Regulatory compliance 'irrelevant' to security