Guidelines and Policies
Guidelines and Policies
The Guidelines and Policies domain covers the non-binding guidance issued by regulators and the internal policies that firms adopt to operationalise compliance. The exam tests whether you can distinguish guidance from law, interpret supervisory expectations, and design policies that are followed in practice.
Core concepts
- Regulatory guidance: statements of expectation, best practice, or interpretation. Guidance is not legally binding, but regulators may expect firms to explain any departure.
- Supervisory policies: how the regulator prioritises inspections, risk assessments, and enforcement. These shape practical outcomes even without rule status.
- Internal policies: firm-specific procedures for anti-money laundering, best execution, business continuity, and personal dealing. Policies must be approved, communicated, and updated.
- Compliance programme: governance, risk assessment, monitoring, training, and remediation. A policy that is not monitored is a red flag.
- Reliance: courts and regulators may treat a firm's own policies as standards it must meet.
Worked example
A regulator issues a guideline recommending two-factor authentication for client login. A firm decides not to implement it because the guideline is not a rule. A data breach occurs. Reasoning: the firm has not broken a specific rule, but the regulator may criticise the firm for ignoring a known risk and for failing to maintain adequate systems and controls. The firm's own security policy may also be used as evidence of what it considered adequate. The safer approach is to document why the guideline was not adopted and what alternative controls were used.
Traps
- Dismissing guidance as irrelevant because it is not binding.
- Writing policies that are not implemented or reviewed.
- Treating internal policies as optional; they can create legal exposure.
- Ignoring supervisory priorities when allocating compliance resources.