What an FCA compliance monitoring plan should contain
A compliance monitoring plan sets out what you will test, against which rule, how often, by whom, and what evidence you will keep. The Handbook does not prescribe its format, but it is how most firms show their controls work.
What the rules require
- Policies and procedures sufficient to ensure compliance, including by managers, employees and appointed representatives (SYSC 6.1.1R)
- Robust governance, with effective processes to identify, manage, monitor and report risks (SYSC 4.1.1R)
- Orderly records sufficient for the FCA to monitor your compliance (SYSC 9.1.1R)
- Regular monitoring of the outcomes retail customers receive (PRIN 2A.9.8R)
- Identifying and fixing recurring or systemic problems found through complaints (DISP 1.3.3R)
- Systems and controls to identify, assess, monitor and manage money laundering risk (SYSC 6.3.1R)
- For principals, an annual review of each appointed representative (SUP 12.6A.2R)
Build it in five steps
List the obligations
Start from your permissions: the sourcebooks that apply, the Consumer Duty, complaints, financial crime and, if you are a principal, appointed representatives.
Rate the risk
For each obligation, judge the likelihood and impact of getting it wrong. Higher risk earns more frequent and deeper testing.
Choose the test
Prefer tests of real files and data over reading the policy again: samples, data checks, call listening, mystery shopping.
Set frequency, owner and evidence
Who tests, how often, and what record proves it was done. A test with no evidence did not happen.
Report and act
Report results to the governing body, track every action to an owner and a date, and re-test what failed.
A worked template
Six columns are enough. Every row names the rule it tests.
| Area | Rule | Test | Frequency | Owner | Evidence |
|---|---|---|---|---|---|
| Complaints | DISP 1.6.2R | Sample closed complaints; check each final response went out within eight weeks | Monthly | Complaints lead | Sample sheet with dates and outcome |
| Root causes | DISP 1.3.3R | Review the root-cause log against complaint themes and check fixes were made | Quarterly | Compliance | Root-cause log and actions |
| Financial promotions | CONC 3.3.1R | Compare live promotions on every channel with approved versions | Monthly | Marketing and compliance | Approval record and screenshots |
| Consumer Duty outcomes | PRIN 2A.9.8R | Review outcome MI for products, communications and support; compare customer groups | Quarterly | Consumer Duty owner | MI pack with conclusions |
| Records | SYSC 9.1.1R | Spot-check customer files for completeness against your record-keeping policy | Half-yearly | Operations | File checklist |
| Appointed representatives | SUP 12.6A.2R | Confirm each annual AR review was done and recorded | Annually | AR oversight lead | Review records |
| Financial crime | SYSC 6.3.1R | Test customer due diligence on a sample of new customers | Quarterly | MLRO | Test results and exceptions |
An illustration, not a prescription: set each frequency by the risk your own assessment finds. Add the sourcebook for your sector.
Keep it running
A plan in a spreadsheet goes stale between reviews. Guardian puts each test on the compliance calendar on the day it falls due, with its owner, its rule and the evidence attached, and drafts the monitoring report from the results. Or ask us to write and run the plan with you.
Questions
Short answers, with the provision each one rests on.
Is a compliance monitoring plan a legal requirement?
The Handbook does not set a format for one. It does require policies and procedures sufficient to ensure compliance (SYSC 6.1.1R) and robust governance with effective processes to identify, manage, monitor and report risks (SYSC 4.1.1R). A written monitoring plan is the usual way to evidence both. Some firms, such as operators of electronic lending systems, must also keep a compliance function with monitoring responsibilities (SYSC 6.1.3R).
How often should we monitor each area?
By risk. The Handbook leaves frequency to the firm, so set it from your risk assessment and record why. Areas with customer harm or a statutory clock, such as complaints, usually warrant the most frequent testing.
Who should carry out the monitoring?
Ideally someone independent of the activity being tested. For firms within SYSC 6.1.3R the compliance function must operate independently.
How does the plan relate to the Consumer Duty?
The Duty requires firms to monitor the outcomes customers receive from products, communications and support (PRIN 2A.9.8R). That monitoring belongs in the plan, and its results feed the annual board report.
Want a plan written for your firm?
Thirty minutes to agree the scope. We write it against your permissions and your risks.