Compliance Culture

Compliance culture is the pattern of values, beliefs and habits inside an organisation that shapes how its people respond to legal, regulatory and ethical obligations. It describes what actually happens when a rule is inconvenient, when no one is watching, or when a commercial target conflicts with doing the right thing. A firm may have complete policies and a well-staffed compliance department and still have a weak compliance culture if staff treat the rules as an obstacle.

The concept is closely tied to the formal compliance programme, which supplies the policies, training, monitoring and reporting lines. Culture determines whether that machinery works. Financial regulators have given the subject sustained attention since the financial crisis of 2007 to 2009 and the misconduct scandals that followed, concluding that rules and fines alone had not changed behaviour.

Several elements recur in regulatory guidance and research:

• Leadership. The conduct of the board of directors and senior executives, often called tone from the top, signals what is truly valued. What leaders do, tolerate and reward counts for more than what they say.
• Middle management. Staff take their cues mainly from their immediate managers, so the message must be carried down consistently.
• Incentives. Pay, promotion and recognition that reward revenue regardless of how it was earned undermine any stated commitment. Balanced scorecards, deferral and adjustment of pay for misconduct support it.
• Accountability. Clear individual responsibility, with consequences applied evenly, including to high performers, shows that the rules bind everyone.
• Openness. People must feel able to raise concerns and admit mistakes without retaliation. An effective whistleblowing framework and real whistleblower protection are part of this.
• Standing of the compliance function. A chief compliance officer with seniority, resources and direct access to the board indicates that compliance has weight.

Regulators generally do not prescribe a culture, but they assess it and hold firms responsible for its consequences. In the United Kingdom, the financial conduct regulator treats culture as a root cause of conduct failings and focuses on four drivers: purpose, leadership, the approach to rewarding and managing people, and governance. The Senior Managers Regime supports this by assigning personal accountability to named individuals and by applying conduct rules to almost all staff, with firms required to assess the fitness of key personnel through a fit and proper assessment.

In the United States, prosecutors deciding how to resolve a corporate case consider whether the company's compliance programme is well designed, adequately resourced and working in practice, and they look explicitly at the conduct of senior and middle management and at incentives and discipline. Banking supervisors examine governance and risk culture as part of their reviews. International bodies, including the Basel Committee and the Financial Stability Board, have published guidance on risk culture and on reducing misconduct.

Culture cannot be observed directly, so firms rely on indicators. Common sources are staff surveys, focus groups, exit interviews, the volume and nature of whistleblowing reports, breaches and near misses, customer complaints, training completion, overdue audit actions and the outcomes of disciplinary cases. Patterns matter more than single numbers: a business unit that reports no incidents at all may be concealing them.

The findings feed into the compliance risk assessment and are tested through the compliance monitoring programme. Some supervisors and firms use behavioural methods, observing meetings and decision making to see how challenge is received. Internal audit increasingly reviews culture, and boards receive dashboards that combine these measures, often through the board risk committee.

Investigations into major failures have identified recurring warning signs. These include dominant leaders who discourage challenge, sales targets pursued without regard to customer outcomes, star performers exempted from rules, compliance staff excluded from decisions or overruled without explanation, repeated minor breaches left unaddressed, and a habit of doing the minimum the letter of a rule requires. The mis-selling of payment protection insurance in the United Kingdom, the manipulation of interest rate benchmarks and the opening of unauthorised customer accounts at a large United States bank have all been attributed in official reports partly to culture.

Under the three lines model, a healthy culture places responsibility for compliance with the business itself, the first line, and not with the compliance department alone.

Changing culture is slow. Effective programmes align the firm's stated purpose and risk appetite with its targets, recruit and promote with conduct in mind, train staff through realistic scenarios instead of rule recitation, and publicise internally how breaches were dealt with. Senior leaders are expected to engage visibly and to respond constructively to bad news.

Sceptics note that culture is hard to define and measure, and that the term can be used to spread blame so widely that no individual is held responsible. Others warn that surveys and dashboards can become a formality. Even so, enforcement outcomes increasingly turn on it: authorities take a firm's culture into account in regulatory enforcement decisions, both when setting penalties and when deciding whether to require independent monitors or wider remediation. The daily work of the compliance officer is far more effective where the surrounding culture supports it, and conduct-related aspects are organised through the conduct risk framework.