The Annual Compliance Report: What the Board Should Expect

Is an Annual Compliance Report Required?

It depends on the firm. For MiFID investment firms, the compliance function is required to report to the management body at least once a year on the implementation and effectiveness of the firm’s control environment, the risks identified, complaints handling and the remedial action taken or planned. For other firms, the FCA’s rules in SYSC 6.1 require a compliance function that monitors and assesses the firm’s arrangements and advises the people responsible, but do not prescribe an annual report in the same terms.

In practice, almost every well-run regulated firm produces one. The board needs a formal, periodic account of compliance risk to discharge its own responsibilities, and the SMF16 needs a record that they told the board what it needed to know. Quarterly reporting covers the detail; the annual report steps back and looks at the year as a whole. Our guide what is SMF16? explains the function behind the report.

How It Differs From the Other Annual Reports

The board of a typical retail firm receives three annual reports with overlapping content. They should be consistent, but they are not the same thing.

Where one person holds SMF16 and SMF17, the compliance and MLRO reports are sometimes combined. That works if both parts are complete; the MLRO section must still stand on its own. Our guide to Consumer Duty and the SMF framework explains how the Duty’s reporting sits alongside compliance.

What the Report Should Contain

A strong annual compliance report is short enough for the board to read properly and specific enough to act on. It usually covers:

1. Executive summary. The compliance officer’s overall view of the framework’s effectiveness, the top risks and the decisions the board needs to make. One page.
2. The year in review. Significant changes to the business, permissions, products and regulation, and how the function responded.
3. Monitoring results. What the compliance monitoring plan covered, what it found, how findings were graded, and the status of actions. Include what was planned but not done, and why.
4. Breaches and notifications. The breaches recorded, root causes, those notified to the FCA under SUP 15, and themes across the year.
5. Complaints. Volumes, themes, root cause analysis, Financial Ombudsman outcomes and what changed as a result.
6. Regulatory relationship. Contact with the FCA, information requests, supervisory feedback and any outstanding commitments.
7. Regulatory change. What changed in the year, what is coming, and the firm’s readiness.
8. Training and culture. Conduct rules and compliance training completion, and any concerns about culture or behaviour.
9. Resourcing. Whether the compliance function has the people, skills and systems it needs, and what the compliance officer recommends.
10. The plan for next year. The proposed monitoring plan and priorities, for the board to approve.

Our compliance monitoring plan template gives a structure for the monitoring section, and what the board should see from the monitoring plan explains how to present results.

Common Weaknesses

Questions the Board Should Ask

• What is your overall view of the effectiveness of our compliance arrangements, and what is it based on?
• Which findings worry you most, and why?
• Which actions from last year are still open, and what is stopping them?
• What did the monitoring plan not cover this year, and is that a risk?
• Do you have the resources you need? If not, what would you add?
• What is the FCA likely to focus on for firms like ours next year?
• Is there anything you have not been able to tell us, or have been discouraged from raising?

The board should record its discussion and the decisions it takes. Under the duty of responsibility, minutes that show challenge and action are part of the evidence that Senior Managers took reasonable steps.

Who Should Write It, and When

The SMF16 owns the report, even where parts are drafted by the team or a consultant. It should be the compliance officer’s own view, presented to the board in person, with time for discussion. Many firms align it with their financial year or with the Consumer Duty board report cycle, so the board sees a consistent picture.

A fractional compliance officer should produce the same report as a full-time one. If they cannot find the days to do it properly, that is itself a sign the arrangement needs reviewing. Our guides to fractional compliance officers and sizing the compliance team cover that decision.

A New Compliance Officer’s First Report

A compliance officer who joins part-way through the year should not simply sign off their predecessor’s work. The first report should say what they have reviewed, what they have not yet been able to test, and what they plan to do about it. It is a natural point to reset the monitoring plan. Our guide to the first 90 days for a new compliance officer covers what to look at first.

Frequently Asked Questions

Is an annual compliance report mandatory?

For MiFID investment firms, the compliance function must report to the management body at least annually. For other firms it is not prescribed in the same terms, but it is standard good practice and helps evidence that the board and the SMF16 took reasonable steps.

Who writes the annual compliance report?

The compliance officer holding SMF16. Parts may be drafted by the team, but the overall view must be theirs.

Can the compliance and MLRO reports be combined?

Yes, where one person holds both functions, provided the MLRO section is complete in its own right.

Is the annual compliance report the same as the Consumer Duty board report?

No. The Consumer Duty report assesses whether the firm is delivering good outcomes for retail customers. The compliance report covers the whole compliance framework. They should be consistent with each other.