I85PREP
⌘ K
Gibraltar Law (PCCGL) study materials
Gibraltar Law (PCCGL) study resources

Gibraltar Law (PCCGL) practice questions

One question at a time. Build your Gibraltar Law (PCCGL) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compliance and Governance Law

Under the Gibraltar regulatory framework for financial services, which body is the principal supervisor of firms authorised to carry on regulated activities in Gibraltar?

  1. The Gibraltar Regulatory Authority
  2. The Gibraltar Financial Services Commission Correct answer.
  3. The Prudential Regulation Authority
  4. The Financial Conduct Authority

Explanation

The Gibraltar Financial Services Commission (GFSC) is the statutory regulator for financial services in Gibraltar, licensing and supervising firms that carry on regulated activities under Gibraltar legislation. The Gibraltar Regulatory Authority handles different remits such as communications and data protection, while the FCA and PRA are UK bodies without supervisory jurisdiction over Gibraltar-authorised firms.

Question 2Compliance and Governance Law

A Gibraltar company wishes to describe itself as carrying on a regulated financial activity. What is the primary statutory consequence of doing so without the required authorisation?

  1. It commits an offence and its agreements may be unenforceable Correct answer.
  2. It only faces an administrative warning
  3. It may continue if it has a UK authorisation
  4. It must notify the GFSC within 28 days after starting

Explanation

Carrying on a regulated activity in Gibraltar without authorisation is a criminal offence, and contracts entered into in contravention may be unenforceable against the other party. Notification after the event does not cure the absence of a licence, and a UK permission does not substitute for Gibraltar authorisation.

Question 3Compliance and Governance Law

In Gibraltar's anti-money-laundering regime, which approach to customer due diligence is required before establishing a business relationship?

  1. Identification only when a transaction exceeds a fixed statutory amount
  2. Simplified due diligence for all retail customers
  3. Risk-based customer due diligence applied before the relationship is established Correct answer.
  4. Reliance on the customer's own self-certification

Explanation

Gibraltar's AML framework requires a risk-based approach, with customer due diligence completed before a business relationship is established and ongoing monitoring thereafter. Simplified measures are permitted only in lower-risk cases, and self-certification alone is not sufficient identification.

Question 4Compliance and Governance Law

Which function does a Gibraltar firm's money laundering reporting officer (MLRO) perform?

  1. Conducting the external audit of client accounts
  2. Receiving and assessing internal suspicious activity reports and deciding on external disclosure Correct answer.
  3. Approving the firm's annual financial statements
  4. Setting the firm's capital adequacy buffers

Explanation

The MLRO is the nominated officer who receives internal reports of suspected money laundering, evaluates them and decides whether a suspicious activity report should be made to the relevant authority. Financial reporting, capital setting and external audit are separate functions performed by other roles.

Question 5Compliance and Governance Law

A Gibraltar insurer is designing its governance arrangements. Which element is central to the requirement for sound and prudent management?

  1. Reliance solely on group-level governance in another jurisdiction
  2. Annual rotation of the entire board to ensure independence
  3. An effective board with appropriate fitness and propriety of directors and senior managers Correct answer.
  4. Delegation of all strategic decisions to an external consultant

Explanation

Gibraltar's regulatory approach requires firms to be soundly and prudently managed, which centres on an effective board whose directors and senior managers are fit and proper. Delegating strategy externally, forced rotation or relying solely on group governance would not satisfy that requirement.

Question 6Compliance and Governance Law

What is the principal purpose of Gibraltar's data protection legislation as applied to financial firms handling client information?

  1. To require all client data to be stored outside Gibraltar
  2. To permit unrestricted sharing of data with any third party
  3. To give individuals rights over their personal data and impose duties on controllers Correct answer.
  4. To replace AML record-keeping obligations

Explanation

Data protection law confers rights on individuals and places duties on controllers regarding lawful processing, security and transparency. It does not mandate offshore storage, permit unrestricted sharing, or displace AML record-keeping, which operates alongside it.

Question 7Compliance and Governance Law

A Gibraltar bank's board is reviewing its compliance with the requirement to have a compliance function. Which arrangement best reflects the expected standard?

  1. Assigning compliance to the external auditor
  2. A part-time role held by the head of sales
  3. Outsourcing compliance entirely with no internal oversight
  4. A permanent compliance function with sufficient resources and direct reporting to the board Correct answer.

