There’s a common mindset in our industry when it comes to compliance: Avoid it for as long as you can, then tackle it all at once, check the box, and move on.

I get it. Compliance can feel overwhelming, like a cold plunge. No one looks forward to it. It’s uncomfortable. It forces you to confront gaps in your business, and sometimes it feels like you’re signing up for work that doesn’t generate revenue. So, businesses delay it. They wait until a lender pushes them, until an examiner shows up, or until something goes wrong.

Then they finally jump in.

And at that moment, one of two things tends to happen:

  1. They realize compliance is more involved than they thought.

It’s not just a privacy policy. It’s not just a Red Flags checklist or a training video. It’s a web of expectations, federal, state, and sometimes local, that affect how you advertise, how you sell, how you collect, how you protect data, and how you treat customers.

  1. Or, they get through the initial checklist and think, “Glad that’s over with.”

They hired a consultant, did some training, made some changes, and now they feel done. They checked the box. Crisis averted.

But that mindset is dangerous.

Because compliance isn’t something you complete. It’s something you maintain.

If it were truly one-and-done, it would mean the world had stopped evolving. That regulators stopped issuing new guidance. That state’s legislature stopped passing new bills. That state and federal agencies stopped changing the way they enforce the rules. It would mean your dealership never grew, never added new salespeople, never changed its business model, and never tried a new marketing strategy.

But none of that is reality.

The truth is: the rules keep changing. The risks keep shifting. And so must your response.

We’ve seen dealers who had pristine compliance programs, two years ago. But no one has updated the documents since. Training hasn’t been refreshed. The Privacy Notice hasn’t been touched. Someone put a new ad on the website last month that raises fair lending questions, and no one ran it by the legal folks. In their mind, “we already did compliance.” But compliance isn’t a fire drill. It’s a fire watch.

We did some in-person with a client recently and we asked whether any of the attendees had watched our online training content.  Everybody raised their hands.  Then we asked who had completed their classes for the current quarter.  Nobody raised their hands.  We asked about the prior six months, and again, nobody raised their hands.  Compliance training isn’t a sometime thing, and the show of hands, or lack thereof, told us that this client needed to do a better job of holding their team accountable.

On another occasion, we started working with a new client that told us we didn’t need to focus on its documented compliance policy content because it was in great shape.  Instead of taking them at their word, we pulled on some threads and discovered that their underwriting policy hadn’t been updated since they’d moved to a new scorecard.  Similarly, they had begun using starter interrupt devices, but that wasn’t reflected in the GPS policy from years earlier.  You get the message, business practices change over time, very often without the involvement of the compliance or legal team.  That’s a mistake, because it’s a whole lot more efficient to do the project once than having to make changes on the eve of implementation.

The most successful dealers don’t treat compliance like a project. They treat it like a practice.

It’s part of their rhythm, like recon or collections or accounting. They have systems for keeping policies updated. They train their people regularly. They revisit their website, their deal jacket, and their customer interactions with fresh eyes, knowing what worked yesterday might not work tomorrow.

Getting started is essential. It’s a necessary step. But don’t confuse it with being finished.

In this business, staying compliant is just as important as becoming compliant.

So, if you’ve taken the plunge, great. But now it’s time to swim.

Joe Allen serves as director of operations at Ignite Consulting Partners, which provides guidance to car dealers, finance companies and other industry participants on compliance issues, best practices, and provides tools to protect clients’ business. He can be reached at Joe.Allen@ignitecp.com.