When the CFO Is Asked to Cover Compliance Too

At a certain size of regulated firm, a particular conversation happens. The compliance officer has resigned, or the outsourced arrangement has ended, or the firm has just been authorised and the question of who holds Compliance Oversight has become urgent. Somebody looks across the table at the CFO and says: you are already approved, you understand the rulebook better than anyone here, could you not just pick it up?

It is a reasonable question and it has a reasonable answer in some firms. But it is asked far more often than it should be accepted, and the CFO who says yes without thinking it through is taking on a second set of personal regulatory responsibilities on terms they have not examined.

This piece is about how to think about that request: why it comes up, where the combination genuinely works, where it does not, and what the alternatives look like for a firm that cannot justify a second full-time appointment.

Why the CFO Gets Asked

Four things usually combine. The CFO is already an approved person, so the firm assumes the second approval is a formality. They are financially literate and comfortable with rules. They have a direct line to the board. And they are, in the firm’s mind, the adult in the room on anything that involves a regulator.

There is also an unspoken fifth reason, which is cost. A firm of thirty people weighing a dedicated compliance appointment against a line in an existing job description will find the second option attractive, particularly where the compliance function has historically been thin and nothing has gone wrong.

None of these are bad reasons. The difficulty is that they are all arguments about the individual, and the objections are structural.

The Conflict Nobody Names in the Meeting

Compliance Oversight exists to provide independent assurance to the governing body that the firm is complying with its obligations. A substantial proportion of those obligations sit inside the finance function: regulatory reporting, the capital position, client money arrangements where the firm holds it, and the accuracy of what is submitted to the regulator.

When the CFO holds Compliance Oversight, the person assuring the board that regulatory reporting is accurate is the person who produced it. That is self-review, and it is the single strongest argument against the combination. It does not mean the individual will do anything wrong. It means that the control the board thinks it has is not the control it actually has, because the second pair of eyes is the first pair of eyes.

Firms tend to respond that the compliance work at their firm is mostly conduct — promotions, suitability, complaints — rather than anything finance touches. Often true, and worth testing honestly rather than asserting. Our piece on what a CFO should know about compliance monitoring is a useful frame for working out how much of the monitoring programme actually points back at the finance function.

The Capacity Problem, Which Is More Immediate

The conflict argument is the one that gets debated. The capacity argument is the one that bites first.

A CFO at a growing regulated firm is not sitting on spare capacity. Add Compliance Oversight and the work does not arrive as a tidy monthly allocation; it arrives as the monitoring programme, the financial promotions queue, the complaints that escalate, the training and competence scheme, the conduct rules breaches register, and the supervisory correspondence that lands without notice and takes precedence over everything in the finance diary.

The predictable failure is not dramatic. It is that compliance work is done last, because finance has hard external deadlines and compliance mostly does not — until it does. Twelve months on, the monitoring plan has been partly executed, the file is thin, and the firm has a compliance function that exists on the organisation chart and not much in evidence.

That matters because the holder of the function is personally accountable for it under the senior managers regime, and the assessment of whether they took reasonable steps will be made against the file rather than against how busy they were.

What Approval Actually Involves

It is worth correcting a common assumption. A CFO already approved for the chief finance function is not automatically able to pick up Compliance Oversight: that is a separate controlled function requiring its own approval, assessed on fitness, propriety and competence for that specific role at that specific firm.

The application is also an opportunity for the firm to be asked exactly the questions it has been avoiding internally — how the conflict is managed, how much time the individual will devote, what compliance experience they bring. Firms sometimes discover their own answer is weaker than they thought at the point they have to write it down. Our guide to the SMF16 compliance oversight function sets out what the role carries.

Where the Combination Is Genuinely Defensible

It can be the right answer. The conditions tend to be these.

The firm is small and its permissions are narrow, so the compliance workload is genuinely modest and predictable. The business model does not put finance and compliance in conflict — no client money, limited regulatory reporting complexity, no product governance obligations of any weight. The CFO has real compliance experience rather than general regulatory literacy. There is somebody independent, usually a non-executive, to whom compliance matters can be escalated without going through the executive the matters concern. And the arrangement is reviewed on a date in the diary rather than left to run until something forces the issue.

Where those hold, a combined appointment is a proportionate answer and the regulator is unlikely to take issue with it. Where two or three of them do not hold, the firm is relying on the individual rather than on an arrangement.

The Middle Option Most Firms Overlook

The choice is usually framed as the CFO taking it on or the firm hiring a full-time compliance officer it cannot really justify. There is a third option, and it is now the most common structure at firms of this size: a fractional compliance officer who holds the function on a part-time basis.

The arrangement is straightforward. The holder is approved for the firm in the ordinary way, attends the board, owns and executes the monitoring programme, handles supervisory correspondence, and is available between visits. The firm gets an independent function at a fraction of a full-time cost, and the CFO gets to be the person the compliance function reports alongside rather than the person it reports as.

Where financial crime is also in scope, the same logic applies to the SMF17 MLRO function, and a single holder covering both the SMF16 and SMF17 roles is a well-established structure at smaller firms. FD Capital recruits for all three arrangements and will give a straight view on which fits a particular firm.

Questions a CFO Should Ask Before Saying Yes

If the request has been made and the answer is not an obvious no, six questions settle it quickly.

How much of the monitoring programme points at work the finance function produces? Who would I escalate to if the issue were a board decision I had been part of? How many hours a month is this, measured rather than estimated, and what comes off my plate to make room? What is the state of the compliance file today, and what would I be inheriting? What compliance experience do I actually have, as distinct from regulatory familiarity? And if this goes wrong in two years, what will the file show that I did?

The last one is the one that concentrates the mind, and it is the right question, because personal accountability under the regime is assessed on evidence rather than on intent. Our piece on what changes when the finance job is a senior manager function is worth reading alongside this.

A Note on Saying No Well

A CFO who declines is not being unhelpful, and it is worth framing the refusal as what it is: a governance point rather than a workload complaint. The firm needs an independent compliance function because that is what the structure is for, and the CFO is the one person in the business who cannot provide independent assurance over a meaningful part of it.

Offering the alternative in the same conversation makes that much easier. A fractional appointment is a real answer with a real cost attached, and boards respond better to a proposal than to an objection.