Explanation

Regulatory expectations require an effective, adequately resourced compliance function that reports to and is overseen by the board. Placing compliance with sales creates conflicts, and full outsourcing without oversight or assigning it to the auditor would not provide the required independent control.

Question 8Compliance and Governance Law

Which statement best describes the Gibraltar Financial Services Commission's approach to enforcement when a firm breaches regulatory requirements?

  1. It must always withdraw authorisation for any breach
  2. It may use a range of sanctions proportionate to the breach, including public censure and financial penalties Correct answer.
  3. It refers all matters exclusively to the criminal courts
  4. It can only issue non-binding guidance

Explanation

The GFSC has a graduated enforcement toolkit, applying sanctions proportionate to the seriousness of the breach, which can include public statements and financial penalties. It is not limited to guidance, does not automatically withdraw authorisation, and handles many matters through its own regulatory processes rather than only criminal referral.

Question 9Compliance and Governance Law

A Gibraltar investment firm plans to outsource its IT infrastructure to a third-party provider. What is the firm's principal regulatory obligation regarding this arrangement?

  1. It remains accountable for the outsourced activity and must manage the associated risks Correct answer.
  2. It may transfer its regulatory responsibilities to the provider
  3. It must obtain client consent for each data transfer
  4. It no longer needs to monitor the provider once contracted

Explanation

Outsourcing does not transfer regulatory responsibility: the firm remains accountable and must conduct due diligence, contract appropriately and monitor the provider on an ongoing basis. Responsibility cannot be shifted to the provider, and ongoing monitoring continues after contracting.

Question 10Compliance and Governance Law

A Gibraltar firm's client presents funds from a jurisdiction identified as higher risk. How should the firm respond under a risk-based AML approach?

  1. Decline all business automatically regardless of circumstances
  2. Rely on the client's written assurance about source of funds
  3. Apply enhanced due diligence and senior management scrutiny proportionate to the risk Correct answer.
  4. Apply simplified measures because the client is new

Explanation

Higher-risk situations, including higher-risk jurisdictions, call for enhanced due diligence with additional measures and senior management involvement. Automatic refusal is not required by the risk-based approach, and simplified measures or reliance on assurances alone would be inappropriate.

Question 11Compliance and Governance Law

A director of a Gibraltar financial firm becomes aware of a material governance failure. Which course best reflects the duty to act with integrity and cooperate with the regulator?

  1. Escalate the matter internally and ensure it is disclosed to the regulator where required Correct answer.
  2. Keep the matter confidential to protect the firm's reputation
  3. Resign immediately without informing anyone
  4. Wait until the next scheduled regulatory inspection

Explanation

Directors must act with integrity and cooperate openly with the regulator, escalating material issues internally and disclosing them where required. Concealment, silent resignation or waiting for an inspection would breach those expectations.

Question 12Compliance and Governance Law

A Gibraltar payment services firm wants to record client calls to meet its compliance obligations. What must it consider under data protection principles?

  1. It must have a lawful basis, provide appropriate notice and retain recordings only as long as necessary Correct answer.
  2. It may record calls freely because compliance always overrides data protection
  3. It must obtain written consent from every caller in all cases
  4. It must delete recordings immediately after the call

Explanation

Recording calls requires a lawful basis, transparency to individuals and adherence to storage limitation, balancing compliance needs against data protection rights. Compliance objectives do not override data protection entirely, and neither blanket consent nor immediate deletion is a universal rule.

Question 13Compliance and Governance Law

A Gibraltar firm's compliance monitoring programme identifies a recurring control weakness. What is the most appropriate governance response?

  1. Suppress the finding to avoid regulatory attention
  2. Reassign the finding to the external auditor to resolve
  3. Remediate the weakness with clear ownership and report progress to the board or committee Correct answer.
  4. Close the finding once a memo is written

Explanation

Effective compliance governance requires remediation with clear ownership, tracking and escalation to the board or a board committee until resolved. Writing a memo, delegating resolution to the auditor or suppressing findings would leave the weakness unaddressed and undermine the control environment.

Question 14Compliance and Governance Law

A Gibraltar firm is appointing a new head of compliance. Which factor is most relevant to the regulator's fitness and propriety assessment?

