A compliance team's approver rule has an extra job: protecting the sources every other agent relies on. Compliance officers approve agent drafts of monitoring notes and returns. Changes to the policy library need the policy owner and a second approver, because every agent treats the library as sealed. Regulatory submissions need a senior signatory. Approval rights follow current certificates.
What does a compliance approver rule cover, and who owns it?
Compliance teams use agents to monitor obligations, read regulatory updates, draft policy changes, prepare returns and log breaches. That work sits close to two sensitive things: what the firm tells its regulator, and what the firm's own policies say. The approver rule decides who may release each held action. Our guide to AI agent skills by role sets out what compliance officers need to know about agents, both as users and as checkers.
The head of compliance owns the rule. Internal audit or the board risk committee reviews it. The agent owner configures it. Our explainer on what an agent approver is covers the approver's role in general.
What are the steps?
- Head of compliance: lists the agent's actions by depth. Depth 1: reads regulatory updates, policies and monitoring data. Depth 2: drafts monitoring reports, breach log entries, policy changes and regulatory returns. Depth 3: updates the obligations register and sends attestation reminders. Depth 4: publishes a change to the policy library or submits a return.
- Head of compliance: assigns depth 2 approvals to compliance officers covering that area.
- Head of compliance: puts policy library changes under two people: the policy owner and a compliance officer who did not draft or request the change.
- Head of compliance: assigns submissions to a named senior signatory, usually the person accountable for that return.
- Head of compliance: ties each role to a current certificate.
- Agent owner: configures the holds and files the rule.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read updates | Summarises new rules and guidance | 1 | Interpretation |
| Draft monitoring report | Drafts findings from data | 2 | Officer approves |
| Update register | Records obligations and owners | 3 | Nothing within bounds |
| Change policy library | Prepares and holds | 4 | Policy owner plus second approver |
| Submit return | Prepares and holds | 4 | Senior signatory |
| Breach decision | Drafts the log entry | 2 | Officer decides if it is a breach |
Why are policy library changes treated as depth 4?
Other agents in the firm read the policy library as a sealed source: issued by the system of record and tamper-evident. A refund agent checks the refund policy there; a lending agent checks the credit policy. When the compliance agent publishes a change, it changes what those agents may do the next time they act. That is hard to undo in practice, because decisions made under the changed policy are already in the world.
So the rule treats a policy change like moving money. Two people approve it. The second approver checks the change against the reason it was requested and checks which agents read that policy. Where the change loosens a limit, the owners of those agents should know before it goes live.
There is also a separation point. Compliance officers should not become day-to-day approvers of first-line agents' actions, such as a lending agent's held loans. That would put them in the first line for that work and remove their ability to check it.
Which controls make the rule work, and what evidence do they leave?
Two approvers on policy changes. Evidence: two named approvers on each published change, neither of them the requester.
Affected agents listed. Evidence: the held change shows which agents read the policy, and their owners acknowledged it.
Senior signatory on submissions. Evidence: the signatory named on each submitted return.
Breach decisions by people. The agent drafts the log entry; an officer decides whether it is a breach. Evidence: the officer named on each entry.
Rights lapse with certificates. Evidence: approver status on the date of each release. The approver authority matrix for the compliance team is the reference.
What should you measure?
- Policy changes published with one approver. The target is none.
- Policy changes that loosened a limit, and whether affected agent owners were told first.
- Draft returns corrected before submission, grouped by cause.
- Compliance officers approving first-line agent actions. Ideally none.
Where does it usually go wrong?
The agent's summary of a new rule becomes the interpretation. Summaries are useful; interpretation belongs to a compliance officer and should be recorded as theirs.
Breach decisions wait on the draft. The agent drafts a breach log entry, the officer means to tidy it, and the entry sits for a week. Some breaches must be reported to a regulator quickly. The rule should set a response-time target for breach decisions, separate from the time it takes to polish the wording, so that the decision is recorded first and the narrative follows.
Policy edits bypass the library. Someone changes a policy document outside the library, and the agents never see it, or see an external copy. Keep one source.
Risk and compliance approve each other's work by habit. Compare the approver authority matrix for the risk team: the two teams should be independent checks, not a closed loop.
Rules borrowed from procurement or IT. Those teams approve purchases and system changes. Compare the approver rule for the procurement team and the approver rule for the IT team for how differently the risks fall.
Questions people ask
Should compliance officers take operator training if they do not run agents?
Yes, at least enough to understand depth, held actions and the verdict record. They need to read the record to check first-line approvers, which means knowing what each verdict means.
Can the agent submit routine returns on its own?
Most firms keep submissions held for a signatory because the firm is accountable for what it tells a regulator. The agent saves the preparation time.
What if a regulatory update requires urgent policy change?
Use the same two-approver route with a shorter response-time target. Urgency is a reason to staff the approval, not to skip it.