Building a compliance framework that holds up

Governance and accountability

Someone must own the obligations. In smaller licensees that is a director with a genuine mandate; in larger ones a compliance committee reporting to the board with a documented charter. Responsible managers are not figureheads — they must be involved in the business, hold the competence relied on in the application, and their departure is a notifiable event that can put your authorisations at risk. Maintain succession cover for every authorisation.

Policies mapped to obligations

Build an obligations register: each obligation, its source, the control that addresses it, the owner, and how compliance is evidenced. The register is what makes the policy suite auditable and what makes gap analysis possible when you add a product or a channel.

Monitoring and supervision

• Risk-based file reviews of advice and client interactions, with findings recorded and remediation tracked to closure.
• Call and communication monitoring where advice is given by phone or chat.
• Pre-approval and periodic review of client-facing material.
• Complaints analysis for systemic themes, not just individual resolution.
• An annual compliance plan with scheduled reviews and reported outcomes.

Registers you must actually keep

Conflicts of interest, gifts and benefits, related party transactions, complaints, incidents and breaches, training and professional development, and authorised representative appointments. Registers that are current and reviewed are the single most useful evidence in a surveillance.