What Is Compliance Monitoring?

Compliance monitoring is the systematic, ongoing review of a firm’s activities to check that they comply with regulatory requirements and the firm’s own policies, and that the controls designed to keep it compliant are working. It answers three questions:

• Are we doing what we say we do? Do day-to-day activities follow the firm’s policies and procedures?
• Do our controls work? Are the checks and safeguards operating effectively in practice, not just on paper?
• Are customers getting good outcomes? Particularly since the Consumer Duty, are the firm’s products, services and communications delivering the outcomes the rules require?

Monitoring is different from advice. The compliance function advises the business on what the rules require and how to meet them; monitoring then tests whether the business has done so. Most compliance functions do both, and the balance between them is one of the main decisions in designing the function.

It is also different from a one-off review. Compliance monitoring is a programme: a plan covering the whole year, built from a risk assessment, carried out in a structured way, and reported regularly to senior management and the board.

What the Rules Require

There is no single rule headed “compliance monitoring”, but the obligation runs through the FCA Handbook and related legislation.

The common thread is proportionality. A small advice firm isn’t expected to run the monitoring programme of a bank, but it is expected to have a plan, carry it out, record what it finds and act on it. The FCA’s Consumer Duty pages make clear that monitoring customer outcomes is now a central expectation for retail firms. Our guide to the Duty of Responsibility explains why effective monitoring matters personally to the compliance officer.

Where Monitoring Sits: The Three Lines

Most firms organise their controls around three lines. Compliance monitoring is a second-line activity, and it works best when everyone is clear where its role starts and stops.

In smaller firms, the lines blur. A compliance officer may do first-line file checks as well as second-line monitoring, and there may be no internal audit function at all. That is acceptable if it is proportionate and recognised, but the firm should be honest about the limits of independence when the same person designs, operates and tests a control.

Monitoring, QA and audit: what’s the difference?

First-line QA checks individual cases as part of the process, often before or shortly after the event. Second-line compliance monitoring looks across the business at whether the framework of controls is working, often thematically. Internal audit assesses the effectiveness of governance, risk management and controls as a whole, including whether the compliance function is doing its job. A good monitoring programme uses first-line QA results as evidence, but doesn’t simply repeat them.

Building a Risk-Based Compliance Monitoring Programme

The FCA expects monitoring to be risk-based: effort should go where the risk of harm or breach is greatest, not spread evenly across everything. Building the programme follows a consistent sequence.

• Define the compliance universe. List the firm’s regulated activities, products, customer types, distribution channels and the regulatory obligations that attach to each.
• Assess the risk in each area. Consider the inherent risk (likelihood and impact of non-compliance or customer harm), the strength of the controls, and evidence such as complaints, breaches, previous findings, audit results and regulatory focus.
• Prioritise. Rank the areas by residual risk. High-risk areas are reviewed more often and in more depth.
• Set frequency and scope. Decide how often each area is reviewed (for example quarterly, half-yearly, annually or on a rolling cycle) and what each review covers.
• Plan the resource. Estimate the days each review needs and compare the total with the people available. If they don’t match, either add resource or make explicit, documented choices about what won’t be covered.
• Get the plan approved. The board or its risk or audit committee should approve the plan, usually annually, and see any material changes during the year.
• Keep it live. Revisit the plan when the business changes, new rules arrive, or monitoring finds problems that suggest wider risk.

The plan itself, and what the board should expect to see in it, is covered in our guide to the compliance monitoring plan.

What to Monitor: Typical Areas by Firm Type

Every firm’s universe is different, but some areas appear in almost every programme, and each sector has its own priorities.

Cross-cutting areas usually include complaints handling, financial promotions, the treatment of vulnerable customers, record keeping, training and competence, conflicts of interest, outsourcing oversight and regulatory reporting. Financial crime monitoring may sit within the compliance programme or with the MLRO; either way it needs to be covered (see below).

How to Test: Monitoring Methods

A good programme uses a mix of methods, chosen for what each review needs to establish.

Sampling

Most reviews test a sample rather than every case. The sample should be large enough to support a conclusion and chosen in a way that reflects the risk: random samples for a general view, targeted samples for higher-risk cases (new advisers, complex products, vulnerable customers, large values). Record how the sample was chosen and why, because the robustness of the conclusion depends on it. Where data allows, analytics across the whole population is increasingly used to target samples more intelligently.

Findings, Ratings and Actions

Monitoring is only useful if what it finds leads to change. Each review should produce a short report with clear findings, a rating, agreed actions, owners and deadlines.

Three disciplines separate effective programmes from weak ones:

Some findings will need more than an action plan. Where monitoring identifies a breach, the firm must consider whether it needs to notify the FCA, and where customers have suffered harm, whether redress is due. Those decisions should be documented, with the compliance officer’s advice recorded.

