Guidelines on certain aspects of the MiFID II compliance function requirements

06/04/2021 | ESMA35-36-1952
Guidelines
On certain aspects of the MiFID II compliance function requirements

ESMA PUBLIC USE
Table of Contents
I. Scope............................................................................................................................. 3
Legislative references, abbreviations and definitions............................................................. 4
II. Purpose.......................................................................................................................... 7
III. Compliance and reporting obligations............................................................................. 8
IV. Guidelines on certain aspects of the MiFID II compliance function requirements............ 9

1. Responsibilities of the compliance function................................................................. 9
2. Guidelines on the organisational requirements of the compliance function ................15
3. Competent authority review of the compliance function .............................................22
   VI. Correlation table between the 2020 guidelines and the 2012 guidelines........................24

ESMA PUBLIC USE
I. Scope
Who?

1. These guidelines apply to competent authorities and to the following financial market
   participants:
   (i) investment firms when carrying out investment services or investment activities or when selling or advising clients in relation to structured deposits; (ii) credit institutions when carrying out investment services or investment activities or when selling or advising clients in relation to structured deposits; (iii) undertakings for collective investment in transferable securities (UCITS) management companies when providing the services referred to in Article 6(3) of the UCITS Directive, in accordance with Article 6(4) of that Directive; and (iv) alternative investment fund managers (AIFMs) when providing the services referred to in Article 6(4) of the AIFMD, in accordance with Article 6(6) of that Directive. What?
2. These guidelines apply in relation to Article 16(2) of MIFID II and Article 22 of the MiFID
   II Delegated Regulation.
   When?
3. These guidelines apply from two months of the date of publication of the guidelines on
   ESMA’s website in all EU official languages.
4. The Guidelines on certain aspects of the MiFID compliance function requirements1
   issued under MiFID I will cease to apply on the same date.
   1 ESMA/2012/388.

ESMA PUBLIC USE
Legislative references, abbreviations and definitions Legislative references AIFMD Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2033/41/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/20102 CRD Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC3 CRR Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/20124 ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC5 MIFID I Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC6 MiFID II Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU7 2 OJ L 174, 01.07.2011, p. 1. 3 OJ L 176, 27.6.2013, p. 338–436 4OJ L 176, 27.6.2013, p. 1–. 5 OJ L 331, 15.12.2010, p. 84. 6 OJ L 145, 30.4.2004, p. 1. 7 OJ L 173, 12.06.2014, p. 349.

ESMA PUBLIC USE
MiFID II Delegated Regulation Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive8 MiFID II Delegated Directive Commission Delegated Directive (EU) 2017/593 of 7 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to safeguarding of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits9 UCITS Directive Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS)10 AIFMD Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2033/41/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/201011 Abbreviations ESMA European Securities and Markets Authority Definitions firms Investment firms (as defined in Article 4(1)(1) of MiFID II) when providing investment services or investment activities or when selling or advising clients in relation to structured deposits; credit institutions (as defined in
Article 4(1)(1) of the CRR) when providing investment
services or investment activities or when selling or advising clients in relation to structured deposits; UCITS management companies (as defined in Article 2(1)(b) of the UCITS Directive) when providing the services 8 OJ L 87, 31.3.2017, p. 1. 9 OJL 87, 31.3.2017, p. 500. 10 OJ L 302, 17.11.2009, p. 32. 11 OJ L 174, 01.07.2011, p. 1.

ESMA PUBLIC USE referred to in Article 6(3) of the UCITS Directive, in accordance with Article 6(4) of that Directive; and AIFMs (as defined in Article 4(1)(b) of the AIFMD) that are external AIFMs when providing the services referred to in Article 6(4) of the AIFMD, in accordance with Article 6(6) of that Directive.

ESMA PUBLIC USE
II. Purpose
5. These guidelines are based on Article 16(1) of the ESMA Regulation. The objectives
of these guidelines are to establish consistent, efficient and effective supervisory practices within the ESFS and to ensure the common, uniform and consistent application of certain aspects of the MiFID II compliance function relating to the requirements referred to in paragraph 2.
6. ESMA also expects these guidelines to promote greater convergence in the
interpretation of, and supervisory approaches to, the MiFID II compliance function requirements by focusing on a number of important issues, and thereby enhancing the value of existing standards. By helping to ensure that firms comply with uniform regulatory standards, ESMA anticipates a corresponding strengthening of investor protection.

