Lean startup inside a regulated business

Regulation is not the opposite of lean. Ambiguity is.

The teams that ship inside banks, energy retailers, and government-adjacent operators treat compliance as a design input. They run thinner experiments: a concierge service, a paper prototype, a shadow process. Not a production integration on day one. Validated learning still counts when the learning is "legal will not let us do X, so we will test Y."

I have run this conversation with energy and banking teams who arrived convinced lean was a Silicon Valley import that dies on contact with a licence. AGL Energy Ltd is a listed Australian generator and retailer. NAB is an Authorised Deposit-taking Institution with the same physics as every major bank in our geos. Lloyds Banking Group sits inside UK conduct, prudential, and operational-resilience rules that make a "just ship it" speech sound like a dare. The Australian Energy Regulator, the AER's retail rules, APRA and ASIC in Australia, the PRA and FCA in the UK: these are not plot twists. They are the brief.

If you treat them as plot twists, you will write a business case that pretends certainty and then spend a year discovering the constraint. If you treat them as design inputs, you can learn in 30 days.

Build-measure-learn, with the licence on the table

The classic loop still holds. You just add a fourth verb: bound.

Build the thinnest version the bound will allow. Measure a behaviour, not a sentiment mural. Learn out loud, including the stop. Bound every cycle by the rule, the licence condition, the conduct outcome, or the safety case you are actually in.

AGL-style retail experiments fail when they start as a new product in the stack and succeed when they start as an offer test, a concierge, or a script a retail and risk lead can live with. NAB-style experiments fail when they start as a core-banking change and succeed when they start as a shadow process or a manual decision with a clock. Lloyds-style experiments fail when they start as an enterprise programme and succeed when they start as a service test with a conduct owner in the room.

The regulator does not ban learning. The regulator bans pretending you learned when you shipped an uncontrolled change to a vulnerable customer. Those are different sentences. Write the second sentence into the brief.

Validated learning still counts when the learning is "legal will not let us do X, so we will test Y."

What "thinnest legal version" looks like in energy and banking

Energy retail (AGL and peers)

You want to test a new offer, a new hardship conversation, a new solar or battery bundle, a new SME product. You do not start by wiring it into billing. You start with:

• A landing page or a call script that makes a non-binding expression of interest, with legal on the claims.
• A concierge: a human runs the process for 30 customers while you watch cycle time and complaints.
• A paper bill explanation tested in a store or a call-centre bay.
• Kill criteria a retail risk lead will sign: complaint rate, call handle time, a conduct flag.

The Australian Energy Regulator and state retailers already live inside rules on marketing, hardship, and disconnection. Those rules tell you what you cannot claim. They do not tell you that you cannot sit with 20 customers and listen. AGL teams that treat lean as "ship a tariff" will stall. AGL teams that treat lean as "test the conversation and the offer shape" will learn.

Banking (NAB, Lloyds, and the rhyme in HK/SG)

You want to test an onboarding step, a credit explanation, a small-business product, a vulnerability play. You do not start with a core release. You start with:

• A shadow process: the new path runs in parallel, a banker or a credit officer executes it by hand, you measure time and error.
• A paper or PDF explanation of a decision, tested for comprehension (FCA-style consumer duty thinking travels).
• A concierge onboarding for a bounded cohort, with AML/KYC still done the approved way.
• Kill criteria a risk and conduct owner will sign.

APRA and ASIC (AU), the PRA and FCA (UK), MAS (SG), the HKMA (HK): different letterheads, same request. Show us you understood the customer outcome and the control. A NAB product owner who brings a one-page control with the prototype gets time. A NAB product owner who brings a vision deck gets a sequel.

Lloyds-scale UK retail has spent years inside ring-fence, conduct, and resilience work. The useful lean pattern is not "disrupt the branch." It is "test the thinnest change to a journey that already exists, with the conduct owner in the room, and publish the learning."

Ambiguity is the real tax

Teams delay because they are not sure whether the rule allows the test. They commission a legal memo that takes six weeks and answers a question nobody asked ("can we launch a platform?"). Ask a better question: can we run this concierge for 30 named customers, with this script, this disclosure, and this kill switch?

That question has a yes or a no. A platform question has a saga.

