A compliance monitoring programme is the difference between telling the FCA your firm is well controlled and being able to prove it. Rules alone do not demonstrate compliance – evidence does. For most small and mid-sized UK firms, the problem is not knowing that monitoring is required, it is knowing what to monitor, how often, and to what standard.
This listicle sets out twelve core checks every FCA-regulated firm should run as part of a documented monitoring programme. Use it as a ready-made annual schedule you can run in-house or hand to an external reviewer.
Why a documented monitoring programme matters
Under SYSC 6.1.1R, an FCA firm must establish and maintain appropriate systems and controls to monitor its compliance. Monitoring is not a one-off exercise – it is a cycle of planned activities, testing, reporting and remediation. A programme that is written down, risk-based and evidenced is worth far more in a supervisory conversation than a stack of good intentions.
If you are reviewing your current arrangements, our in-depth FCA Compliance Audit & Benchmarking Report tests governance, controls and processes and rates your weaknesses with practical recommendations.
The 12 monitoring checks to build into your schedule
1. Client file testing
Sample client files against your own policies and the relevant FCA rules – onboarding, suitability, disclosure and record-keeping. Test a risk-based mix of recent files, plus any flagged by complaints or breaches.
2. Transaction monitoring review
Review transaction monitoring rules, thresholds and alerts for adequacy, and check that alerts are investigated and escalated, not simply closed. Confirm the logic still matches your current business and customer profile.
3. Complaints and root cause analysis
Confirm complaints are logged, acknowledged and resolved within DISP timescales, then look for patterns. Root cause analysis turns complaint data into intelligence on where your controls or product design are failing.
4. Whistleblowing and speak-up arrangements
Check that the firm’s speak-up channels are genuinely independent, that disclosures are recorded, and that staff understand how to raise a concern. Assess whether the culture supports escalation without fear.
5. CASS client money reconciliation (where applicable)
If your firm holds client money or assets, test that internal and external reconciliations are completed on time, discrepancies are investigated and resolved, and the client money calculation is accurate.
6. SMCR conduct and fitness and propriety
Review that Senior Managers and Certified Persons hold the right approvals, that Statements of Responsibility are current, and that annual fitness and propriety assessments are completed and evidenced.
7. Business-wide risk assessment and risk register review
Refreshed risk assessments keep your whole programme risk-based. Test that the business-wide risk assessment reflects your current products, customers and channels, and that your risk register has owners, ratings and actions.
8. Financial promotions and marketing sign-off
Sample promotions – web pages, emails, social posts – and check they are fair, clear and not misleading, with the correct risk warnings and an evidenced sign-off process.
9. Vulnerable customer outcomes under Consumer Duty
Test that vulnerability is identified, recorded and acted on, and that outcomes for vulnerable customers are as good as for others. This is a standing supervisory priority, not a paper exercise.
10. Training and competence records
Confirm that staff have completed required training, that competence is assessed against role requirements, and that gaps are closed with documented action.
11. Conflicts of interest, gifts and hospitality
Review the conflicts register, personal account dealing and gifts and hospitality logs. Test whether conflicts are identified before they cause harm, not after.
12. Regulatory reporting, notifications and the breach log
Check that regulatory reports were submitted accurately and on time, that breaches and errors are logged, assessed for reportability and remediated, and that lessons feed back into the control framework.
Turning the checks into a working programme
Twelve checks listed is not a programme – a programme has owners, frequencies, sample sizes, evidence standards and a reporting line. The practical way to build one is a risk-based calendar that allocates each activity to a month, records who performs it, and captures the outcome for board reporting.
Our Compliance Monitoring Programme Builder provides that 12-month planner, with activity templates, a board reporting framework and action tracking. For firms that want ongoing support, compliance retainer services deliver proactive monitoring and a full template library on a predictable monthly footing.
Run more than a compliance review once a year
A one-off compliance review is a snapshot. A monitoring programme is the film – it shows the FCA, and your board, that controls are operating continuously and that issues are found and fixed. Start with the twelve checks above, assign an owner to each, and put them on a calendar you can evidence.
Where a gap is too large or too technical to close internally, expert support pays for itself. Speak to a compliance expert and get a monitoring programme built around your firm’s actual risks.