ESMA PUBLIC USE
III. Compliance and reporting obligations
Status of the guidelines
7. In accordance with Article 16(3) of the ESMA Regulation, competent authorities and firms
must make every effort to comply with these guidelines.
8. Competent authorities to which these guidelines apply should comply by incorporating
them into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at firms. In this case, competent authorities should ensure through their supervision that firms comply with the guidelines. Reporting requirements
9. Within two months of the date of publication of the guidelines on ESMA’s website in all
EU official languages, competent authorities to which these guidelines apply must notify ESMA whether they (i) comply, (ii) do not comply, but intend to comply, or (iii) do not comply and do not intend to comply with the guidelines.
10. In case of non-compliance, competent authorities must also notify ESMA within two
months of the date of publication of the guidelines on ESMA’s website in all EU official languages of their reasons for non-complying with the guidelines.
11. A template for notifications is available on ESMA’s website. Once the template has been
filled in, it shall be transmitted to ESMA.
12. Firms are not required to report whether they comply with these guidelines.

ESMA PUBLIC USE
IV. Guidelines on certain aspects of the MiFID II compliance
function requirements
13. As part of its responsibility for ensuring that the firm complies with its obligations under
MiFID II, senior management must ensure that the compliance function fulfils the requirements set out in Article 22 of the MiFID II Delegated Regulation.

1. Responsibilities of the compliance function
   Guideline on the compliance risk assessment
   (paragraph 1 and second subparagraph of paragraph (2) of Article 22 of the MiFID II Delegated Regulation) Guideline 1
2. In accordance with Article 22(2) of the MiFID II Delegated Regulation, the compliance
   function shall, as part of its tasks, conduct a risk assessment to ensure that compliance risks are comprehensively monitored. The compliance function shall establish a risk￾based monitoring programme on the basis of this compliance risk assessment to determine its priorities and the focus of the monitoring, advisory and assistance activities.
3. The findings of the compliance risk assessment should be used to set the work
   programme of the compliance function and to allocate the functions resources efficiently. The compliance risk assessment should be reviewed on a regular basis, and, when necessary, updated to ensure that the objectives, focus and the scope of compliance monitoring and advisory activities remain valid.
4. In identifying the level of compliance risk the firm faces, the second subparagraph of
   Article 22(1) of the MiFID II Delegated Regulation requires the compliance function to
   take into account all the areas of the investment services, activities and ancillary services provided by the firm. This should include the types of financial instruments traded and distributed, the categories of the firm’s clients, the distribution channels and, where relevant, the internal organisation of the group.
5. The compliance risk assessment should consider the applicable obligations under MiFID
   II, national implementing rules and the policies, procedures, systems and controls implemented within the firm in the area of investment services and activities. The assessment should also consider the results of any monitoring activities and of any relevant internal or external audit findings.
6. The identified risks should be reviewed on a regular basis and, when necessary, also on
   an ad-hoc basis to ensure that any emerging risks are taken into consideration (for example, resulting from new business fields, other relevant changes in the firm’s structure or in the applicable regulatory framework).

ESMA PUBLIC USE
Guideline on the monitoring obligations of the compliance function (Point (a) and second subparagraph of paragraph (2) of Article 22 of the MiFID II Delegated Regulation) Guideline 2
19. The aim of the risk-based monitoring programme should be to evaluate whether the
firm’s business is conducted in compliance with its obligations under MiFID II as well as whether its internal policies and procedures, organisation and control measures remain effective and appropriate to ensure that compliance risk is comprehensively monitored.
20. Where a firm is part of a group, responsibility for the compliance function rests with each
firm in that group. A firm should therefore ensure that its compliance function remains responsible for monitoring its own compliance risk. This includes where a firm outsources compliance tasks to another firm within the group. The compliance function within each firm should, however, take into account the group of which it is a part - for example, by working closely with audit, legal, regulatory and compliance staff in other parts of the group.
21. The risk-based approach to compliance should form the basis for determining the
appropriate tools and methodologies used by the compliance function, as well as the extent of the monitoring programme and the frequency of monitoring activities performed by the compliance function (which may be recurring, ad-hoc and/or continuous). The compliance function should also ensure that its monitoring activities are not only desk￾based, but that it also verifies how policies and procedures are implemented in practice, for example through on-site inspections at the operative business units. The compliance function should also consider the scope of reviews to be performed.
22. Examples of suitable tools and methodologies for monitoring activities that could be used
by the compliance function include (but are not limited to):
(a) the use of aggregated risk measurements (for example, risk indicators); (b) the use of (additional) reports warranting management attention documenting material deviations between actual occurrences and expectations (exceptions report) or situations requiring resolution (issues log); (c) targeted trade surveillance, observation of procedures, desk reviews, interview of relevant staff and/or, where necessary, and at the discretion of the compliance function, of a relevant sample of firm’s clients;
23. The monitoring programme should reflect changes to the firm’s risk profile, which may
arise, for example, from significant events such as corporate acquisitions, IT system changes, or reorganisation. It should also extend to the implementation and effectiveness of any remedial measures taken by the firm in response to breaches of MiFID II, related delegated or implementing acts and/or any national implementing provisions thereof.
24. Monitoring activities performed by the compliance function should also take into account:

