# Building the compliance function that keeps you licensed
In 2018, the SEC fined a mid-sized advisory firm because its compliance manual said one thing and the firm did another: the manual promised annual reviews of every client account, but the firm had no evidence it ever performed them. The rules were fine. The machinery to prove them was missing. That gap, not the rule itself, is what gets firms fined, suspended, or deregistered.
This lesson assembles that machinery. You already know the major regulations. Now learn how a manager operationalizes them so that when a regulator walks in, the answers are on file.
Every regulated asset manager must designate a Chief Compliance Officer (CCO), the individual formally accountable for the compliance program.
In the US, this is a hard legal requirement. Rule 206(4)-7 under the Investment Advisers Act of 1940 (the federal law governing investment advisers, enforced by the SEC, the Securities and Exchange Commission) requires every registered adviser to appoint a CCO and adopt written policies. In the EU, the UCITS and AIFMD frameworks (the two directives covering retail funds and alternative funds respectively) require a "permanent compliance function." In the UK, the FCA (Financial Conduct Authority) assigns personal accountability through the Senior Managers and Certification Regime (SMCR), under which a named senior manager can be held personally liable.
Personal liability matters. The SEC has brought enforcement actions directly against CCOs who ignored obvious red flags. The role is not ceremonial.
At a small firm, the CCO may also be the COO or general counsel. The SEC dislikes "part-time" CCOs stretched too thin, and has said so in exam findings.
A compliance monitoring plan (CMP) is the calendar and checklist that turns rules into recurring, evidenced tasks. It answers one question for every obligation: who checks this, how often, and where is the proof?
Think of it as mapping each rule to a control.
| Rule / obligation | Control | Frequency | Owner |
|---|---|---|---|
| Best execution (getting clients the best available terms) | Sample and review trades vs benchmark prices | Quarterly | Trading desk + CCO |
| Marketing Rule (SEC Rule 206(4)-1) | Pre-approve all client-facing materials | Every use | Compliance |
| Personal account dealing | Review employee trade reports | Monthly | CCO |
| Client suitability | Review new accounts vs mandate | On onboarding | Advisers |
The point is not the table. It is that a regulator can ask "show me your best execution reviews for Q2" and you produce twelve signed samples, not a shrug.
The FCA publishes practical expectations for monitoring in its handbook. See the FCA's guidance on the compliance function for the formal UK standard.
A breach is any failure to comply with a rule, a client mandate, or an internal policy. A breach register is the log where every one gets recorded, investigated, and closed out.
Breaches split into two types:
Concrete example. A fund mandate caps any single holding at 10% of the portfolio. Tesla rallies and the position hits 11%. That is a passive breach. The register records: date detected, cause, client impact, remediation (trim to under 10% within the mandate's cure period), and sign-off.
Why regulators obsess over this: the register proves the firm *finds* its own problems. A clean register with zero entries is a red flag, not a gold star. It usually means the firm is not looking.
Many regimes require prompt notification of material breaches. Under UCITS and AIFMD, certain limit breaches must be reported to the national regulator. Under the FCA's Principle 11, firms must disclose anything the regulator "would reasonably expect notice of." Timelines vary, so the CCO's job is to know which breaches trigger which clock.
🎬 [VIDEO: "What Does a Compliance Officer Do?" - youtube.com - a plain-English walkthrough of the compliance role in financial firms]
Modern monitoring is automated. Firms run trade surveillance systems that flag suspicious patterns: front-running (trading ahead of a client order), wash trades, or off-market prices.
A simple mandate check looks like this in practice:
# Passive breach detection: single-name concentration limit
LIMIT = 0.10 # 10% mandate cap
for holding in portfolio:
weight = holding.market_value / portfolio.total_value
if weight > LIMIT:
breach_register.log(
security=holding.name,
weight=round(weight, 4),
type="passive",
action="flag_for_review"
)This is not exotic. It is a nightly job. The regulatory value is that the check runs automatically and logs its output, so the evidence trail is machine-generated, not reconstructed after the fact.
Sooner or later, a regulator inspects you. In the US the SEC's Division of Examinations runs periodic exams. In the EU, national competent authorities (for example BaFin in Germany, the AMF in France) do the same. The FCA runs supervisory reviews in the UK.
Exams follow a rhythm:
1. Document request. The regulator sends a list, often 50+ items: compliance manual, breach register, trade blotters, marketing materials, employee trade reports, the CMP.
2. On-site or remote review. Examiners interview the CCO and staff.
3. Findings. Delivered as a deficiency letter listing problems.
4. Response. The firm must remediate and reply, usually within 30 days.
The SEC publishes annual examination priorities flagging what it will focus on. In recent years these have included the Marketing Rule, fee calculations, and use of AI in advice. Reading them each year is free intelligence about where the pressure is coming.
Notice the pattern: almost every finding is a *documentation and evidence* failure, not a case of a firm being ignorant of the law.
Vérification des acquis
1. The lesson opens with a firm being fined despite having compliant rules in its manual. What core concept does this illustrate about compliance?
2. Why does the lesson emphasize that the CCO role 'is not ceremonial'?
3. A US registered investment adviser argues it doesn't need a formal CCO because it is small and trusts its staff. Why is this reasoning flawed?
4. Select ALL correct answers about how different jurisdictions mandate a compliance function.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about what a real CCO's responsibilities include according to the lesson.
Sélectionnez toutes les réponses correctes.
Enforcement is the sharp end. When compliance fails badly, the SEC, FCA, or an EU authority can impose fines, force disgorgement (returning ill-gotten profits), bar individuals, or revoke registration. The US FINRA (Financial Industry Regulatory Authority, the self-regulatory body for broker-dealers) can expel firms from the industry.
But the goal of the machinery is not to survive one exam. It is a culture of compliance, a phrase regulators use deliberately. It means compliance is embedded in how the front office works, not bolted on afterward.
Practical signs of a healthy culture:
A firm where compliance is seen as the "business prevention department" will eventually generate the breach that ends it.
If you were standing up a new manager tomorrow, the irreducible core is:
1. A designated, qualified CCO with real authority.
2. A written compliance manual mapped to your actual activities.
3. A compliance monitoring plan with dated, owned controls.
4. A breach register that people actually use.
5. Annual review with documented evidence it occurred.
Everything else is elaboration on these five.