Regulatory Compliance Management (RCM) Guideline (2014)

I. Purpose and Scope of the Guideline

• Communicates OSFI's expectations for managing regulatory compliance risk by federally regulated financial institutions (FRFIs).
• Revises and replaces the 2003 Legislative Compliance Management (LCM) Guideline.
• Elaborates on principles regarding key controls in RCM.
• Acknowledges variations in RCM practices due to factors like size, structure, operations, strategy, risk profile, and location.

II. Definitions

Regulatory Compliance Management (RCM)

• Refers to key controls managing regulatory compliance risk by a FRFI.

Regulatory Compliance Risk

• Risk of non-conformance with laws, rules, regulations, and prescribed practices.
• Does not include risk from non-conformance with ethical standards.

RCM Framework

• Structures and processes managing regulatory compliance risk enterprise-wide.

III. RCM Framework Overview

• Essential component of risk management to ensure compliance with regulatory requirements.
• Aims to prevent negative effects on reputation and regulatory intervention.
• Requires a risk-based approach for identifying and managing compliance risks.
• Responsibility assigned to a Chief Compliance Officer (CCO) or equivalent.

IV. RCM Framework

Key Controls

• Role of the CCO.
• Procedures for identifying and managing risks.
• Day-to-day compliance and independent monitoring.
• Internal reporting and documentation.
• Role of Internal Audit and Senior Management.

Role of the CCO

• Responsible for assessing adequacy and effectiveness of controls.
• Direct reporting line to Board or Branch Management.

Procedures for Managing Compliance Risk

• Risk-based approach for resource allocation.
• Regular updates to reflect changes in regulations and corporate structure.

Day-to-Day Compliance Procedures

• Tailored to business activities and integrated into operations.
• Includes monitoring and testing components.

Independent Monitoring and Testing

• Overseen by CCO using a risk-based approach.
• Internal Audit to validate compliance oversight.

Internal Reporting

1. Reporting procedures ensure information is timely and relevant.
2. Compliance reports to Senior Management for oversight responsibilities.
3. Internal Audit findings to assist in assessing RCM reliability.

Role of Internal Audit

• Periodic reviews of CCO activities and RCM framework reliability.
• Reports significant findings to management.

Adequate Documentation

• Clear documentation of roles and responsibilities.
• Supports information flow and RCM assessment.

Role of Senior Management

• Oversee RCM framework design and implementation.
• Ensure compliance policies are appropriate and regularly reviewed.
• Monitor and act on audit findings and recommendations.

V. OSFI's Supervisory Assessment

• OSFI conducts supervision to assess safety, soundness, and compliance.
• Principles-based and risk-focused framework.
• Intensity depends on FRFI's nature, size, complexity, and risk profile.
• Assessment focuses on the ability to manage regulatory compliance risk.