ESMA PUBLIC USE
(a) the business area’s obligation to comply with regulatory requirements; (b) the first level of controls in the firm’s business areas (namely controls by the operative units, as opposed to second level controls performed by compliance); and (c) reviews by the risk management function, internal audit function or other control functions in the area of investment services and activities.
25. Reviews by control functions should be coordinated with the monitoring activities
performed by the compliance function while respecting the different functions’ independence and mandate.
26. The compliance function should have a role in monitoring the operation of the complaints
process and it should consider complaints as a source of relevant information in the context of its general monitoring responsibilities. This does not require the compliance function to have a role in determining the outcome of complaints. In this regard, firms should grant the compliance function access to all customer complaints received by the firm. Guideline on the reporting obligations of the compliance function (Article 16(2) of MiFID II, paragraphs (1)(e), (2)(c) and (3)(b) of Article 21, paragraphs (2) and (3) of Article 25 and paragraphs (3) and (7) of Article 26 of the MiFID II Delegated Regulation, paragraphs (6) and (7) of Article 9 and paragraphs (6) and (8) of Article 10 of the MiFID II Delegated Directive) Guideline 3
27. The mandatory compliance reports according to paragraphs (2)(c) and (3)(c) of Article
22 and paragraphs (2) and (3) of Article 25 of the MiFID II Delegated Regulation are suitable tools to warrant the necessary management attention. The mandatory compliance reports should cover all business units involved in the provision of investment services, activities and ancillary services provided by a firm. Where the report does not cover all of these activities and services of the firm, it should clearly state the reasons.
28. The mandatory compliance reports should, inter alia, contain information on the following
matters, where relevant:
(a) General information:

• information on the adequacy and effectiveness of the firm’s policies and
  procedures designed to ensure that the firm and its staff comply with the obligations under MiFID II;
• relevant changes and developments in the applicable requirements over the
  period covered by the report;
• a summary of the compliance function’s structure, including the overall
  personnel employed, their qualifications and reporting lines and in following reports, any change thereto; (b) Manner of monitoring and reviewing

ESMA PUBLIC USE

• how the compliance-function monitors the development and review of the
  obligations under MiFID II and how possible risks of failure by the firm or its staff to comply with these obligations are identified at an early stage;
• a summary of on-site inspections or desk-based reviews performed by the
  compliance function;
• a summary of the planned monitoring activities for the subsequent review;
  (c) Findings
• a summary of major findings of the review of the policies and procedure,
  including risks identified in the scope of the compliance function’s monitoring activities;
• breaches and deficiencies in the firm’s organisation and compliance process;
• the number of complaints received in the period under review if not already
  reported through other sources. Where, as a result of the review of clients’ complaints, specific compliance or risk issues are identified in relation to the policies or procedures adopted by the firm for the provision of investment services and activities, these aspects should be specifically reported; (d) Actions taken
• a summary of any action taken to address any significant risk of failure by the
  firm or its staff to comply with the obligations under MiFID II;
• measures taken and to be taken to ensure compliance with changed applicable
  requirements;
• reaction to complaints received and any pay-out performed based on the
  complaint, if not already reported through other sources. Actions regarding specific compliance or risk issues identified in relation to the policies or procedures adopted by the firm for the provision of investment services and activities as a result of the review of clients’ complaints; (e) Others
• other significant compliance issues that have occurred since the last report;
• overview of material correspondence with competent authorities; and
• information as regards any deviation by senior management from important
  recommendations or assessments issued by the compliance function;
• information in relation to any deviation from the principle that the other business
  units must not issue instructions or otherwise influence compliance staff and their activities; and
• where a firm makes use of the exemption to avoid appointing a compliance officer
  whose sole responsibility within the firm is the compliance function, assessment of the continuing appropriateness of the arrangements to minimize conflicts of interest.

29. In the section of the report covering the firm’s product governance arrangements, the
    compliance function should also address, where relevant to the situation of the firm (for example, taking into account its role as product manufacturer and/or distributor), at least:

ESMA PUBLIC USE
(a) the compliance function’s role in participating to the elaboration, monitoring and reviewing of the firm’s product governance policies and procedures; (b) all topics required under Article 22(2) MiFID II Delegated Regulation, regarding the monitoring of the firm’s product governance by the compliance-function (for example, the compliance function’s findings relating to the firm’s product governance policies and procedures, breaches and deficiencies, actions taken or to be taken to remedy the latter). (c) systematically, information about the financial instruments manufactured/distributed by the firm, including information on the distribution strategy according to Articles 9(6) and 10 (8) of the MiFID II Delegated Directive, namely at least:

