18/04 in 2014. According to Article 42, banks were required to establish a dedicated compliance unit, thereby formalizing expectations that had only been implied in the 2008 framework. The responsibilities of the compliance unit were defined under Article 41 and included setting risk tolerance limits, aligning policies with the bank’s strategy, assigning responsibilities across organizational levels, applying zero-tolerance policies to specific violations, and conducting regular compliance reviews [4]. It also clarified the respective roles of the Supervisory Board, Directorate, and control functions - including Internal Audit, Compliance Unit, and Risk Management Unit, emphasizing the importance of their independence and coordination. Additionally, it mandated that the organizational structure must ensure the independence of control units from departments directly involved in operational activities, and quarterly risk assessments must be conducted and corresponding reports submitted to the NBG [20]. The obligation to manage the nine key risk categories -including compliance risk-along with the supervisory responsibilities assigned to both banks and the NBG, remained unchanged from the previous regulation. Following the signing of the Association Agreement (AA/DCFTA) with the European Union in 2014, Georgia entered a new phase of regulatory reform, assuming a formal obligation to gradually align its national legislation with EU standards, including in the area of financial sector regulation. This obligation extends to the regulation and supervision of financial services, including the adoption of internationally recognized frameworks, such as the Basel Core Principles for Effective Banking Supervision (BCP), as well as measures aimed at preventing tax evasion and avoidance [21]. These commitments are explicitly outlined in Article 323 and Annex XV-A of the Agreement, which enumerate the relevant EU legislative acts and international instruments to be adopted within specified Norwegian Journal of development of the International Science No 167/2025 61 implementation timelines. Before 2014, Georgia’s engagement with international standards, such as those developed by the Basel Committee, was voluntary and discretionary. However, the AA/DCFTA institutionalized these expectations, requiring their integration into national law. This marked a strategic shift from voluntary adoption to mandatory legislative alignment, signaling Georgia’s formal commitment to strengthening its financial regulatory framework in line with global best practices [4]. According to the above-mentioned, new legislative acts concerning Compliance and compliance risk management were issued by the NBG: The Order of NBG №92/04 “the Regulation on the disclosure requirements for commercial banks within Pillar 3“, 2017 and the Order of NBG №215/04 "Corporate Governance Code for Commercial Banks", 2018; At the same time, the Order of NBG N48/04, which had previously defined compliance risk and detailed the responsibilities of the compliance unit, was repealed. Under Pillar III, commercial banks are obligated to publish both quantitative and qualitative disclosures on capital adequacy, governance, and risk management practices. Article 6 requires that banks must disclose their internal control structure, including the roles and relationships of key units: the Supervisory Board, Executive Body, Internal Audit, Risk Management and Compliance units, and Internal Audit [22]. Section 3(c) outlines disclosure components such as control mechanisms, responsibilities, and the overall risk framework, extending to compliance risk, which was first introduced in regulation in 2008 [19]. Pillar III regulation formalized transparency requirements related to compliance risk management, building on earlier obligations from 2008 and 2014, such as to disclose their compliance risk management practices and the Compliance Unit’s role within the broader risk framework. While compliance responsibilities date back to 2008, the explicit requirement to establish a dedicated Compliance Unit appeared in 2014, followed by disclosure obligations in 2017 [4]. The Corporate Governance Code for Commercial Banks governs the roles and responsibilities of the Supervisory Board, risk management frameworks, and internal controls (Internal Audit, Risk Management, and Compliance units). The Code remains the only active regulatory instrument explicitly defining the framework for compliance risk management in Georgian commercial banks [4]. The Compliance Unit is formally recognized as a structural division responsible for implementing the compliance function. The responsibilities of the Supervisory Board are expanded, mandating that it ensure the Compliance Unit’s independence, grant it sufficient authority, and provide it with unrestricted access to the board. Core responsibilities of the Compliance unit include: together with other units, ensure that the Bank operates in compliance with applicable laws, regulations, internal policies, and procedures, as well as identify and assess compliance-related material/potential risks, make recommendations to the