Compliance Monitoring Programme

A compliance monitoring programme is the structured schedule of checks that a regulated firm's compliance function carries out to establish whether the firm's activities comply with applicable laws, regulations and internal policies, and whether the controls meant to secure compliance are working. It sets out what will be reviewed, how, how often and by whom, normally over a twelve-month period.

The programme is the main means by which the second line in the three lines model gives assurance to senior management and the board. It should not be confused with transaction monitoring, which is the automated screening of customer activity for signs of financial crime; that system is one of many controls a monitoring programme may test. In the European Union and the United Kingdom, rules made under MiFID II expressly require investment firms' compliance functions to establish a risk-based monitoring programme covering all areas of their services, and comparable expectations apply across banking, payments and insurance.

The starting point is the firm's inventory of regulatory obligations and its compliance risk assessment, which rates each area by the likelihood and impact of a breach. Higher-risk areas are reviewed more often and in greater depth. A typical programme draws on several inputs: the risk assessment, past breaches and complaints, internal audit and regulatory findings, changes in the business such as new products or markets, and new rules identified through regulatory horizon scanning.

The resulting plan lists each review with its scope, method, frequency, owner and timing. It is approved by senior management or a board committee, and it is expected to change during the year as risks emerge. Regulators look for evidence that the plan is proportionate to the firm's size and complexity and that the compliance function has the staff and skills to deliver it.

Programmes combine different techniques:

• Continuous monitoring. Key indicators and exception reports are reviewed on a regular cycle, for example breaches of limits, overdue customer reviews or complaint volumes.
• Sample testing. Files or transactions are selected and checked against requirements; see compliance testing and regulatory compliance testing.
• Thematic reviews. A topic, such as suitability of advice or the handling of vulnerable customers, is examined in depth across the firm.
• Desk-based reviews. Policies, procedures, registers and management information are checked for completeness and accuracy, including items such as the conflicts of interest register.
• On-site visits and interviews. Reviewers observe processes and speak to staff, particularly at branches, agents and outsourced providers.
• Surveillance. Communications and trading are monitored for market abuse and other misconduct.

Monitoring tests both design, whether a control would work if operated as intended, and operating effectiveness, whether it has in fact been operated.

The content depends on the business. For a payment institution or bank, the financial crime sections will cover customer due diligence, sanctions screening, the tuning and output of transaction monitoring, and suspicious activity reporting, often in coordination with the money laundering reporting officer. Conduct sections may cover financial promotions, sales practices, complaints handling, product governance and the treatment of client money. Other common areas are data protection, outsourcing, regulatory reporting, staff training and personal account dealing. The firm's own compliance manual is the reference against which practice is compared.

Each review produces a report with findings graded by seriousness, a root cause analysis and agreed actions with owners and deadlines. The compliance function tracks actions to completion and retests where necessary. Significant issues may require regulatory breach reporting to the supervisor and a formal regulatory remediation plan.

Results are summarised for senior management and the board, usually quarterly, and in an annual compliance report. Governance bodies such as the board audit committee or a risk and compliance committee review progress against the plan, overdue actions and recurring themes. The compliance officer must be able to report directly to the board where necessary.

Monitoring by compliance is distinct from the checks that business units perform on their own work, which are first-line controls, and from internal audit, which is the third line and reviews the compliance function itself. Coordination between the three avoids duplication and gaps. In anti-money laundering, many jurisdictions additionally require a periodic independent AML review.

Supervisory reviews repeatedly find the same shortcomings. Plans are not linked to a current risk assessment, or cover low-risk areas in detail while leaving high-risk ones untested. Reviews are postponed for lack of resources. Sample sizes are too small to support conclusions. Findings are recorded but actions are closed without evidence. Compliance staff carry out operational tasks and then test their own work, compromising independence. Reports to the board present activity counts and not conclusions about risk.

Technology is changing the practice. Data analytics allow whole populations of transactions to be tested instead of samples, and automated controls can be monitored continuously. These tools increase coverage but depend on data quality and still require judgement in interpreting results. A programme is most useful where the firm's compliance culture treats findings as information to act on, not as criticism to be contested.