Compliance Risk
Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failing to comply with laws, regulations, and standards. The exam tests the compliance framework, risk assessment, monitoring and testing, regulatory change, conduct, and breach management.
Core rules and concepts
- Basel's Compliance and the Compliance Function in Banks (2005) expects an independent compliance function, board oversight, policies, training, and monitoring.
- Compliance risk assessment should be risk-based, covering products, jurisdictions, processes, and regulations; it drives monitoring and testing plans.
- Regulatory change management: identify, interpret, gap-assess, implement, train, and verify.
- Monitoring is ongoing; testing is independent and sample-based; issues need root-cause analysis, ownership, deadlines, and validation.
- Conduct risk covers conflicts of interest, market abuse, bribery, AML/KYC, sanctions, and data privacy; incentives can drive misconduct.
- Breach reporting should be timely, accurate, and escalated; remediation must address control design and culture.
Worked example
A bank receives a new AML rule requiring enhanced due diligence for high-risk customers. Compliance performs a gap assessment, updates policy and onboarding screens, trains front-line staff, and tests a sample of 50 files. Testing finds 12% lack source-of-wealth evidence. Compliance reports the issue to the board, sets a remediation deadline, and validates fixes. Compliance is a control cycle of assess, implement, monitor, test, and remediate, not legal advice only.
Traps that cost marks
Equating compliance with legal; counting training as a control without testing; one-off remediation without root cause; compliance monitoring not risk-based; treating conduct as HR only.