CISI Global Financial Compliance cheat sheet

Regulatory architecture tiers: statute (e.g. FSMA 2000, UK) → regulator rulebooks (FCA Handbook) → guidance and supervisory expectations; only the first two are legally binding.

IOSCO Objectives and Principles of Securities Regulation rest on three aims: protecting investors, ensuring markets are fair, efficient and transparent, and reducing systemic risk.

Extraterritorial reach examples: US FCPA applies to foreign firms with US nexus (issuer, US territory act, or US dollar clearing); EU GDPR Article 3 covers non-EU firms offering goods/services to EU data subjects.

FSB/BCBS/Basel standards are not directly enforceable; they bind only once transposed into national law or rulebooks (e.g. CRR/CRD in the EU).

Mutual recognition vs equivalence: equivalence is a unilateral third-country assessment by one regulator; mutual recognition is a reciprocal treaty-based arrangement.

FATF Recommendations are soft law; jurisdiction risk ratings (grey/black lists) drive enhanced due diligence and can trigger national countermeasures.

Wolfsberg, IOSCO and Basel guidance are industry/standard-setter material: persuasive in supervisory dialogue, not a source of private rights of action.

Regulatory perimeter decisions (what needs authorisation) turn on activities and instruments, not on the firm's name or legal form; unauthorised activity is a criminal offence in most regimes.

Three lines model: business (owns risk), risk/compliance (oversight and challenge), internal audit (independent assurance); compliance must not own first-line decisions.

Proportionality is applied through the firm's categorisation (e.g. FCA fixed portfolio vs flexible portfolio fees; PRA category for SM&CR) which sets intensity of supervision.

Senior Manager & Certification Regime (UK): Senior Managers hold prescribed responsibilities with Statements of Responsibilities; Certification staff need annual fitness and propriety re-certification.

Compliance officer independence requires: direct reporting line to the board or a board committee, separate remuneration from revenue lines, and unrestricted access to records.

Principles-based vs rules-based regimes: principles require judgement and evidence of outcomes; rules give certainty but invite 'letter not spirit' arbitrage.

Regulatory reporting obligations typically include annual reports, breach notifications, change-in-control and passporting notifications, each with its own deadline.

A compliance monitoring plan is risk-based: scope, frequency and depth derive from an annual risk assessment, not from a fixed cycle for all areas.

Regulators expect documented policies, procedures and controls (the 'three P' evidence chain) and records retained for the applicable limitation period, often five years.

Money laundering stages: placement, layering, integration; suspicious activity reporting is triggered by knowledge or suspicion, not by proof of an offence.

CDD elements: identify the customer, verify identity, identify beneficial owners (typically >25% ownership or control), establish purpose and intended nature of the relationship.

PEPs and high-risk relationships require enhanced due diligence: source of funds, source of wealth, senior management sign-off and more frequent review.

Market abuse forms: insider dealing, unlawful disclosure of inside information, market manipulation (including benchmark manipulation) and attempted abuse.

Inside information test: precise, not generally available, and if made public would likely significantly affect the price of the financial instrument or related derivatives.

Suspicious transaction/order reports (STORs) protect the firm from tipping off; disclosure to the customer that a report was made is a criminal offence in many regimes.

Sanctions screening is strict-liability in most regimes: a match must be blocked or frozen and reported to the competent authority regardless of intent.

Market soundings require the discloser to obtain consent, assess whether the recipient is 'inside' and keep records; recipients must apply wall-crossing controls.

Suitability requires a client-specific assessment of knowledge, experience, financial situation and objectives; a risk-tolerance score alone is not sufficient evidence.

Appropriateness (execution-only) tests knowledge and experience only and is required for complex products; it is not a substitute for suitability.

Inducements test: a payment or benefit must enhance the service, not impair compliance with the duty to act in the client's best interests, and must be disclosed.

Product governance: manufacturers define a target market and review it; distributors must ensure the product reaches that target market and report sales outside it.

Client categorisation (eligible counterparty, professional, retail) determines the protections available; opt-up to professional requires a documented, warned election.

Costs and charges disclosure must be aggregated and shown as a percentage or cash amount before and after sale, with an illustration of cumulative effect.

Financial promotions must be fair, clear and not misleading; a promotion to retail clients requires a risk warning and balanced presentation of benefits and risks.

Best execution is judged on price, cost, speed, likelihood of execution and settlement, and must be evidenced by an execution policy and monitoring.

Risk assessment formula: risk = likelihood × impact; residual risk = inherent risk minus the effect of controls, and controls must be evidenced to be credited.

Breach versus error: a breach is a failure to comply with a rule or standard; an error is an operational mistake that may or may not breach a rule.

Breach management cycle: identify, log, assess root cause and impact, remediate, notify the regulator where required, and report to the board.

Notification thresholds depend on the regime (e.g. FCA requires notification of a breach that is material, including any breach of a rule that is significant); materiality criteria must be documented in advance.

Root cause analysis should distinguish control design failure from control operating failure; remediation must address both the specific event and the population of similar exposures.

Compliance risk appetite is expressed as a statement plus tolerances and metrics; breaches of tolerance trigger escalation, not automatic regulatory notification.

Key risk indicators (e.g. overdue KYC reviews, complaints upheld rate, training completion) are leading indicators; loss events are lagging indicators.

Lessons-learned and thematic reviews should feed back into the annual risk assessment and the compliance monitoring plan, closing the loop.