Compliance Monitoring Explained: What FCA-Regulated Firms Need to Know

Today we're looking at one of the most important parts of an effective compliance function: compliance monitoring.

For FCA-regulated firms, compliance monitoring is much more than a box-ticking exercise. It is the process of checking whether the business is actually complying with its regulatory obligations, following its own policies and procedures, operating effective controls and delivering the outcomes customers should receive.

SMF Capital has produced a detailed guide to the subject:

https://www.smfcapital.co.uk/compliance-monitoring-explained/

So, what does good compliance monitoring actually involve?

It Starts With Risk

The first principle is that monitoring should be risk based.

A firm should not simply create a list of reviews at the beginning of the year and repeat exactly the same programme every year.

The monitoring programme should reflect the firm's actual risks.

That means considering its regulated activities, products, customer base and distribution channels, together with complaints, breaches, previous monitoring findings, audit results, regulatory developments and changes within the business.

Higher-risk areas should generally receive more frequent and more detailed testing.

This is important because compliance monitoring is not simply about checking whether a policy exists.

A policy may say that customers must be assessed in a particular way. Monitoring needs to establish whether that process is actually followed, whether the controls work in practice and whether the resulting customer outcomes are appropriate.

Consumer Duty Has Changed Monitoring

The Consumer Duty has made this even more important for retail firms.

It is no longer enough to demonstrate that a process was followed.

Firms increasingly need evidence that customers are actually receiving good outcomes across products and services, price and value, consumer understanding and consumer support.

That means compliance monitoring may need to examine customer data, complaints, cancellation rates, arrears, call handling and other outcome information.

It also means considering whether vulnerable customers or particular customer groups are receiving worse outcomes.

In other words, monitoring needs to look beyond paperwork and establish what is actually happening.

The Three Lines

Another important consideration is the relationship between the three lines of defence.

The first line is the business itself. Advisers, operations teams, customer service and other employees own the risks and operate the day-to-day controls.

The second line is compliance and risk. This function sets standards, provides advice and independently tests whether controls are operating effectively.

The third line is internal audit, providing independent assurance over the overall framework.

Smaller firms may not have the same level of separation between these functions.

That can be perfectly reasonable if it is proportionate, but the firm needs to recognise any limitations on independence.

For example, there is an important difference between someone designing a control and someone independently testing whether that control works.

Building the Monitoring Programme

A good programme normally begins by defining the firm's compliance universe.

What