Compliance Monitoring for Investment Firms: What to Test and How Often
A compliance monitoring plan for a discretionary manager, wealth manager or advice firm should look very different from one for a payments firm or a broker. The risks sit in suitability, best execution, client categorisation, inducements, market abuse, Consumer Duty and the accuracy of what clients are told about costs. This post sets out the areas that matter for investment firms, a worked annual plan for a mid-sized wealth manager, how to risk-rate and adjust it, and what the board should see.
The Starting Point
SYSC 6.1 requires a firm to have a permanent and effective compliance function that monitors, and regularly assesses, the adequacy and effectiveness of its measures for complying with its regulatory obligations. For investment firms, the compliance monitoring programme is how the compliance officer (SMF16) evidences that. If you need the basics first, read compliance monitoring explained and our compliance monitoring plan template. The rest of this post stays on what is specific to investment firms.
The Risk Areas Specific to Investment Firms
The list below covers the areas most investment firms will need to consider. Not all will apply: an advice-only firm that does not hold client money has no CASS testing, and a firm that does not deal on its own account has a lighter market abuse profile. Advisory firms outside MiFID, such as many Article 3 exempt firms, test suitability against COBS 9 rather than COBS 9A.
- Suitability (COBS 9A) and appropriateness (COBS 10A): know your client information, risk profiling, capacity for loss, suitability reports, periodic suitability assessments, and the appropriateness test and warnings for execution-only business in complex products.
- Best execution (COBS 11.2A): the execution policy, monitoring of execution quality, broker and venue reviews, order handling, aggregation and allocation.
- Client categorisation (COBS 3): particularly elective professional clients, where the qualitative and quantitative tests and written warnings must be evidenced.
- Inducements and research (COBS 2.3A and COBS 2.3B): gifts and hospitality, minor non-monetary benefits, and how research is paid for.
- Conflicts of interest (SYSC 10): the conflicts register, in-house fund use, remuneration incentives and outside interests.
- Market abuse surveillance: systems to detect and report suspicious orders and transactions under Article 16 of UK MAR, insider lists and handling of inside information. The FCA’s market abuse pages set out its expectations.
- Personal account dealing (COBS 11.7): pre-clearance, restricted lists, declarations and post-trade checks.
- Financial promotions (COBS 4): sign-off, website and social media content, performance presentation and risk warnings. See financial promotions and the compliance officer’s role.
- Consumer Duty outcomes and fair value (PRIN 2A): outcomes testing, value assessments for your services and charges, consumer understanding, support and treatment of vulnerable clients. The FCA’s Consumer Duty hub links to its rules and findings.
- Client reporting and costs and charges disclosure: ex-ante and ex-post costs and charges, periodic statements and, for portfolio management, depreciation reporting to clients.
- CASS, if applicable: client money and custody assets, reconciliations, acknowledgement letters, the CASS resolution pack and the client money and asset return. See CASS client money oversight explained.
- Record keeping and recording of communications (COBS 11.8): capture of relevant phone calls and electronic communications, including mobile devices and messaging apps, and retrieval within required timescales.
- MIFIDPRU regulatory reporting: accuracy and timeliness of prudential returns, consistent with the ICARA. See our ICARA and IFPR guide for boards and FCA regulatory reporting explained.
Anti-money laundering and sanctions controls are usually tested by or for the MLRO under a separate financial crime programme. Make sure the two plans don’t leave gaps or duplicate work.
