Building a compliance function that survives an audit

In 2012, JPMorgan lost more than $6 billion in the "London Whale" trading scandal. The trades were legal in isolation. What sank the bank in regulatory terms was that its control functions failed to catch, escalate, and document what was happening. Regulators fined the bank hundreds of millions, and the lesson stuck across the industry: compliance is not a memo, it is a machine. When an examiner arrives, they do not ask "are you compliant?" They ask "show me."

This lesson assembles that machine from its real parts.

The three lines of defence

Nearly every serious bank organizes control around the three lines of defence (3LoD) model. It is not a law. It is an operating structure regulators expect to see, formalized by bodies like the Basel Committee on Banking Supervision (the global standard-setter for bank regulation, based in Basel, Switzerland).

First line: the business. The traders, lenders, and relationship managers who take risk own it first. A loan officer checking a borrower's documents before approval is first-line control.

Second line: risk and compliance. Independent functions that set policy and monitor the first line. The compliance department that writes the anti-money-laundering (AML) rules and watches transaction alerts sits here.

Third line: internal audit. Independent assessors who check that lines one and two actually work. They report to the board's audit committee, not to management, so they can criticize freely.

The point of separation is simple: the people making money should not be the only people checking the money. When the FCA (Financial Conduct Authority, the UK's main conduct regulator) or the OCC (Office of the Comptroller of the Currency, a US federal bank regulator) inspects a bank, they trace an issue through all three lines to see where it should have been caught.

The Institute of Internal Auditors' Three Lines Model is the free reference document most banks build from.

What the machine must actually produce

A compliance function is judged on outputs, not intentions. Four outputs matter most.

1. Transaction reporting (MiFID II and beyond)

MiFID II (Markets in Financial Instruments Directive II) is the EU framework governing investment services, in force since January 2018. One of its heaviest demands is transaction reporting: banks must report the details of most trades in financial instruments to their national regulator by the end of the next working day (T+1).

Each report can carry dozens of fields: instrument identifier, price, quantity, buyer and seller identity (via a Legal Entity Identifier, or LEI, a 20-character global code identifying the parties), timestamps to the microsecond, and who made the trading decision.

Miss a field, report late, or report a phantom trade, and the fine follows. Regulators have penalized firms for reporting failures running into millions of transactions. The compliance machine here is a data pipelinedata pipelineETL (Extract, Transform, Load) is a data integration process that pulls data from sources, reshapes it into a consistent format, and writes it into a target system.View full definition →: capture the trade, enrich it with reference data, validate it, submit it, and reconcile what the regulator received against what you sent.

In the US, the equivalent muscle is the Consolidated Audit Trail (CAT), overseen by the SEC (Securities and Exchange Commission), which captures the lifecycle of orders across US equity and options markets.

2. Stress tests

Regulators no longer trust banks to say "we are safe." They make banks prove resilience under simulated disaster.

In the US, the Federal Reserve runs the annual CCAR (Comprehensive Capital Analysis and Review) and the DFAST (Dodd-Frank Act Stress Test) exercises. The Fed hands large banks a hypothetical severe recession (for example, sharp unemployment spikes and asset-price crashes) and the bank must model whether it survives with enough capital.

In Europe, the EBA (European Banking Authority) runs EU-wide stress tests, typically every two years, in coordination with the ECB (European Central Bank).

For the compliance and control function, the exam is not just "do we pass?" It is "can we defend every number?" The submitted models, assumptions, and data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → must be documented well enough that an examiner can reconstruct them.

3. AML and sanctions screening

Under the US Bank Secrecy Act (BSA) and its later amendments, plus EU Anti-Money-Laundering Directives, banks must know their customers (KYC, Know Your Customer), monitor transactions, and file Suspicious Activity Reports (SARs) when something looks like laundering or terrorist financing.

This is where banks get hit hardest. Enforcement actions over AML failures regularly reach into hundreds of millions and occasionally billions of dollars. The machine: onboarding checks, ongoing screening against sanctions lists (such as the US OFAC list, from the Office of Foreign Assets Control), alert investigation, and SAR filing with the financial intelligence unit (FinCEN in the US).

4. The audit trail

Everything above depends on one unglamorous asset: the audit trail. An audit trail is a tamper-resistant, time-stamped record of who did what, when, and why.

If a compliance officer overrode a transaction alert, the trail must show the decision, the reason, the approver, and the timestamp. Regulators like MiFID II Article 16 and record-keeping rules require firms to retain communications and decisions (often for five years, sometimes more) in a form they can reproduce on demand.

Here is the shape of a minimal alert-handling audit record:

{
  "alert_id": "AML-2026-084213",
  "customer_id": "CUST-559102",
  "trigger_rule": "structuring_below_10k",
  "raised_at": "2026-03-14T09:12:47Z",
  "reviewed_by": "compliance.analyst.42",
  "decision": "escalated_to_SAR",
  "rationale": "5 cash deposits of 9,800 over 3 days",
  "approved_by": "mlro.hicks",
  "closed_at": "2026-03-16T14:03:11Z"
}

Notice the record explains itself. An examiner reading it two years later can reconstruct the judgment without asking a single question. That is what "survives an audit" means in practice.

Wiring the parts into one operating machine

Individually these are obligations. Together they form a control cycle that runs continuously.

Policy to control. The second line translates each regulation into concrete controls. "MiFID II requires T+1 transaction reporting" becomes "automated pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → submits by 22:00, with a reconciliation check at 23:00 and an exception queue for failures."

Control to evidence. Every control must leave evidence. A control nobody can prove ran is, to a regulator, a control that did not exist. This is why banks obsess over logging and sign-offs.

Evidence to escalation. When a control fails, it must escalate to a named owner within a defined time. In AML, the MLRO (Money Laundering Reporting Officer) is a legally designated individual who owns SAR decisions. Naming an accountable human is itself a regulatory expectation, reinforced in the UK by the Senior Managers and Certification Regime (SMCR), which makes senior individuals personally responsible for failures in their area.

Escalation to remediation. Issues get logged, tracked, and closed with evidence of the fix. Internal audit (third line) later tests whether remediation actually worked.

The examiner's walkthrough

Picture an FCA or Fed examiner arriving. They will not read your policy binder cover to cover. They will pick one transaction and pull the thread:

• Show me this trade.
• Show me the MiFID II report you filed for it.
• Show me the reconciliation proving the regulator received it.
• This customer triggered an alert last year: show me who reviewed it and why they closed it.
• Show me where internal audit last tested this control.

If every question has a documented answer produced in minutes, the function survives. If answers require frantic emails and reconstructed spreadsheets, the finding writes itself. The difference is rarely the quality of intentions. It is whether the machine was built to produce evidence as a byproduct of normal work.

Key takeaways

• Compliance is an operating machine, not a document. Regulators judge outputs (reports, evidence, escalations), not policy binders. When they arrive, they say "show me."
• The three lines of defence separate risk-taking from control. Business owns risk first, risk and compliance monitor independently, internal audit checks that both work and reports straight to the board.
• Four outputs carry the heaviest legal weight: transaction reporting (MiFID II in the EU, CAT in the US), stress tests (CCAR/DFAST via the Fed, EBA in Europe), AML/sanctions screening (BSA, OFAC, SARs), and an immutable audit trail.
• Name accountable humans. Regimes like SMCR and the MLRO role make specific individuals personally responsible, so escalation paths must end with a named owner.
• Design controls to leave evidence automatically. A control nobody can prove ran did not run. Build logging and sign-offs into normal workflow so an examiner's questions answer themselves.