Compliance, Legal and Conduct Risk
Compliance risk
Compliance risk is the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a firm may suffer as a result of its failure to comply with laws, regulations, rules, self-regulatory standards and codes of conduct. The compliance function advises, monitors, trains and challenges; it should be independent of the business lines it oversees and have direct access to the board or a board committee.
Legal risk
Legal risk covers unenforceable contracts, litigation, disputes and regulatory action. It is generally treated within operational risk but managed with distinct legal expertise and provisioning judgement.
Conduct risk
Conduct risk is the risk that the firm's behaviour produces unfair customer outcomes or harms market integrity - mis-selling, unsuitable advice, poor product design, conflicts of interest, market abuse, mishandled complaints, and incentive structures that reward the wrong behaviour. It is foreseeable and manageable, not simply bad intent.
Traps
- Treating compliance as the owner of compliance risk - the first line owns it; compliance provides framework and challenge.
- Equating conduct risk with deliberate fraud.
- Assuming legal risk and compliance risk are interchangeable.
- Ignoring incentive design as a conduct driver.
- Believing a regulatory breach with no fine carries no risk consequence - remediation cost and reputational damage count.
Rule of thumb: measure conduct through outcomes, not policies - complaints per thousand accounts, upheld complaint rates, remediation volumes, breach counts and incentive-plan risk reviews. If an incentive pays for volume, expect conduct questions to follow.