EU and G7 Russian diamond sanctions highlight a pattern the compliance community has seen again and again: regulators establishing requirements without prescribing verification methods, leaving technology vendors to define practical standards. CCI contributing writer Gordon Feller examines the benefits and risks of outsourcing compliance infrastructure through the prism of the diamond industry.
When the European Union and the G7 sanctioned Russian diamonds in January 2024, they followed a script that is becoming familiar across regulated industries.
In this case, importers of qualifying polished diamonds must now file a due diligence statement attesting non-Russian origin. But the rules stop there. No single verification method is mandated, no government agency is empowered to check the claims, and no unified registry exists that could confirm diamond origins.
Into that vacuum has flowed a stream of private technology companies, each proposing itself as the practical answer to what “compliant” actually means.
Compliance officers outside the jewelry trade will recognize the shape of this story even where the specifics are unfamiliar. The same pattern was seen with the growth of the consent-management platforms for GDPR, the reporting software built for the EU’s Corporate Sustainability Reporting Directive and the attestation tools financial firms use to document Sarbanes-Oxley (SOX) controls.
A regulator writes a rule, leaves the mechanism unspecified and a commercial marketplace — usually backed by venture capital or private equity, competing for customers and answerable to investors rather than to the public — fills the gap. The practical effect, whether intended or not, is that the operative definition of “compliant” becomes delegated to vendors.
“The endgame is a unified digital registry,” Leanne Kemp, founder and CEO of Everledger and former Queensland chief entrepreneur said, predicting the regulatory focus on diamond origins will eventually expand to broader ESG disclosure for luxury goods. If she’s right, today’s vendor competition is really a competition to become tomorrow’s default infrastructure — with everything that implies about who ends up writing the rules.
Competing for what ‘compliant’ means
Regulators have acknowledged the tension between regulation and vendor solutions even as they lean on the private sector to build the plumbing. Patrick Armstrong, a senior official on financial innovation at the European Securities and Markets Authority, warned in a 2017 speech at a London regtech conference that regulatory technology can delegate tasks, not responsibility — the underlying obligation stays with the regulated firm no matter how much of the verification work gets handed to a vendor. That distinction is hard to enforce once dozens of platforms, each with its own methodology, are all calling themselves the solution.
The diamond trade makes the pattern unusually easy to see because the industry is small enough to watch the vendors compete in real time and because the compliance stakes — sanctions evasion, conflict financing — are stated in blunt terms rather than buried in regulatory footnotes.
The Gemological Institute of America, the industry’s dominant certification body, states plainly that the vacuum is not just regulatory but scientific. In a statement to CCI, the GIA said more than 50 years of research on diamonds has produced “no scientific method to determine a diamond’s country of origin with certainty by examining rough or polished diamonds.” Origin confirmation through “audited and verified documentation is at this time the best way to meet the demands of consumers and governments.” That’s another way of saying paper trails, not physics, currently decide the question regulators are asking. The GIA runs two origin services built on document review rather than direct measurement and has begun folding blockchain-sourced origin data from Tracr, a platform for tracing diamond origins, into its own grading reports.
Two camps have formed to fill the gap in diamond origin regulation, Kemp said: “producer-led ecosystems and independent verifiers.” She places Tracr and Sarine, a physical-mapping specialist that recently integrated with Tracr, in the first camp — “Tracr offers massive scale, while Sarine provides physical ‘DNA’ mapping of a diamond’s internal structure” — and positions her own company, alongside providers like iTraceIt, in the second.
Wesley Tucker, Tracr’s recently retired CEO, argues that self-declaration alone can’t carry the weight regulators are placing on it: any traceability system, he said, “must go beyond self-declaration and toward deeper, technology-driven verification” if it’s going to hold up as “expectations around transparency continue to rise.” Tracr’s approach — matching diamond scans captured at the mine and again at the manufacturer with results logged to a blockchain — has produced more than a million rough-to-rough matches since the process opened to the wider industry in 2023, according to the company. Tracr is also, notably, migrating toward third-party equity ownership, a step it frames as strengthening its neutrality — an acknowledgment, even if unstated, that a for-profit gatekeeper’s credibility depends partly on distance from the industry it grades.
The Greenwashing Reckoning Isn’t About Marketing
A bold public target and a cautious financial model can contradict each other inside the same annual report
Read moreDetailsPrivate or public sector answers
Whether that arrangement is good news or bad news is a question CCI’s readers are arguably better positioned to answer than most, since versions of it are showing up in their own vendor selections. There’s a real case for the private-sector answer, including that public agencies in much of the world simply lack the capacity, funding or technical expertise to build and run verification infrastructure themselves, and a competitive vendor market can move faster than any regulator.
Edward Bankoloh Koroma, acting executive director of Transparency International Sierra Leone, has watched the alternative up close. His organization’s research found that diamond tracing “from the mines is challenged with corruption, transparency and accountability issues,” including mining compliance officers who accept bribes to under-report finds, and a national minerals agency too thinly staffed to monitor its own sites. Weak public capacity is exactly the vacuum private vendors say they can fill.
But there’s a counter-case, too. A regulator that outsources the definition of compliance to a handful of competing, investor-backed platforms has also outsourced the standard itself — and with it, some of the accountability that’s supposed to run back to the public. Angola’s diamond sector shows what can happen when weak state capacity meets a value chain captured by monied interests: decades of documented human-rights abuse tied to profits that, in an earlier era, helped fund a civil war. Of course, traceability technology alone doesn’t fix that; it depends on who controls the technology and who can audit it. A compliance officer evaluating any regtech vendor — in diamonds, in privacy, in ESG reporting — is implicitly making a judgment about whether that vendor’s incentives point toward rigor or toward retaining a paying customer. Which outcome is more likely for any given platform is a live, unresolved argument, not a settled one, and compliance officers evaluating their vendors are right to keep asking it.
The EU’s own rules illustrate how thin the mandated mechanism actually is. Since March 2025, importers bringing mixed-origin rough diamonds into the EU for the first time have had to present a Kimberley Process certificate listing every country of origin in the shipment — a paper certificate, not a technological check. Diamonds already verified under the G7 scheme are exempt from that. Nothing in the regulation requires the scanning, matching or blockchain logging that companies like Tracr, Sarine and Everledger have built businesses around; the law asks for a documented attestation and leaves it to the market to decide how rigorous that attestation should be.
But no matter the rigor of the attestation to compliance from the market solutions for diamond importers or any other regulated businesses, it’s the companies that must face regulators.
“A firm can outsource the work. It cannot outsource the answer,” Lillian Freiberg, head of North America at Clarity AI, a financial intelligence, risk and regulatory reporting provider, told CCI. “When a regulator asks how a number was produced, ‘our provider calculated it’ has never been sufficient. The firms that hold up under examination are the ones that understood the methodology well enough to defend it as their own. The question in any vendor selection is not whether the tool is compliant. It is whether you can explain what it did.
“The consequences land on the company, not on the vendor. That is why the expertise behind the technology matters as much as the technology.”
That gap between what the rule requires and what the vendors sell is one that compliance professionals find themselves in the middle of, whatever their niche. The pressure in the diamond industry is just the latest example.
Gordon Feller is a journalist and technology strategist who has spent four decades covering emerging tech, urban sustainability and global infrastructure. He has been published in Manufacturing Dive, Ars Technica and International Policy Digest. 