  1. The candidate's membership of a particular professional body
  2. The candidate's length of service at the firm
  3. The candidate's honesty, competence, financial soundness and relevant experience Correct answer.
  4. The candidate's willingness to accept the lowest salary

Explanation

Fitness and propriety assessments consider honesty and integrity, competence and capability, financial soundness and relevant experience. Professional body membership, tenure or salary levels are not the determinants of the regulatory assessment.

Question 15Compliance and Governance Law

A Gibraltar firm discovers that a client relationship is being used for suspected terrorist financing. What is the appropriate immediate step under the AML/CFT regime?

  1. Make an internal report to the MLRO so a suspicious activity report can be considered Correct answer.
  2. Confront the client and ask for an explanation before any report
  3. Inform the client's other banks directly
  4. Terminate the relationship and destroy all records

Explanation

Suspicions of terrorist financing must be routed internally to the MLRO, who assesses whether to make an external suspicious activity report; tipping off the client is prohibited. Destroying records or notifying other institutions directly would breach the regime.

Question 16Compliance and Governance Law

A Gibraltar firm's board delegates risk oversight to a committee. Which condition is essential for this delegation to be consistent with good governance?

  1. Delegation of the board's ultimate accountability
  2. Removal of internal audit coverage of risk
  3. Permanent exclusion of the board from risk matters
  4. Clear terms of reference and reporting lines back to the board Correct answer.

Explanation

Delegation to a committee is consistent with good governance where terms of reference and reporting lines are clear and the board retains ultimate accountability. The board cannot delegate its accountability, exclude itself from risk matters, or remove audit coverage.

Question 17Compliance and Governance Law

A Gibraltar firm is preparing for a supervisory review of its AML controls. Which evidence most directly demonstrates an effective transaction monitoring system?

  1. A statement that no suspicious transactions have ever occurred
  2. Documented alert rules, tuning rationale and records of investigations and outcomes Correct answer.
  3. An annual training attendance list
  4. A copy of the AML policy signed by the chief executive

Explanation

An effective monitoring system is evidenced by documented rules, periodic tuning and testing, and records showing alerts were investigated and resolved. A policy document or training list supports the framework but does not show monitoring in operation, and an assertion of no suspicious activity is not evidence of effectiveness.

Question 18Compliance and Governance Law

A Gibraltar firm's compliance officer believes a proposed product launch may conflict with regulatory expectations. What is the most appropriate action?

  1. Ask the marketing team to assess the regulatory risk
  2. Raise the concern through governance so the board can decide with the regulatory risk documented Correct answer.
  3. Escalate only if the regulator later asks
  4. Approve the launch to avoid commercial delay

Explanation

Compliance concerns should be escalated through governance so the board decides with the regulatory risk fully documented and considered. Approving to avoid delay, waiting for the regulator to ask, or delegating regulatory assessment to marketing would undermine the control framework.

Question 19Compliance and Governance Law

A Gibraltar firm's internal audit reports that compliance monitoring is not independent of the business lines it reviews. Why is this a governance concern?

  1. Independence is optional where the firm is profitable
  2. Independence slows commercial decision-making
  3. Independence only matters for external audit
  4. Independence is essential for objective assurance over the control environment Correct answer.

Explanation

Independence is fundamental to the credibility and objectivity of assurance over the control environment; without it, findings may be compromised by commercial pressures. It is not confined to external audit, is not a mere drag on decisions, and is never optional.

Question 20Compliance and Governance Law

A Gibraltar firm uses a third-party cloud provider to store client records. Which arrangement best satisfies both outsourcing and data protection expectations?

  1. A written contract with security, audit and data-return obligations plus ongoing monitoring Correct answer.
  2. Reliance on the provider's assurance that it is compliant
  3. An informal agreement based on the provider's standard terms without review
  4. Transfer of all client records without any contractual safeguards

Explanation

Outsourcing to a cloud provider requires a formal contract addressing security, audit rights and data return, together with ongoing monitoring of the provider. Informal terms, unsafeguarded transfers or reliance on bare assurances would not satisfy outsourcing or data protection expectations.

Question 21Compliance and Governance Law

A Gibraltar firm's board is considering a transaction that would materially change its risk profile. How should the compliance function contribute?

