NISM Series III-A · Chapter 3: Introduction to Compliance

L1 · Foundation

Introduction to Compliance

What compliance means in the securities market, who the compliance officer is and why the role exists; his appointment under Regulation 18A of the Stock Brokers Regulations and Regulation 14 of the Intermediaries Regulations; his dual reporting to the board and to SEBI; why independence matters and the RBI's parallel chief compliance officer guidelines; mandatory and critical reporting and the 1st April certificate; and the CAPSM Regulations — who must be certified, how the certificate is obtained, its three-year validity and continuing professional education.

18 min read · Worth 4% of the paper · Written from pages 66–73 of the official NISM workbook · Updated 17 September 2026

What this chapter covers

This chapter carries 4 per cent of the III-A examination.

LEARNING OBJECTIVES: After studying this chapter, you should know about:

Appointment of compliance officer by stock brokers.
Role and Reporting structure of Compliance officer.
Appointment of compliance officer.
Responsibilities of compliance officers towards stakeholders.
Compliance requirements under the SEBI (Certification of Associated Persons in Securities Markets) Regulations, 2007.**

3.1.1 What compliance means

In general, compliance means conforming to a rule, such as a specification, policy, standard or law.

The first review question asks exactly that — compliance primarily involves conforming to a rule, policy, standard or law. Record keeping and reporting are among the actions by which it is achieved, not the meaning of the word.

Specifically, in the context of the securities market, compliance however means a set of actions by which registered intermediaries in securities markets and issuer companies need to comply with the rules and regulations, notifications, guidelines and instructions issued by the Securities and Exchange Board of India (SEBI), the stock exchanges, depositories with whom the intermediary has taken membership, as well as policies laid down by the Board of Directors (BoD) of the Company and other competent authorities.

In plain words: compliance is what a firm does to follow the rules. The rules come from SEBI, the exchanges, the depositories, its own board and other competent authorities.

Five sources of obligation — SEBI, the exchanges, the depositories, the company's own board, and other competent authorities.

The set of actions include maintenance of records, adoption of policies and procedures, preparation of reports, taking actions and making submissions to the competent authorities.

Five actions: records · policies and procedures · reports · actions · submissions.

3.1.2 The compliance officer

Compliance Officer (CO) is a person specifically designated by the regulated entity for monitoring compliance with the provisions of the SEBI Act, 1992, rules and regulations thereunder, notifications, guidelines and instructions issued by the SEBI or the Central Government and for redressal of investors' grievances.

Two mandates in one sentence — monitoring compliance, and redressal of grievances.

The compliance officer is also required to monitor the compliance of the rules, regulations and bye-laws of the concerned stock exchanges, or the Registrar of Companies, where applicable. In other words, the compliance officer is the first line regulator and all regulations require the appointment of COs.

"The first line regulator" — the phrase to remember. The regulator supervises from outside; the CO supervises from within.

Compliance as a function has been noted as one of the most important functions in the intermediaries across worldwide exchanges, commissions etc.

IOSCO's definition, from its 2005 discussion paper on 'Compliance function at Market Intermediaries', is worth learning:

"A function that, on an on-going basis, identifies, assesses, advises on, monitors and reports on a market intermediary's compliance with securities regulatory requirements, including whether there are appropriate supervisory procedures in place".

Five verbs — identifies, assesses, advises on, monitors and reports — and one addition: it also checks whether there are appropriate supervisory procedures in place.

3.1.3 Appointment

Two regulations require it.

Under the SEBI (Stock Brokers) Regulations, 1992, Regulation 18A:

(1) Every stockbroker shall appoint a CO who shall be responsible for monitoring the compliance of the Act, rules and regulations, notifications, guidelines, instructions and so on, issued by SEBI or the Central Government and for redressal of investors' grievances.

(2) The Compliance Officer shall immediately and independently report to SEBI any non-compliance observed by him.

Note the two words in sub-regulation (2) — immediately and independently.

Under the SEBI (Intermediaries) Regulations, 2008 dated 26th May 2008, Regulation 14:

1) An intermediary shall appoint a compliance officer for monitoring the compliance by it, of the requirements of the Act, rules, regulations, notifications, guidelines, circulars and orders made or issued by SEBI or the Central Government, or the rules, regulations and bye-laws of the concerned stock exchanges, or the SRO, where applicable: Provided that the intermediary may not appoint a compliance officer if it is not carrying on the activity of the intermediary.

In plain words: every intermediary must have a compliance officer. The officer watches whether the firm follows the rules of SEBI, the Central Government, the exchanges and the SRO. The only exception is a firm that is not carrying on the activity of the intermediary.

2) The compliance officer shall report to the intermediary or its BoD, in writing, any material non-compliance by the intermediary.

The second review question is therefore True — the Intermediaries Regulations do mandate the appointment.

One exemption: an intermediary may not appoint a compliance officer if it is not carrying on the activity of the intermediary.

And the requirement is not confined to these two: the compliance officer may be appointed under other regulations also, apart from the Securities and Exchange Board of India (Stock Brokers) Regulations, 1992.

Regulation	Reports to
Stock Brokers Regulations, Reg. 18A(2)	Immediately and independently report to SEBI any non-compliance
Intermediaries Regulations, Reg. 14(2)	Report to the intermediary or its BoD, in writing, any material non-compliance

Both, not either — see below.

