Rules and scope
A maintained obligations map connects sources of law with products, countries, customers and process owners. A new service or rule change triggers a fresh applicability review.
REGULATORY TOOLS / GRC
Compliance function: make rules work in daily operations
A compliance function helps a regulated firm meet its obligations in day-to-day business. It identifies risks, advises management and checks whether procedures and controls actually work.
Mandate and position
Management is responsible for sound organisation. Compliance promotes effective procedures and controls, identifies material regulatory risks and advises management. It needs a clear mandate, resources, information access and a direct reporting line. Its design follows the firm’s risk profile.
Independence and involvement
Compliance must be involved before product and process launches while remaining free from sales conflicts. Securities services are also subject to the specific MaComp requirements.
Risk assessment and monitoring
A compliance risk assessment connects obligations with real workflows: what may fail, how severe is the impact, what controls exist, and what gap remains? A documented, risk-based monitoring programme follows from that assessment.
Assess the risks
Examples include customer disclosures, suitability, target markets, conflicts, advertising, complaints, outsourcing and records. Control frequency and depth reflect the risk.
Evidence the controls
Samples, system rules, exceptions and complaints provide evidence. Findings need an owner, deadline, action and effectiveness review.
Advice, training and escalation
The function reviews new products, agreements, digital customer journeys and major process changes before launch. It translates requirements into instructions and relevant training. Repeated breaches and serious deficiencies need management decisions.
Customer journey
A CFD onboarding journey may raise questions about appropriateness, risk warnings, target-market restrictions and records. Compliance examines the control logic using real cases.
Reporting
Reports should show risk trends, findings, causes and open actions. Banking MaRisk requires at least annual and event-driven management reports, also passed to internal audit.
Interfaces and visible outputs
Business owners run their processes and controls. Compliance monitors and advises within its remit; internal audit independently assesses the effectiveness of compliance too. Outsourcing tasks does not transfer management responsibility.
Typical evidence
Mandate, obligations map, risk assessment, monitoring plan, samples, advice records, training, reports and action log.
Warning signs
A plan without testing, late involvement in product launches, reports without decisions or overdue actions point to a gap between policy and operations.
Sources and applicability
Duties depend on firm type and activity. MaComp, banking MaRisk and WpI MaRisk have different addressees; this overview does not replace an applicability assessment.
- BaFin MaComp, BT 1 (securities compliance)
- BaFin MaRisk 06/2026, AT 4.4.2
- BaFin WpI MaRisk 09/2026, AT 4.4.2 (for small and medium investment firms from 1 January 2027)
Did you know?
From the Pathfinder
Business concept
How an app can become an activity that requires permission.
Have you explored?
Across our tools & projects
Fit & Proper · skills matrix
Prepare management profiles and collective suitability reviews.
International market entry / Germany
Is Germany your next market?
Considering a local office, a branch or a standalone authorisation in Germany? The appropriate route depends on your home jurisdiction, activities and operating model. 3RMCN combines experience from complex supervisory projects with product, technology and delivery expertise: from entry strategy and key interfaces through to operational readiness.
Discuss your plans ↗Supervisory perspectives
Familiar with several regimes
Experience in the context of CySEC (Cyprus), MFSA (Malta), FCA (United Kingdom), the European ESMA framework and MAS (Singapore). ESMA is not a national licensing authority.
International structuring
Incorporating offshore?
For incorporation in offshore jurisdictions, relevant specialists from the network can be involved. Jurisdiction, activities and regulatory obligations need to be considered for each project.