A Worked Annual Plan for a Mid-Sized Wealth Manager
The table below is an illustrative example, not a template to adopt as it stands. It assumes a firm offering discretionary portfolio management and advice to private clients, holding client money and custody assets, with a team of investment managers and advisers dealing mainly in listed securities and funds. Frequencies and samples are starting points: yours should follow your own risk assessment, size and findings.
| Area | Risk rating | Frequency | Test method | Typical sample |
|---|---|---|---|---|
| Suitability: advised business | High | Quarterly | File review of fact-find, risk profile, capacity for loss, rationale and suitability report | 10 to 15 files, weighted to new clients and larger investments |
| Suitability: discretionary mandates | High | Quarterly | Data comparison of each portfolio’s risk and asset allocation against the agreed mandate, then outlier review; check periodic suitability assessments | Whole book screened by data, 10 outliers reviewed in depth |
| Appropriateness and execution-only | Medium | Half-yearly | Check appropriateness assessments and warnings for complex products | 10 transactions |
| Client categorisation | Medium | Annual, plus every new opt-up | Evidence of qualitative and quantitative tests and written warnings for elective professionals | All opt-ups in the period, or 20 if more |
| Best execution | Medium | Quarterly MI review, annual deep dive | Review execution monitoring, broker reviews, aggregation and allocation, timeliness of orders | 30 trades across asset classes and brokers |
| Inducements and research | Medium | Annual | Gifts and hospitality register against expenses; research payment arrangements | Full register, 10 expense claims |
| Conflicts of interest | Medium | Annual, plus on business change | Register currency; test controls on selected conflicts such as in-house funds and remuneration | Register plus 3 conflicts in depth |
| Market abuse surveillance | Medium | Quarterly | Review alert disposition, escalation and suspicious transaction and order report decisions; insider lists | 20 closed alerts |
| Personal account dealing | Medium | Quarterly | Match pre-clearances to trade confirmations; annual staff attestations | 10 staff, all attestations |
| Financial promotions | Medium | Monthly sign-off check, half-yearly review | Approval log against live promotions, website and social media | 10 promotions plus a website review |
| Consumer Duty outcomes and fair value | High | Quarterly MI, annual board report | Outcomes data, complaints themes, value assessment review, communications testing, vulnerable client files | Outcome MI plus 10 vulnerable client files |
| Costs and charges and client reporting | Medium | Annual after ex-post statements, half-yearly statement check | Reconcile disclosed costs to actual charges; check statements and depreciation notifications | 15 clients |
| CASS | High | Monthly oversight, annual review before the CASS audit | Review reconciliations and breaks, acknowledgement letters, resolution pack and returns | 3 months of reconciliations, all open breaks |
| Recording of communications | Medium | Half-yearly | Confirm capture across channels and devices; retrieval test | 10 random communications |
| MIFIDPRU reporting | Medium | Quarterly | Reconcile a return to the ledger and the ICARA; check submission dates | 1 return per quarter |
A plan of this shape gives the board a programme that is weighted to the firm’s highest risks, uses data where it can, and still includes file-level testing where judgement matters most. For guidance on the documents around it, see the plan template.
How to Risk-Rate and Adjust the Plan
Rate each area on inherent risk and on the strength of controls, then set frequency and sample size from the result. Inputs for an investment firm should include:
- Business model and change: new products, a new platform, a new investment proposition, or growth in a client segment.
- Client base: the proportion of retail clients, older or vulnerable clients, and clients with complex needs.
- Previous findings: areas with recent adverse findings should be retested sooner and with larger samples.
- Complaints and breaches: themes in complaints, errors and breaches are often the earliest signal.
- Regulatory focus: the FCA’s portfolio letters for your sector, published findings and changes in rules.
- Other assurance: internal audit, the CASS auditor and external reviews, so you don’t test the same thing twice.
Review the plan at least quarterly. Increase frequency or sample sizes where findings appear, and record the reasons for any change, including tests you defer. A plan that never changes during the year is a warning sign.
Illustrative scenario: Quarterly testing at a wealth manager finds several discretionary portfolios running above the risk level agreed with the client, with no record of a conversation. The compliance officer raises suitability testing from quarterly outlier review to a monthly data check for two quarters, adds a test of the investment committee’s mandate breach process, and reports the root cause and remediation to the risk committee. Once two consecutive months are clean, the frequency returns to quarterly.
