What Adequate Compliance Resourcing Costs

Every regulated firm has a compliance budget. Very few finance leaders can explain how the number was arrived at, beyond its being roughly what it was last year plus inflation.

That is a problem, because unlike most cost lines, this one has a regulatory floor. The FCA does not merely prefer that firms resource compliance properly. It requires it, it tests it, and the finding that a function was under-resourced appears in enforcement notices with some regularity.

This is written for the CFO or finance director who owns the budget rather than the function. It sets out what the obligation actually is, how to size the requirement from the workload rather than from last year’s figure, what the realistic ways of buying capacity are, and how to defend the number to a board that regards compliance as overhead.

“Adequate resources” is a rule, not an opinion

Two separate obligations bite here, and they operate at different levels.

At firm level, adequate resources is one of the threshold conditions a firm must satisfy to hold and keep its permission. It covers financial resources, but it also covers people, systems and controls. A firm that cannot demonstrate it has the capability to run its regulated business compliantly is not meeting a condition of authorisation.

At function level, SYSC requires the compliance function to have the authority, resources and expertise to do its job, and to monitor and assess the adequacy and effectiveness of the firm’s arrangements. Our guide to SYSC covers the detail.

Both of these are judged on outcomes, not on spend. There is no published minimum, no percentage-of-revenue benchmark, and no safe harbour. What a supervisor assesses is whether the function is actually delivering what the firm’s risk profile demands — which means the honest way to build the budget is from the workload upwards.

What one person is actually being asked to do

Most small and mid-sized regulated firms run a compliance function of one. Before deciding whether that is adequate, it is worth writing down what that one person owns.

• The monitoring programme — planning it, performing the testing, writing up findings, tracking actions to closure and reporting to the board. SMF Capital’s guide to compliance monitoring gives a realistic picture of what a programme involves; it is not a part-time activity squeezed around other duties.
• Advice to the business — the queries that arrive daily and cannot wait, which is the work that crowds out everything scheduled.
• Financial promotions — review and sign-off, record keeping, and the approvals regime where it applies.
• Policies and procedures — drafting, annual review, and keeping them aligned with what the firm actually does.
• Training and competence — conduct rules training, certification where it applies, and evidencing both.
• Regulatory reporting and notifications — returns, breach reporting and keeping the supervisor informed.
• Financial crime — where the same person also holds SMF17, add the risk assessment, customer due diligence oversight, transaction monitoring review, suspicious activity reporting and the annual MLRO report.
• Project work — every new product, new permission, system change or regulatory initiative lands here.

Set that list against one full-time equivalent and the arithmetic usually fails somewhere. The question is not whether something gets dropped. It is which thing, and whether the firm chose it deliberately or discovered it in a supervisory review.

The four ways to buy capacity

Each has a different cost shape, and the right answer is usually a combination rather than a single choice.

A permanent hire

The default, and the right answer where the workload genuinely supports a full-time role. Remember that the true cost is not the salary: add employer’s National Insurance, pension, bonus, recruitment, equipment and the management time of someone who may have no compliance background supervising them. Our compliance salary guide carries current UK benchmarks by role and seniority.

The risk with a permanent hire at a small firm is seniority mismatch. A firm that can only afford a junior person for a role carrying SMF16 accountability has not solved its problem, it has relocated it.

Fractional or part-time senior capability

An experienced Head of Compliance or MLRO working one to three days a week gives a small firm genuine seniority at a cost it can carry indefinitely. For firms whose workload does not justify a full-time senior person but whose risk profile demands senior judgement, this is frequently the correct structural answer rather than a stopgap.

The constraint is that the time commitment has to be real and defensible. The FCA will expect the days contracted to match the responsibilities held, and a nominal arrangement will not survive scrutiny. SMF Capital’s fractional and part-time MLRO recruitment page covers how these engagements are typically structured.

Outsourced testing capacity

Buying in a consultancy to perform specific monitoring reviews is a sensible way to add testing capacity without adding headcount, and it has the useful side effect of introducing independence where an in-house person would be reviewing their own area.

The limit is accountability. Outsourcing the testing does not outsource the responsibility for it; the SMF16 still owns the programme and the conclusions. Our post on outsourcing the MLRO function sets out where the line falls.

A second pair of hands below senior level

Often the most cost-effective and least considered option. A compliance analyst or monitoring officer doing the file reviews, call sampling and evidence gathering frees the senior person to exercise judgement rather than performing clerical testing. For many firms this buys more real capacity per pound than any other option.

Where firms under-resource and get caught

Four patterns recur.

Growth without review. The compliance function was sized for the firm as it was three years ago. Headcount has doubled, a new product line has launched, and the compliance resource has not moved. This is the single most common failure, and it is a finance failure as much as a compliance one, because nobody triggered a review when the business changed.

The combined role at scale. One person holding both SMF16 and SMF17 is proportionate at twenty staff and increasingly indefensible at a hundred. There is no bright line, but if the same individual is designing the monitoring programme and owning the financial crime controls it tests, independence is already strained.

No cover. A single-person function with no deputy means that illness, resignation or a sustained project leaves the firm with no compliance capability at all. The regulatory obligations do not pause, and the 12-week rule is a safety net rather than a resourcing plan.

Authorisation commitments not funded. The regulatory business plan submitted at authorisation described a compliance function. Firms routinely describe what they intend to build and then fund what they can afford, and the gap between the two is a documented commitment the firm is not meeting. Our guide to the regulatory business plan covers what those commitments look like.

Building a number you can defend

A workable method, and one that produces a figure with reasoning attached rather than a guess.

Start from the obligations, not the headcount. List what the firm must do, by regime and by frequency. Monitoring reviews per year, promotions volume, training cycles, reporting deadlines, financial crime obligations. This is the demand side, and it is knowable.

Estimate the time each requires. Ask the person doing it. They will usually know, and the exercise itself tends to surface work that nobody had accounted for.

Allow properly for reactive work. Advice queries, incidents and ad hoc business requests consume a substantial share of any compliance function’s week. A plan built on the assumption that scheduled work fills the available days will fail in month one.

Identify the gap and price the options. The difference between what is required and what current resource can deliver is the decision. Price it as a permanent hire, as fractional days, as outsourced testing, and as a junior addition — the comparison is frequently counter-intuitive.

Record the decision and the reasoning. This matters more than the number. A board that considered the analysis, chose a level of resourcing and documented why is demonstrating reasonable steps. A board with no paper trail is not, whatever it spent.

Defending it to a board that sees overhead

The argument that works is not about risk appetite in the abstract. It is about the specific, quantifiable consequences of being found inadequate: a skilled person review commissioned at the firm’s own expense, a variation or restriction on permissions, remediation and redress programmes, and in the worst cases individual liability for the senior manager who accepted the resourcing.

A section 166 review alone routinely costs a multiple of what the resourcing gap would have cost to close, before accounting for management time and the supervisory relationship afterwards.

Framed that way, the compliance budget stops being a cost to be minimised and becomes an insurance decision with a knowable downside — which is a conversation finance leaders are well equipped to have.

References and further reading

• FCA: Senior Managers and Certification Regime — senior manager accountability for resourcing decisions.
• The Money Laundering Regulations 2017 — the financial crime obligations that fall on a combined compliance and MLRO function.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — the workload a monitoring programme actually represents.