• the number and nature of the products manufactured or distributed (as
  applicable), including their respective target markets and other information from the respective product approval process necessary to assess the product’s compliance-risk, notably with the firm’s product governance policy (for example, complexity of the product, product related conflicts of interests, particularly relevant data from the scenario analysis, the cost-return ratio), with a specific focus on new types of products manufactured or distributed during the reporting period as well as the ones whose features have been significantly amended during that period.
• (in case of manufacturers) as part of the information on the respective
  distribution strategy: the respective distributors with a specific focus on new distributors;
• whether the products are distributed outside their (positive) target market and
  to which extent, with the aim to assess whether the firm’s product governance arrangements function as intended. To do so, the compliance function may take a critical look at any work, reports or methods from the firm’s function or personnel working on product governance arrangements. According to the proportionality principle, when reporting, for example, on the firm’s product governance arrangements, the information for simpler, more common products may be less in-depth, whereas products characterised by complexity/risk features or by other relevant features (such as, for example, illiquidity and innovation) should be described in more detail.

30. Subject to the proportionality principle, firms should favour an organisation where the
    compliance function and the complaints management function are properly separated. Where the firm’s compliance function also acts as its complaints management function, the compliance report should address any issue arising out of the implementation of the arrangements the firm has in place to assess, minimise and manage any conflicts of interest between the two functions, including notably, any failure identified as regards the firm’s compliance with its complaints handling obligations.
31. The compliance function should consider the need for additional reporting lines to any
    group compliance function.
32. Competent authorities may take different approaches to supervising the reporting
    obligations of the compliance function. By way of example, some competent authorities

ESMA PUBLIC USE require firms to provide them with compliance function reports on a regular or ad hoc basis while others also require senior management to provide an annotated version of the report containing explanations of the compliance function’s findings. These practices provide competent authorities with first-hand insight into a firm’s compliance activities, as well as any breaches of the applicable provisions. Guideline on the advisory and assistance obligations of the compliance function (Articles 22(2)(b) and 27(3) of the MiFID II Delegated Regulation) Guideline 4
33. Firms should ensure that the compliance function fulfils its advisory and assistance
responsibilities, including providing support for staff and management training; providing day-to-day assistance for staff and management and participating in the establishment of policies and procedures within the firm (e.g. the firm’s remuneration policy or the firm’s product governance policies and procedures)
34. Firms should promote and enhance a ‘compliance culture’ throughout the firm, which
should be supported by the senior management. The purpose of the compliance culture is not only to establish the overall environment in which compliance matters are treated, but also to engage staff with the principle of improving investor protection as well as contributing to the stability of the financial system.
35. The firm needs to ensure that its staff is adequately trained12 . The compliance function
should support the business units in the area of investment services and activities (namely all staff involved directly or indirectly in the provision of investment services and activities) in performing any relevant training. Training and other support should focus particularly, but not exclusively, on:
(a) the internal policies and procedures of the firm and its organisational structure in the area of investment services and activities; and (b) MiFID II, its delegated and implementing acts, national implementing laws, the applicable standards, guidelines and other guidance set out by ESMA and competent authorities, any other supervisory and regulatory requirements that may be relevant and any changes to those.
36. Training should be performed on a regular basis, and needs-based training should be
performed where necessary. Training should be delivered as appropriate – for example, to the firm’s entire staff as a whole, to specific business units, or to a particular individual.
37. Training should be developed on an on-going basis so that it takes into account all
relevant changes (for example, new legislation, standards or guidelines issued by ESMA and competent authorities, and changes in the firm’s business model). 12 See Guidelines for the assessment of knowledge and competence; ESMA71-1154262120-153 EN (rev)

ESMA PUBLIC USE
38. The compliance function should monitor, in cooperation with the management team,
which holds ultimate executive responsibility, whether staff in the area of investment services and activities hold the necessary level of awareness and correctly apply the firm’s policies and procedures.
39. Compliance staff should also provide assistance to staff from the operative units in their
day-to-day business and be available to answer questions arising out of daily business activity.
40. Firms should ensure that the compliance function is involved in the development of the
relevant policies and procedures within the firm in the area of investment services, activities and ancillary services (for example the firm’s remuneration policy or the firm’s product governance policies and procedures). In this context, the compliance function should be enabled, for example, to provide compliance expertise and advice to business units about all strategic decisions or new business models, or about the launch of a new advertising strategy in the area of investment services and activities. If the compliance function’s advice is not followed, the compliance function should document this accordingly and present it in its compliance reports (possibly as ad-hoc reports, where necessary).
41. Firms should ensure that the compliance function is involved in all significant
modifications of the organisation of the firm in the area of investment services, activities and ancillary services. This includes the decision-making process when new business lines or new financial products are being approved as well as the definition of staff remuneration policies. In this context, the compliance function should be given the right to participate in the product approval process for manufacturers and distributors as applicable. Senior management should therefore request business units to consult with the compliance function in due time regarding their operations, where relevant.
42. Firms should ensure that the compliance function is involved in all material non-routine
correspondence with competent authorities in the area of investment services and activities.
2. Guidelines on the organisational requirements of the compliance function
Guideline on the effectiveness of the compliance function (Articles 21(1)(d) and 22(3)(a) of the MiFID II Delegated Regulation) Guideline 5
43. When ensuring that appropriate human and other resources are allocated to the
compliance function, firms should take into account the scale and types of investment services, activities and ancillary services undertaken by the firm.
44. The number of staff required for the tasks of the compliance function depends to a large
extent on the nature of the investment services, activities and ancillary services and other services provided by the firm. Where a firm’s business unit activities are significantly

