Professional Ethics and Compliance cheat sheet

Core ethical duties: act with integrity, skill, care and diligence; deal with regulators cooperatively; treat customers fairly; manage conflicts of interest honestly.

Ethical decision test: would you be comfortable if the decision were published, and does it comply with both the letter and the spirit of the rules?

Conflicts of interest: identify, then avoid, decline, disclose, or manage with controls such as information barriers, separate reporting lines and independent oversight.

Independence is compromised when a relationship or interest (financial, personal, employment) would influence professional judgement; threats are self-interest, self-review, advocacy, familiarity and intimidation.

Confidentiality duty persists after the professional relationship ends; permitted disclosures are those required by law, court order, regulator or with client consent.

Whistleblowing: internal escalation first where safe; protected disclosure regimes typically require a reasonable belief of wrongdoing and a qualifying recipient.

Fit and proper criteria usually combine honesty and integrity, competence and capability, and financial soundness.

Gifts and hospitality: record, apply a monetary threshold, obtain pre-approval above it, and never accept anything that could reasonably create a sense of obligation.

Professional scepticism means questioning information and evidence rather than accepting it at face value; it is required even where no fraud indicator exists.

Three lines model: first line owns and manages risk; second line provides independent compliance and risk oversight; third line is internal audit reporting to the governing body.

Risk-based compliance: likelihood multiplied by impact ranks risks; scarce monitoring resources go to the highest residual risk after controls.

Regulatory principles are usually outcome-based and sit above detailed rules; complying with a rule does not cure a breach of an underlying principle.

Senior manager regimes attach prescribed responsibilities to named individuals; reasonable steps defences require documented evidence of oversight and challenge.

Regulators' typical supervisory toolkit: information requests, thematic reviews, skilled-person reports, remediation programmes, fines, restrictions and public censure.

Market abuse concepts: insider dealing, unlawful disclosure of inside information, and market manipulation; controls include insider lists, dealing restrictions and surveillance.

Financial crime controls: customer due diligence, beneficial ownership identification, enhanced due diligence for higher-risk cases, ongoing monitoring and suspicious activity reporting.

Record-keeping: retain records that evidence decisions, advice, conflicts management and training for the period set by the applicable regime.

Change management: regulatory impact assessment before launching products, outsourcing or new technology, with sign-off by compliance and risk.

Conduct risk is the risk that business behaviour harms customers, markets or the firm; it is managed through incentives, governance, monitoring and consequences.

Culture indicators include complaints root causes, breach and near-miss trends, escalation quality, staff survey results, attrition and remuneration outcomes.

Incentive design rule: performance metrics must not reward volume or revenue in a way that conflicts with fair treatment of customers or risk limits.

Tone from the top is only credible if reinforced by tone from the middle: line managers translate stated values into daily decisions and challenge.

Speak-up effectiveness requires at least three elements: accessible channels, protection from retaliation, and visible follow-up on outcomes.

Treating customers fairly outcomes typically cover product design, clear communication, suitable advice, service quality and no post-sale barriers.

Near-miss and error reporting is a leading indicator; suppressing bad news is a lagging warning sign of a weak conduct culture.

Remuneration: deferral, malus and clawback align reward with longer-term risk and allow recovery of pay after misconduct or losses.

Governing body duties: set strategy and risk appetite, approve and oversee its implementation, challenge management, and ensure the compliance function has authority, resources and independence.

Risk appetite statement translates strategy into quantified tolerances and limits; breaches must be escalated and remediated on a defined timeline.

Three-year strategic plan should link business goals to regulatory obligations, conduct metrics and capability investment.

Board information quality test: is it timely, forward-looking, complete enough to challenge, and supported by both risk and compliance data?

Compliance function independence indicators: direct reporting line to the governing body, separate budget, unrestricted access to records, and no revenue targets.

Leadership accountability: delegated authority must be documented; delegation transfers tasks, not ultimate responsibility.

Strategy execution requires cascaded objectives, clear ownership, and monitoring with defined key risk and performance indicators.

Scenario and stress testing connects strategy to resilience: test the plan against regulatory change, conduct failure, cyber incident and market shock.