Reporting to the Board and Committees
The board or the risk and compliance committee should receive a quarterly report covering progress against the plan, findings rated by severity, overdue actions with owners and dates, themes across reviews, changes to the plan with reasons, and the compliance officer’s view of the overall control environment. Consumer Duty outcomes testing should feed the annual board report on the Duty. Our guide to what the board should see covers the format and level of detail in more depth.
Non-executives should challenge the plan as well as the results: are the highest risks tested often enough, are samples large enough to mean something, and are actions closed on time? See also the Consumer Duty guide for senior managers.
Resourcing: In-House or Outsourced?
A larger investment firm will usually have an in-house compliance team running the plan, with specialist support for areas such as CASS, best execution analysis or market abuse surveillance. Smaller firms often combine a part-time or fractional compliance officer with outsourced testing. The test is whether the person holding SMF16 understands and owns the plan and its findings, whoever does the fieldwork.
Outsourcing the testing does not outsource the responsibility. Our guides to fractional or full-time compliance officers and what you can and can’t outsource cover the options.
Hiring a Compliance Officer for an Investment Firm
A compliance officer at an investment firm needs more than general compliance experience. Look for:
- Direct experience of investment business: discretionary management, advice or both, ideally at a firm of similar size and client mix.
- File review skill: the ability to judge a suitability file or a discretionary mandate breach, not just check that documents exist.
- Technical knowledge: COBS conduct rules, best execution, inducements, client categorisation and, where relevant, CASS and MIFIDPRU.
- Data confidence: comfort using portfolio and trade data to target testing.
- Board presence: the ability to report findings clearly and hold a line when the business pushes back.
Useful interview questions include: how would you build a monitoring plan for our business in your first 90 days; how would you test whether discretionary portfolios match client mandates; what would you look for in a best execution review; and how would you evidence fair value for our charging structure? See our compliance officer recruitment (SMF16) service, SMF recruitment for investment managers and the experience that matters for your type of firm.
The Bottom Line
An investment firm’s monitoring plan should be built around its own risks: suitability, best execution, categorisation, inducements, market abuse, Consumer Duty, client reporting and, where relevant, CASS. Rate each area, set frequencies and samples from that rating, adjust through the year as findings emerge, and report clearly to the board. If you need the compliance officer to run it, tell us about your hire.
Investment Firm Compliance
The people who run compliance at investment and wealth firms. Every SMF Capital search is overseen by Adrian Lawrence FCA
Compliance Officers
SMF16 for investment firms.
→ Compliance officer (SMF16) → Outsourced compliance officerCompliance monitoring explained →
Investment Managers
Senior managers for asset managers.
→ Investment manager SMFs → RDR-qualified senior managersICARA and IFPR guide →
Wealth Management
Compliance for wealth firms.
→ Wealth management SMFs → Fractional or full-time?Consumer Duty guide →
Monitoring
Plans, templates and reporting.
→ Monitoring plan template → CASS oversight explainedWhat the board should see →
Every SMF Capital search is overseen by Adrian Lawrence FCA
Frequently Asked Questions
How often should an investment firm test suitability?
For most firms giving advice or managing discretionary portfolios, suitability is a high-risk area tested at least quarterly. Smaller firms may test less often if findings are consistently clean and the rationale is recorded.
Does compliance monitoring have to cover CASS?
Only if the firm holds client money or custody assets. Where it does, CASS is usually rated high risk and monitored alongside the annual CASS audit.
Which rules require a compliance monitoring programme?
SYSC 6.1 requires a permanent and effective compliance function that monitors and regularly assesses the firm’s compliance measures. The monitoring programme is how that is evidenced.
Should AML be in the compliance monitoring plan?
It can be, but at many firms the MLRO runs a separate financial crime testing programme. Either way, make sure the two plans are coordinated.
Can the monitoring be outsourced?
The testing can be, but the SMF16 remains responsible for the plan, the findings and the follow-up.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He oversees every SMF Capital search. View Adrian’s ICAEW profile.
Need a Compliance Officer Who Knows Investment Business?
Tell us about your firm, your permissions and your client base. We’ll come back with the profile you need and how we would approach the search.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.