ESMA PUBLIC USE extended, the firm should ensure that the compliance function is similarly extended as necessary in view of changes to the firm’s compliance risk. Senior management should monitor regularly, and at least once a year, whether the number of staff and their expertise is still adequate for the fulfilment of the duties of the compliance function.
45. In addition to human resources, sufficient IT resources should be allocated to the
compliance function.
46. Where the firm establishes budgets for specific functions or units, the compliance
function should be allocated a budget that is consistent with the level of compliance risk the firm is exposed to. The compliance officer should be consulted before the budget is determined. All decisions for significant cuts in the budget should be documented in writing and should contain detailed explanations.
47. In ensuring compliance staff have access to the relevant information for their tasks at all
times, firms should provide access to all relevant database and records (such as recordings of telephone conversations and electronic communications referred to in
Article 76 of MiFID II Delegated Regulation). In order to have a permanent overview of
the areas of the firm where sensitive or relevant information might arise, the compliance officer should have access to all relevant information systems within the firm as well as any internal or external audit reports or other reporting to senior management or the supervisory function, if any. Where relevant, the compliance officer should also be able to attend meetings of senior management or the supervisory function. Where this right is not granted (which should remain exceptional) this should be documented and explained in writing. The compliance officer should have in-depth knowledge of the firm’s organisation, corporate culture and decision-making processes in order to be able to identify which meetings are important to attend.
48. In particular, it is important that the firm puts in place necessary arrangements to ensure
an effective exchange of information between the compliance function and other control functions (for example internal audit and risk management) as well as with any internal or external auditors. Guideline on the skills, knowledge, expertise and authority of the compliance function (Articles 21(1)(d) and paragraphs (a) and (b) of 22(3) of the MiFID II Delegated Regulation) Guideline 6
49. Firm’s compliance staff shall have the necessary skills, knowledge and expertise to
discharge their obligations pursuant to Articles 21(1)(d) of the MiFID II Delegated Regulation. Furthermore, the compliance function shall have the necessary authority pursuant to Article 22(3)(a) of the MiFID II Delegated Regulation. These requirements should in particular be taken into account by firms when appointing the compliance officer. Having regard to the function and tasks assigned to the compliance officer, he or she should demonstrate high professional ethical standards and personal integrity.

ESMA PUBLIC USE
50. In order to ensure that the compliance function has the authority required for its duties,
the senior management of the firm should support it in the exercise of these duties. Authority implies possessing adequate expertise and relevant personal skills (such as, for instance, judgment), and may be enhanced by the firm’s compliance policy explicitly acknowledging the specific authority of the compliance function.
51. Within the compliance function there should at least be knowledge of MiFID II and all
related delegated and implementing acts, the national implementing laws and regulations as well as of all applicable standards, guidelines and other guidance issued by ESMA and competent authorities, as far as these are relevant for the performance of the compliance tasks. Compliance staff should be regularly trained in order to maintain their knowledge. The designated compliance officer should possess a higher level of expertise.
52. The compliance officer should have sufficiently broad knowledge and experience and a
sufficiently high level of expertise so as to be able to assume responsibility for the compliance function as a whole and ensure that it is effective. In order to demonstrate the necessary level of knowledge and/or of experience, different options may be foreseen at national level in the Member State concerned. For instance, some competent authorities license or approve the nominated compliance officer following an assessment of the qualifications of the compliance officer. This assessment may include an analysis of the compliance officer’s curriculum vitae, as well as an interview with the nominated person and/or an exam to be passed. This sort of process may help to strengthen the position of the compliance function within the firm and in relation to third parties. Other regulatory approaches impose the responsibility for the assessment of the compliance officer’s qualification solely on the senior management of the firm. Senior management assesses the prospective compliance officer’s qualifications before appointment. Whether the firm properly complies with the requirements in Article 21(1)(d) and paragraphs (a) and (b) of Article 22(3) is then assessed within the general review of the firm’s compliance with the relevant MiFID II requirements.
53. The compliance officer should demonstrate sufficient professional experience as it is
necessary to be able to assess the compliance risks and conflicts of interest inherent in the firm’s business activities. The required professional experience may have, amongst others, been acquired in operational positions, in other control functions or in regulatory functions. In some jurisdictions, the professional experience is only taken into consideration if it has been acquired during a minimum period of time and provided it is not outdated.
54. The compliance officer should have specific knowledge of the different activities provided
by the firm. The relevant expertise required may differ from one firm to another, as the nature of the main compliance risks that firms face could differ. A newly employed compliance officer may therefore need additional specialised knowledge focused on the specific business model of the firm even if the person has previously been the compliance officer for another firm.

