Outsourcing the compliance function? Responsibility remains with your organisation

An external compliance officer takes work off your hands. What remains your organisation’s role?

Outsourcing the compliance function: what does the external officer do and what remains with you?

For many small and medium-sized regulated financial firms, maintaining a full in-house compliance department is neither necessary nor proportionate. Outsourcing the compliance function to an external compliance officer may then be an appropriate solution, whether for ongoing support or periodic monitoring.

This does not mean that the firm must still perform the compliance work itself. The purpose of outsourcing is precisely to have a qualified external specialist carry out the agreed activities. The firm does, however, remain responsible for compliance with applicable requirements and for ensuring that the compliance function operates properly. What does this mean in practice - and where does the external compliance officer’s role end?

Start with the obligation, not the contract

The Dutch Financial Supervision Act contains general rules on outsourcing. The precise requirements depend on the type of financial firm, its licence and the activities being outsourced. Sector-specific Dutch and European requirements may also apply. There is therefore no standard model suitable for every regulated firm.

The analysis should not start with the external provider’s service package, but with the firm’s own obligations and risks. These determine which compliance activities are required and what level of support is appropriate. This helps prevent both relevant matters from being overlooked and the firm paying for activities that add little value.

The actual nature of the relationship also matters. Occasional legal or compliance advice differs from an external provider that performs ongoing monitoring, reporting and advisory work and thereby fulfils all or part of the compliance function. The label attached to the agreement is not decisive; the activities actually performed are what matter.

What does an external compliance officer do?

An external compliance officer can carry out a substantial part of the specialist and recurring compliance work. Depending on the agreed scope, the external officer may:

prepare or update the compliance risk assessment and monitoring programme;

• perform monitoring reviews and report on the results;

• advise on regulation, policies, products, incidents and organisational changes;

• provide training and identify relevant developments; and

• report findings, risks and required improvements to the management body and escalate where necessary.

A properly designed external function should therefore reduce the firm’s workload. The firm does not need to repeat the analysis and controls or develop all specialist expertise in-house. It should be able to rely on the work and expertise of the external compliance officer, provided that the engagement is appropriately structured and the officer is able to perform the role effectively.

What must the firm continue to do itself?

The responsibility retained by the firm primarily requires it to enable the external function to operate and to act on its output. In practice, this involves a limited number of clear tasks:

• appoint an internal contact who understands the organisation and coordinates the relationship;

• give the external compliance officer timely access to relevant information, staff and decision-making;

• discuss reports and advice and decide which measures are required; and

• ensure that agreed actions are implemented and completed within the organisation.

This is not the same as creating a second compliance function alongside the external officer. The external compliance officer investigates, monitors, identifies issues and advises. The management body and responsible employees take business decisions and implement remedial measures. A clear division of responsibilities prevents duplication.

How can the management body retain oversight without repeating the work?

Oversight does not require the management body to reassess every file or repeat every control. At a high level, it must be able to determine whether the engagement continues to reflect the firm’s activities, whether adequate capacity and access are available and whether significant findings are being addressed. A periodic discussion of the monitoring programme, reports and outstanding actions can provide a workable basis.

The external compliance officer must have sufficient freedom to identify risks independently and propose priorities. The management body should not determine the desired outcome of a review. Its role is to ensure that the compliance function can perform its work and that relevant findings lead to decisions and action.

An external compliance officer is not automatically independent

To operate independently, an external compliance officer must not review activities for which they are also operationally responsible. The officer must also have independent access to relevant information and staff and be able to report findings directly to the management body without obstruction. Independence therefore depends on the actual allocation of responsibilities and the officer’s position within the organisation, not merely on the fact that the officer is external.

When is an external compliance function proportionate?

A smaller firm with limited activities, products and clients can often use a more compact model than a large and complex organisation. It may not need a full-time compliance officer; monitoring may take place at predefined intervals, with specialist expertise used where it is most relevant.

This is appropriate only if the model reflects the firm’s actual risks. A limited range of activities may justify a more focused monitoring programme, but it does not justify disregarding relevant risks. The firm should be clear about what is monitored, what capacity is required and when additional support will be available.

Proportionality is not a one-off conclusion. A new service or client group, growth, an incident or regulatory change may require the scope, frequency or capacity to be adjusted. The model should therefore be reviewed periodically and when relevant changes occur. Proportionality allows the form, scale and intensity to be tailored, but the chosen model must always ensure that the compliance function remains effective.

Outsourcing should genuinely reduce the workload

An external compliance function is successful only if it adds expertise and structure while also taking work off the firm’s hands. This requires clarity from the outset about what the external compliance officer will do, which information and cooperation are needed and who within the firm will decide on follow-up action.

The firm does not have to perform the compliance work itself after outsourcing it. It must remain available to answer questions, make decisions when required and ensure that findings are not left unresolved. The external officer performs the compliance work; the firm remains responsible for what it does with the results.

DUFINCO supports organisations in determining the applicable obligations and risks, defining and structuring the external compliance function and monitoring the arrangement.

Would you like to assess which model fits your licence, activities and organisation? Contact us at info@dufinco.nl or call +31 6 512 47 217.