From CompliNEWS | Financial Services Intelligence Watch

RMCPs under scrutiny as regulators target weak implementation

CityWire reports that regulators are continuing to take action against financial services providers with inadequate or poorly implemented risk management and compliance programmes, reinforcing the importance of aligning frameworks with actual business risk. The shift toward a risk-based approach under FICA requires firms to move beyond generic templates and develop RMCPs that accurately reflect their client base, products, delivery channels and geographic exposure, with clear articulation of how financial crime risks are identified, assessed and managed in practice.

From a compliance perspective, the expectation is no longer centred on the existence of a document, but on its application. Customer due diligence, risk rating, ongoing monitoring and reporting processes must be operational, consistent and supported by evidence, with accountability sitting at board and senior management level. Regulators are increasingly testing files and outcomes, not policy wording, with enforcement actions reflecting gaps between what firms say they do and what they can demonstrate.

Read the Full CityWire report here

Compli-Serve insights

Section 42 of the FIC Act is clear. An RMCP must enable the identification, assessment, monitoring and management of financial crime risk, and must be implemented in a manner that is proportionate to the institution’s business. In practice, this means the RMCP must operate as a living framework, with defined risk methodologies, documented controls, clear escalation and reporting processes, and ongoing review aligned to evolving risk. Where the RMCP cannot be evidenced in day-to-day activity, it will not withstand regulatory scrutiny.