The FCA doesn't just expect firms to have policies — under SYSC 6.1.1R, it expects firms to have a coherent, integrated compliance framework in which every policy, every monitoring activity, every training programme, and every governance structure connects to a clearly articulated overarching commitment. Without that foundation, what you have is a collection of documents. With it, you have a compliance programme. Most firms have the documents. Very few have the framework that ties them together into something the FCA would recognise as a genuine compliance programme. The FCA doesn't inspect policies — it inspects programmes.
What's included:
Full regulatory mapping: SYSC 1.1.1R/4.1.1R/6.1.1R/9/24/25/27, PRIN 2.1.1R/2A/3/6/7/8/9/10/11, COBS 2.1/9A/10/16A, TC Sourcebook, COCON 2.1.1R, SUP 10C/15.3, FSMA 2000, UK GDPR/DPA 2018, MLRs 2017, Consumer Duty PS22/9, and FG21/1
18-chapter integrated framework: compliance programme structure, governance, regulatory obligations, financial crime, data protection, conduct and consumer protection, SM&CR, monitoring, training, risk management, breach management, and record keeping
Three-lines-of-defence model: First Line (business ownership), Second Line (compliance oversight and challenge), and Third Line (internal audit assurance) — with Board governance structure and Management Responsibilities Map
Compliance monitoring programme: monthly CDD/transaction monitoring, quarterly conduct risk indicators, bi-annual training and competency review, and annual framework effectiveness assessment
Breach management: four-hour initial notification standard, 20 business day investigation completion, SUP 15 reporting triggers, and customer redress governance (Board approval for aggregate cost exceeding £50,000)
Five-category compliance risk assessment: regulatory/legal, conduct/consumer, financial crime, data protection, and operational — with five-point likelihood/impact/velocity matrix
Ready-to-use appendices: General Compliance Assessment Checklist, Product Approval and Governance Assessment, Financial Crime Risk Assessment, and Product and Service Compliance Assessment Template
+ much more
Who is this for?
Compliance Officers, SMF16/17 holders, and Boards at FCA-regulated firms who need a single, board-approved Master Compliance Policy that ties every subsidiary policy and compliance activity into a coherent, auditable programme — and gives the FCA a clear picture of a firm that takes compliance seriously at every level.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
The FCA doesn't just expect firms to have policies — under SYSC 6.1.1R, it expects firms to have a coherent, integrated compliance framework in which every policy, every monitoring activity, every training programme, and every governance structure connects to a clearly articulated overarching commitment. Without that foundation, what you have is a collection of documents. With it, you have a compliance programme. Most firms have the documents. Very few have the framework that ties them together into something the FCA would recognise as a genuine compliance programme. The FCA doesn't inspect policies — it inspects programmes.
What's included:
Full regulatory mapping: SYSC 1.1.1R/4.1.1R/6.1.1R/9/24/25/27, PRIN 2.1.1R/2A/3/6/7/8/9/10/11, COBS 2.1/9A/10/16A, TC Sourcebook, COCON 2.1.1R, SUP 10C/15.3, FSMA 2000, UK GDPR/DPA 2018, MLRs 2017, Consumer Duty PS22/9, and FG21/1
18-chapter integrated framework: compliance programme structure, governance, regulatory obligations, financial crime, data protection, conduct and consumer protection, SM&CR, monitoring, training, risk management, breach management, and record keeping
Three-lines-of-defence model: First Line (business ownership), Second Line (compliance oversight and challenge), and Third Line (internal audit assurance) — with Board governance structure and Management Responsibilities Map
Compliance monitoring programme: monthly CDD/transaction monitoring, quarterly conduct risk indicators, bi-annual training and competency review, and annual framework effectiveness assessment
Breach management: four-hour initial notification standard, 20 business day investigation completion, SUP 15 reporting triggers, and customer redress governance (Board approval for aggregate cost exceeding £50,000)
Five-category compliance risk assessment: regulatory/legal, conduct/consumer, financial crime, data protection, and operational — with five-point likelihood/impact/velocity matrix
Ready-to-use appendices: General Compliance Assessment Checklist, Product Approval and Governance Assessment, Financial Crime Risk Assessment, and Product and Service Compliance Assessment Template
+ much more
Who is this for?
Compliance Officers, SMF16/17 holders, and Boards at FCA-regulated firms who need a single, board-approved Master Compliance Policy that ties every subsidiary policy and compliance activity into a coherent, auditable programme — and gives the FCA a clear picture of a firm that takes compliance seriously at every level.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Image 1 of 12
Image 2 of 12
Image 3 of 12
Image 4 of 12
Image 5 of 12
Image 6 of 12
Image 7 of 12
Image 8 of 12
Image 9 of 12
Image 10 of 12
Image 11 of 12
Image 12 of 12