Write a one-page "test licence" for internal use:

• What we will do
• Who it touches (number, segment, vulnerability flags)
• What we will not change in production
• What data we will use
• Who can stop it (name)
• When it expires
• What we will report to risk

AGL retail risk, NAB operational risk, Lloyds conduct: they can mark that page. They cannot mark a mural.

The loop, written for a regulated Monday

Hypothesis. "If we explain the bill this way, hardship calls drop 15 percent in the pilot bay." Or: "If a banker runs this shadow onboarding, cycle time drops by a day without raising KYC exceptions."

Thinnest allowed test. Script, concierge, shadow, paper. Name the bound.

Metric. One number a CRO and a product owner both understand. Complaints, time, completion, exceptions. Not NPS of the workshop.

Kill date. 30 days is a default. 90 if the cycle needs a statement cycle or a billing run. Expiry is a control.

Public stop. If you kill it, write the learning in the same channel you would have written the win. This is how you earn the next test. GDS-style and DBS-style cultures already do this. Energy and banking can steal it.

Don'ts that keep showing up in listed companies

Don't use "regulatory uncertainty" as a blanket. Name the section, the licence condition, or the guidance. If you cannot, you have not asked.

Don't run a customer test that is accidentally a regulated financial promotion or an energy marketing claim. That is how you get the sequel you deserve. Put legal on the sentence the public will see.

Don't measure vanity. Unique visitors to an unapproved page is not learning if you cannot sell the thing.

Don't staff the experiment with a centre of excellence and no operator. The operator knows where the process actually breaks. AGL retail, NAB branch or digital ops, Lloyds journey owners: they are the builders.

Don't hide the experiment from the people who will audit it. Surprise is how lean dies in a regulated shop. Invite them. Give them the test licence.

For the next product committee

Take this paragraph to NAB, to AGL, to a Lloyds journey forum, to a peer in Singapore or Hong Kong.

We will test [behaviour] with [N] customers in [channel] for [N] days. We will not change [production system]. We will use [data] under [existing permission]. [Name] can stop it. We will kill it if [metric] is worse than [baseline]. We will report learning on [date] whether we scale or stop.

If the committee cannot live with that paragraph, the problem is not lean. The problem is that you do not have a test. You have a launch fantasy.

Collective Campus runs Lean Startup T&E with that paragraph as the residue. Problem interviews, offer tests, kill criteria risk and retail (or risk and the branch) can live with. The loop is old. The honesty is the scarce part.

Problem interviews inside a licence

Lean interviews are not NPS with extra steps. They are structured conversations that try to kill your offer before you spend a quarter. In AGL-shaped retail, ask about the last bill that confused them, the last hardship call, the last solar promise that did not match the connection. In NAB-shaped or Lloyds-shaped banking, ask about the last onboarding stall, the last unexplained decline, the last small-business hour wasted on a document the bank already had.

Record the behaviour, not the compliment. "I would love that" is not evidence. "I called twice last Tuesday" is. Compliance people can sit in, or they can review the guide. They should not ban the conversation. If they try, you asked the wrong question (a promotional question) or you used the wrong channel. Fix the guide. Do not skip the customer.

Shadow processes are production's honest twin

A shadow process is the lean move regulated shops forget. The new path runs beside the old one. A human executes it. You measure time, error, and exception. Nothing in the system of record changes until the numbers move and the control holds.

NAB credit and ops can shadow a decision explanation. Lloyds journey owners can shadow a vulnerability play. AGL retail can shadow a hardship conversation. Energy and banking regulators did not ban shadows. They ban uncontrolled change to a customer in production. Write the difference on the test licence. Show it to audit before they ask.

If the shadow needs 40 people and a PMO, you overbuilt it. Start with one bay, one branch, one journey owner. Thirty customers. A clock. A stop.

The test licence, filled in

The lean piece already argued for a one-page test licence. Here is the page filled, in language AGL retail risk, NAB operational risk, Lloyds conduct, and an Ofgem-shaped UK supplier can mark. Copy the headings. Replace the brackets. Do not add a vision paragraph.

Title. Test licence for [offer, conversation, or shadow process]. Not a programme name.

What we will do. We will run a [script / concierge / non-binding expression of interest / paper explanation / shadow onboarding] with [N] customers in [named channel or bay] for [N] days. We will not change [billing, CIS, core banking, system of record].