Reporting Compliance Monitoring to the Board

The board needs a clear, honest picture, not a list of every test performed. Good compliance monitoring reporting typically includes:

• progress against the approved plan, with reasons for any slippage;
• key findings and their ratings, focusing on what matters most;
• themes across reviews, such as a recurring weakness in record keeping;
• the status of open actions, especially overdue high-rated ones;
• Consumer Duty outcome data and what it shows; and
• any resource constraints that mean the plan can’t be delivered as approved.

For MiFID investment firms, reporting to the management body must happen at least annually; most firms report quarterly, with a fuller annual compliance report. Our guide to what the board should see from its SMF16 goes into board reporting in detail, and the annual MLRO report is its financial crime equivalent.

Monitoring Consumer Duty Outcomes

The Consumer Duty changed compliance monitoring for retail firms. Instead of testing only whether processes were followed, firms must now evidence whether customers are getting good outcomes across products and services, price and value, consumer understanding, and consumer support, and whether any groups of customers, including those with characteristics of vulnerability, are getting worse outcomes than others.

In practice that means more data-led monitoring: outcome measures such as product performance, complaint and cancellation rates, arrears outcomes, call handling times and comprehension testing, broken down by customer group. Compliance monitoring increasingly works alongside the first line’s outcome MI, testing whether it’s reliable and challenging what it shows. Our Consumer Duty guide for Senior Managers covers the outcomes and accountability in more depth.

Financial Crime Monitoring

Financial crime controls need monitoring too: customer due diligence quality, screening, transaction monitoring alert handling, suspicious activity reporting and sanctions. At some firms this sits in the compliance monitoring plan; at others the MLRO runs a separate financial crime assurance programme. What matters is that it’s covered and that the two programmes don’t leave gaps between them. Our guides to transaction monitoring, customer due diligence and the business-wide risk assessment describe the controls that financial crime monitoring tests.

An Annual Compliance Monitoring Cycle

Technology and Monitoring

Monitoring tools have improved significantly. Case management and workflow systems track reviews and actions; analytics tools test whole populations; call analytics and speech recognition flag interactions for review; and dashboards bring outcome MI together. Technology makes monitoring more efficient and better targeted, but it doesn’t replace judgement. Someone still has to decide what the data means, whether a finding is serious, and what the business should do about it.

Resourcing: In-House, Outsourced or Fractional

How a firm resources compliance monitoring depends on its size and risk.

Outsourcing the testing doesn’t outsource the responsibility. The compliance officer and the board remain accountable for the programme and its conclusions, as our guide to what you can and can’t outsource explains. For sizing a part-time arrangement, see how many days a fractional compliance officer needs.

Who Runs Compliance Monitoring

At the top sits the compliance officer, approved as SMF16 at most firms, who is accountable for the compliance function and therefore for the monitoring programme. At larger firms, a head of compliance monitoring or compliance assurance runs the programme day to day, with monitoring managers and analysts beneath them.

The skills that make a strong monitoring professional are distinct from advisory compliance work:

When we recruit compliance officers, we test monitoring experience specifically, because it’s the part of the role the regulator looks at most closely when things go wrong. Our pages on compliance officer recruitment (SMF16), combined compliance officer and MLRO recruitment and part-time compliance officers explain how we find people with genuine monitoring depth, and our guide to the experience that matters by firm type covers sector differences.

Common Weaknesses Regulators Find

Getting Started: A Practical Checklist

• Map your obligations by activity, product and channel.
• Assess risk using complaints, breaches, MI, audit findings and regulatory priorities.
• Draft a plan with frequency, scope and estimated days for each review.
• Check resource against the plan and close any gap honestly.
• Agree templates for review reports, ratings and action tracking.
• Get board approval and agree how often you’ll report.
• Deliver, report and re-test, then refresh the plan as the business changes.

Frequently Asked Questions

Is compliance monitoring a regulatory requirement?

Yes, in substance. SYSC requires adequate arrangements to ensure compliance, MiFID investment firms must run a risk-based monitoring programme, and the Consumer Duty requires retail firms to monitor customer outcomes. The scale should be proportionate to the firm.

Who is responsible for compliance monitoring?

The compliance officer, usually approved as SMF16, is accountable for the compliance function and its monitoring. The board approves the plan and oversees the results.

How often should compliance monitoring be done?

Continuously, through a plan that reviews higher-risk areas more often. Many firms review their highest-risk areas quarterly and lower-risk areas annually or on a rolling cycle.

What is the difference between a compliance monitoring plan and a compliance monitoring programme?

The plan is the schedule of reviews for the year. The programme is the whole activity: risk assessment, plan, testing, reporting, actions and validation.

Can compliance monitoring be outsourced?

The testing can be, but accountability can’t. The compliance officer and board remain responsible for the programme and its conclusions.

What qualifications should a compliance monitoring manager have?

Relevant sector experience matters most, alongside a structured approach to testing and strong report writing. Professional qualifications such as those from the ICA or CISI are common and useful.