@jerry That training need to include the "marketing team" and creatives in the business too! :) . It does take a loooong time (years) but it is possible, as long as the Regulator works *with* the business to ensure continued compliance, that way the business can ask stupid" questions of the Regulator without fear.
I have seen this work in giant public companies that span multiple Jurisdictions...
Just my 2cents work .