Building an effective compliance programme: what the DFSA’s thematic review expects from your firm

An effective compliance programme puts two things at its centre: Compliance risk and senior management accountability. Around them sit seven elements: controls and supervision, policies and procedures, advice, training, monitoring, regulatory relations and reporting.

These are the areas where the DFSA’s thematic review on compliance arrangements, published on 10 April 2026, found many firms falling short. The review focused on fintech, but the DFSA encourages all authorised firms to assess themselves against it.

Following our recent webinar on the thematic review, Peter Haines, Director of GRC Training at CCL Academy, explores what each element of an effective compliance programme looks like in practice, where firms commonly fall short, and how they can strengthen their arrangements.

What sits at the centre of an effective compliance programme?

Around 20 years ago, the group heads of compliance at around ten globally significant financial institutions agreed seven elements of an effective compliance programme, with senior management accountability at the centre. I would put one more thing alongside it: compliance risk, and a systematic approach to managing it.

Compliance risk

The best definition of compliance risk I know comes from the Basel Committee on Banking Supervision’s 2005 paper, Compliance and the compliance function in banks:

 “The risk of legal or regulatory sanctions, material financial loss or loss to reputation as a result of failing to comply with laws, regulations and rules.”

This definition has been highly influential across international regulatory practice, including in the Middle East. Its breadth is important, because it relates to “laws”. This breadth makes it essential to define the Compliance function’s responsibilities clearly.

For compliance officers and Senior Executive Officers (SEOs), my advice is to establish who in the second line manages each area of risk. This should be a deliberate decision, not an assumption.

Whatever the arrangement, everyone needs to understand their responsibilities, particularly across the first and second lines of defence.

Senior management accountability

You cannot run an effective compliance programme without senior management accountability. That means senior management supporting and valuing the compliance function, while challenging it and the wider compliance culture when necessary.

The most concrete form of that support is resourcing. Making sure compliance has the people and expertise it needs is one of senior management’s clearest responsibilities, and the DFSA is paying attention. Since the RJ O’Brien fine, compliance resourcing has remained a recurring theme in the DFSA’s supervisory communications and outreach.

The Head of Compliance and the SEO may not see eye to eye on resourcing at first. That’s healthy, as long as they reach a shared view on how much resource compliance needs and how much compliance risk the firm is prepared to take. The same principle applies more widely: constructive challenge is a sign of a working compliance culture, and senior management should want compliance officers who are willing to ask, “are you sure?” when it matters. Compliance officers should be prepared to provide that challenge.

What are the seven elements of an effective compliance programme?

1. Controls and supervision

First, distinguish between the compliance programme and the compliance function. Compliance should review and challenge the controls that manage compliance risk, but those controls should generally be operated by first-line management and overseen by senior management. That division of responsibility is central to effective governance.

Secondly, be honest about how your controls actually work. The DFSA’s review found firms claiming significant automation where the processes, such as onboarding, were still largely manual.

2. Policies and procedures

Every firm, large or small, should have a compliance risk assessment, and its policies should flow from it. Higher-risk business areas and products need more focused policies and controls that are reviewed more often.

Length matters too: keep policies short. If a single compliance policy runs past 10 pages, there is a good chance the only people reading it are the Compliance team, perhaps a Risk Committee member, and, perhaps, some of your SEOs. Most people in the first line won't read more than a page or two.

So put an executive summary at the front of each policy, setting out the dos and don’ts and the key things employees need to know. The detail can sit behind it, and anyone who needs more can come to you for advice.

 3. Advice

Compliance advice should also be risk-based. Spend more time with the people in your highest-risk areas. If you're Head of Compliance, walk through their office every day. You'll get the usual banter, but you'll also get "while you're here, I've got a question."

Those informal conversations matter. They often produce questions you’d never hear otherwise, giving Compliance a chance to address issues before they become problems.

4. Training and awareness

Firm-wide eLearning on your key subjects is a solid foundation. For the pockets of higher compliance risk, add instructor-led training tailored to your firm’s activities, people and specific risks.

Just as important is who it reaches. A good programme covers everyone, from the board and senior management to revenue generators, operations, and the second and third lines.