  1. Provide an independent regulatory assessment to inform the board before the decision Correct answer.
  2. Vote on the transaction alongside executive directors
  3. Approve the transaction on the board's behalf
  4. Remain silent to preserve its independence

Explanation

Compliance adds value by providing an independent, documented regulatory assessment so the board can make an informed decision. It should not vote or approve transactions on the board's behalf, and silence does not preserve independence; it undermines the control framework.

Question 22Compliance and Governance Law

A Gibraltar firm identifies that its risk-based AML approach has become static and has not been recalibrated despite changes in its client base. What is the principal governance failing?

  1. Failure to publish its AML policy externally
  2. Failure to reduce its product range
  3. Failure to keep the risk assessment and related controls under ongoing review Correct answer.
  4. Failure to appoint enough front-office staff

Explanation

A risk-based approach requires the business-wide risk assessment and related controls to be kept under review and recalibrated as the client base and risks change. Staffing levels, external publication or product range are not the core governance failing described.

Question 23Compliance and Governance Law

A Gibraltar firm's senior manager wishes to rely on group policies drafted in another jurisdiction. What approach best satisfies local regulatory expectations?

  1. Reject all group policies as inherently unsuitable
  2. Adopt the group policies unchanged to ensure consistency
  3. Apply group policies only to non-client-facing staff
  4. Adapt the group policies to Gibraltar requirements and evidence local ownership and oversight Correct answer.

Explanation

Group policies may be used as a starting point but must be adapted to local requirements, with clear local ownership, oversight and evidence of application. Adopting them unchanged, rejecting them wholesale or applying them selectively would not meet local expectations.

Question 24Compliance and Governance Law

A Gibraltar firm's compliance function reports only to the head of trading. Why does this reporting line create a governance weakness?

  1. It removes the need for a compliance monitoring plan
  2. It compromises the independence and objectivity of the compliance function Correct answer.
  3. It satisfies the requirement for board oversight
  4. It improves the speed of commercial decisions

Explanation

Reporting solely to a business head compromises independence, since compliance must be able to challenge commercial activity objectively and escalate to the board. It does not satisfy board oversight, remove the need for monitoring, and faster decisions do not offset the loss of independence.

Question 25Compliance and Governance Law

A Gibraltar firm is assessing whether a proposed acquisition of a client book is consistent with its regulatory obligations. Which consideration is most directly relevant to the compliance assessment?

  1. Whether the deal can be completed before the year end
  2. Whether the acquisition will increase headline revenue
  3. Whether the seller's branding can be retained
  4. Whether the acquired clients and activities can be onboarded and supervised within the firm's control framework Correct answer.

Explanation

The compliance assessment should focus on whether the acquired clients and activities can be onboarded, risk-assessed and supervised within the firm's existing control framework. Revenue, branding or deal timing are commercial considerations that do not determine regulatory compatibility.

Question 26Compliance and Governance Law

Under Gibraltar's financial services framework, which body is the principal prudential and conduct regulator for firms authorised to carry on regulated activities in or from Gibraltar?

  1. The Gibraltar Financial Services Commission Correct answer.
  2. The Gibraltar Betting and Gaming Association
  3. The Gibraltar Chamber of Commerce
  4. The Financial Conduct Authority of the United Kingdom

Explanation

The Gibraltar Financial Services Commission (GFSC) is the statutory regulator established under Gibraltar law and is responsible for authorising and supervising financial services firms, including prudential and conduct oversight. The other bodies either represent commercial interests or regulate outside Gibraltar's jurisdiction.

Question 27Compliance and Governance Law

A Gibraltar firm's governing body is ultimately accountable for the firm's compliance with regulatory obligations. Which arrangement best reflects this principle of governance?

  1. The firm's parent company in another jurisdiction assumes the board's regulatory duties
  2. The external auditor assumes responsibility for the firm's regulatory reporting
  3. The board approves and periodically reviews the compliance framework and receives regular compliance reporting Correct answer.
  4. The head of compliance personally certifies every transaction the firm executes

Explanation

Governance principles place ultimate accountability for compliance with the governing body, which should approve the framework and oversee it through regular reporting. Operational execution is delegated, but accountability cannot be transferred to auditors, parents or individual officers.

Question 28Compliance and Governance Law

Which statement best describes the role of a Gibraltar firm's money laundering reporting officer (MLRO)?

