The First 90 Days of a New Head of Compliance

Why the first 90 days matter so much

A new Head of Compliance takes on personal accountability from the day they start performing the SMF16 Compliance Oversight function. Under the Senior Managers and Certification Regime, the duty of responsibility means they can be held to account if a breach happens in their area and they did not take reasonable steps to prevent it. That makes the first three months unusually important. The new holder needs to understand the firm quickly, find any problems they have inherited, and put a credible plan in front of the board.

The first 90 days also shape how the rest of the business sees the role. A Head of Compliance who arrives, listens, prioritises sensibly and reports clearly earns trust. One who either changes nothing or tries to change everything at once can lose it fast.

This article sets out a practical 90-day plan from both sides: what the new Head of Compliance should do, and what the CEO and board should expect to see and provide. It applies whether the appointment is permanent, interim or fractional, and whether this is the firm’s first in-house Head of Compliance or a replacement for someone who has left.

Before day one

Good onboarding starts before the start date.

• Confirm the regulatory position. Is the new holder already approved for SMF16 at your firm, is a Form A application in progress, or are they covering under the 12-week rule while an application is prepared? Since April 2026, firms have 12 weeks to submit an application for a replacement, and the cover individual can continue until the FCA decides it. Our page on SMF16 and SMF17 temporary cover explains the timetable, and our Form A guide covers the application.
• Prepare the Statement of Responsibilities. Agree which prescribed responsibilities the new holder will carry, and make sure the document reflects what they will actually do. See our Statement of Responsibilities guide.
• Assemble the handover pack. If the previous holder is still in post, arrange an overlap. If not, gather the records they would have handed over. Our article on senior manager handover best practice lists what should be included.
• Arrange access. Systems, board papers, regulatory correspondence, the FCA’s online systems and key people’s diaries should all be ready on day one.

Days 1 to 30: listen, read and triage

The first month is about understanding the business and finding anything urgent. A new Head of Compliance should resist the temptation to rewrite policies straight away.

Meet the people who matter

The CEO, the chair and other non-executives, the other senior managers, the heads of each business area, the MLRO if it is a separate role, internal audit if there is one, and the people who do the day-to-day compliance work. Each conversation should cover what the business does, where people think the risks are and what they expect from compliance.

Read the essential documents

• the firm’s permissions and its entry on the FCA Financial Services Register
• the business plan and any regulatory business plan from authorisation
• correspondence with the FCA for the last two to three years, including any open requests or commitments
• the breach log, complaints data and any FOS decisions
• the compliance monitoring plan and recent results
• the latest Consumer Duty board assessment (see our article on what a good Consumer Duty board report looks like)
• the financial promotions approval records
• the compliance policies and procedures
• Statements of Responsibilities and, for Enhanced firms, the management responsibilities map
• recent board and committee minutes

Triage for urgent issues

The most important output of the first month is a short list of anything that needs immediate action. Typical examples are an unresolved breach that may need to be notified to the FCA under SUP 15, an overdue regulatory return, a commitment made to the FCA that has slipped, or a financial promotion that should not be live. Anything notifiable should be escalated and reported promptly; inheriting a problem is not a reason to delay.

Days 31 to 60: assess and plan

With the urgent issues identified, the second month is about forming a view of the compliance framework as a whole.

• Compliance risk assessment. Map the firm’s regulatory obligations against its business lines, products and customers, and rate where the risks are highest.
• Gap analysis. Compare the existing framework against that risk assessment. Where are policies missing, out of date or not followed in practice?
• Reset the monitoring plan. Make sure compliance monitoring is aimed at the highest risks, not simply repeating last year’s tests.
• Review management information. Does the board receive information that would tell it if something was going wrong? If not, design the MI it needs.
• Check resources. Is the compliance function adequately resourced for the firm’s size and risk? The FCA expects an adequate, independent compliance function, applied proportionately.
• Agree the interface with the MLRO. Where SMF16 and SMF17 are held by different people, agree how compliance monitoring will test financial crime controls. Where they are held by one person, plan for independent review. Our article SMF16 and SMF17: one person or two? covers the trade-offs.
• Deliver some quick wins. Fixing a slow financial promotions process or clarifying who signs off what builds credibility with the business.

Days 61 to 90: report and commit

By the end of the third month, the board should receive a clear written report from the new Head of Compliance. It should cover:

1. an honest assessment of the compliance framework, including what works well
2. issues found and how they have been or will be resolved, including any regulatory notifications made
3. the compliance risk assessment and the priorities that follow from it
4. a 12-month roadmap with milestones and owners
5. the revised compliance monitoring plan
6. resourcing needs, including any hires, systems or external support
7. the MI the board will receive in future

The board’s response matters as much as the report. A board that discusses it seriously, records its decisions and funds the agreed priorities gives the new Head of Compliance the backing they need. It also creates evidence that the firm, and its senior managers, took reasonable steps.

What the CEO and board should provide

• Access. A seat at the executive committee and a standing item at board meetings.
• Time. Space in the first month to listen and read, without being pulled straight into day-to-day sign-offs.
• Candour. An honest briefing on known problems. A new Head of Compliance who discovers something the CEO already knew about will trust the CEO less.
• Support for difficult messages. If the 90-day report identifies serious issues, the board should treat it as the system working, not as bad news to be softened.
• Budget. Agreement in principle that the priorities identified will be resourced.

How the plan differs for interim and fractional appointments

Interim. An interim Head of Compliance brought in after a sudden departure, or during supervisory pressure, compresses the first two phases into a few weeks. Their priority is to stabilise the function, deal with urgent regulatory matters and hand over a clear plan to the permanent appointee.

Fractional. A fractional Head of Compliance working one or two days a week will take longer to cover the same ground, so the plan needs to be prioritised more sharply. Agreeing the scope of each day, and who in the business supports the role between visits, is essential.

A note for candidates

If you are considering an SMF16 role, ask about the first 90 days before you accept. Ask what the previous holder left behind, whether there are open FCA matters, how the board engages with compliance and what budget exists. A firm that answers openly is far more likely to support you once you are in post. Our articles on career paths to SMF16 and SMF personal liability are useful background, and you can register with us for current roles.

Frequently asked questions

When does a new Head of Compliance become accountable?

From when they begin performing the SMF16 function, whether as an approved senior manager or as cover under the 12-week rule. Cover individuals are now subject to the Senior Manager Conduct Rules.

What if the new Head of Compliance finds a breach the previous holder did not report?

It should be assessed promptly and, if it is notifiable, reported to the FCA under SUP 15 without delay. Inheriting a problem is a reason to act quickly, not to wait.

Should the 90-day report go to the full board?

Yes, in most firms. It sets the compliance agenda for the year and records the board’s decisions on priorities and resources.

How can we make sure we hire someone who will handle the first 90 days well?

Ask candidates at interview how they would approach their first three months at your firm, and listen for a plan that balances listening, triage and reporting. Our compliance recruitment team can help you assess this.