Building the compliance function that keeps you licensed

What a real CCO actually does

• Owns the compliance manual and updates it when rules change.
• Runs the annual compliance program review (required under 206(4)-7).
• Approves or escalates conflicts, gifts, and personal trades.
• Manages the relationship with regulators during exams.
• Signs off on marketing materials before they go out.

At a small firm, the CCO may also be the COO or general counsel. The SEC dislikes "part-time" CCOs stretched too thin, and has said so in exam findings.

The compliance monitoring plan

A compliance monitoring plan (CMP) is the calendar and checklist that turns rules into recurring, evidenced tasks. It answers one question for every obligation: who checks this, how often, and where is the proof?

Think of it as mapping each rule to a control.

| Rule / obligation | Control | Frequency | Owner |

|---|---|---|---|

| Best execution (getting clients the best available terms) | Sample and review trades vs benchmark prices | Quarterly | Trading desk + CCO |

| Marketing Rule (SEC Rule 206(4)-1) | Pre-approve all client-facing materials | Every use | Compliance |

| Personal account dealing | Review employee trade reports | Monthly | CCO |

| Client suitability | Review new accounts vs mandate | On onboarding | Advisers |

The point is not the table. It is that a regulator can ask "show me your best execution reviews for Q2" and you produce twelve signed samples, not a shrug.

The FCA publishes practical expectations for monitoring in its handbook. See the FCA's guidance on the compliance function for the formal UK standard.

The breach register

A breach is any failure to comply with a rule, a client mandate, or an internal policy. A breach register is the log where every one gets recorded, investigated, and closed out.

Breaches split into two types:

• Active breach: caused by an action, for example buying a stock the client mandate prohibits.
• Passive breach: caused by market movement, for example a position drifting above a 5% concentration limit because the stock rallied.

Concrete example. A fund mandate caps any single holding at 10% of the portfolio. Tesla rallies and the position hits 11%. That is a passive breach. The register records: date detected, cause, client impact, remediation (trim to under 10% within the mandate's cure period), and sign-off.

Why regulators obsess over this: the register proves the firm *finds* its own problems. A clean register with zero entries is a red flag, not a gold star. It usually means the firm is not looking.

The 72-hour instinct

Many regimes require prompt notification of material breaches. Under UCITS and AIFMD, certain limit breaches must be reported to the national regulator. Under the FCA's Principle 11, firms must disclose anything the regulator "would reasonably expect notice of." Timelines vary, so the CCO's job is to know which breaches trigger which clock.

🎬 [VIDEO: "What Does a Compliance Officer Do?" - youtube.com - a plain-English walkthrough of the compliance role in financial firms]

Surveillance and the technology layer

Modern monitoring is automated. Firms run trade surveillance systems that flag suspicious patterns: front-running (trading ahead of a client order), wash trades, or off-market prices.

A simple mandate check looks like this in practice:

This is not exotic. It is a nightly job. The regulatory value is that the check runs automatically and logs its output, so the evidence trail is machine-generated, not reconstructed after the fact.

The regulator exam

Sooner or later, a regulator inspects you. In the US the SEC's Division of Examinations runs periodic exams. In the EU, national competent authorities (for example BaFin in Germany, the AMF in France) do the same. The FCA runs supervisory reviews in the UK.

Exams follow a rhythm:

1. Document request. The regulator sends a list, often 50+ items: compliance manual, breach register, trade blotters, marketing materials, employee trade reports, the CMP.

2. On-site or remote review. Examiners interview the CCO and staff.

3. Findings. Delivered as a deficiency letter listing problems.

4. Response. The firm must remediate and reply, usually within 30 days.

The SEC publishes annual examination priorities flagging what it will focus on. In recent years these have included the Marketing Rule, fee calculations, and use of AI in advice. Reading them each year is free intelligence about where the pressure is coming.

What examiners actually catch

• Manual says one thing, practice does another (the opening story).
• Fees charged do not match the disclosed schedule.
• Marketing claims performance without required disclosures.
• No evidence the annual review actually happened.

Notice the pattern: almost every finding is a *documentation and evidence* failure, not a case of a firm being ignorant of the law.

From enforcement to culture

Enforcement is the sharp end. When compliance fails badly, the SEC, FCA, or an EU authority can impose fines, force disgorgement (returning ill-gotten profits), bar individuals, or revoke registration. The US FINRA (Financial Industry Regulatory Authority, the self-regulatory body for broker-dealers) can expel firms from the industry.

But the goal of the machinery is not to survive one exam. It is a culture of compliance, a phrase regulators use deliberately. It means compliance is embedded in how the front office works, not bolted on afterward.

Practical signs of a healthy culture:

• Portfolio managers call compliance *before* doing something questionable, not after.
• The CCO reports to the board or a senior committee, not buried under the head of sales.
• Compensation does not punish people for flagging problems.

A firm where compliance is seen as the "business prevention department" will eventually generate the breach that ends it.

Building it from scratch: minimum viable compliance

If you were standing up a new manager tomorrow, the irreducible core is:

1. A designated, qualified CCO with real authority.

2. A written compliance manual mapped to your actual activities.

3. A compliance monitoring plan with dated, owned controls.

4. A breach register that people actually use.

5. Annual review with documented evidence it occurred.

Everything else is elaboration on these five.

Key Takeaways

• The rule is not the risk; the missing evidence is. Nearly all enforcement findings are failures to document or prove compliance, not ignorance of the law.
• The CCO is a named, personally accountable role under SEC Rule 206(4)-7, EU UCITS/AIFMD, and UK SMCR. Regulators can and do pursue CCOs individually.
• A breach register with zero entries is a warning sign, not a success. It signals the firm is not looking for its own problems.
• The compliance monitoring plan converts abstract rules into dated, owned, evidenced tasks so that any exam request produces a paper trail instantly.
• Read the SEC examination priorities each year. They tell you exactly where the next wave of scrutiny is aimed, for free.