ESMA PUBLIC USE
Guideline on the permanence of the compliance function (first subparagraph of Article 22(2) of the MiFID II Delegated Regulation) Guideline 7
55. The first subparagraph of Article 22(2) of the MiFID II Delegated Regulation requires
firms to ensure that the compliance function performs its tasks and responsibilities on a permanent basis. Firms should therefore establish adequate arrangements for ensuring that the responsibilities of the compliance officer are fulfilled when the compliance officer is absent, and adequate arrangements to ensure that the responsibilities of the compliance function are performed on an ongoing basis. These arrangements should be in writing.
56. The firm should ensure, for example through internal procedures and stand-in
arrangements, that the responsibilities of the compliance function are fulfilled adequately during any absence of the compliance officer.
57. The responsibilities and competences as well as the authority of the compliance function
should be set out in a ‘compliance policy’ or other general policies or internal rules that take account of the scope and nature of the firm’s investment services and activities. This should include information on the monitoring programme and the reporting duties of the compliance function as well as information on the compliance function’s risk-based approach to monitoring activities. Relevant amendments to the applicable requirements should be reflected promptly by adapting these policies/rules.
58. The compliance function should perform its activities on a permanent basis and not only
in specific circumstances. This entails regular monitoring on the basis of a monitoring
schedule. The monitoring activities should regularly cover all key areas of the investment
services and activities provided by the firm, taking into account the compliance risk associated with the business areas. The compliance function should be able to respond rapidly to unforeseen events, thereby changing the focus of its activities within a short timeframe if necessary. Guideline on the Independence of the compliance function (points (b), (d) and (e) of Article 22(3) of the MiFID II Delegated Regulation) Guideline 8
59. Firms should ensure that the compliance function holds a position in their organisational
structure that ensures that the compliance officer and other compliance staff act independently when performing their tasks.
60. While senior management is responsible for establishing an appropriate compliance
organisation and for monitoring the effectiveness of the organisation that has been implemented, the tasks performed by the compliance function should be carried out independently from senior management and other units of the firm. In particular, the

ESMA PUBLIC USE firm’s organisation should ensure that other business units may not issue instructions or otherwise influence compliance staff and their activities and an appropriate escalation process by the compliance function to senior management should be implemented.
61. Where senior management deviates from important recommendations or assessments
issued by the compliance function, the compliance officer should document this accordingly and present it in the compliance reports. Guideline regarding the proportionality with regard to the effectiveness of the compliance function (Article 22(4) of the MiFID II Delegated Regulation) Guideline 9
62. Firms should decide which measures, including organisational measures and the level
of resources, are best suited to ensuring the effectiveness of the compliance function in the firm’s particular circumstances.
63. In deciding whether the requirements under points (d) and (e) of Article 22(3) of the MiFID
II Delegated Regulation are proportionate and whether their compliance function continues to be effective, firms should take at least the following criteria into account:
a) the types of investment services, activities and ancillary services and other business activities provided by the firm (including those not related to investment services, activities and ancillary services); b) the interaction between the investment services and activities and ancillary services and other business activities carried out by the firm; c) the scope and volume of the investment services, activities and ancillary services carried out (absolute and relative to other business activities), balance sheet total and income of the firm from commissions and fees and other income in the context of the provision of investment services, activities and ancillary services; d) the types of financial instruments offered to clients; e) the types of clients targeted by the firm (professional, retail, eligible counterparties); f) staff headcount; g) whether the firm is part of a group within the meaning of point 11 of Article 2 of CRD; h) services provided through a commercial network, such as tied agents, or branches; i) cross-border activities provided by the firm; and j) organisation and sophistication of the IT systems.
64. Competent authorities may also find these criteria useful in determining which types of
firms may benefit from the proportionality exemption under Article 22(4) of the MiFID II Delegated Regulation.