  1. To receive and assess internal suspicious activity reports and make disclosures to the relevant authority Correct answer.
  2. To negotiate commercial terms with high-risk clients
  3. To approve the firm's annual financial statements before audit
  4. To represent the firm in civil litigation arising from client disputes

Explanation

The MLRO is the nominated officer responsible for receiving internal reports of suspected money laundering or terrorist financing, assessing them, and making external disclosures where appropriate. The role is a control function, not a commercial, accounting or litigation function.

Question 29Compliance and Governance Law

A Gibraltar firm maintains a compliance manual that has not been updated since a significant change in its business model. What is the principal governance concern?

  1. The manual was drafted by an external consultant rather than in-house
  2. The documented policies no longer reflect actual practice, weakening the control environment Correct answer.
  3. The manual is stored electronically rather than in hard copy
  4. The manual's length is insufficient for the firm's size

Explanation

Policies and procedures must remain current and aligned with the firm's actual activities; a stale manual creates a gap between documented controls and real practice. Length, authorship and storage format are not the governing concern.

Question 30Compliance and Governance Law

Which of the following best describes the purpose of a firm's compliance risk assessment?

  1. To set the interest rates offered to depositors
  2. To determine individual staff bonuses
  3. To calculate the firm's corporation tax liability
  4. To identify and rank the compliance risks arising from the firm's activities so that controls can be proportionate Correct answer.

Explanation

A compliance risk assessment identifies the risks inherent in the firm's business and prioritises controls and monitoring accordingly. It is a governance tool, not a tax, remuneration or pricing mechanism.

Question 31Compliance and Governance Law

A Gibraltar firm wants to demonstrate a healthy compliance culture. Which indicator most directly supports that claim?

  1. Staff at all levels feel able to raise concerns without fear of detriment and concerns are acted upon Correct answer.
  2. The compliance function reports exclusively to the sales director
  3. Compliance training is delivered only to the compliance department
  4. The firm has the lowest compliance headcount in its peer group

Explanation

A culture in which employees can escalate concerns and see them addressed is a recognised hallmark of an effective compliance culture. Low headcount, narrow training and compromised reporting lines point the other way.

Question 32Compliance and Governance Law

Which of the following is a core element of a Gibraltar firm's record-keeping obligations under its regulatory framework?

  1. Destroying records once the financial year closes
  2. Retaining records for the prescribed period and producing them promptly to the regulator on request Correct answer.
  3. Retaining records only while the client relationship remains open
  4. Storing records solely in the personal files of relationship managers

Explanation

Regulated firms must keep adequate records for the prescribed retention period and be able to produce them to the supervisor on request. Records cannot be discarded at will or held only informally by individuals.

Question 33Compliance and Governance Law

A Gibraltar firm's board is told that a senior manager has been delegated responsibility for a control function. What must accompany that delegation for it to be effective?

  1. Clear terms of reference, adequate resources and a defined reporting line back to the board Correct answer.
  2. Removal of the function from the firm's risk register
  3. A reduction in the firm's overall compliance budget
  4. A verbal understanding between the senior manager and the chief executive

Explanation

Effective delegation requires documented responsibilities, sufficient resources and a reporting line that keeps the board informed. Informal arrangements, resource cuts or removing oversight from the risk register undermine accountability.

Question 34Compliance and Governance Law

A Gibraltar firm's compliance monitoring plan should be primarily driven by which consideration?

  1. The order in which departments were established
  2. The availability of staff who happen to be on leave
  3. The risk profile of the firm's activities and the significance of the controls being tested Correct answer.
  4. The personal preferences of the front-office managers

Explanation

Risk-based monitoring directs effort to the areas of greatest compliance risk and to controls whose failure would matter most. Personal preference, staffing convenience and historical order are not legitimate drivers.

Question 35Compliance and Governance Law

A Gibraltar firm's compliance function is asked to review a marketing campaign that promises guaranteed returns to retail clients. What is the compliance function's most appropriate action?

  1. Approve the campaign because marketing is a commercial decision
  2. Defer the decision to the external auditor
  3. Advise that the material be amended because guaranteed-return claims are likely to mislead and breach conduct requirements Correct answer.
  4. Approve the campaign provided the claims appear in small print

Explanation

Financial promotions must be fair, clear and not misleading; promising guaranteed returns on investment products is likely to breach conduct requirements and mislead clients. Compliance should require amendment rather than approve the material.

