What must an investment firm's compliance function do, and how independent must it be?

A firm must have policies and procedures aimed at spotting any risk of failing to meet its obligations, and measures to keep that risk low, scaled to the size and complexity of its business. To run them it needs a permanent and effective compliance function that operates independently.

The function has four tasks. It monitors on a permanent basis, and assesses on a regular basis, whether the firm's measures and the actions taken to address deficiencies are adequate and effective. It advises and assists the people responsible for investment services. It reports to the management body at least once a year on the control environment for investment services, the risks identified and complaints handling, including remedies taken or to be taken. And it monitors how the complaints-handling process works.

Its work follows a compliance risk assessment, which leads to a risk-based monitoring programme covering all areas of the firm's investment and ancillary services, with priorities set by the level of risk so that compliance risk is monitored comprehensively. Risk-based means every area is covered, with more attention where the risk is higher.

Five conditions apply. The function needs sufficient authority, resources and expertise, and access to every piece of relevant information. The management body appoints and replaces the compliance officer, who is responsible for the function and its reports. Whenever the function finds a significant risk that the firm may fail to comply, it reports directly to the management body, without waiting for the annual cycle. Its staff must not be involved in performing the services or activities they monitor. And the way they are paid must not compromise, or be likely to compromise, their objectivity.

The last two conditions can be disapplied, but only if the firm can demonstrate that, given its business, they would be disproportionate and that the function still works effectively. The firm must then assess whether effectiveness is compromised, and review that assessment regularly. Senior management also receives written reports on compliance at least annually.

ESMA's guidelines on the compliance function, which replaced the 2012 version in 2021, expand on the Delegated Regulation. Where the firm sets budgets for specific functions, the budget for compliance should match the level of compliance risk; the compliance officer should be consulted before it is set, and any decision to cut it significantly should be documented in writing with detailed reasons. The compliance officer needs sufficiently broad knowledge and experience and a high level of expertise, including knowledge of MiFID II and national law. Combining compliance with other control functions of the same level, such as money laundering prevention, may be acceptable if it does not compromise the function's effectiveness and independence and is documented with its reasons, but an internal audit function may never be combined with compliance.

In Cyprus a CIF may appoint someone as its regulatory compliance officer only if that person has passed CySEC's Advanced examination and is entered in CySEC's public register. As an exception, CySEC may approve, on prior written notice from the firm, a person who is not yet registered; that person must then qualify and register within six months, with two examination sittings to do so. CySEC may extend the six months only if no examination slot is available or there is another serious impediment. The officer who monitors money laundering controls is a separate role under the AML/CFT Law, described in What does the AML compliance officer do?