CME-2A Global Financial Compliance Complete Review Guide 2026–2027

4. Senior management establishes and communicates a written compliance policy, ensures it is observed, assesses the main compliance risks at least annually with the compliance function, reports to the board annually and promptly on any material failure (§1.1.3).
5. Principle 6 (resources): compliance staff need suitable qualifications and experience, kept current through regular, systematic education and training (§1.2).
6. The compliance manual documents the standards staff must follow and gives policy and guidance, not detailed procedures; it must be a living document, reviewed and updated for changes and staff feedback (§1.3).
7. The compliance function has a formal documented status, a right of access to information (with a staff duty to cooperate), a right to investigate and appoint outside experts, and direct access to the board or a board committee (§1.3.3).
8. The monitoring programme is risk-based because reviewing every item is impractical; it confirms that tasks follow procedures and that procedures still reflect current regulatory requirements (§1.5).
9. The three stages are information gathering on potential adverse events, scoring (financial impact, exposure frequency, probability) and weightings (anxiety, perspective, days since last tested) (§1.5).
10. In the scoring example, 250 is a daily event, 50 weekly, 1 annual and 0.1 rare; probability of the risk crystallising is low below 30%, medium 30% to 70% and high above 70% (§1.5).
11. Working papers give an evidential record of what was tested and found; findings go to business management to agree remedial action, and larger programmes produce a risk mitigation plan for the board (§1.5).
12. Regulatory requirements are integrated through five elements: people, allocation of responsibilities, training, procedures and systems (§1.6).
13. Regulations are minimum rules set by governments and regulators; internal policies are set by the firm and may go beyond regulation; procedures detail what staff do; local rules may conflict with head-office policies (§1.7).
14. Outsourcing: the firm stays responsible; the regulator expects due diligence on the provider, enough expertise to oversee it, a written contract with an SLA and KPIs, and business continuity and disaster recovery plans (§1.8.1).
15. Capital: the minimum is set by a standard formula (higher risk, more capital) or by internal models approved by the regulator; examples are Basel II and III for banks and Solvency II for insurers (§1.8.2).
16. Variation of permission: a minor variation can take two to eight weeks and a major one up to a year; compliance should be involved early in any new activity (§1.8.3).
17. Independence has four elements: formal status, a head of compliance, no conflict of interest with other responsibilities, and access to information and personnel (§2.1.3).
18. Three lines of defence: operational controls and business and process owners; compliance, supporting management through sample-based review; internal audit, giving assurance to senior management and the board (§2.1.3).

Common mistakes in this chapter

• ✕ Mixing up policies and procedures: a policy sets principles and may go beyond regulation, procedures give detailed steps, and the compliance manual is policy and guidance, not a procedures manual.
• ✕ Believing independence means distance from the business: close cooperation is welcome; independence means formal status, a head of compliance, no conflicts of interest, and access to information.
• ✕ Pay linked to the performance of the business line a compliance officer oversees undermines independence; pay linked to the performance of the whole bank is generally acceptable.
• ✕ Thinking outsourcing transfers responsibility: the firm remains responsible for outsourced tasks and must not become an “empty shell” without the substance to stay authorised.
• ✕ Confusing the second and third lines: compliance is the second line (sample-based monitoring supporting management); internal audit is the third (assurance to senior management and the board).
• ✕ Assuming every breach is reported to the regulator at once: minor breaches go in the breaches log and are reviewed; a notifiable breach is one the rules make reportable, typically within 24 hours of identification.
• ✕ Confusing reporting with tipping off: reporting suspicion to the MLRO and the authorities is required and does not breach confidentiality; telling the client a report is being made is tipping off, which can be punished.
• ✕ Mixing up scoring and weightings in the monitoring programme: scoring covers financial impact, exposure frequency and probability; weightings add anxiety, perspective and days since last tested.