Ensure your boards are educated on the relevant regulatory requirements (including the principles relating to board composition, performance, and risk management) using the resources produced by the FMA.

Ensure your directors/trustees spend enough time understanding the entities they govern and applicable regulatory requirements – rather than solely relying on the FMA’s monitoring (proactive vs reactive).

Regularly review the effectiveness of the board, including the criteria for what constitutes an ‘independent’ director/trustee (if relevant)

Simply assume that your directors/trustees understand all of their general corporate governance obligations or the entity’s obligations. 

Assume continued board independence, particularly where your directors/trustees have been serving for a long period of time. 

Provide inadequately detailed reporting to the board (or, conversely, provide overly lengthy documents).

Design risk and compliance frameworks that are fit for purpose and right-sized.

Allocate sufficient resources to risk and compliance to ensure you successfully identify and manage risks and comply with your regulatory obligations. 

Clearly define risk and compliance responsibilities both within teams supporting these areas and within frontline staff who identify and manage risks on a day-to-day basis.

Ensure your compliance managers have adequate knowledge of policies, operating models or obligations.  

Ensure that the effectiveness of your resources are being monitored to confirm your objectives are being achieved

Forget to renew, update, and define functions and responsibilities that are assigned to roles in managing risk and compliance. 

Adopt policy and procedure compliance frameworks that are not tailored and inadequately reflect the intention and purpose of your business.

Create compliance frameworks that are going to be too ambitious to implement.

Allow frontline teams insufficient time and resources to adhere to your obligations. 

Ensure outsource arrangements are appropriately documented.

Undertake due diligence on your outsource providers before engaging them. 

Ensure you carry out due diligence on an ongoing basis, and do not solely rely on the information provided by the provider. 

Review your outsourcing provider arrangements at a frequency appropriate to the risk involved depending on the nature and importance of the outsourced service. 

Waive the responsibility for having a formal and adequately detailed agreement with your outsource providers (even if the provider is within the same corporate group), or for having formal periodic review and monitoring of controls in place. 

Fail to monitor the performance of your outsourcing providers.

Simply assume that your outsource providers have the required authorisation, licence, or registration –  do your own due diligence.

Ensure planned monitoring includes relevant known risks, and takes into account sector-based risk assessments. 

Prioritise monitoring based on risk (and not revenue) and apply a sense of urgency and focus on any issues identified. 

Clearly document any associated controls, if custodial functions are outsourced./p>

Rely on discovering risks at a later date by failing to be proactive from the start with the risk-based monitoring programmes.

Undertake and document an assessment of your business in line with the principles in the FMA Conduct Guide and other FMA guidance, and address any gaps. 

Consistently revisit your processes and the treatment of your customers to assess whether these lead to the best outcomes you can deliver for your customers.  

Think and act beyond the minimum legal and regulatory standards so customers can maintain trust and confidence in financial institutions and systems. 

Ensure your boards and senior leaders are encouraging good conduct, and provide the appropriate resources and support.

Ignore conduct that falls short of the FMA Conduct Guide principles or lack commitment to implement change in this area. 

Disregard feedback and insight from your customers and advisers, or fail to prioritise your customers’ needs. 

Tolerate inconsistency in approaches for identifying and dealing with customer complaints or have sufficient internal policies and processes for reporting conduct issues. 

Provide sales incentives that encourage staff to sell more products without ensuring there are adequate controls in place to address the conflicts of interest arising. 

Have a CAP in place that challenges and tests the design and operations of your processes and controls. 

Ensure the CAP operates as intended, and includes the minimum standards of independent testing. 

Review the CAP frequently to ensure it reflects current processes and controls, and operates as intended. 

Ensure your board obtains the assurance required to exercise its duties, and conducts reporting and testing as planned.

Review the FMA’s 2018 Compliance Assurance Programmes information sheet.

Fail to complete or implement a CAP – it is a minimum requirement for licensed entities. 

Only consider a narrow set of obligations, such as the NZX rules – wider entity obligations must also be covered. 

Allow the CAP to lack sufficient detail about obligations or roles, and the responsibilities for overseeing its operation.

Overdo the CAP, making it too complex and not effective to operate. It must be fit for purpose and right-sized.

Combine CAP requirements with your other internal policies. This can create ambiguity resulting in a lack of a clear testing plan.

Provide the FMA with early notice of any potential issues, as doing so allows for more assistance to resolve issues and minimize any potential harm to investors.

Have adequate processes in place to detect and resolve any issues that arise.

Revisit your financial markets conduct compliance obligations if there has been a change of ownership or integration into another business.

Ensure the appointment of appropriately qualified and experienced directors.

Fail to implement all of the policies, processes, and controls you told the FMA you had at the time of licensing.

Fail to meet the licence condition of maintaining the same or better standard of capability, governance, and compliance as was the case when the FMA assessed your license application.

Provide information to the FMA that is incorrect or potentially misleading.

Ensure you have processes and controls in place to cover all obligations required, and to ensure that no disclosure documentation, advertisements, or other communications are false or misleading.

Ensure customers’ decisions are based on fair understanding of your financial products and services, and their risks and benefits.

Consider instructing different staff in your business to undertake customer-facing documentation sign-off processes as a check on identifying potentially misleading content.

Focus only on the benefits of your products and services – instead, provide balanced information by explaining the related risks.

For Authorised Financial Advisors – promote yourself as independent if you do not meet the definition of ‘independent’.

Use the term ‘broker’ if you are not offering broking services as defined in the legislation.

Inadequately explain the terms and conditions of an incentive to your customers.

Comply with the requirements in the standard conditions and minimum licensing standards that require you to maintain internal policies and procedures. 

Put in place policies and procedures to ensure your customers receive fair and transparent outcomes.

Review your internal policies and procedures periodically, especially when there are changes in your business, to ensure they remain current and fir for purpose.

Effectively communicate the policies and procedures to your staff to ensure they are understood and followed.

Provide policies and procedures at a group or parent company level and have insufficient detail specific to your business.

Rely on policies that are too complex for a small business or generic templates that are not sufficiently customised to your business.

Fail to keep evidence of periodic reviews of your policies and procedures, or fail to undertake these reviews in a timely manner.

Ensure that appropriate training is provided to your staff and records of training are maintained.

Provide staff with a range of options to learn about their obligations. These may include facilitated sessions, online learning modules, webinars, seminars or conferences, formal study through a training institute, reading documents, and participating in discussions.

Limit training to some staff in your business over others.

Provide only one avenue for staff to receive training

Provide out-of-date material as the basis for staff training.

Outline training programmes in your plans then fail to implement them.

Obtain the correct consent before acting on behalf of a customer.

Treat customers as ‘eligible investors’ without obtaining the appropriate certification.

Obtain consent from only one trustee (where your customer is a trust) when acting on behalf of your customer.