The FCA has recently published some interesting findings from its review of compliance functions within corporate finance firms.
At first glance, this might seem like a relatively niche piece of FCA work, focused on corporate finance.
But I think there is a much broader lesson here for regulated firms of all sizes, particularly smaller firms that need to ensure their compliance arrangements are effective without creating unnecessary complexity.
Sometimes the biggest compliance challenges are caused by the basics not being properly embedded.
The FCA surveyed 411 corporate finance firms, receiving 382 responses. Most were relatively small businesses, with 64% employing nine people or fewer and 89% employing fewer than 50.
The FCA found that most firms were carrying out many of the key compliance activities it expected. However, there were significant gaps in some of the more fundamental practices that help make compliance part of the way a business actually operates.
Some of the most interesting statistics I found were as follows:
· 74 firms did not have oversight of their complaints process
· 82 firms did not have a breach register
· 82 firms did not have compliance attending management meetings.
· 82 firms were not reporting to management at least annually
· 63% of firms reported having a compliance function that is not dedicated solely to compliance activities and has other business responsibilities. This can create conflicts of interest, if for example the compliance function also plays a role in revenue generation.
· Perhaps most strikingly, only 47% of firms reported carrying out all of the activities covered by the FCA's survey.
The FCA's conclusion is particularly relevant:
Compliance cannot simply be seen as a series of tasks. It needs to form part of the culture of the business.
Consumer Duty makes this even more important
The quality of a firm's compliance framework can tell you a great deal about how seriously it takes its regulatory responsibilities.
Having policies and procedures in place is important, but they are only part of the picture. Without effective oversight, monitoring and governance, there is a risk that compliance becomes an exercise in documenting what a firm should be doing, rather than demonstrating what it actually does.
Consumer Duty brings this distinction into sharp focus.
Firms need to understand their customers, monitor outcomes, use meaningful management information, identify weaknesses and take appropriate action. They also need to be able to demonstrate how they have reached their conclusions.
These activities depend on having the right foundations in place. Consumer Duty is much harder to implement effectively when the underlying compliance framework is not working as it should.
Why the fundamentals matter
The FCA's findings are a useful reminder that effective compliance is not necessarily about having the most sophisticated compliance framework.
It is about having one that is appropriate, proportionate and actually works.
For smaller and growing regulated firms, that can mean getting the fundamentals right before trying to build something more complicated.
Do you know what your key compliance risks are?
Are they being monitored?
Are breaches and complaints being identified and acted upon?
Does management receive the information it needs?
Are policies actually reflected in the way the business operates?
Is compliance involved early enough to provide meaningful challenge?
And, importantly, can you demonstrate all of this if the FCA asks?
These are not particularly glamorous questions.
But they are the foundations of a good compliance function.
And getting those foundations right is often where the real value of compliance support begins.
Getting the basics right
This is one of the reasons I set up Danbury Compliance and one of the reasons we have created the Compliance Fundamentals Assurance review. Our Compliance Fundamentals Assurance review is designed to assess whether the fundamental building blocks of an effective compliance framework are in place, identify potential gaps and help firms understand where improvements may be needed.
Interestingly, two statistics from the review directly align with the content of our review:
· 67 firms reported that they did not have a compliance monitoring programme at all
· 38 firms had not regularly reviewed their Compliance policies and procedures
For many smaller and growing firms, the more useful question is:
"Do we have the right compliance foundations in place, and are they actually working?"
The question is straightforward, but being able to answer it confidently — and evidence that answer — is crucial
Compliance Fundamentals Assurance
Identifying gaps is an important first step. But compliance is not a one-off exercise.
Firms also need to maintain their arrangements, respond to regulatory change and ensure that emerging risks are identified and addressed. That is where ongoing compliance support can make a difference.
External compliance support can work
Interestingly, the FCA found that 90% of the firms surveyed used some form of third-party compliance support.
That isn't surprising.
Smaller firms often don't need, or can't justify, a full-time in-house compliance team.
But they still need access to appropriate expertise, challenge and oversight.
The important point is that outsourcing compliance doesn't mean outsourcing responsibility. The FCA is clear that senior management remains responsible for regulatory compliance and that firms need to maintain active oversight of third-party support.
That is where an ongoing compliance relationship can be particularly valuable.
Rather than bringing in a consultant only when something goes wrong, firms can have access to experienced compliance support on an ongoing basis — helping them keep on top of the fundamentals, identify emerging issues and deal with regulatory change.
This is why we created the Compliance Retainer Services, which aim to provide firms with that ongoing, independent support.
Sometimes, compliance needs to go back to basics
Although the FCA's review focused on corporate finance firms, its findings raise questions that are relevant to regulated businesses in other sectors, including wealth management.
Effective compliance is not necessarily about having the most sophisticated framework. It is about having arrangements that are appropriate, proportionate and effective in practice.
Do you know whether your compliance framework is working as it should? Are the right controls in place, are risks being monitored, and can you demonstrate that your arrangements are effective?
Sometimes, the most valuable next step is not to introduce another policy or process. It is to take a step back and assess whether the foundations are right.
At Danbury Compliance, we help firms strengthen those foundations through our Compliance Fundamentals Assurance review and provide ongoing support through our Compliance Retainer Services.
If you would like to understand whether your compliance arrangements are fit for purpose, get in touch with Danbury Compliance to discuss how we can help.