The compliance monitoring plan: how to build one that works

A compliance monitoring plan is the document that sets out what your firm will check, how often, how deep and who will do it, so that you find compliance failures before a customer or the FCA does. The SYSC 6.1 text does not prescribe a format. What it does is set duties that a sensible plan has to meet, and the FCA's letters to firms say what weak oversight looks like.

The clearest wording on monitoring programmes sits in SYSC 6.1, the Handbook chapter on the compliance function. For a common platform firm (a MIFIDPRU investment firm, bank, building society or designated investment firm), the compliance function must monitor on a permanent basis and assess on a regular basis how well the firm's policies and procedures work. The rule then says how:

The same rule says the programme must set priorities from the compliance risk assessment, so that compliance risk is monitored comprehensively. That one sentence is the method for the whole guide: assess the risk first, then let the assessment decide what you monitor and how hard.

It depends on your firm type. SYSC 6.1.3-AR and SYSC 6.1.3-BR are rules for common platform firms. The table in SYSC 1 Annex 1 shows they do not apply to most other SYSC firms. Instead, SYSC 6.1.3AG says those other firms should take account of the general compliance function rule in SYSC 6.1.3R as if it were guidance: monitor and regularly assess whether their compliance measures and procedures work. It adds that, depending on the nature, scale and complexity of the business, a separate compliance function may be appropriate. SYSC 4.1.1R requires every firm in its scope to have robust governance arrangements, including effective processes to identify, manage, monitor and report risks and internal control mechanisms. Payment and e-money institutions like Fenwick Pay sit largely outside SYSC: SYSC 1.1A.1BG lists only chapter 15A (operational resilience) as applying to them. For them, SYSC 6.1 is a useful benchmark, not a rule. Check how SYSC applies to your permissions before you rely on any one rule. In practice, the FCA will still ask how you know your controls work.

For common platform firms, SYSC 6.1.3-BR puts the order beyond doubt: assessment first, programme second. For every other firm it is still the order that makes sense. If you write the programme from last year's checks or from a template, the plan will cover what is easy to test rather than what could hurt customers. The risk assessment is the part an examiner will read first, because it explains every choice that follows.

Fenwick Pay has about 40 staff, a small agent network and an EMI authorisation. Tomasz listed ten areas, scored them with the operations leads and the money laundering reporting officer (MLRO), and agreed a simple scale. The scale is the firm's own choice. It is not an FCA scale.

A plan is a calendar, a scope and an owner for each review. The FCA's rules do not set frequencies or sample sizes, so these are your decisions. What matters is that they follow the risk assessment, that you can explain them, and that you stick to them.

Sample sizes here are practical rules of thumb, not figures from the FCA. Record the population, how you picked the sample (random, risk-weighted, or both) and why the size is enough for the conclusion you draw. If a small sample shows a serious failure, widen it.

Mix the methods. A desk review tells you a control is designed well. A file review or data query tells you it operates. A walkthrough tells you whether staff do what the procedure says. The FCA's April 2026 review of customer due diligence found that most firms had some form of compliance monitoring and audit, but that the level and depth of reviews and the independence of the arrangements differed. It also describes firms that used sample-based monitoring with proportionate review cycles.

Every review follows the same five steps. Using one method each time makes results comparable from quarter to quarter and makes the work easy to explain to the board and to the FCA.

In months 3 and 4 Tomasz reviewed customer due diligence, a high-tier area. The population was 1,240 customers onboarded in the previous six months. He chose 40 files, 20 of them high-risk customers, 12 medium and 8 low, because the high-risk files carry the greatest harm. He wrote five tests before opening a file.

Nine of the 40 files had at least one exception, so 31 files passed every test: a 78 per cent clean pass rate. The three missing source-of-funds records were all on high-risk customers, which is why that finding is rated Red even though the failure rate is 15 per cent. Rating takes account of the consequence as well as the count.

The FCA's 2025 letter to payments firms says weaknesses in governance, oversight and leadership are a root cause of many of the regulatory issues it sees, and it expects you and your board to discuss the letter and act on it. Monitoring only helps if the board sees what you found and holds people to the dates. A small number of clear measures does more than a long pack.

The chart tells a story the board can read in seconds. Findings rise in the first half-year because Tomasz is looking in places no one looked before. They fall in the second half because owners are fixing them and the re-test confirms the fixes work. Do not close an action because the owner says it is done. Close it when you have seen the evidence or re-tested.

We have not found an FCA review devoted to compliance monitoring plans alone. Its multi-firm reviews and letters do show where oversight breaks down, and the same themes recur. These are drawn from the FCA's own text, and each links to a habit you can fix.

The same pattern appears in the sector letters. The payments letter expects independent challenge to business and operational decisions, active monitoring of agents and distributors, and checks that outsourced functions work as intended. The consumer lending letter says that, through its firm engagement including on-site visits, the FCA has seen deficient oversight and ineffective governance structures, and it expects a board-level Consumer Duty champion to make sure outcomes are tested and challenged.