What is compliance monitoring?

Compliance monitoring is the planned, risk-based testing by a firm's compliance function of whether the business is following its regulatory obligations and internal policies in practice. Testers sample real work, check it against the rule, and report what they find. AI agents can test far larger samples, but the findings and the judgement on them stay with compliance staff.

Why does compliance monitoring matter once agents act?

Monitoring answers a simple question: do the controls the firm says it runs actually work? Once agents do part of the first line's work, that question extends to them. Did the collections agent offer the forbearance options the policy requires? Did the onboarding agent collect every document? Monitoring has to test agent-performed work as rigorously as work done by people.

Agents also change how monitoring is done. A tester who once read 30 files a month can direct an agent to check every file against the same criteria, then spend their time on the exceptions. Our guide to AI compliance agents sets out why that agent belongs in the second line and nowhere else.

How does a monitoring programme work in practice?

The cycle has four stages:

1. Plan. Compliance ranks regulatory risks and sets which areas will be tested, how often and how deeply. A compliance monitoring plan template gives the structure.
2. Test. For each area, testers define criteria, select a sample and check each item. This is where agents help most: running compliance monitoring tests with an AI agent means the agent checks every item and records evidence for each.
3. Report. Findings are rated, root causes stated, and actions agreed with the business owner.
4. Follow up. Compliance checks that agreed actions were completed and worked.

An example from a consumer lender

Take a consumer lender testing whether arrears letters went out within the timescale its policy sets. Previously a tester sampled 25 accounts a quarter. Now the agent reads every arrears case for the quarter, compares the letter date to the trigger date, and lists each late letter with its account reference and the delay.

The tester reviews the list, finds that most late letters came from one product system after a change, and writes a finding with the root cause. The agent drafted the evidence. The tester wrote the finding, rated it and agreed the action with the head of collections.

How is compliance monitoring different from transaction monitoring?

The names are close and the jobs are not. Transaction monitoring is a first-line, continuous control that flags individual customer transactions that might indicate money laundering or fraud. It runs on every payment, in near real time, and produces alerts.

Compliance monitoring is a second-line assurance activity that tests whether controls, including transaction monitoring itself, are working. It runs on a plan, samples work after the event and produces findings. A compliance monitoring review might well conclude that the transaction monitoring rules are badly tuned.

Which terms sit next to compliance monitoring?

• Internal audit: the third line, which gives independent assurance over both the business and compliance.
• Thematic review: a deep test of one topic across the firm.
• Control testing: checking that a single control is designed well and operates as designed.