Compliance monitoring

Compliance monitoring that keeps the programme, the findings and the sign-offs in one place.

Book a demo

Amoreg · Compliance monitoring3 capabilities

Regulators watched for youEvery publication from the regulators you choose, logged with its kind, stage and dates.
The library read every weekInspector checks your policies against the rules you answer to and raises findings where they fall short.
Findings followed to closureEach finding has a severity, a drafted fix and a named person who decides; the file keeps who and when.

Today

The monitoring plan is a spreadsheet, the test results are in email and the fixes are in someone’s head.
When the regulator asks what you tested and what you did about it, the answer takes a week to assemble.

With Amoreg

Regulators watched for you. Every publication from the regulators you choose, logged with its kind, stage and dates.
The library read every week. Inspector checks your policies against the rules you answer to and raises findings where they fall short.
Findings followed to closure. Each finding has a severity, a drafted fix and a named person who decides; the file keeps who and when.

Follow one through. A GFSC letter, from posted to decided.

Switch on the regimes you are held to. Amoreg watches their sources and keeps every publication until someone decides.

Regulatory monitoring · one caseStep 5 of 5

Three ways to do it. One that keeps the file.

Compare Amoreg

Without AmoregDrives, inboxes and spreadsheetsCopilotAnd other general AI assistantsAmoregBuilt for regulated firms

Watching regulatorsChecking each regulator’s news page by handAnswers when asked; does not watch regulatorsWatched regulator pages read on every run

Library reviewA periodic read-through of every policy by handReviews a policy only when askedEvery document swept weekly, each point citing its rule

Tracking gapsImpact notes scattered across email and spreadsheetsA reply to copy into your documentsOne queue of open, resolved and dismissed findings

Recurring checksRecurring checks run from memory and remindersA prompt, not a charted process with stepsA charted process, run by hand or on a schedule

FiguresCompiling adoption and findings figures by handUsage figures for the assistant, not your compliance programFigures computed from records, against the period before

General descriptions of each approach. Some assistants add connectors, citations and enterprise controls; we are happy to compare Amoreg with the tools you use today.

Compliance monitoring: what it is and what regulators expect.

What compliance monitoring is

Compliance monitoring is how a firm checks, on a schedule and with evidence, that it is doing what its rules and its own policies say. It is the second line of defence at work: the compliance function tests the business, records what it found, and follows each gap until it is closed.

It differs from the first line’s own day-to-day checks, and from internal audit, which reports independently to the board. Monitoring sits between the two. It is also not transaction monitoring, which is a system that scores payments and customer activity for suspicious patterns. This page is about the compliance function’s monitoring of the firm.

What a compliance monitoring programme contains

A compliance monitoring programme, often shortened to CMP, is the written plan for that work. A usable one answers six questions: which obligations apply, which of them carry the most risk, what will be tested and how often, who tests it, how results are reported, and how gaps are fixed and rechecked.

Most programmes are risk-based. High-risk areas, such as customer due diligence or client money, are tested more often and more deeply than low-risk ones, and the reasoning is written down so the board and the regulator can see why. The programme is then reviewed at least once a year, and whenever the rules or the business change.

Our article on designing a compliance monitoring plan, linked below, walks through how heads of compliance balance risk, resource and proportionality.

What regulators expect

In the United Kingdom, the FCA’s SYSC sourcebook requires a firm to establish, implement and maintain adequate policies and procedures sufficient to ensure it complies with its obligations (SYSC 6.1.1R). SYSC 6.1 also describes a compliance function that monitors, and regularly assesses, the adequacy and effectiveness of those measures. That part is a rule for some kinds of firm, such as common platform firms, management companies and operators of electronic lending systems, and guidance for others, so check how SYSC 6.1 applies to yours. The Money Laundering Regulations 2017 add duties on policies, controls and procedures, including a requirement to review and update them, and, where appropriate to the firm’s size and nature, an independent audit function.

The Crown Dependencies and other offshore centres make their own rules. The Isle of Man, Jersey and Guernsey each publish their own AML/CFT rules and handbooks, and a monitoring programme has to be built against the rules of the regulator that licenses the firm, not the UK’s. The library holds those regimes with their headline controls; the regime pages linked below are the place to start.

A compliance monitoring programme template

This template is free and needs no sign-up. Copy the table into a spreadsheet, one row per obligation you test. It carries the six questions above as columns, plus the evidence you will want on file. The example rows show the level of detail to aim for; replace them with the obligations of your own licence and your own risk assessment.

Fill it in this order. List the obligations that apply to your licence, from the rules your regulator publishes. Rate each one for risk, using your business risk assessment. Decide the test and its frequency from the rating, so that higher-risk rows are tested more often. Name an owner for each test who is not the person who runs the control. Record where the evidence will be kept.

