The Regulatory Environment and the Compliance Function
Domain 2 tests the regulatory institutions and their powers, and how the compliance function is mandated, structured and held accountable.
Regulators and their toolkit
Supervisory authorities typically combine authorisation, rule-making, supervision, investigation and enforcement. Sanctions include public censure, financial penalties, prohibitions on individuals, restitution and referral for criminal prosecution. In the UK the FCA has three operational objectives - consumer protection, market integrity and competition - while the PRA handles prudential regulation of banks and insurers. The FCA can require a skilled person report under section 166 FSMA when it wants independent verification. In the EU, ESMA, EBA and EIOPA coordinate national competent authorities; in the US, the SEC and CFTC regulate markets while FINRA operates as a self-regulatory organisation for broker-dealers.
The compliance function
The function exists to help the governing body identify, assess, mitigate and monitor regulatory risk. Its activities are advisory, monitoring, training, policy-setting and regulatory liaison. Independence is structural as well as cultural: a reporting line to the board or a board committee, direct access to the chair, a documented charter, adequate resources and unrestricted access to records. In the UK Senior Managers and Certification Regime, SMF16 is the compliance oversight function and SMF17 is the money laundering reporting officer; both are senior manager functions in most firms and carry prescribed responsibilities.
Three lines of defence
The first line is the business, which owns the risk and the controls. The second line is compliance and risk, which sets frameworks, advises and provides oversight and challenge. The third line is internal audit, which gives independent assurance to the board. Compliance does not own conduct risk, and internal audit does not sit inside compliance.
Worked example
Compliance monitoring finds that advisers are sending clients product emails without the required review. The business line owns the failed control; compliance tests and reports; internal audit may later review the control environment. The head of compliance escalates to the board committee and assesses whether regulatory notification is required. The fix is procedural change, training and re-testing - not a memo.
Traps that cost marks
Saying compliance owns conduct risk; confusing SMF16 with SMF17; treating internal audit as part of compliance; overlooking ongoing fitness and propriety; forgetting a regulator's power to commission a section 166 report.