Compliance Control: What It Is, Who Is Responsible, and How to Automate Checks

Compliance control brings together several different legal regimes: anti-money laundering, anti-corruption, personal data protection, antimonopoly regulation, and banking supervision. Each regime has its own circle of obligated persons, and it is not always an obligation at all — in some cases the law expressly calls it a right. Let’s look at which regime applies to whom, who within a company is responsible for it, and which checks can be automated and which, under the law, remain with people.

This article covers legal compliance: regimes in which the law names who is obligated and who is responsible. Information security — information protection, DLP, requirements of the Federal Service for Technical and Export Control (FSTEC) — is not covered in this article.

What Compliance Control Is

None of the five laws examined here uses the term “compliance.” They call it something else: Federal Law No. 115-FZ “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism” — “internal control rules”; Federal Law No. 273-FZ “On Combating Corruption” — “measures to prevent corruption”; Federal Law No. 152-FZ “On Personal Data” — measures to protect personal data, without a separate term for them as a whole; Federal Law No. 135-FZ “On Protection of Competition” — “a system of internal assurance of conformity with the requirements of antimonopoly legislation”; and the Banking Law (Federal Law No. 395-1 “On Banks and Banking Activities”) — “a system of internal control.” “Compliance control” and “compliance” are an umbrella business term used in practice for these regimes, which differ in their legal nature, when they are discussed together as a single company function.

Because of this, there is no single legal answer to the question “what is compliance control” — there are several separate obligations and rights, each with its own addressee.

Who Is Obligated: Regimes With Different Circles of Persons

For each regime below, the law defines in its own way the circle of obligated persons and whether it is an obligation or a right:

Anti-money laundering. Internal control rules under 115-FZ must be developed by organizations that carry out transactions with funds or other property, as well as by attorneys, notaries, auditors, persons providing legal and accounting services, and certain others — in connection with certain transactions and services (Article 7(2) and Article 7.1 of 115-FZ). Each of these groups has its own condition: for attorneys, trustees of a foreign structure, and persons providing legal or accounting services — when they prepare or carry out certain transactions and deals on behalf of a client (for example, with real estate or in managing accounts); for notaries — for the same transactions and for certain notarial acts; for audit organizations and individual auditors — specifically when providing audit services; for persons organizing a mining pool — when distributing digital currency among the pool’s participants. There is no single “in connection with transactions” condition for all four groups. A full breakdown of what exactly a business is required to do under 115-FZ and how to meet these requirements is in the article “115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements”.

Anti-corruption. Organizations are required to take measures to prevent corruption (Article 13.3 of 273-FZ) — the law does not limit the circle by the company’s type, size, or form of ownership. The law names designating responsible units or officials as one of the measures that such measures may include, alongside five others, including cooperation with law enforcement agencies and preventing conflicts of interest — the list is open, and the organization itself decides which of these measures to adopt.

Personal data protection. An operator that is a legal entity is required to appoint a person responsible for organizing the processing of personal data (Article 22.1(1) of 152-FZ). Any operator, including an individual entrepreneur (IP), is required to take the measures under Article 18.1(1); the operator determines the set of measures itself, and two of the six — appointing a responsible person and a processing policy — are addressed to a legal entity. One of the six measures — applying personal data security measures under Article 19 of the same law — already belongs to information security. For state and municipal bodies, the list of measures is established by the Government — a circle of addressees separate from operator companies.

Antimonopoly compliance. A company is entitled to create a system of internal assurance of conformity with antimonopoly legislation — the law frames this as a right (Article 9.1(1) of 135-FZ). But if a company has decided to create one, its internal acts must, taken together, contain five elements, including the procedure for assessing the risks of violating antimonopoly legislation and information about the official responsible for the functioning of the system (Article 9.1(2)). That is, the right to set up a system turns into an obligation to name a responsible person — but only for those who have already exercised this right.