Question 36Compliance and Governance Law

A Gibraltar firm discovers that a member of staff has been executing client orders ahead of the client's own instructions for personal gain. Which governance response is most appropriate?

  1. Take no action provided the client suffered no measurable loss
  2. Transfer the individual to a role with broader trading authority
  3. Escalate to the appropriate authorities and conduct an internal investigation covering controls and remediation Correct answer.
  4. Reprimand the individual informally and leave the control framework unchanged

Explanation

Front-running is a serious market conduct breach that requires escalation, investigation and remediation of the controls that allowed it. Absence of measurable loss, informal discipline or promotion does not address the misconduct.

Question 37Compliance and Governance Law

A Gibraltar firm is designing its complaints-handling process. Which feature best supports fair treatment of clients?

  1. Routing complaints directly to the relationship manager who is the subject of the complaint
  2. A policy of resolving complaints only when clients threaten legal action
  3. A documented procedure with defined timeframes, clear escalation and analysis of root causes Correct answer.
  4. Charging clients a fee for each complaint submitted

Explanation

Fair complaints handling requires a documented process, timely responses, independent escalation and root-cause analysis to prevent recurrence. Reactive, conflicted or punitive approaches undermine fair treatment.

Question 38Compliance and Governance Law

A Gibraltar firm is considering appointing a non-executive director to its board. Which contribution is most relevant to the firm's governance of compliance?

  1. Day-to-day management of the compliance monitoring plan
  2. Preparation of the firm's statutory accounts
  3. Execution of client orders during peak periods
  4. Independent challenge to executive assumptions and oversight of the compliance framework Correct answer.

Explanation

Non-executive directors contribute independent challenge and oversight, strengthening board governance of compliance. They do not take on executive or operational tasks such as running monitoring or executing orders.

Question 39Compliance and Governance Law

A Gibraltar firm's compliance officer identifies that a new regulation will require changes to client onboarding. What is the most effective way to manage the implementation?

  1. Delegate the whole implementation to a single junior staff member without oversight
  2. Announce the change to clients before assessing its operational impact
  3. Produce a gap analysis, assign owners and timelines, and report progress to the board or a committee Correct answer.
  4. Wait until the regulator inspects the firm before making changes

Explanation

Regulatory change is best managed through structured gap analysis, clear ownership, timelines and governance reporting. Passive waiting, unsupervised delegation or premature client communication creates avoidable risk.

Question 40Compliance and Governance Law

A Gibraltar firm's internal compliance training programme should be evaluated primarily on which basis?

  1. Whether attendance records are stored in paper form
  2. Whether the trainer is external rather than internal
  3. Whether the training module is the longest available
  4. Whether staff can demonstrate understanding of the risks relevant to their roles Correct answer.

Explanation

Training effectiveness is measured by whether employees understand and can apply the compliance requirements relevant to their work. Length, storage format and trainer origin are not measures of effectiveness.

Question 41Compliance and Governance Law

A Gibraltar firm is reviewing its conflicts of interest policy. Which measure best mitigates a conflict arising from a staff member overseeing a control over their own business unit?

  1. Separating the control function from the business unit and requiring independent escalation Correct answer.
  2. Removing the control from the firm's procedures
  3. Asking the staff member to self-certify that no conflict exists
  4. Increasing the staff member's authority over the business unit

Explanation

Structural separation and independent escalation are recognised mitigants for conflicts of interest. Self-certification, expanded authority or removing the control leave the conflict unmanaged.

Question 42Compliance and Governance Law

A Gibraltar firm outsources a material compliance activity to a service provider. Which governance arrangement best preserves the firm's accountability?

  1. Transfer of all regulatory responsibility to the provider
  2. A written agreement with service levels, audit rights and retained oversight by the firm Correct answer.
  3. A clause preventing the firm from contacting the provider's staff
  4. An oral agreement with no performance measures

Explanation

Outsourcing does not transfer regulatory responsibility; the firm must retain oversight through written agreements, service levels, audit rights and monitoring. Oral terms, responsibility transfer and communication bans all undermine control.

Question 43Compliance and Governance Law

A Gibraltar firm's board receives a compliance report showing that a key control has failed repeatedly. Which board response best reflects sound governance?

