Who Should Run Compliance Monitoring at a Smaller Regulated Firm?

Large banks and insurers have whole teams dedicated to compliance monitoring. A small wealth manager, broker, payments firm or consumer lender usually has one compliance officer, perhaps with an assistant, doing everything. Monitoring is one task among many, and it is often the one that slips when the diary fills up.

That matters, because monitoring is how a firm proves its compliance is real rather than assumed. The FCA’s systems and controls rules in SYSC 6.1 require adequate arrangements to ensure compliance, and the Consumer Duty requires retail firms to monitor the outcomes their customers actually receive. A firm of any size needs to be able to show the work.

So who should do it? For smaller firms there are three realistic options, and many end up combining them. This article looks at each. For the wider picture of what a monitoring programme should contain, see our guide, Compliance Monitoring Explained.

Option 1: The In-House Compliance Officer

In most small firms, the compliance officer holding the SMF16 compliance oversight function runs monitoring personally. That has real advantages. They know the business, the people and the systems. Findings come from someone with authority who can push for change, and there is no external fee.

The drawbacks are time and independence. A compliance officer handling advice queries, financial promotions sign-off, regulatory change, complaints oversight and breach reporting will struggle to protect the days a proper monitoring programme needs. They may also be testing processes they helped design, which makes objective findings harder.

This option works best where the compliance officer has a manageable workload, has run a risk-based programme before and blocks out monitoring time in the diary as firmly as any client meeting.

Option 2: An Outsourced Monitoring Provider

Many compliance consultancies offer monitoring as a service: file reviews, thematic testing, mystery shopping and an annual programme built around the firm’s risks. For small firms this can be very effective. The reviewers are independent, experienced in testing, and bring a view of what good looks like across many firms.

The limits are worth understanding. An outsourced reviewer sees the firm a few days a year and may not pick up context that someone inside would notice. Findings still need an owner inside the firm to agree actions and see them through. Most importantly, outsourcing the work does not outsource the accountability. The firm and its Senior Managers remain responsible for the programme and what it finds.

This option works best when there is a capable person in-house to own the programme, agree the plan with the provider and drive the actions.

Option 3: A Fractional Compliance Officer

A growing number of smaller firms appoint a fractional compliance officer: an experienced, approved SMF16 who works for the firm one or two days a week, or a few days a month. They hold the function, design the monitoring programme and carry out much of the testing themselves.

For a firm that doesn’t need a full-time compliance officer, this often gives the strongest combination: senior experience, genuine ownership and enough time to monitor properly, at a cost proportionate to the firm’s size. The key is being realistic about days. A fractional arrangement that covers monitoring, plus everything else the role involves, needs enough time to do both. Our page on the part-time compliance officer for small firms sets out how these arrangements usually work.

The Three Options Side by Side

Combining the Options

In practice, the most robust approach for many smaller firms is a mix. The compliance officer, full-time or fractional, owns the programme, sets the plan from the firm’s risk assessment and runs most of the routine testing. An outsourced provider is brought in for the areas where independence matters most, such as reviewing the compliance officer’s own work, or where specialist skills are needed, such as financial crime or a technical product review.

Whichever route a firm takes, the same test applies. Can the firm show what it monitored and why, what it found, what it did about it, and whether the fixes worked? If the answer is yes, the resourcing model is working. If not, the model is the first thing to look at.

What to Look for When Hiring

When firms recruit a compliance officer, monitoring experience is easy to overlook in favour of regulatory knowledge. It shouldn’t be. Good candidates can describe a programme they designed, how they chose what to test and how much to sample, the findings it produced and how they took them to the board. Candidates who have only ever completed someone else’s checklist are a different proposition.

The same applies to a fractional appointment. Ask how they would build a monitoring plan for your firm in the first three months, and how many days it would need. A clear, specific answer is a good sign.

For the full detail on rules, programme design, testing methods, board reporting and an annual monitoring cycle, read Compliance Monitoring Explained on the SMF Capital website.