Compliance and Risk

Regulatory compliance, anti-money-laundering, data protection and enterprise risk, applied to the sector you operate in.

Levels it usually serves: L3 Technical, L4 Supervisory, L5 Senior, L6 Executive

What Members Come Away With

• Building a risk register the board can use
• Compliance obligations by sector
• Handling a regulatory finding

In Scope

Sector regulatory obligations, anti-money-laundering and know-your-customer procedure, data protection practice, enterprise and operational risk, risk registers that support decisions, and responding properly to a regulatory finding.

Out of Scope

Not legal advice and not compliance outsourcing. Naming your obligations is training. Discharging them is your function, and nobody on this register can carry that for you.

Situations We See

The Finding with a Deadline on It

A regulator has written, a remediation date is fixed, and training is part of the response. Say the deadline in the brief - we filter on availability before anything else.

The Risk Register Nobody Uses

A spreadsheet updated annually and never referenced in a decision. This is as much a governance problem as a risk one, and it is often bought together with the governance discipline.

The Frontline That Has to Apply the Rule

Policy exists, the tellers and clerks who must apply it have had a slide deck. This is where compliance actually fails, and it is L3 and L4 work, not board work.