Supervisory Board and Board of Directors regarding the management and control strategies of compliance risks, ensure employee awareness of compliance-related matters [23]. Under the now-repealed Regulation on Risk Management in Commercial Banks [20], the Compliance Unit was also tasked with human resource-related responsibilities, such as: Evaluating compensation programs from a compliance perspective; Identifying key personnel and setting rotation limits; Assessing the adequacy of training programs; Evaluating the competence of governing bodies; Defining the bank’s risk tolerance in its business activities. Results for RQ2: 1. TB: An analysis of TB’s annual reports showed that in the period from 2010 to 2017, the various types of risks managed by the bank were described, and the primary risk management approaches employed; however, compliance risk was not mentioned as a separate area of focus. The reports between 2015 and 2017 indicate that a legal compliance unit was introduced within the bank's organizational structure. This unit was responsible for overseeing AML/CFT efforts and managing compliance risks. Nonetheless, the reports do not provide details on the specific methods used for managing compliance risk. In the subsequent period, from 2018 to 2021, compliance risk was explicitly identified for the first time as one of the bank’s key risks. Responsibility for this area was assigned to the Compliance Risk Management Unit. Despite this development, compliance risk was not integrated into the bank’s broader risk management framework, and no specific risk assessment methodologies were disclosed in the reports. The 2022-2023 reports state that the Compliance Department is responsible for initiating changes to internal instructions and issuing recommendations to relevant processes. The department is also tasked with defining and monitoring the compliance risk matrix by the bank’s risk appetite framework. However, as with prior years, the reports do not provide any information on the risk assessment methods applied. The findings suggest that TBC Bank’s approach to compliance risk management has been limited in scope and insufficiently integrated into its overall risk management framework. From 2008 to 2018, compliance risk was not addressed as a distinct risk category. Although reports from 2018 to 2023 acknowledge some level of engagement with compliance risk management, they do not specify whether this extends beyond AML/CFT obligations. 2. GB: From 2010 to 2017, GB’s annual reports outlined the various types of risks managed by the institution and described the main approaches applied. However, compliance risk management was not mentioned during this period. In the years 2018 to 2020, the reports began referencing compliance risk management. Nevertheless, the coverage was confined to AML/CFT measures, which reflects a narrow interpretation of compliance risk (just one regulatory act) and does not align with its broader regulatory definition. 62 Norwegian Journal of development of the International Science No 167/2025 Reports from 2021 to 2023 introduced, for the first time, a formal definition of compliance risk. This marked a shift from prior years, where no such definition was provided. However, despite this conceptual advancement, the reports still did not specify the methods used for compliance risk assessment. The focus continued to center primarily on AML/CFT activities. The findings indicate that between 2008 and 2018, compliance risks were not managed as a distinct risk category by the Bank. While the period from 2018 to 2020 saw the introduction of compliance risk references, these were limited to AML/CFT obligations and did not reflect the full scope of regulatory compliance. Although the reports from 2021 to 2023 included a formal definition of compliance risk, they lacked any description of the methodologies employed to assess or manage it, in contrast to the more comprehensive treatment of other risk types. 3. LB: From 2010 to 2013, LB’s annual reports outlined the main types of risks managed by the bank and described the methods used for their management. However, during this period, compliance risk was not mentioned or treated as a distinct category. In the financial statements from 2014 to 2023, compliance risk is not presented independently. Instead, it is described as a component of operational risk, which the bank reports as being actively managed. This classification stands in contradiction to the standards established by the Basel Committee and the regulatory requirements of the NBG, both of which define compliance risk as a distinct and standalone risk category that should not be subsumed under operational risk. Moreover, across all years reviewed, the reports do not specify the methods used to assess compliance risk. The analysis indicates that between 2008 and 2013, LB did not manage compliance risk as a distinct category. From 2014 to 2023, the bank continued to treat compliance risk as a component of operational risk, contrary to both international (Basel Committee) and local (NBG) regulatory standards. The reports do not indicate the assessment