Spoiler alert: This article references general plot points from Season 3 of HBO’s The White Lotus.
The White Lotus is known for sharp writing, dark humor, and a signature formula: luxury resort, tropical backdrop, and a murder that gets slowly revealed to us over the course of the season. This time, though, one subplot hit especially close to home for me.
If you work in governance, risk, or compliance — and you’ve been watching — you might’ve noticed it too: A fund set up years ago. Long dormant. Barely on the radar. Then documents surface. The feds get involved. What looked like a closed chapter suddenly reemerges — not as history, but as exposure.
I’ve heard versions of this story more times than you’d expect — just without the spa robes and sunsets.
I’m Jeizel, and while I’m a White Lotus fan, I also lead GRC Sales at Resolver. I work with risk and compliance leaders across some of the world’s best financial services companies every day. And most of the teams I meet aren’t ignoring financial compliance risk. They’ve got policies, controls, and often a compliance culture in place. But when scrutiny hits, they’re still stitching together folders and spreadsheets, trying to prove they’re in control.
What they don’t always have, consistently, is visibility. And that’s where risk grows — especially under pressure. It’s where oversight starts to slip, and gaps in due diligence quietly start to widen.
It’s easy to write off the show’s plot as HBO drama. But real-world compliance failures rarely start with fraud. They start with comfort:
- “The vendor was approved years ago — it’s fine.”
- “The control is still listed — someone must be managing it.”
- “The policy is uploaded — we’re compliant, right?”
But if no one’s watching, risk doesn’t disappear. It compounds. And by the time someone starts asking questions, it’s often too late to prove you’re in control.
Let’s talk about what The White Lotus gets right, and what financial compliance teams can do to stay ready before the headlines hit.
More than fiction: How dormant financial risks can quietly resurface
One storyline in this season of The White Lotus mirrors a real-world risk pattern I’ve seen too often: Old business relationships and long-forgotten obligations quietly turning into active exposure. Not because someone set out to hide them (though in this case, someone definitely did) — but because no one was looking.
In Season 3, we meet hedge fund executive Timothy Ratliff (played by Jason Isaacs of Harry Potter fame) while he’s enjoying a luxury wellness retreat with his picture-perfect family in Thailand. But the calm doesn’t last — and soon things heat up faster than Phuket in May.
A Wall Street Journal reporter starts asking questions about Sho-Kel — a fund Timothy helped set up years ago — and suddenly, the energy shifts. What felt like a distant, dormant business relationship reemerges. And what Timothy assumed was ancient history starts to look like a current liability.
It’s HBO-level drama, sure. But that tension — a risk hiding under the radar? I’ve seen it play out in real financial firms. Just without the tropical setting.
(Image via X.com)
Most compliance teams I work with aren’t missing things on purpose. They’re doing their best to keep up with the volume of regulatory changes using outdated tools, limited visibility, and disconnected systems. But they’re also still relying on spreadsheets, shared drives, and good intentions. And when regulators, auditors, or the board come calling, there’s no system to show the work.
The White Lotus may be fiction, but it captures something real: the way dormant risks resurface when no one’s watching. I see it all the time — and it usually looks like this:
- A third-party relationship no one’s reviewed in years
- A control marked “complete” that was never tested
- A policy rollout that stopped at email
- Spreadsheets standing in for systems
These aren’t signs of negligence. They’re symptoms of a program built on “good enough” tools and a patchwork of processes no one’s questioned in years. For asset managers, a single third-party misstep in one region can trigger reputational risk across your investor base. In broader GRC terms, we can view this fictional former business associate as a third-party risk — especially when the relationship lingers off the books and outside your controls framework.
Why financial compliance risk gets missed — even when there’s a system
“We thought we had this covered.” That’s what I hear most from teams when a visibility gap surfaces. Sure, they had policies and processes in place, and maybe even a compliance management system. But no one was using it the same way — or using it at all.
Here’s where things usually break down:
- Disconnected systems that don’t talk to each other
- Unclear accountability for controls and owners
- Controls aren’t updated or tested regularly
- A policy rollout that stopped at email
- Workflows aren’t repeatable and don’t scale
Risk doesn’t usually hide in the shadows. If you don’t have the right dashboards and reports to keep an eye on what’s happening across your business, risk gets overlooked in plain sight.
