Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

The following BSI references relate to the work on this standard:

Committee reference SVS/6
Draft for comment 10/30210204 DC

Publication history

First published February 2011

Foreword

Publishing information

This British Standard is published by BSI and came into effect on 28 February 2011. It was prepared by SVS/6, Financial services. A list of organizations represented on this committee can be obtained on request to its secretary.

Information about this document

The standard is relevant to all firms providing regulated financial services in the UK. The extent to which the requirements of this standard are applicable to an individual firm depends on the nature, size and complexity of the firm’s business.

A compliance framework and the compliance function can cover many different aspects of a firm’s control environment. The aim of this standard is not to specify how this is structured, but to indicate that the control environment around compliance risk is established by the governing body after discussions with the compliance function as to how responsibility for identifying and managing the various aspects of compliance risk is apportioned within the firm. The standard is not intended as an instrument for regulation. Rather, it is a tool for compliance functions and professionals. Compliance with the standard is voluntary and firms are at liberty to implement the standard in a way that is relevant, appropriate and proportionate to their business model.

Presentational conventions

The provisions of this standard are presented in roman (i.e. upright) type and are expressed in sentences in which the principal auxiliary verb is “shall”. Compliance with the provisions is necessary for compliance with the standard.

Commentary, explanation and general informative material is presented in notes in smaller italic type, and does not constitute a normative element.

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

Compliance with a British Standard does not equate to compliance with legal and regulatory requirements. Users still have to comply with the law.

1 Scope

This British Standard specifies overarching policies, procedures and methods for operating a compliance framework (see Clause 4) within a regulated financial services firm.

This standard sets out a methodology for implementing and managing the compliance framework at both group and line level.

The extent to which the requirements of this standard are applicable to an individual firm depends on the nature, size and complexity of the firm’s business.

NOTE Firms may implement this standard in a way that is relevant, appropriate and proportionate to their business model.

The standard does not specify requirements for risk management, data protection (covered in BIP 0012 and BS 10012), complaints handling (covered in BS ISO 10002), or inclusive service provision (covered in BS 18477).

2 Normative references

3 Terms and definitions

4 Guiding principles

4.1 Compliance culture

4.2 Transparency in dealings with regulators

4.3 Independence

4.4 Authority

4.5 Adequacy of resources and approach

4.6 Confidentiality

5 The compliance framework

5.1 Governing body involvement and responsibilities

5.2 Compliance risk assessment and management

5.3 Advice

5.4 Compliance monitoring

5.5 Compliance training

5.5.1 Scope of compliance training plan: subject matter

As part of its overall training and competence programme, the firm shall develop a compliance training plan that underpins its compliance culture. In doing so, the firm shall identify appropriate training requirements for staff, by role, line or other categorization and by experience and length of service, and communicate these together with applicable internal policies and procedures.

NOTE An example of an area where training is mandatory is the requirement to provide regular anti-money laundering training for “relevant employees” under the Money Laundering Regulations 2007 [4]. Examples of areas where training is deemed appropriate include the introduction of new regulatory requirements or identified internal deficiencies.

5.5.2 Scope of compliance training plan: employees

The firm shall seek to ensure that all appropriate staff, including senior managers and the governing body, are covered by the training plan.

NOTE Depending on the organization, “staff” can include full-time employees, contractors, temporary staff, appointed representatives, and outsourced/third party service providers. The firm should endeavor to ensure that contracts with its third party providers require them to provide appropriate compliance training where such training is necessary to assist in managing the firm’s compliance risk.

5.6 Regulatory relations

5.7 Policies and procedures

5.8 Compliance reporting

5.9 Compliance function: controls and supervision

Bibliography

BS 8453:2011

Compliance framework for regulated financial services firms. Specification

Current

Published:

28 Feb 2011