5. Monitoring

A compliance monitoring programme (CMP) must be built around your compliance risk assessment. Higher-risk areas should have more frequent testing, larger samples, or both.

Yet many compliance monitoring plans I see are not fit for purpose, and the most common problem is direction. You need to test in the direction of your compliance risk. A surprising number of firms do the opposite, wasting time on tests that do not properly establish whether the relevant risk is being managed. On every risk-based monitoring course I’ve run, at least one attendee has had tests pointing the wrong way.

A good plan also tests both how things are done and what they achieve. Process tests check that controls and procedures are being followed, while outcome tests check that they are producing the intended results.

How the CMP is managed matters too. The DFSA’s review found missing board sign-off, no version history, no clear document owner, and over-reliance on group-level templates that haven’t been tailored to the DFSA Rulebook. These are not minor administrative details. If a firm can’t show that its CMP is properly governed, maintained and relevant to its own activities, the regulator has little reason to trust what’s in it.

Finally, consider scope. GEN 5.3.12 requires firms to document their monitoring and keep records of breaches of legislation applicable in the DIFC. My reading is that this implies monitoring DIFC laws, not just the DFSA rules. Not every law will apply to your firm, and many are reflected in the rules anyway, but assess what’s relevant, take a view and agree it with your board.

6. Regulatory relations

Treat your regulator like a key client. The Compliance Officer will usually manage the day-to-day relationship, but the SEO and others in senior leadership roles should also have occasional touchpoints, especially in larger firms. An SEO with no interest in the regulator is missing a trick.

The aim is simple: no surprises for the regulator. That means understanding what the DFSA expects, maintaining open communication and ensuring the firm can evidence that it does what it claims to do. Record-keeping comes up again and again, because the DFSA, like any regulator, works on a simple principle: if it isn’t evidenced, it didn’t happen.

Expertise matters too. When compliance officers ask the DFSA very basic questions about the rules, it raises concerns about whether the function has the expertise to do its job. The DFSA specifically commented on this in the review. Investing in your compliance team’s own training is as important as training the rest of the firm.

7. Reporting

Reports to senior management should be concise, clear and punchy. They should explain the firm's key compliance risks, what's being done to manage them, where the outstanding issues lie and what senior management needs to do. They should also cover the status of compliance risks and relevant upcoming regulatory developments.

A 30-page compliance report is barely worth putting in the board papers, because it is unlikely to be read. An executive summary that says "this is what I need you to know, and this is what I need from you" is a far better starting point. Reports must also stand up to scrutiny, as the DFSA may ask to see Compliance and MLRO reports.

Good reporting also depends on Compliance being able to escalate freely. Senior managers must make sure the Compliance function can raise issues directly with the board. That means setting up reporting lines that give Compliance real independence and authority, so its concerns aren’t filtered or diluted along the way.

What comes next?

Most attendees at our recent DFSA compliance webinar are already planning to act, and 63% said they will review their compliance monitoring programme. That’s the right instinct. A risk-based approach doesn’t mean zero risk, but when something goes wrong, one of the first questions will be why your monitoring didn’t find it.

Don’t wait for the DFSA to come to you, either. It could well run similar reviews outside fintech, so consider running your own thematic review, internally or externally, ideally led jointly by the Head of Compliance and a first-line senior manager. This gives you the chance to find and fix gaps on your own terms, and to show the regulator a proactive approach if it does come calling.

How we can help

Several of the gaps the DFSA found come down to training, from first-line staff who don’t realise they own the risk to Compliance teams that need deeper expertise. CCL Academy provides training for every level of the firm, tailored to your risks. Get in touch to find out more.

Peter has over 35 years’ experience in the field of regulation and compliance. A chartered accountant, Peter spent 6 years working with the UK’s SFA (now the FCA) and has headed up regional and global compliance functions at Paribas, UBS Investment Bank and Bank of America.

Since 2006, Peter has specialised in training, focusing on boards, senior management and assisting the next generation of compliance officers. His coverage includes most areas of compliance and financial crime, corporate governance and risk management. His style is inclusive, interactive and based on practicalities, not just rules.

As Director of GRC Training, he works closely with our clients to ensure that our programmes are tailored to their exact needs and meet, or surpass, their expectations.