4 Governance, Risk Management and Compliance

Institutional controls: governance and accountability, risk frameworks, key risk types and AML/KYC. The examination tests who is accountable, how limits and models are controlled, and the AML obligations.

4.1 Governance Structure

Governance assigns accountability, authority and challenge across the board, senior management, front office, risk, compliance, operations and audit. Controls are stronger when responsibilities and escalation paths are explicit.

4.2 Remuneration Structure

Pay structures should not reward volume or short-term profit in a way that encourages misconduct, hidden risk or customer harm. Deferrals, malus, clawback and balanced performance measures can align incentives with sound conduct.

4.3 Reporting Misconduct/Inappropriate Behaviour

Firms need confidential reporting, investigation and escalation routes. Retaliation should not deter good-faith reporting, and records should preserve facts and decisions.

4.4 Segregation of Duties

Front, middle and back office roles should be separated by responsibilities, information barriers and system permissions. Separation does not mean no communication; it means communication is controlled and no one person can originate, process and conceal a transaction.

4.5 Overview Risk Management and Compliance

Risk management identifies, measures, limits, monitors and reports risk. Compliance interprets obligations, tests adherence, advises the business and escalates breaches. Both functions need independence, resources and access to information.

4.6 Risk Management Frameworks

A framework links risk appetite to limits, controls, monitoring, validation, escalation and remediation. It should cover normal and stressed conditions and be understood by the people who make and control trades.

4.6.1 Approval of Risk Limits

Limits should be approved by the appropriate authority, documented, assigned to a person or desk and reviewed when the business or risk profile changes. Informal limit increases are not a substitute for approval.

4.6.2 Implementation of Risk Measures

Risk measures may include notional, sensitivity, stop-loss, stress, liquidity, counterparty and concentration measures. They must be implemented in systems and procedures that are complete, timely and resistant to override.

4.6.3 Monitoring Risk Activity

Monitoring compares current activity with limits, exposures, P&L, exceptions and stress results. Breaches should be escalated promptly, investigated and resolved, rather than normalised through repeated overrides.

4.6.4 Periodic Validation of Valuation Models

Valuation models need independent validation, documentation, testing, input governance and periodic review. Changes in products, markets or assumptions can make a previously reliable model unsuitable.

4.7 Framework for Compliance and Review

Compliance frameworks translate laws, notices and codes into policies, controls, training, surveillance, testing, issue management and reporting. Reviews should be risk-based and tracked to closure.

4.8 Ensuring Adherence

Adherence is demonstrated through supervision, monitoring, exception reports, attestations, reconciliations, training and disciplinary action where necessary. A policy without evidence of operation is a weak control.

4.9 Key Risk Types

Market, credit/counterparty and operational risks interact. A position can be profitable while creating settlement, liquidity, conduct or model risk, so risk assessment must not focus on price movement alone.

4.9.1 Market Risk

Market risk is the risk of loss from adverse movements in rates, prices, spreads, volatility or correlations. It is managed with limits, hedging, valuation, stress testing and timely escalation.

4.9.2 Credit/Counterparty Risk

Counterparty risk is the risk that the other party fails to perform. Limits, netting, collateral, margin, settlement controls, credit review and close-out rights reduce exposure.

4.9.3 Operational Risk

Operational risk arises from failed or inadequate people, processes, systems or external events. Examples include erroneous trades, weak access controls, processing failures, fraud and business interruption.

4.10 AML/KYC

AML/KYC controls identify customers, beneficial owners, purpose, source of funds and unusual activity. They are ongoing controls, not a one-time account-opening formality.

4.10.1 AML

AML programs use risk-based customer due diligence, screening, transaction monitoring, suspicious-transaction escalation, record retention and staff training. Tipping off a customer about a report can itself be prohibited.

4.10.2 Regulatory Framework of Financial Crimes

The framework includes Singapore statutes and MAS notices addressing laundering, terrorism financing, confiscation, mutual assistance and related financial crime. The firm must apply the current rule to the relevant institution and activity.

4.10.3 Customer Onboarding

Onboarding verifies identity, authority, beneficial ownership, risk rating, purpose and expected activity before access is granted. Missing or inconsistent information should be resolved or escalated — never ignored to meet a sales target.

Exam cues

• Three lines: front office (1st), risk/compliance (2nd), independent audit (3rd); the board and senior management retain accountability.
• Risk framework: approved limits → implemented measures → monitoring → independent model validation → remediation.
• Three key risks: market (adverse moves), credit/counterparty (failure to perform), operational (people, processes, systems, events).
• Remuneration: deferrals, malus and clawback counter misconduct incentives.
• AML/KYC is ongoing, not a one-time formality; tipping off is itself prohibited.
• Trap: a breach normalised through repeated overrides is still a breach.

---

Practise this chapter →