A 'Green' Compliance Rating at a Firm Expanding Into Dubai and Singapore
Meridian Capital Partners is a UK FCA-authorised investment firm with 420 staff and £6.1bn AUM. In 18 months it opened offices in Dubai (DIFC) and Singapore, which now generate 55% of revenue. The compliance team has six people; the head of compliance is also MLRO and sits on the risk committee. The annual monitoring plan was copied from a previous employer's template by a junior analyst and devotes 70% of reviews to the UK retail desk. Two experienced compliance staff left and one was replaced by a six-month contractor. The board pack records compliance as 'green' because no reportable breaches occurred. An outsourced internal audit finds the plan is not risk-based, has no coverage of Dubai or Singapore, and that training completion is 61%. The CEO describes compliance as a 'support function' and proposes a 15% budget cut. The board asks you, as the newly appointed compliance director, to respond.
1. Explain why the board's 'green' rating is misleading and identify the principal compliance weaknesses this scenario reveals.
Read the worked answer
The 'green' rating measures the absence of reportable breaches, not the effectiveness of the compliance function, so it is a lagging and incomplete indicator. The weaknesses are: governance, because combining head of compliance, MLRO and risk committee membership concentrates authority and reduces challenge; risk assessment, because the monitoring plan is template-driven and allocates coverage by legacy rather than by risk, leaving the fastest-growing cross-border business unreviewed; resourcing and competence, because two departures and a contractor leave gaps and 61% training completion suggests weak control awareness; independence and culture, because the CEO's 'support function' label and proposed cut create pressure to under-invest; and assurance, because internal audit found gaps that the second line should have identified itself. A proper board report should combine risk-based monitoring results, key risk indicators such as training completion and overdue reviews, and forward-looking risk, not just breach counts.
2. Set out the actions you would take in the first 90 days, and explain how you would protect the compliance function's independence and escalate the resourcing issue.
Read the worked answer
In the first 90 days I would perform a risk assessment covering products, clients, jurisdictions and processes, and rebuild the monitoring plan around the highest inherent risks, including Dubai and Singapore. I would establish a regulatory inventory and map obligations to controls for each jurisdiction, fill the MLRO gap or separate the roles, and secure interim experienced resource. I would report to the board in writing with a clear amber or red assessment and a costed resourcing plan, and meet the CEO and chair to explain that independence is a regulatory expectation and that a budget cut without a risk assessment would itself be a governance risk. To protect independence, I would seek a direct reporting line to the board or audit committee, documented terms of reference and a right of access. I would not accept responsibility without the resources or authority to escalate; if the board refuses, I would record my dissent and consider whether the role remains viable. Escalation should be factual, quantified and tied to regulatory obligations.
3. How should the firm treat the internal audit findings and the CEO's budget proposal? Consider the respective roles of the board, the compliance function and internal audit.
Read the worked answer
Internal audit is a third-line function and its findings should be accepted as a trigger for action, not negotiated away. The board should require a management response with owners and dates and track it through the audit committee. The compliance function should not own the audit findings alone; the business should own remediation. On the budget, the board should ask for a risk-based cost-benefit analysis: what controls would be reduced, what risks would rise and what the regulatory consequences could be. The CEO's proposal should be tested against the firm's risk appetite and the FCA's expectation that compliance is adequately resourced. If the board approves a cut, the compliance director should document the advice given and consider whether the firm can still meet its regulatory obligations. The chair and non-executives have a key role in challenging both the CEO and the compliance report.