Internal control in banks. A credit institution, a parent credit institution of a banking group, and a branch of a foreign bank are required to create internal control systems (Article 24(4) of the Banking Law). Who exactly within the bank is responsible for this, the provision itself does not name; the requirements for the systems the bank is required to create are established by the Bank of Russia.

Who Is Responsible Within the Company

Under the law, responsibility is distributed differently for each regime — who exactly is responsible can be seen in the third column of the table above.

In practice, a single person or unit in a company is often responsible for several of these regimes at once — a compliance department, a compliance officer, or a compliance manager. This is a distribution of roles within the company: none of the regimes examined requires creating a position of exactly this kind with this title — what matters is that the roles named by each specific provision are filled.

What Can Be Automated and What Remains With People

The internal control provisions we have examined require organizational measures: rules, responsible persons, documentation, training. Software and hardware tools are mentioned in them once — as a subject of risk assessment: among the requirements that Article 7.1(1) extends to the groups in the first row of the table, there is an assessment of the possibility of new services and software and hardware tools being used for the legalization (laundering) of proceeds and the financing of terrorism. There is no requirement in them to use a specific program. Which tools to use to carry out the organizational measures is for the company itself to decide.

On the market, what lends itself to formalization is automated: checks of counterparties and customers against databases, screening against sanctions lists and lists of politically exposed persons (PEPs), detection of conflicts of interest, communications monitoring, tracking of completed briefings. How to build such a check of counterparties and beneficial owners for B2B compliance is covered separately in the article “AML, KYB, and Beneficiary Verification”. Database checks are a tool for one part of one regime: customer identification and confirming the accuracy of information under 115-FZ. Such a check neither replaces nor performs the internal control rules themselves, the appointment of a responsible person, their training, or documentation.

Responsibility, however, remains with people: the internal control rules are approved by the head of the organization, and the appointed special official is responsible for implementing them. Other regimes have their own responsible persons, according to the rows of the table above.

Where to Start

The practical order is as follows: first, use the table above to determine which of the regimes examined apply to the company — based on its type of activity and the transactions it carries out. For each applicable regime, appoint the person within the company who is responsible for it, under the rules of the relevant provision. Next, prepare the documents a specific regime requires: internal control rules, a personal data processing policy, an internal act on the antimonopoly compliance system if the company has decided to create one. Train those employees for whom training is provided. And regularly check that the measures are actually applied in practice.

FAQ

Is Compliance Control Mandatory for All Companies?

No. The obligation arises under separate regimes and for different circles of persons: some companies fall under several of the regimes examined here, some under none. None of these laws names a single obligation to “conduct compliance control” (statutory provision, taken across the regimes examined).

Is Antimonopoly Compliance an Obligation or a Right?

A right. An economic entity is entitled to set up a system of internal assurance of conformity with antimonopoly legislation (Article 9.1(1) of 135-FZ, statutory provision). But if a system has been created, the internal act must name the official responsible for it (Article 9.1(2)(5)).

Who Approves the Internal Control Rules Under 115-FZ?

The head of the organization (a paragraph of Article 7(2) of 115-FZ, statutory provision).

Who Appoints the Person Responsible for Personal Data Processing?

An operator that is a legal entity — the law obliges precisely it to appoint such a person (Article 22.1(1) of 152-FZ, statutory provision). Any other operator, including an individual entrepreneur, is required to take measures to protect personal data, but the appointment of a responsible person is not addressed to it by law.

Can Software Replace the Person Responsible for Compliance?

No. The internal control provisions we have examined place the implementation of organizational measures on people — for example, the internal control rules under 115-FZ are approved by the head of the organization. Individual checks can be automated, but not the replacement of the responsible person named by law.

What Is Compliance Control in Simple Terms?

An umbrella business term for several different legal regimes, each of which the law names in its own way — for example, “internal control rules” or “a system of internal control.” The word “compliance” itself does not appear in these laws.