Scaling a Digital Broker's Monitoring Plan Without Proportional Controls
A digital brokerage has grown from 2,000 to 14,000 clients in nine months. Its compliance monitoring plan still samples 10 trade tickets per month and one onboarding file per week, regardless of risk. In the last quarter, the surveillance system generated 6,800 alerts; 93% were closed as false positives by a single analyst who also handles client complaints. No alert was generated for trades above the firm's Rs 2.5 million enhanced-review threshold because that rule was never configured. The board receives a two-page summary showing 'alerts closed' but no risk metrics. The regulator has asked for the firm's monitoring plan and evidence of independent testing. The COO proposes hiring a second analyst but keeping the same sampling approach because 'the regulator only looks at whether a plan exists'.
1. Redesign the monitoring plan using a risk-based approach. Specify thresholds, sampling, alert triage and resource needs.
Read the worked answer
Start with a risk assessment by product, client, channel, transaction type and geography. The current uniform sampling is indefensible: 10 tickets and one onboarding file cannot cover 14,000 clients, and the unconfigured Rs 2.5m rule means the highest-risk trades are invisible. Build a rule set: all trades above Rs 2.5m, all cash-intensive or third-party funding, all high-risk jurisdiction links, all PEP or negative-news hits and all complaints linked to trading. Below those thresholds, use stratified random sampling weighted to risk, not a flat monthly number.
Triage alerts by risk score, not by whoever is available. A single analyst handling complaints and 6,800 alerts with 93% false positives indicates calibration failure; review rule thresholds monthly and document tuning. Add a second analyst or outsource level-one triage, but keep decision accountability in compliance. Require documented rationale for every closure, quality assurance of at least 10% of closures, and a monthly board dashboard showing alert volumes, true positives, ageing, breaches and testing results. Independent testing should be done by internal audit or an external reviewer, not by the analyst who closes the alerts.
2. How should the compliance officer respond to the COO's view that 'the regulator only looks at whether a plan exists', and what evidence should go to the board and regulator?
Read the worked answer
The COO's view is wrong and dangerous. A plan that exists but is not risk-based or operating effectively is a control failure; regulators increasingly ask for evidence of design, operation, testing and remediation. The compliance officer should not accept the second analyst as a complete fix if sampling remains unchanged. Respond in writing: acknowledge the resource request, show the gap analysis, propose a dated remediation plan and state the residual risk if it is not funded. Use specific data: 14,000 clients, 6,800 alerts, 93% false positives, one unconfigured threshold and a Rs 2.5m rule that missed all above-threshold trades. Ask the board to approve risk appetite, monitoring standards and resource.
Evidence pack: risk assessment, monitoring plan, rule configuration, alert samples and closures, quality assurance results, training records, complaint logs, issue log, independent testing report and board minutes. If the regulator requests the plan, provide the current plan plus the remediation plan and evidence of escalation. Do not misrepresent the current state. The compliance officer should also record the COO's statement and the compliance objection in the board pack so the governance trail is clear.