The vendor file exists, but no one knows if it’s current. The trail lives in someone’s inbox. The control is listed, but no one follows up.
And it’s not just internal pressure that’s rising. According to Kroll’s 2025 Financial Crime Report:
- 71% of executives expect financial crime risk to rise this year
- But only 23% say their compliance program is very effective
- And just 29% strongly agree that their organization has a robust governance infrastructure for overseeing financial crime.
The gap is clear: risk is rising, confidence is low, and most teams aren’t short on awareness — they’re short on tools. In fact, just 30% of executives in the Kroll report say they feel confident they have the right tools and investment in place to manage financial crime risk. Without a connected compliance solution, you can’t see what’s working, what’s stalled, or what’s been forgotten — until someone else finds it first.
What being proactively prepared looks like for compliance teams
The best compliance programs I see don’t chase perfection. They prioritize clarity, consistency, and visibility.
In practice, mature compliance programs operate like this:
- Control testing is automated, assigned, and tracked — not chased down
- Policies are rolled out and acknowledged — not just uploaded
- Risk assessments live in a shared system — not buried in inboxes
- Third-party due diligence is completed at scale — not skipped because “we know them”
Want to go deeper? We’ve outlined this in our Enterprise Risk Maturity Model e-book.
The truth is that most firms we work with aren’t lagging on intent — they’re lagging on infrastructure. They know what needs to get done, but without systems that link risk, controls, and ownership — or automated workflows teams can rely on quarter after quarter — they can’t do it consistently.
According to Resolver’s 2024 survey with Compliance Week:
-
Only 20% of compliance professionals described their approach as “highly proactive.”
-
One in three flagged “managing regulatory change” as their most pressing challenge.
-
In financial services, 36% listed horizon scanning as a top concern — but most lacked integrated systems to take action when change hits.
-
And 28% of firms spend more than 400 hours a year just monitoring regulatory change — a burden that rarely delivers confidence without the right tools.
Resolver isn’t an AML tool. But we are the connective tissue for the processes compliance teams rely on every day — tracking obligations, assigning ownership, creating audit trails, and surfacing gaps before they become headlines. This doesn’t mean adding headcount or reworking strategy. Compliance done confidently is about building a foundation that reflects how your team actually works — and makes the right actions easy to track, repeat, and prove.
Final word: Visibility is the best risk and compliance control
Compliance risk doesn’t start loud. It starts quiet. One overlooked vendor. One out-of-date control. One missing audit trail.
Then a journalist calls, a regulator knocks, or the board starts asking questions — and you’re not ready.
As The White Lotus unfolds, Timothy isn’t managing the problem — he’s unraveling. Phones off. Stress high. Hiding the truth from his family and team. He doesn’t need spin. He needs a system that could’ve surfaced the risk before it spiraled.
(Image via @HBO on Instagram)
That’s what Resolver makes possible. We help compliance and risk teams stay ahead by connecting tools, owners, and oversight in one place — so when the pressure hits, you’re not scrambling. You’re already in control. Imagine what you could do with:
- One place to manage ownership, documentation, and testing
- Real-time visibility into what’s working — and what’s not
- A clear path to show regulators, auditors, and the board what’s been done (and what hasn’t)
No rip-and-replace. No reinvention. Just clarity, consistency, and systems that fit how your team already works.
Don’t just take my word for it — in a Forrester Total Economic Impact™ (TEI) study, Resolver customers reported:
- 75% faster compliance testing
- 95% faster executive reporting
- $190K saved annually by eliminating legacy tools
Now imagine what kind of strategic intelligence you could provide if the tedious information gathering work was already done — and done right. Because when the tough questions come, you deserve to have the answers at the ready.
Curious about what this looks like in practice? Watch a quick walkthrough or book a demo. And if you just want to talk White Lotus theories? I’m in — connect with me on LinkedIn.
About the author: Jeizel Rosenthal is VP of GRC Sales at Resolver, where she works with compliance, audit, and risk leaders across financial services to strengthen oversight, streamline workflows, and reduce reputational exposure. She’s seen how fast things unravel when assumptions go unchallenged — and how quickly the right system can shift a team from reactive to ready.
