Compliance

What it is

Compliance is the organisational function — and the body of practice — through which an institution makes sure that what it does is consistent with the laws, regulations, supervisory expectations, contractual obligations and ethical commitments that bind it. In financial institutions it is one of the three classical lines of defence, alongside the operating business and internal audit.

How it differs from risk management and internal audit

• Compliance answers "are we operating inside the rules?" Its mandate is rule-driven: prevent, detect and document breaches of obligations.
• Risk management answers "are we knowingly taking acceptable risk?" Its mandate covers a broader exposure surface — credit, market, operational, liquidity, conduct.
• Internal audit answers "are the first two lines working?" It is independent of both, reports to the audit committee, and tests the effectiveness of controls rather than running them.

What changes the work

The compliance discipline is increasingly evidence-driven and audit-grade: a control that cannot be proven to have operated is treated as a control that did not. Modern frameworks — the EU AML Package, DORA, GDPR, the EU AI Act — all reward institutions that can demonstrate continuous, traceable, reproducible operation of their controls, and penalise those that cannot.