  1. Reassign the compliance officer who reported the failure
  2. Require a remediation plan with root-cause analysis and track its completion Correct answer.
  3. Remove the control from the risk register to reduce reported failures
  4. Note the report and take no further action

Explanation

Repeated control failures call for root-cause analysis and a tracked remediation plan overseen by the board. Inaction, concealment or penalising the reporter would compound the governance failure.

Question 44Compliance and Governance Law

Which statement best describes the relationship between a Gibraltar firm's risk appetite statement and its compliance controls?

  1. The risk appetite is set by the external auditor independently of the board
  2. The risk appetite sets tolerances that the compliance controls are designed to keep the firm within Correct answer.
  3. The risk appetite applies only to the finance department
  4. The risk appetite statement replaces the need for compliance controls

Explanation

A risk appetite statement expresses the level of risk the board is willing to accept, and compliance controls are calibrated to keep activity within those tolerances. It complements rather than replaces controls and is a board responsibility.

Question 45Compliance and Governance Law

A Gibraltar firm's compliance function is under pressure to reduce its independence to speed up business approvals. Which consequence is most directly associated with weakened independence?

  1. Conflicts of interest go unchallenged and regulatory breaches are more likely to go unreported Correct answer.
  2. The firm's marketing budget is reduced
  3. The firm's tax filings become overdue
  4. Client onboarding becomes slower

Explanation

Independence allows compliance to challenge business decisions objectively; weakening it increases the risk that conflicts and breaches go unchallenged. Budget, tax and onboarding speed are not the direct governance consequences.

Question 46Compliance and Governance Law

A Gibraltar firm's board is assessing whether its governance arrangements meet supervisory expectations. Which approach best evidences a robust self-assessment?

  1. Comparing the firm only with its closest competitor
  2. Benchmarking the framework against regulatory requirements, documenting gaps and evidencing remediation Correct answer.
  3. Relying solely on management assurances that all is well
  4. Commissioning a review but withholding the findings from the board

Explanation

A credible self-assessment benchmarks against the applicable requirements, documents gaps and demonstrates remediation with evidence. Assurances, peer comparison and suppressed findings do not provide robust assurance.

Question 47Compliance and Governance Law

A Gibraltar firm's compliance officer proposes to rely on a group-wide risk model developed for a different regulatory regime. What is the most defensible approach?

  1. Adopt the model but omit documentation to save time
  2. Reject all group tools as inherently unsuitable
  3. Map the model to Gibraltar requirements, test its assumptions and document any local adjustments Correct answer.
  4. Adopt the model unchanged because it is used elsewhere in the group

Explanation

Group tools can be used if they are mapped to local requirements, tested and adjusted with documented rationale. Uncritical adoption, blanket rejection or undocumented use all leave the firm unable to demonstrate compliance.

Question 48Compliance and Governance Law

A Gibraltar firm's senior management becomes aware of a suspected breach of regulatory requirements. Which sequence best reflects sound governance escalation?

  1. Delegate the decision to the client affected by the breach
  2. Assess the breach, notify the appropriate governance body and the regulator where required, and remediate Correct answer.
  3. Resolve the matter quietly to avoid reputational damage
  4. Wait for the next annual audit before recording the breach

Explanation

Breaches should be assessed promptly, escalated to the appropriate governance body and, where required, notified to the regulator, with remediation tracked. Delay, concealment or client-led decisions are inconsistent with governance obligations.

Question 49Compliance and Governance Law

A Gibraltar firm's board wants assurance that its compliance function has sufficient stature within the organisation. Which arrangement best provides that assurance?

  1. Reporting to the head of a revenue-generating division
  2. Rotation of the compliance head every quarter
  3. A charter that can be amended by any business unit head
  4. A direct reporting line to the board or a board committee, with a charter setting out authority and access Correct answer.

Explanation

Stature is supported by direct access to the board, a documented charter defining authority and resources, and independence from revenue lines. Revenue reporting, amendable charters and rapid rotation undermine the function's standing.

Question 50Compliance and Governance Law

Under Gibraltar's regulatory framework, which body holds ultimate responsibility for a firm's compliance and governance arrangements?

  1. The compliance officer alone
  2. The governing body of the firm Correct answer.
  3. The firm's largest client
  4. The external auditor

Explanation

Ultimate responsibility for compliance and governance sits with the firm's governing body, which must set strategy, oversee controls and ensure adequate resources. It may delegate execution to committees and senior managers but cannot delegate accountability.