Compliance officers · the role
What does a compliance officer do?
The short answer · updated
A compliance officer makes sure a business follows the rules that apply to it. In an FCA-regulated firm they run the compliance function: monitoring the business against the regulatory system, advising staff, keeping policies current and reporting to the board. Where the FCA requires one, the head of compliance holds the Compliance Oversight function (SMF16) and needs FCA approval.
What is a compliance officer?
A compliance officer is the person a business makes responsible for keeping it within the law and the rules of its regulator. The title is used loosely, from an analyst checking files to the head of a regulated firm’s compliance function. Three legal meanings matter most.
In financial services, the FCA Handbook requires certain firms to keep a permanent and effective compliance function that operates independently, with a compliance officer responsible for it. Under the Senior Managers Regime the senior holder is the Compliance Oversight function, SMF16: in the FCA’s words, “the person responsible for the compliance function in the firm and reporting to the governing body on this”.
Under the Money Laundering Regulations, a business in scope must, where appropriate to its size and nature, appoint a board member or senior manager as the officer responsible for its compliance with the Regulations, and a nominated officer to receive internal suspicion reports. That covers estate agents, accountants and lawyers as well as banks.
In law firms, the Solicitors Regulation Authority uses “compliance officer” for two named roles: the compliance officer for legal practice (COLP) and compliance officer for finance and administration (COFA).
What a compliance officer does day to day
The FCA’s rules for the compliance function in an investment firm set out the core of the job. The function must monitor and assess whether the firm’s policies and procedures work, advise and assist the people doing regulated business, report to the management body at least once a year, and watch how complaints are handled. Its monitoring programme is built from a compliance risk assessment, so the riskiest areas are checked most.
In practice the week usually covers:
- Monitoring: testing files, calls, promotions and sales against the rules, and logging what fails.
- Advice: answering the business’s questions before a product, campaign or deal goes out.
- Policies and training: keeping the rulebook current and making sure staff know it.
- Regulatory change: reading what the regulator publishes and turning it into changes inside the firm.
- Reporting: a regular compliance report to the board, and breaches recorded and reported to the regulator when they must be.
- The regulator: applications, returns, visits and correspondence with the FCA, SRA or other supervisor.
Compliance officer vs MLRO vs chief compliance officer vs DPO
The MLRO (money laundering reporting officer) owns financial crime. In an FCA firm it is SMF17, the person responsible for overseeing the firm’s compliance with the FCA’s rules on systems and controls against money laundering. The MLRO receives internal suspicion reports and decides whether to file a Suspicious Activity Report with the National Crime Agency. One person can hold both SMF16 and SMF17, with approval for each. See fractional MLRO roles.
A chief compliance officer heads the whole compliance function in a larger firm or group, reports to the chief executive or the board, and in an FCA firm is often the SMF16 holder, with compliance officers and managers reporting to them. See part-time chief compliance officer jobs.
A data protection officer is a separate, statutory role under the UK GDPR. The ICO says a DPO must be appointed by public authorities and by organisations whose core activities involve large-scale monitoring or special category data, and must be independent, an expert in data protection, adequately resourced, and report to the highest management level. A compliance officer may also be the DPO only where the two jobs do not conflict. See fractional DPO jobs.
A compliance officer below the head of function runs part of the programme: monitoring, advice or a business line. In a small firm one person covers all of it.
Who a compliance officer reports to
The head of compliance reports to the board or its equivalent. In an investment firm the compliance officer must be appointed and replaced by the management body, must not be involved in the services they monitor, and must not be paid in a way that compromises their objectivity. Independence is the point of the role.
Most compliance officers are not directors. The FCA notes that SMF16 and SMF17 are often held by people who are not members of the governing body. Holding an SMF still brings personal accountability: under the Duty of Responsibility, a senior manager can be held to account for a breach in their area if they did not take reasonable steps to prevent it.
Day to day, a compliance officer works most closely with the general counsel, the MLRO, risk and the chief executive. Our page on what a general counsel does covers the legal side.
