Manage and Oversee the Compliance Functions as Required by the FAIS Act

Task 4 established that the KI is accountable and the Compliance Officer monitors. This task goes deeper into that relationship across all 18 of its QCs — when a CO must be appointed, how they're approved, what genuine independence looks like, and what happens when their findings are ignored.

QC1–QC6: Establish vs Monitor

This single distinction gets tested repeatedly in different forms across this task. The KI establishes the compliance function — builds the framework, the reporting lines, the monitoring schedule (QC3). The compliance function then monitors it day to day. QC4's "maintain" is the critical addition: a compliance function set up once and never revisited as the FSP grows has not satisfied the ongoing half of the obligation.

QC5 pushes further — vague arrangements ("we monitor regularly") fail this QC. A defined frequency, like monthly file reviews or quarterly compliance reports, is what turns a policy into an actual operating rhythm. QC6 is the meta-level check: periodically reviewing whether the monitoring itself is still adequate as the FSP's size or risk profile changes.

QC7–QC9: When a Compliance Officer Must Be Appointed

Section 17(1) sets a specific trigger: once an FSP has more than one Key Individual, or one or more representatives. The only genuine exception is a sole proprietor who is their own only KI and only representative.

A Compliance Officer must be approved against the criteria in Board Notice 127 of 2010, including passing the applicable Level 1 regulatory exam. QC9 is blunt about the consequence of skipping this: an unapproved CO cannot lawfully be relied on, however qualified they appear on paper — approval is not a formality that can be assumed while an application is pending.

QC10–QC15: Independence Isn't Just an Org Chart Line

The CO monitors the FSP's ongoing compliance and reports on it — but this never transfers the KI's own accountability; a CO signing off a report doesn't shield the KI if the underlying oversight was inadequate. QC11 adds a resourcing dimension often overlooked: under-resourcing a compliance function is itself a compliance risk. A CO with no budget, no support staff, and no real time allocation cannot function effectively regardless of individual competence.

Independence (QC12–14) means a CO who reports to, and is evaluated by, the very people whose conduct they monitor cannot function independently in substance, whatever the reporting line looks like on paper — and the same conflict-of-interest logic applied to representatives under Task 6 applies to the CO role itself. QC15 closes a gap candidates often miss: small FSPs without a dedicated CO are not exempt from managing conflicts of interest — the obligation continues through the FSP's general governance and Code of Conduct duties regardless.

QC16–QC18: Reading Reports and Acting on Them

QC16 is a genuine engagement requirement, not a formality — a KI must actually understand what a compliance report says before signing it off. A KI who signs without reading, and later discovers the report flagged serious issues, cannot claim the signature protects them; it's evidence they had the information and failed to act. QC17 follows: findings of non-compliance must actually trigger corrective action tracked through to resolution, not just acknowledgment. And QC18 removes any ambiguity — if a CO lacks or loses FSCA approval, the FSP must replace them, not simply wait for the situation to resolve itself.

Quick Recap

• The KI establishes the compliance function; the Compliance Officer monitors it — two different verbs, two different roles
• Section 17(1) triggers mandatory CO appointment once an FSP has more than one KI, or any representatives
• Independence means freedom to report honestly on management itself, not just a title on an org chart
• Signing a compliance report without genuinely reading it does not protect a KI from what it contained