Who it touches. Segment: [household retail / SME / existing credit customers]. Number cap: [N]. Vulnerability flags: [hardship, impaired, age, language]. Anyone outside the cap is out of scope. AGL-shaped hardship physics and FCA-style consumer duty thinking both belong on this line. If you cannot fill it, you are not ready.

What we will not change in production. List the systems. List the tariffs or products that stay as they are. List the letters that will not go out as "the new version" unless legal marked them.

Data we will use. Source, existing permission, retention, who can see it. APRA-shaped and MAS-shaped rooms already know this sentence. Write it before the first customer is invited.

Claims or explanations the public will see. Paste the sentence. Legal or conduct marks it. AER marketing and hardship rules, ASIC and FCA financial-promotion physics, Ofgem supply-licence communications: these are specifications, not vibes. If the sentence cannot clear, the test is a different test.

Who can stop it. Name and role. A retail-risk lead at AGL. An operational-risk or conduct owner at NAB or Lloyds. A compliance lead at a UK energy supplier. Phone number. They do not need a committee to pull the stop.

When it expires. A date. 30 days is a default. 90 if you need a billing cycle or a statement cycle. Expiry is a control. After expiry the test is dead unless a new licence is signed.

What we will measure. One number a CRO and a product owner both understand: complaints, handle time, completion, exceptions, cycle time. Baseline written here. Kill if worse than baseline, or if we cannot complete the concierge for the named cohort.

What we will report, and to whom. Date of the learning note. Channel (existing product committee, not a new pack). We will publish the stop as loudly as the win.

Named operator. The person who will run the bay, the branch, or the shadow. Centres of excellence do not get this line.

NAB, AGL, Lloyds, and peers in HK or SG can mark that page in a sitting. They cannot mark a mural. If the committee cannot live with the filled page, you do not have a lean problem. You have a launch fantasy.

A practical: attach the filled licence to the calendar invite for the test. If a name is missing, the invite does not go.

APRA-shaped, AER-shaped, and Ofgem-shaped rooms

Regulation is not one room. The letterhead changes the stopper, not the loop. Write the room mix on day one so you do not discover the missing chair in week six.

APRA-shaped (and ASIC-shaped) banking

NAB and every major ADI in Australia sit inside prudential and conduct gravity. APRA cares whether you understood operational risk, data, and resilience. ASIC cares whether a customer could be misled. The useful lean room is: product owner, operational-risk counterpart, a conduct or complaints owner, an operator who runs the process by hand, and a builder who will not start with core. MAS in Singapore and the HKMA in Hong Kong rhyme. Lloyds-shaped UK rooms swap in PRA and FCA nouns. The physics hold: shadow and concierge first, core later.

What this room kills early: tests that are accidentally financial promotions, cohorts with no vulnerability flag, "innovations" that change the system of record to learn a sentence. Good. That is the bound working.

AER-shaped energy retail

AGL and peer retailers live inside marketing, hardship, and disconnection rules. The Australian Energy Regulator does not ban listening to 20 customers. It does ban claims you cannot stand behind. The useful lean room is: retail lead, retail-risk or compliance, a hardship or vulnerability specialist, a call-centre or store operator, legal on the public sentence. Origin-shaped corporates have the same mix plus a trading and operations clock that corporate rooms should not pretend they share.

What this room kills early: tariff-in-the-stack stories, cute offers that fail hardship physics, landing pages that are accidentally marketable claims. Good.

Ofgem-shaped UK supply

UK energy suppliers sit inside supply-licence communications, vulnerability, and a political weather system that will not be kind to a cute experiment. The useful lean room is the AER mix with Ofgem nouns and a comms owner who can live with a leak. Do not run a household test that comms has never seen. Prototype the sentence.

What this room kills early: the same launch fantasies, plus anything that needs a new industry process to learn whether a letter is clearer. Test the letter.

Across all three rooms the steal is identical. Bound every cycle. Build the thinnest version the bound allows. Measure a behaviour. Learn out loud, including the stop. Invite the stopper before you invite the caterer.

A practical room checklist:

Product or retail owner. Operator. Stopper (risk, conduct, or compliance). Legal on the public sentence. Builder who is not allowed to open a platform ticket on day one. If any chair is empty, you are running theatre inside a licence. Cancel and rebook.