methods used for compliance risk. Discussion Identified gaps for RQ1: The current legal framework no longer defines compliance risk or outlines how it should be assessed. The Code emphasizes risk identification and evaluation but lacks the procedural specificity that earlier regulations provided (e.g., 2008 and 2014 risk management regulations). As the World Bank (2021) notes, the enforcement just the existence of sanctions is essential for the effective implementation of corporate governance. In Georgia, enforcement remains inconsistent, weakening regulatory impact [24, pp. 28-29]. Basel Committee guidance requires that supervisors ensure banks have a permanent, independent, and adequately staffed compliance function with boardlevel oversight [25, p. 67]. Georgia’s framework does not provide tools to evaluate these conditions in practice. The NBG must be capable of evaluating the independence and effectiveness of compliance functions. Fulfilling Association Agreement obligations requires more than referencing compliance in the Code; it demands a dedicated regulatory framework on compliance risk management. There is no regulatory requirement to adopt a formal compliance policy, define clear appointment procedures for the Chief Compliance Officer (CCO), and establish fixed terms and board-approved mandates for the CCO [26, p. 3], as it is used in best practices. This lack of formal requirements indicates that the regulator views the compliance unit more as a symbolic obligation under the Association Agreement than as a function requiring practical regulatory support. The existing regulatory framework for compliance risk management does not meet the standards that can be used to determine: 1) Methods that will allow the NBG to assess the compliance risk profile, level, risk appetite, and overall quality of compliance risk management, which indicates the inefficiency of the enforcement part. 2 ) The role, status, functions, definition, and guarantees of independence of the control function - Compliance unit; relevant experience of the chief compliance officer, whether the CCO has sufficient authority to effectively perform the role in the bank, budget, and remuneration policy. Identified gaps for RQ2: The analysis reveals several significant gaps in the implementation of compliance risk management regulations among Georgian commercial banks:  There is a general lack of practical implementation of existing compliance regulations across the sector.  Neither the 2008 nor the 2014 editions of the regulation “On Risk Management in Commercial Banks” have been effectively enforced by the commercial banks or by the NBG in the area of compliance risk management.  Banks apply inconsistent and, in some cases, inappropriate definitions of compliance risk. For example, LB classifies compliance risk as a component of operational risk, whereas GB and TB primarily associate compliance risk with AML/CFT obligations. This approach fails to reflect the broader scope of compliance as outlined in international best practices.  The guidelines established by the Basel Committee on Banking Supervision (BCBS) are not being adequately considered by the Georgian banking sector. The Basel Committee has explicitly criticized the trend of narrowing compliance functions to AML alone. In its Principles for Enhancing Corporate Governance, note 34, it states: “Compliance functions are being solely focused on anti-money laundering (AML), which is inconsistent with the Basel Committee’s guidance. The Committee emphasizes that the compliance function should have a broader scope, addressing various areas as specified in their guidance” [15, p. 32]. In all three cases analyzed, compliance risk was either entirely omitted, classified under operational risk, or addressed exclusively through the lens of AML/CFT. While some progress has been observed in recent years, such as the inclusion of definitions and designation of internal compliance responsibilities, none of the banks articulate a clear or structured meth- Norwegian Journal of development of the International Science No 167/2025 63 odology for assessing compliance risk. Moreover, integration of compliance risk into the banks’ broader risk management frameworks remains limited and underdeveloped. The findings suggest that all three systematically important banks demonstrate a narrow interpretation of compliance risk management that overlooks the broader function and scope outlined in established compliance frameworks [2], [15, pp. 32, note 34]. These frameworks - including the Sarbanes-Oxley Act [11], and the Dodd-Frank Act [12] - define compliance in terms of a wide array of regulatory responsibilities, such as conflict of interest prevention, ethical standards, executive accountability, fraud prevention, consumer protection, and corporate liability. The NBG’s regulation also recognizes compliance risk as an independent and significant risk category [23]. The continued absence of clearly defined compliance risk assessment methodologies stands in stark contrast to the more structured and transparent treatment of other risk types in bank disclosures. This fragmented