ESMA PUBLIC USE
65. A firm may fall, for example, under the proportionality exemption if the performance of
the necessary compliance tasks does not require a full-time position due to the nature, scale and complexity of the firm’s business, and the nature and range of the investment services, activities and ancillary services offered.
66. While a compliance officer must always be appointed, it may be disproportionate for
some firms, depending on the circumstances (for instance, small firms with limited and non-complex activities and/or limited volumes) to appoint a separate compliance officer that does not perform any other function. Where a firm makes use of the exemption (which should be assessed and justified on a case-by-case basis), conflicts of interest between the tasks performed by the relevant persons should be minimised as much as possible.
67. A firm that does not need to comply with all the requirements set out in Article 22(3) of
the MiFID II Delegated Regulation under the proportionality principle may combine the legal and compliance function. However, a firm with more complex activities or greater size should avoid such combination if it could undermine the compliance function’s effectiveness.
68. Where a firm makes use of the proportionality exemption, it should record how this is
justified, so that the competent authority is able to assess this.
Guidelines on combining the compliance function with other internal control functions (Article 22(3)(d) of the MiFID II Delegated Regulation) Guideline 10
69. A firm should favour an organisation where control functions are properly separated. The
combination of the compliance function with other control functions may be acceptable if this does not compromise the effectiveness and independence of the compliance function. Any such combination should be documented, including the reasons for the combination so that competent authorities are able to assess whether the combination of functions is appropriate in the circumstances. However, where an internal audit function has been established and is maintained within the investment firm in accordance with Article 24 of the MiFID II Delegated Regulation, such function may not be combined with other control functions such as the compliance function, in accordance with Article 24.
70. Compliance staff should generally not be involved in the activities they monitor. However,
a combination of the compliance function with other control units at the same level (such as money laundering prevention) may be acceptable if this does not generate conflicts of interests or compromise the effectiveness of the compliance function.
71. Whether staff from other control functions also perform compliance tasks should also be
a relevant consideration in the determination of the relevant number of staff necessary for the compliance function.

ESMA PUBLIC USE
72. Whether or not the compliance function is combined with other control functions, the
compliance function should coordinate its activities with the second-level control activities performed by other units in charge of other control functions.
73. Where the compliance officer is not appointed as the single officer referred to in article 7
of the MiFID II Delegated Directive, both the officer referred to in Article 7 of the MiFID II Delegated Directive and the compliance officer should act independently, and the compliance officer should not supervise and/or issue any instruction to the single officer referred to in Article 7 of the MiFID II Delegated Directive.
74. Where the compliance function is combined with other control functions as specified in
paragraph 69 or where it is also responsible for other tasks (for example anti-money laundering), the firm should ensure that it allocates enough resources for MiFID￾compliance at all times. Guidelines on outsourcing of the compliance function (Articles 22 and 31 of the MiFID II Delegated Regulation) Guideline 11
75. Firms should ensure that all requirements applicable to the compliance function
continued to be fulfilled where all or part of the compliance function is outsourced.
76. The outsourcing requirements for critical or important functions set out in Articles 16(5)
of MiFID II and 31 of the MiFID II Commission Delegated Regulation apply in full to the outsourcing of the compliance function.
77. Firms can only outsource tasks, but not responsibilities: firms wishing to engage in
outsourcing remain fully responsible for the tasks that are outsourced. In other words, as set out in Article 31(2)(e) of the MiFID II Delegated Regulation, the ability to control outsourced tasks and manage the risks associated with the outsourcing must always be retained by the firm initiating the outsourcing.
78. The firm should perform a due diligence assessment before choosing a service provider
in order to ensure that the requirements set out in Articles 22 and 31 of the MiFID II Delegated Regulation are met. The firm should ensure that the service provider has the necessary authority, resources, expertise and access to all relevant information in order to perform the outsourced compliance function tasks effectively. The extent of the due diligence assessment should be dependent on the nature, scale, complexity and risk of the compliance tasks and processes that are outsourced.
79. Firms should also ensure that when, outsourced partially or fully, the compliance function
remains permanent in nature, namely that the service provider should be able to perform the function on an ongoing basis and not only in specific circumstances.
80. Firms should monitor whether the service provider performs its duties adequately, which
includes monitoring the quality and the quantity of the services provided. Senior

ESMA PUBLIC USE management is responsible for supervising and monitoring the outsourced tasks on an ongoing basis and should have the necessary resources and expertise to be able to fulfil this responsibility. Senior management may appoint a specific person to supervise and monitor the outsourced function on their behalf.
81. Outsourcing of the compliance function’s tasks within a group does not lead to a lower
level of responsibility for the senior management of the individual firms within the group. However, a centralised group compliance function may, in some cases, provide the compliance officer with better access to information, and lead to greater efficiency of the function, especially if the entities share the same premises.
82. In compliance with the proportionality principle set out in Article 22(4) of the MiFID II
Delegated Regulation, if a firm, due to the nature, scale and complexity of its business and the nature and range of investment services and activities, does not comply with
Article 22(3)(d) of the MiFID II Delegated Regulation (namely its compliance staff is also
involved in the performance of services or activities they monitor), then it may consider that the outsourcing of the compliance function’s tasks is likely to be an appropriate approach to take.
83. In all cases, outsourcing of the compliance function should not (i) undermine its quality
and independence, (ii) create undue additional operational risks, (iii) impair the activities of internal controls or (iv) impair the ability of the firm and the relevant competent authority to supervise compliance with the applicable requirements.
84. Outsourcing of all or part of the tasks of the compliance function to non-EU entities may
potentially make oversight and supervision of the compliance function more difficult and should therefore be subject to a closer monitoring.
85. In case the outsourcing arrangement related to the compliance function is terminated,
firms should ensure the continuity of the compliance function either by transferring it back to the firm or outsourcing it to another provider.
3. Competent authority review of the compliance function
Guidelines on the review of the compliance function by competent authorities (Article 7 of MiFID II and Article 22 of the MiFID II Delegated Regulation) Guideline 12
86. Competent authorities should review how firms plan to meet, implement and maintain
the applicable compliance function requirements. This should apply in the context of the authorisation process, as well as, following a risk-based approach, in the course of on￾going supervision.
87. Article 7 of MiFID II states that a “competent authority shall not grant authorisation (to a
firm) unless and until such time as it is fully satisfied that the applicant complies with all requirements under the provisions adopted pursuant to this Directive (MiFID II)”.