Skills and qualifications a compliance officer needs
No single qualification is required by law. Employers look for knowledge of the rules that bind their sector, judgement about risk, and the confidence to say no to senior people. A law or finance background helps but is not essential.
Two professional bodies set the common benchmarks in financial services. The International Compliance Association describes its Diploma in Governance, Risk and Compliance as the industry-standard qualification for compliance officers and managers. The CISI’s Diploma in Investment Compliance, an Ofqual level 6 qualification, is aimed at compliance professionals working towards a senior management role.
Anyone stepping into an SMF must be fit and proper and approved before they start. In a law firm, a COLP must be authorised to carry out reserved legal activities. For the routes in, see compliance officer jobs.
Fractional, interim and part-time compliance officers vs permanent
A permanent compliance officer suits a firm with enough regulated activity to keep a monitoring programme running every week.
A part-time or fractional compliance officer works set days a week, often in a smaller FCA-authorised firm, fintech or payments business. The FCA is clear that a firm can outsource a function but not the accountability for it, so the person must still have the authority and access the role needs. See part-time compliance jobs.
An interim compliance officer covers a departure, a regulatory review or a remediation programme. The FCA’s 12-week rule lets someone cover a senior manager’s temporary or unforeseen absence for less than 12 consecutive weeks without approval, and the FCA can grant time-limited approval to an interim while a firm finds a permanent candidate.
Where a fractional or interim compliance officer works through their own limited company, the off-payroll working rules (IR35) may apply. Status turns on how the engagement runs in practice, and a medium or large client makes the determination. Our IR35 guide sets out the tests.
What a compliance officer earns, and how to hire one
Pay depends on the regulator and the sector, the size of the firm, whether the role holds an SMF, the person’s qualifications, and location. Permanent compliance officers are paid a salary; fractional and interim compliance officers a day rate. We publish no compliance officer salary figure because we have no sourced one; the listings on compliance officer jobs show pay where the posting states it.
To hire, start with the obligation: which regulator, which functions need approval, and how many days of monitoring and advice the business really needs. Then decide permanent, interim, fractional or part-time.
We recruit permanent, interim, fractional, part-time and temporary compliance leaders. To hire a compliance officer, every brief gets a shortlist of 3–5 after five-stage vetting, each with pay or day rate, availability and IR35 position set out.
Questions people ask
What is the role of a compliance officer?
To keep the business within the rules of its regulator: monitoring, advising, maintaining policies and reporting to the board. In an FCA investment firm the compliance function must also report to the management body at least annually.
Is a compliance officer the same as an MLRO?
No. The compliance officer (SMF16 at the senior level) covers the whole regulatory system; the MLRO (SMF17) owns anti-money laundering systems and controls and decides which suspicions to report to the NCA. In a small firm one approved person can hold both.
Does a compliance officer need FCA approval?
Only for a Senior Management Function. Anyone holding SMF16 or SMF17 needs FCA or PRA approval before starting. Compliance staff below that level do not need approval, though the firm must check they are fit and proper where the Certification Regime applies.
Do small businesses need a compliance officer?
It depends on the rules they are under. A business covered by the Money Laundering Regulations must, where appropriate to its size and nature, appoint an officer responsible for compliance and a nominated officer, and tell its supervisor within 14 days. An individual who neither employs nor works with anyone else is exempt from that part.
What qualifications does a compliance officer need?
None is required by law. In financial services the ICA Diploma in Governance, Risk and Compliance and the CISI Diploma in Investment Compliance are common benchmarks. See compliance officer jobs for how people get into the role.
How much does it cost to hire a compliance officer?
A permanent compliance officer is paid a salary; a fractional or interim one a day rate. Pay depends on the sector, the regulator, firm size and whether the role holds an SMF. On every shortlist we set out each candidate’s pay or day rate.
How do I hire a compliance officer?
Work out which regulator and which approved functions apply, how many days a week the work needs, and whether the gap is permanent or temporary. Our part-time compliance jobs page sets out the options; we send a shortlist of 3–5, each with pay or day rate, availability and IR35 position set out.