Then add three things the table does not hold: the date the programme was last reviewed, the date of the next review, and the name of the person who approved it. Review it at least once a year and whenever the rules or the business change. Keep a short note of what you chose not to test and why.

Compliance monitoring programme template, with example rows
Obligation	Risk	Test	Frequency	Owner	Evidence
Customer due diligence is completed before a relationship starts	High	Sample new customer files and check each for identity, beneficial ownership and the risk rating	Quarterly	Compliance officer	Sample list, checklist per file, findings log
Policies are reviewed on their cycle	Medium	Compare each policy’s last review date with its cycle and check the approver	Twice a year	Head of compliance	Policy register extract, approval records
Staff have completed required training	Medium	Match the training record to the staff list and chase gaps	Twice a year	Compliance officer	Training log, completion report
Suspicious activity is escalated and reported on time	High	Trace a sample of internal reports from escalation to decision	Quarterly	MLRO deputy	Report register, decision notes
Regulatory changes are assessed and acted on	Medium	Check that each publication in the period has a decision, an owner and a date	Monthly	Head of compliance	Change log, decisions on file
Earlier findings are fixed and retested	High	Check every closed finding for a fix, a retest and a sign-off	Quarterly	Compliance officer	Findings log, retest results

Two jobs that share a name

Firms use “monitoring” for two different jobs. The first is watching the regulators: noticing a consultation, a rule change or a Dear CEO letter and deciding whether it applies. The second is testing the firm: checking that policies exist, are current, and are followed.

Both feed the programme. A rule change alters what must be tested, and a test result may show that a policy no longer matches the rule. Keeping them in one record is what lets a firm answer “what changed, what did you check, and what did you do about it” without reconstructing the history.

What a good monitoring record looks like

A supervisor reading your monitoring file wants to see five things for every test: what was checked and why it was chosen, the sample and the date, the result, the gap if there was one, and who closed it and when. A test that found nothing still needs the first three, because an empty result is only believable when the work behind it is on file.

The weak points are almost always the same. Plans that were never updated after a rule change. Findings that sit open with no owner. Fixes that were made but never retested. Results that reach the compliance officer but never the board. A programme that closes those four loops is already ahead of most.

Proportionality matters as much as thoroughness. A small trust company does not need a bank’s testing calendar, but it does need a plan it can show it follows. Write down what you chose not to test and why.

How Amoreg runs it

The Monitor watches the sources of the regimes you switch on and records each publication once, with its kind, stage, effective date and comment deadline. A person confirms whether it applies; the agent’s view stays a proposal until then.

Inspector reads your whole policy library every week against the rules you answer to. It stays quiet about documents that are fine and raises a finding, with a drafted fix, where one falls short. Every document has owners and a review cycle, so overdue reviews surface on their own.

Findings carry a severity and are followed to a decision. Approving a fix records who decided; dismissing one needs a written reason. The command center shows open findings and the health of each framework, so the monthly report to the board is a view rather than a project.

Workflows run the programme itself on a schedule: each test is a step with an owner and an approval gate, and the command center shows what is overdue.

Amoreg supports the programme; it does not write it for you or replace the compliance officer’s judgement. You decide what to test and how often, and every decision carries a name.

Sources

Questions firms ask about compliance monitoring.

What is compliance monitoring?

The compliance function’s regular, evidenced checking that the firm is doing what its rules and policies say, with each gap recorded and followed until it is closed. It sits between the business’s own controls and internal audit.

What is a compliance monitoring programme?

The written plan for that checking: which obligations apply, which carry the most risk, what is tested and how often, who tests it, how results are reported and how gaps are fixed and rechecked. It is reviewed at least once a year and when the rules or the business change.

Is there a free compliance monitoring programme template?

Yes. This page carries one you can copy without signing up: obligation, risk, test, frequency, owner and evidence, one row per obligation, with example rows. Replace the examples with the obligations of your own licence, rate them against your risk assessment, and have the board or senior management approve the result.

Does the FCA require compliance monitoring?

The FCA’s SYSC sourcebook requires a firm to establish, implement and maintain adequate policies and procedures sufficient to ensure compliance. It also describes a compliance function that monitors and regularly assesses whether those measures are adequate and effective: a rule for some kinds of firm and guidance for others. See SYSC 6.1 in the FCA Handbook for the exact wording and how it applies to your firm.

Is compliance monitoring the same as transaction monitoring?

No. Transaction monitoring scores payments and customer activity for suspicious patterns. Compliance monitoring tests whether the firm’s controls, including transaction monitoring, are designed and working as the rules require.

How does Amoreg help with compliance monitoring?

The Monitor logs regulator publications, Inspector reads your policy library against the rules each week and raises findings with drafted fixes, and findings are followed to a named person’s decision. You still write the programme and judge what to test.