ESMA PUBLIC USE
Accordingly, the competent authority should assess whether a firm’s compliance function is adequately resourced and organised and whether adequate reporting lines have been established. It should require, as a condition for authorisation, that any necessary amendments to the compliance function are made as a condition for authorisation.
88. Additionally, as part of the ongoing supervisory process, a competent authority should –
following a risk-based approach – assess whether the measures implemented by the firm for the compliance function are adequate, and whether the compliance function fulfils its responsibilities appropriately. Firms are responsible for determining whether amendments to the resources and organisation of the compliance function are required due to changes in the business model of the firm. Competent authorities should also, as
part of their ongoing supervision and following a risk-based approach, assess and
monitor - where and if appropriate - whether such amendments are necessary and have been implemented. The competent authority should provide a reasonable timeframe for the firm to make amendments. However, firms’ amendments are not necessarily subject to approval by the competent authorities.
89. As mentioned under paragraph 52 above, some competent authorities license or
approve the nominated compliance officer following an assessment of the qualifications of the compliance officer.
90. Other regulatory approaches impose the responsibility for the assessment of the
compliance officer’s qualification solely on the senior management of the firm. Some Member States require firms to notify the competent authorities of the appointment and replacement of the compliance officer. In some jurisdictions, this notification must also be accompanied by a detailed statement on the grounds for the replacement. This can help competent authorities gain insight into possible tensions between the compliance officer and senior management which could be an indication of deficiencies in the compliance function’s independence.
91. Some Member States require the compliance officer to fulfil an annual questionnaire in
order to gather information on compliance of the firm. The questionnaire is an evaluation grid on how the firm’s business is intended to be conducted and monitored by the firm. This evaluation grid includes questions related to all investment services the firm is authorised to perform. Some questions also relate to the monitoring and control of the activity to be performed by the firm. (e.g. how the control functions are organized, who they report to, whether some functions are outsourced, etc., as well as a number of open fields asking the firm to describe any relevant changes and developments compared to the previous years). The answers could be validated by the firm’s senior management and then sent to the competent authority. This questionnaire could be a standardised, machine-readable report to enable data extraction, incorporate qualitative indicators and flags anomalies in a resource-efficient manner. The questionnaire could be used by competent authorities to monitor the firm and to require the firm to adopt an action plan to remediate to the issues as well as to determine the priorities of the supervision of the competent authority and to calibrate its risk-based approach.
92. The above practices could be helpful to other competent authorities.

ESMA PUBLIC USE
VI. Correlation table between the 2020 guidelines and the
2012 guidelines
2020 Guidelines 2012 Guidelines
Responsibilities of the compliance function
Compliance risk assessment
Guideline 1
Compliance risk assessment
General Guideline 1
Monitoring obligations of the compliance function Guideline 2 Monitoring obligations of the compliance function General Guideline 2 Reporting obligations of the compliance function Guideline 3 Reporting obligations of the compliance function General Guideline 3 Advisory and assistance obligations of the compliance function Guideline 4 Advisory obligations of the compliance function General Guideline 4 Organisational requirements of the compliance function Effectiveness of the compliance function Guideline 5 Effectiveness of the compliance function General Guideline 5 Skills, knowledge, expertise and authority of the compliance function Guideline 6 Permanence of the compliance function Guideline 7 Permanence of the compliance function General Guideline 6 Independence of the compliance function Guideline 8 Independence of the compliance function General Guideline 7 Proportionality with regard to the effectiveness of the compliance function Guideline 9 Exemptions General Guideline 8

ESMA PUBLIC USE
Combining the compliance function with other internal control functions Guideline 10 Complying the compliance function with other internal control functions General Guideline 9 Outsourcing of the compliance function Guideline 11 Outsourcing of the compliance function General Guideline 10 Competent authority review of the compliance function Review of the compliance function by competent authorities Guideline 12 Review of the compliance function by competent authorities General Guideline 11