Regulation and Compliance
Regulation and Compliance tests your grasp of the regulatory architecture, the core obligation regimes and how a compliance function operates day to day. Expect questions on who regulates what, which obligations attach to which activity, and what a firm must do when something goes wrong.
Core concepts the exam tests
- Regulatory style. Rules-based regimes prescribe specific conduct; outcomes-based regimes state the result to be achieved and leave method to the firm. Most modern regimes blend both, with principles sitting above detailed rules.
- Authorisation and supervision. Firms must hold permission for each regulated activity, meet threshold conditions and notify changes in control. Supervision ranges from ongoing reporting to thematic review and enforcement.
- Recurring obligation families. Market abuse (insider dealing, unlawful disclosure, manipulation); anti-money laundering and terrorist financing (risk-based customer due diligence, enhanced checks for politically exposed persons, suspicious activity reporting to the financial intelligence unit via a nominated officer); conduct of business (suitability, disclosure, best execution, product governance); data protection.
- The compliance function. Second line of defence: owns the compliance risk assessment, monitoring plan, policies, training, advice and regulatory relationships. The first line owns its risks; internal audit provides independent assurance.
- Breach management. Contain, assess impact and clients affected, remediate, record, notify where required, and fix root cause. Self-reporting and cooperation normally mitigate penalty.
Worked example
A firm discovers that transaction reports submitted to the regulator for a quarter were missing a client identifier. Reasoning: accurate and timely reporting is a direct legal obligation, not an administrative task, so this is a regulatory breach. Steps: correct and resubmit the reports, notify the regulator promptly with scope and remediation, check the full history for the same defect, document root cause (a mapping error in the reporting system), assign ownership to the accountable senior manager, and add a control plus monitoring test. Concealing the error is far more serious than the error itself.
Traps that cost marks
- Treating compliance as solely the second line's job; accountability stays with the business.
- Assuming delegation to a vendor or overseas team removes the firm's obligation.
- Confusing a breach with a complaint - many breaches generate no complaint at all.
- Forgetting record-keeping: undocumented monitoring is treated as not done.