Compliance monitoring for FCA-regulated firms: build a plan that covers every customer interaction

Compliance monitoring for FCA-regulated firms: build a plan that covers every customer interaction

Most compliance monitoring plans in financial services rest on a sample. A QA team reviews around 2% of customer calls, scores them and reports the results upward. The other 98% of conversations are never checked.

This guide sets out what compliance monitoring means for an FCA-regulated firm, what the regulator expects, and how to build a risk-based compliance monitoring plan. It also shows how Aveni Detect assesses every customer interaction against that plan.

What is compliance monitoring?

Compliance monitoring is the ongoing checking of a firm’s activities against the rules, policies and standards that apply to it. In financial services, it means testing whether advice, sales, servicing, collections and complaints handling meet FCA requirements, recording the evidence, and fixing what falls short.

A monitoring programme does three jobs:

• Detect. Find breaches, poor outcomes and emerging risks before they reach customers at scale.
• Evidence. Keep a record that shows the board and the regulator what was checked, what was found and what was done.
• Improve. Feed findings back into training, processes and product design.

For most firms, the evidence sits in customer interactions: calls, meetings, emails, chat and the documents that follow them. A plan that reviews only a small share of those interactions can report only on that share.

Map what the FCA expects from compliance monitoring

Two sets of FCA rules shape compliance monitoring in financial services.

SYSC. The Senior Management Arrangements, Systems and Controls sourcebook requires firms to maintain adequate policies and procedures to comply with their regulatory obligations. Many firms must also keep a permanent compliance function that monitors and assesses how well those arrangements work.

Consumer Duty. Firms must monitor whether customers receive good outcomes across four areas: products and services, price and value, consumer understanding and consumer support. The board must review the results at least once a year.

On 27 July 2026 the FCA published Outcomes monitoring: good practice and areas for improvement. The review covered strategy and frameworks, data and testing, and governance. Its central message: collecting data and reporting MI does not show whether customers receive good outcomes.

The FCA also listed quality assurance testing and complaints among the data sources that strong firms combine. Both come from customer interactions, which is why coverage of those interactions matters.

Build a risk-based compliance monitoring plan

A risk-based compliance monitoring plan puts the most checking where customers face the most harm. The FCA does not prescribe a format, so firms set their own. Six steps cover what most plans need.

1. List your regulated activities and customer journeys. Include each stage from first contact to exit, and any activity a third party carries out for you.
2. Rate each one for risk. Weigh the potential harm to customers, the volume of interactions, the complexity of the product and past findings.
3. Define good and poor outcomes. Write down what each looks like for every high-risk area, in terms a reviewer can test.
4. Choose the evidence and the method. Decide which calls, documents and data show the outcome, and how they will be assessed.
5. Set frequency and ownership. Name one owner for each risk area and state how often results are reviewed.
6. Report, act and re-test. Send findings to the board during the year, track each action to completion and check it changed the outcome.

Compliance monitoring plan template

Replace the owners and risk areas with your own. The “With Detect” column shows how each row changes when monitoring covers every interaction.

Compare sample-based QA with continuous compliance monitoring

A plan is only as good as the share of interactions it reaches. Manual QA teams typically review around 2% of calls, because listening to a call takes as long as the call itself.

Across the conversations Detect has assessed, 182,408 high-risk calls would have been missed under 2% manual QA coverage. Each was a conversation that carried a risk to a customer and would never have reached a reviewer.

Continuous compliance monitoring replaces the sample with the full record. The QA team stops searching for the calls that matter and starts with them.

Run the plan with Detect

Detect is Aveni’s compliance monitoring software for financial services firms. It automates the first assessment of every customer interaction and sends the cases that need judgement to your reviewers.

1. Capture every interaction. Detect takes in calls and other customer interactions across every channel.
2. Assess each one against your framework. Detect checks each interaction against the standards in your monitoring plan.
3. Assess the whole case. Detect analyses the calls, documents and evidence for a customer case together, where manual QA reviews them separately.
4. Flag and prioritise risk. Vulnerability, complaints, dissatisfaction and conduct risks are flagged, and the highest-risk cases go to the front of the review queue.
5. Keep the evidence. Each flag links to the part of the interaction that triggered it, so a reviewer, an auditor or the board can trace the finding.

Detect in numbers

Firms comparing compliance monitoring tools can read our guide to the best compliance monitoring software for FCA-regulated firms.

Keep people in charge of AI compliance monitoring

Automated compliance monitoring changes who does the first read. It does not change who is accountable. Under the Senior Managers and Certification Regime, responsibility for compliance stays with named individuals.

Detect is built around that split. AI completes the first assessment of every interaction, and people review the cases that carry risk. For every human review, Detect completes about 77 automated assessments.

Three practices keep that oversight meaningful:

• Reviewers see the evidence. A flag arrives with the part of the conversation that triggered it, so a reviewer can agree or overturn it.
• AI results are checked against human results. The FCA’s July 2026 review noted firms benchmarking AI-based testing against human testing to measure how often the two match.
• Decisions stay with people. Detect prioritises and evidences. Reviewers decide what the finding means and what happens next.

Compliance monitoring FAQs

What is a compliance monitoring plan?

A compliance monitoring plan is a document that lists the risks a firm will check, the evidence it will use, how often it will check and who owns each area. It turns regulatory obligations into a schedule of testing.

What is an FCA compliance monitoring programme?

A compliance monitoring programme is the ongoing activity that carries out the plan: the reviews, the reporting and the follow-up actions. The FCA expects firms to monitor compliance and customer outcomes but does not prescribe a template.

What should a risk-based compliance monitoring plan include?

It should include a risk rating for each regulated activity, a definition of good and poor outcomes, evidence sources, review frequency, named owners and a route for reporting to the board.

Which compliance monitoring tools do FCA-regulated firms use?

Firms use call recording, QA scorecards, complaints systems and MI dashboards. Compliance monitoring software such as Aveni Detect adds automated assessment of every customer interaction, so the plan no longer depends on a sample.

Can AI carry out compliance monitoring?

AI can complete the first assessment of every interaction and flag risk. Accountability stays with the firm’s people, who review flagged cases and decide on action.

How often should compliance monitoring take place?

Higher-risk activities need more frequent checks. With automated monitoring, every interaction is assessed as it is processed, and the board receives results during the year as well as in the annual Consumer Duty report.

See Detect assess your own customer interactions

Book a demo to see how Detect applies your compliance monitoring plan to every customer interaction.