WhatsApp and Telegram +44 7563 115980
[email protected]
We design and run risk-based compliance monitoring programmes (CMPs) that show your board, your bank partners and the Financial Conduct Authority (FCA) that your controls work in practice.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
A compliance monitoring programme is a risk-based plan of tests that checks, on a set schedule, whether a firm's controls are working and its regulatory obligations are being met, with findings reported to the board and tracked to closure. FCA rules require firms to monitor and regularly assess their compliance arrangements. A consultant builds the plan from the firm's risks, carries out the testing and reports the results.
SYSC 6.1.1R in the FCA's Senior Management Arrangements, Systems and Controls sourcebook (SYSC) requires firms to establish, implement and maintain adequate policies and procedures sufficient to ensure compliance with their regulatory obligations. For firms within its scope, SYSC 6.1.3R requires a permanent and effective compliance function that operates independently, monitors and regularly assesses the adequacy and effectiveness of the firm's measures, and advises the staff who carry out regulated activities. SYSC 6.1.4R adds that compliance staff must have the authority, resources, expertise and access to information they need, and must not monitor services they perform themselves.
Payment institutions (PIs) and e-money institutions (EMIs) must have robust governance arrangements and adequate internal control mechanisms as a condition of authorisation under the Payment Services Regulations 2017 (PSRs) and Electronic Money Regulations 2011 (EMRs). The FCA's 2026 payments priorities expect firms to have the skills to design and test their controls. A compliance monitoring programme is how a firm shows that testing takes place.
A compliance monitoring plan should start from the firm's own risks and obligations, not from a template. A plan copied from another firm tests the wrong things and leaves real risks unchecked, which the FCA and auditors notice quickly. We build it in four steps.
Compliance testing checks evidence, not just whether a document exists. For each area we take samples, trace them through the process and compare the result to the rule and to your own policy. Typical areas include:
For PIs and EMIs, the programme must give particular weight to safeguarding. CASS 15 took effect on 7 May 2026, bringing daily internal and external reconciliations, a monthly safeguarding return to the FCA within 15 business days of each month end, a resolution pack and an annual safeguarding audit. Each is a natural monitoring test, and the monthly return gives a regular point to check that reconciliations, breaches and shortfalls were recorded and reported correctly.
Financial crime is the second priority. The FCA's 2026 payments priorities focus on money laundering and fraud, including authorised push payment fraud. Testing should cover onboarding, monitoring and SAR quality, and the payments fraud report (REP017) figures. Agents, distributors and outsourced service providers also need regular checks, because the firm remains responsible for them.
Monitoring is only useful if its findings change something. Each test produces a rating, a clear description of what failed and why, a recommended action, an owner and a deadline. Root cause analysis matters: a single file error may be a training issue, but the same error across many files usually points to a flawed process or system.
We report to the board or risk committee at least quarterly, with a summary of tests completed against the plan, findings by severity, overdue actions and themes. That record is evidence of oversight for the board, for the senior managers responsible under SM&CR where it applies, and for the FCA, auditors, safeguarding auditors and bank partners who ask for it. Findings are retested before closure, and the plan is updated during the year when new risks, rules or incidents appear, rather than waiting for the annual refresh.
Most weak monitoring programmes share the same faults, and each one reduces the value of the evidence the board relies on when it tells the FCA that the firm is compliant. These are the issues we see most often when we review an existing programme.
Every engagement follows the same four stages, scaled to the size of your firm and the urgency of the issue.
Assessment: we review your risks, permissions, existing policies, past findings, complaints and incidents to understand where testing should focus. Written findings: we deliver the compliance monitoring plan for board approval, then a written report for each round of testing that sets out results, ratings and actions. Remediation: where testing finds failures, we help fix the process, rewrite procedures and train staff, then retest. Ongoing support or outsourced roles: we can run the full programme as an outsourced monitoring function, provide independent second-line testing alongside your team, or act as your outsourced compliance officer or MLRO. The plan, test results and action log stay with your firm, so the record is yours.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. That licensing work means we have seen, from the application stage onwards, the controls, people and documents regulators expect to find when they test a firm after authorisation.
We do not stop at the licence. BCC also arranges banking and runs compliance for regulated firms, so the advice you receive reflects how a regulated business actually operates day to day: how its bank partners review it, how its regulator supervises it and how its own board needs to evidence control. Our aim is set out in one line: we open global markets to payment, e-money and crypto businesses, with the licences to enter, the banking to operate and the compliance to scale. If you are weighing your options, use the contact form to describe your firm and the issue, and we will reply with a proposed scope.
It is a documented, risk-based schedule of tests that checks whether a firm's controls work and its regulatory obligations are being met, together with the reports and action tracking that follow. It gives the board evidence of oversight and shows the FCA, auditors and bank partners that compliance is tested, not assumed.
FCA rules require firms to have adequate compliance policies and procedures, and for firms within the scope of SYSC 6.1.3R, a compliance function that monitors and regularly assesses them. Payment and e-money firms must have adequate internal control mechanisms. The FCA does not prescribe one format, but a documented plan is the usual way to show compliance.
As often as the risk justifies. High-risk areas such as safeguarding, financial crime and Consumer Duty outcomes usually need monthly or quarterly testing, while lower-risk areas may be tested once or twice a year. The plan should be reviewed annually and updated whenever the business or rules change.
Yes. Many smaller firms outsource some or all monitoring to gain independence and expertise. The firm remains responsible for compliance and for overseeing the provider, so the arrangement needs a clear scope, access to information and regular reporting to the board.
Tests completed against the plan, findings ranked by severity, root causes, actions with owners and deadlines, overdue items, and themes across tests. It should be short enough for the board to see the issues that matter and act on them.
Compliance monitoring is a second line activity that tests, on a frequent schedule, whether the business follows rules and policies. Internal audit is a third line function that independently reviews the effectiveness of the whole control framework, including the compliance function itself, usually less often.
Tell us what you need and where you operate.