Governance, Compliance, and Risk Management
Domain overview
This domain tests governance and compliance architecture for crypto businesses: board oversight, risk appetite, the three lines of defence, policies, monitoring, outsourcing, and audit. The exam expects practical controls, not slogans, and asks who is accountable when a protocol, DAO, or exchange fails.
Core concepts
- Board and senior management: approve the risk appetite, appoint accountable executives, and receive regular compliance and risk reporting.
- Three lines of defence: business owns risk; compliance and risk monitor; internal audit provides independent assurance.
- Compliance programme: risk assessment, policies, training, monitoring, surveillance, recordkeeping, whistleblowing, and remediation tracking.
- Third-party and model risk: due diligence on custodians, wallet-screening vendors, and smart-contract auditors; change control and exit plans.
Worked example
A DAO launches a lending protocol with tokenholder voting but no legal entity. A bug drains funds. The exam answer should identify the gap: token voting is not a control environment. The operator or foundation needs a board-level owner, risk assessment, independent smart-contract audit, multi-signature treasury controls, incident-response plan, and clear legal wrappers. A code audit alone is not a governance answer.
Traps that cost marks
Confusing a code audit with a compliance programme. Having no named accountable person. Ignoring vendor and outsourcing risk. Treating DAO votes as sufficient board oversight. Keeping policies without monitoring or remediation evidence.