Chapter 2 · The Compliance Function

Purpose: protect the firm from regulatory / legal breaches (and the fines, licence loss, and reputational damage that follow) by identifying, assessing, monitoring, advising on, and reporting compliance risk.

Compliance is a control function. It does NOT replace management's ownership of compliance risk — every business unit remains responsible for its own compliance; compliance provides oversight, advice, and challenge.

Compliance sits in the 2nd line. This is why compliance must be independent of revenue-generating business units — a compliance officer reporting to the head of sales cannot credibly challenge sales practices.

To preserve independence, the head of compliance should typically report to:

• The BOARD (or a board committee — often audit or risk committee)
• And/or the CEO directly
• NOT a revenue-generating business unit

The head of compliance should have direct access to the board — enabling independent escalation of significant compliance risks, breaches, or disagreements with executive management, WITHOUT filtering through the CEO.

A compliance function must be adequately resourced (headcount, skill, seniority, technology, budget) proportionate to the firm's size, complexity, risk profile, and regulatory environment.

Under-resourced compliance is a common regulatory finding. Head of compliance should have (and use) the ability to raise concerns to the board if they believe resources are inadequate. Regulators may ask "did you request more resources? Were you refused?"

Core responsibilities of a CCO:

• Setting the compliance strategy
• Maintaining the compliance policy framework
• Running the compliance monitoring programme
• Providing advice to the business
• Ensuring training
• Liaising with regulators
• Reporting to the board
• Managing the compliance team

Under regimes like the UK SMCR, the CCO is a Senior Manager with personal regulatory accountability — meaning they can be personally fined or banned for failures within their remit.

Approved persons must meet a fit and proper standard covering:

1. HONESTY, INTEGRITY, and REPUTATION
2. COMPETENCE and CAPABILITY (technical knowledge, experience)
3. FINANCIAL SOUNDNESS

Assessed by the firm and (in many jurisdictions) tested by the regulator before approval. Failures (undisclosed criminal record, bankruptcy, prior regulatory action) can bar someone from senior compliance roles.

Culture is established by tone from the top — visible, consistent leadership commitment from the board and senior executives, backed by aligned incentives, HR consequences for breaches, and rewards for compliance-supportive behaviour.

What leaders SAY matters less than what they DO — who they promote, who they fire, what they tolerate, how they handle a whistleblowing case.

Positive indicators: employees speaking up without fear · near-miss reporting valued · timely breach reporting · consistent discipline regardless of seniority · compliance concerns addressed (not deferred) · board engagement on culture.

Warning signs: ZERO breach reports (usually means people are hiding them) · rainmakers get away with things ordinary staff would be fired for · policies exist but not lived.

Compliance Monitoring Programme (CMP) = a risk-based, planned programme of activities designed to give the compliance function ongoing assurance that regulatory / policy requirements are being met.

Distinct from internal audit's periodic assurance — CMP is CONTINUOUS 2nd-line testing, not periodic 3rd-line testing.

Elements:

• Risk-based prioritisation (informed by the compliance risk assessment)
• Sample testing, thematic reviews, deep-dives
• Documented findings + ratings + agreed actions
• Tracked to CLOSURE
• MI to senior management + board on trends

Higher-risk areas (large volumes · sensitive customers · high-fine regulations · past breach history · new business · new regulation) receive PROPORTIONATELY MORE monitoring than lower-risk areas.

Compliance risk assessment (CRA) → heat map → CMP prioritisation. Don't spread butter thinly across everything.

Compliance advises the business on the compliance implications of new products, new business lines, transactions, marketing material, client relationships, and regulatory change. Early involvement matters — being asked "is X compliant?" AFTER launch is much worse than being asked BEFORE.

Give objective, independent advice — even when unwelcome. Document material advice. Escalate where compliance disagrees but is overruled.

General regulatory expectation (formal rule in many jurisdictions e.g. FCA Principle 11): firms must deal with regulators OPENLY AND COOPERATIVELY — proactively disclosing significant issues, responding promptly to information requests, not misleading the regulator.

Compliance ensures the firm makes required NOTIFICATIONS: regular reports (returns, transaction reports, financial data) + ad-hoc event-driven (material breaches, senior appointments/departures, litigation, IT incidents affecting clients, whistleblowing referrals). Timing is critical.

UK SMCR (2016 → expanded 2023+) is the current UK model of individual accountability. Features:

• Named INDIVIDUALS accountable for specified prescribed responsibilities (via statements of responsibility)
• Personal regulatory approval for Senior Managers
• Annual certification of "significant harm" staff as fit & proper
• Individual Conduct Rules applying across most staff
• Duty of responsibility — Senior Manager can be sanctioned for failures in their area, regardless of whether they knew

Similar regimes globally: Hong Kong Manager-in-Charge (2017), Singapore MAS senior management guidelines, Australia FAR (2024 for banking/insurance/super).

Under SMCR's Duty of Responsibility, a Senior Manager can be personally sanctioned by the regulator where:

1. There has been a regulatory breach in an area they were responsible for, AND
2. They did NOT take "such steps as a person in their position could reasonably have been expected to take" to prevent it

Note: "I didn't know" is not automatically a defence. The question is: SHOULD you have known, and DID you take reasonable steps?

1. Containment — stop the harm continuing
2. Investigation — facts, scope, root cause
3. Notification where required (regulator, affected clients)
4. Remediation (customer redress, control fix)
5. Discipline where individuals culpable
6. Documentation
7. Tracked to closure

Universal principle: you can outsource the OPERATION, not the RESPONSIBILITY.

Even for outsourced compliance operations, the firm:

• Retains FULL regulatory accountability
• Must due-diligence the provider
• Must contract clearly (SLAs, access rights, exit)
• Must monitor performance
• Must retain sufficient in-house knowledge to oversee
• Typically requires an internal accountable individual (Senior Manager)

Response hierarchy for identified conflicts:

1. AVOID the conflict where possible
2. If not avoidable, MANAGE via controls (info barriers / Chinese walls, separation of duties, restricted lists, PAD rules)
3. DISCLOSE to the client as a LAST resort, and only where management is sufficient to protect the client

Disclosure alone is NOT a fix for a genuine ongoing conflict.