and incomplete approach points to a critical need for both more robust regulatory guidance from the NBG and the adoption of internal compliance practices aligned with international standards. Compliance risk must be treated as a distinct and strategically important risk area requiring dedicated resources, consistent methodologies, and meaningful integration into enterprise-wide risk management frameworks. Conclusion Although a formal regulatory structure is in place, significant challenges remain in its effective implementation. As the findings demonstrate, gaps exist within local regulations, and banks often fail to comply due to the absence of detailed guidance, such as manuals and instructions, as well as weak enforcement mechanisms on the part of the supervisory authority. To accurately assess rising compliance risk levels within banks and understand their quantitative impact on profit, loss, and capital, the regulator must establish clear compliance risk management guidelines, including a defined risk assessment methodology. It is impossible to implement standards without enforcement. Before enforcement, a uniform standard must exist. References: 1. European Banking Authority, "EBA Guidelines on Internal Governance (GL 44)," 27 September 2011. [Online]. [Accessed March 2023]. 2. BCBS, "(BIS) -Compliance and the Compliance Function in Banks," 29 April 2005. [Online]. Available: https://www.bis.org/publ/bcbs113.htm. 3. Federal Reserve System, "Compliance Risk Management Programs and Oversight at Large Banking Organizations with Complex Compliance Profiles -SR 08-8 / CA 08-11," 16 October 2008. [Online]. Available: https://www.federalreserve.gov/boarddocs/srletters/20 08/SR0808.htm#Footnote1. [Accessed March 2023]. 4. L. Kodelashvili, „Compliance Risk – What is Known About It in Georgia?,” German International Journal of Modern Science, pp. 18-22, 2025. 5. M. Fotaki, S. Lioukas and I. Voudouris, "Ethos is destiny: Organizational Values and Compliance in Corporate Governance," Journal of Business Ethics, pp. 19-37, 2020. 6. J. A. Gerard and C. M. Weber, "Compliance and Corporate Governance: Theoretical Analysis of the Effectiveness of Compliance Based on Locus of Functional Responsibility," International Journal of Global Business, vol. 8, no. 1, pp. 15-26, 2015. 7. G. P. Miller, "The Role of Risk Management and Compliance in Banking Integration," NYU Law and Economics Research Paper, pp. 14-34, 2014. 8. S. Seifi și D. Crowther, Corporate Governance and International Business., BookBoon, 2011. 9. G. P. Miller , „The Compliance Function: An Overview,” NYU Law and Economics Research Paper, Vol. %1 din %2No. 14-36, pp. 1-20, November 2014. 10. K. Doshi, „Risk and Regulatory Compliance in Banking: A Comprehensive Guide,” International Journal of Management, IT & Engineering, vol. Vol. 13, nr. 03, pp. 127-134, March 2023. 11. Sarbanes-Oxley Act, „Public Law 107 - 204,” 2002. 12. Dodd-Frank Act, "Public Law 111 - 203, Dodd-Frank Wall Street Reform and Consumer Protection Act," 2010. 13. M. N. Baily, A. Klein și J. Schardin, „The Impact of the Dodd-Frank Act on Financial Stability and Economic Growth,” The Russell Sage Foundation Journal of the Social Sciences, pp. 20-47, 2017. 14. C. Ferreira, N. Jenkinson and C. Wilson, "From Basel I to Basel III: Sequencing Implementation in Developing Economies," IMF Working Paper, pp. 142, 2019. 15. BCBS, "Principles for Enhancing Corporate Governance (BIS)," October 2010. [Online]. Available: https://www.bis.org/publ/bcbs176.pdf. 16. COSO, "Internal Control - Integrated Framework," 2013. [Online]. Available: https://www.coso.org/guidance-on-ic. 17. K. Park, J. Qin, T. Seidel și J. Zhou, „Determinants and consequences of noncompliance with the 2013 COSO framework,” Journal of Accounting and Public Policy, vol. 40, nr. 6, pp. 1-21, 2021. 18. ISO 37301, "Compliance Management Systems - Requirements with Guidance for Use," 2021. [Online]. 19. The Order of NBG N71, "Regulation on Risk Management in Commercial Banks," Legislative Herald of Georgia, Tbilisi, 2008. 20. The Order of NBG N48/04, "Regulation on Risk Management in Commercial Banks," Legislative Herald of Georgia, Tbilisi, 2014. 21. AA/DCFTA, "The Association Agreement," Legislative Herald of Georgia, Tbilisi, 2014. 22. The NBG Order №92/04, "Procedure for Disclosure of Information by Commercial Banks under Pillar 3," Legislative Herald of Georgia, Tbilisi, 2017. 64 Norwegian Journal of development of the International Science No 167/2025 23. The NBG Order №215/04, "Corporate Governance Code for Commercial Banks," Legislative Herald of Georgia, Tbilisi, 2018. 24. World Bank, "Report on the implementation of corporate governance codes and standards in Georgia (ROSC). © World Bank.," The World Bank Group, Washington, DC, 2021. 25. BCBS, ""BCP -Core Principles for Effective Banking Supervision" (BIS)," 25 04 2024. [Online]. Available: https://www.bis.org/basel_framework/standard/BCP.h tm?type=all&tldate=20250122. 26. M. K. Jain, "Governance and Prudential Supervision of Financial Institutions - Recent Initiatives," November 2 2021. [Online]. Available: https://www.bis.org/review/r211105i.htm.