What is compliance in banking?

The meaning of compliance in banking is that a bank keeps to every rule that governs its business, from laws to its own codes of conduct. The Basel Committee lists what these rules generally cover: "observing proper standards of market conduct, managing conflicts of interest, treating customers fairly, and ensuring the suitability of customer advice". They include the prevention of money laundering and terrorist financing and can extend to tax laws relevant to banking products (BCBS, April 2005). Regulatory compliance in banking is the part that follows from laws and supervisory rules.

Compliance risk in banking is the risk of sanctions, loss or reputational damage when a bank breaks the rules that apply to it. The Basel Committee defines it as "the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules", related industry standards and codes of conduct. That definition also answers why compliance is important in banking: a breach can lead to sanctions and to financial and reputational loss.

The compliance function in banks monitors compliance with legal requirements and internal policies, advises the management body and sets up policies and processes to manage compliance risk (EBA/GL/2021/05, paragraph 33). Section 21 of the EBA guidelines adds the details. The function is permanent and has a head of compliance (paragraph 204). It is independent of the business lines it controls (paragraph 206). It checks compliance through a structured, well-defined monitoring program and reports to the management body (paragraph 210). It checks that new products and procedures comply with current law and with known coming changes (paragraph 211).

A compliance policy in banks is the written basis. The management body in its supervisory function oversees a "well-documented compliance policy", communicated to all staff, and the bank tracks changes in the law (paragraph 208).

Risk management covers all risks of the bank; compliance covers the risk of breaking rules. In banking, the two share the second line of defense: under the EBA guidelines, the risk management function and the compliance function together form that line (paragraph 33). The risk management function identifies, measures and reports risks and forms "a holistic view on all risks". The compliance function looks at legal requirements and internal policies. Internal audit is the third line and reviews both.

The types of compliance in banking follow the rule areas: conduct toward clients, conflicts of interest, anti-money laundering, sanctions and tax. The EBA guidelines let banks set up extra control functions, for example for IT security or AML compliance (paragraph 33).

AML compliance in banking and KYC compliance in banking belong together: know-your-customer checks are one of the controls against money laundering. From July 10, 2027, Article 11(2) AMLR requires a compliance officer, appointed by the management body, who is responsible for the AML/CFT policies, procedures and controls, including targeted financial sanctions. The difference between the two is covered under KYC vs AML.

In Germany, compliance in banking works under BaFin's MaRisk, circular 06/2024 (BA) of May 29, 2024, which gives detail to § 25a(1) KWG. Module AT 4.4.2 requires every institution to have a compliance function against the risks of not complying with legal rules. As a rule, the function reports directly to the management board and sits in an area independent of the Markt and Handel units. Significant institutions must, as a rule, set it up as a separate unit, and every institution names a Compliance-Beauftragter (BaFin MaRisk).

Two of the supervisors have offices in Frankfurt am Main. BaFin, which checks how banks apply MaRisk, works from Bonn and Frankfurt (BaFin), and the ECB, which supervises the significant banks, has its seat there (ECB).

In Austria, the FMA supervises banks with the OeNB, and the ECB supervises the significant ones (OeNB). Switzerland is outside the EU, so neither the EBA guidelines nor the AMLR apply there. FINMA Circular 2017/1 on corporate governance at banks sets minimum requirements for the internal control systems of banks and entered into force on July 1, 2017 (FINMA, November 1, 2016). This page gives no legal advice.