3.1.4 Scope and role

The CO shall be responsible for monitoring the compliance with the SEBI Act, 1992, and more specifically with the rules and regulations, notifications, guidelines, orders passed and instructions issued by SEBI or the Central Government or the rules, regulations and bye-laws of the concerned stock exchanges, or the Self-Regulatory Organization (SROs), where applicable, by the concerned intermediary. The responsibility of the CO also extends to ensure redressal of investors' grievances.

In plain words: the CO checks that the firm follows SEBI's rules and the exchange's rules. He also makes sure investor grievances are redressed.

Why the function matters: compliance looks into the different aspects of the culture and ethics of a market intermediary and is an important tool in managing the risk of legal or regulatory sanctions, financial loss, or loss to reputation resulting from the violation of regulatory requirements.

Three risks named — legal or regulatory sanctions, financial loss, or loss to reputation.

And an internal dimension: the CO is responsible for monitoring the internal standards and policies put in place by the intermediary that also involves protecting the firm from any liability arising from false claims/abuses committed by its customers.

Protecting the firm from its own customers' abuses — a point often missed.

The dual reporting line, stated plainly: the CO is appointed by an entity or its Board of Directors (BoD) to comply with the SEBI Act and regulations, rules and so on. As such, the CO is required to report to the BoD of the Intermediary. However, where there is a non-compliance of the provisions of the SEBI Act or the allied regulations and rules, the CO is required to report to SEBI immediately and independently any non-compliance of the intermediary.

Routine reporting inward; non-compliance outward as well.

3.1.5 Independence

The gap between regulatory intent and compliance shall be minimal if there is a professional cadre of compliance officers in each organization of intermediaries. This is the rationale for the independent functioning of the CO, in any intermediary organization.

And the sharpest sentence in the chapter: CO shall participate in the preparation of policies and procedures so that the internal affairs of the intermediary are aligned with the regulatory objective rather than business expediency in case of conflict between the two.

Regulatory objective over business expediency — that is what independence is for.

This necessitates the level of reporting by the CO to the BoD/owners and SEBI and other competent authorities. It frees the CO from elaborate internal reporting procedures and protocol with the delays and inadequate attention to compliance matters.

A direct line exists precisely so that no one in between can slow the message down.

The banking parallel. RBI in September 2020 issued guidelines to Banks to set up an independent corporate compliance function headed by a designated chief compliance officer (CCO) selected through a suitable process with an appropriate 'fit and proper' selection criteria to effectively manage compliance risk.

The CCO should be appointed for a minimum fixed period of three years in the rank of a general manager or not below two levels of the rank of CEO. A CCO "may be transferred/ removed before completion of the tenure only in exceptional circumstances with the explicit prior approval of the board after following a well-defined and transparent internal administrative procedure".

Three protections in one paragraph — a minimum fixed period of three years, a rank not below two levels of the rank of CEO, and removal only in exceptional circumstances with the explicit prior approval of the board.

Tenure, rank and protected removal are how independence is made real.

3.1.6 Reporting responsibility

It is the duty of the CO to immediately and independently report any non-compliance observed to the BoD of the intermediary and SEBI.

Two kinds of reporting:

Mandatory reporting: Periodic submission of reports as per provisions of regulations.

Critical Reporting: CO must immediately and independently report to SEBI and BoD any non-compliance observed.

The distinction the third review question tests. Routine filings such as books of accounts or the sauda book are mandatory reporting — periodic and scheduled. Something like a money laundering activity is critical reporting — it must go immediately and independently, without waiting for a due date.

Periodic on a calendar; critical on discovery.

A third duty sits alongside them: Coordination with the Regulators - The Compliance Officer is responsible for all the compliances under various laws. The coordination with the regulators under each law applicable to the entity is an important role of the Compliance Officer.

The annual certificate

Under Regulation 12 of the SEBI (Intermediaries) Regulations 2008, the intermediary must:

(1) Provide SEBI with a certificate of its compliance officer on the 1st April of each year certifying: a) the compliance by the intermediary with all the obligations, responsibilities and the fulfilment of the eligibility criteria on a continuous basis under these regulations and the relevant regulations; b) that all disclosures made in Form A and under the relevant regulations are true and complete.

In plain words: every year, on 1st April, the firm gives SEBI a certificate from its compliance officer. It says two things. The firm met all its obligations and eligibility criteria on a continuous basis. And its disclosures in Form A are true and complete.

Note "on a continuous basis" — the certificate is not about a single date; it certifies that eligibility held throughout.

(2) Prominently display a photocopy of the certificate at all its offices including branch offices.

(3) Prominently display the name and contact details of the compliance officer to whom a complaint may be made in the event of any investor grievance.

(4) Maintain books, accounts and records as specified in the relevant regulations.

The CO's name must be on the wall — which is the practical face of his grievance-redressal mandate.

3.2 The CAPSM Regulations, 2007

The SEBI (Certification of Associated Persons in Securities Markets) (CAPSM) Regulations, 2007, Regulations 7 and 8, delegates the following powers and functions to the National Institute of Securities Markets (NISM):

(a) The functions of NISM in respect of certification for associated persons in the securities market shall include putting in place and implementing the certification process, procedure and policies.

(b) NISM in consultation with SEBI may lay down standards which may, (i) specify that all or any portion of such standards shall be applicable to all or any category of associated persons working or associated with all or any class of intermediaries in the securities market; (ii) specify that no associated person in any such class may be qualified to be employed or engaged or continued to be employed or engaged by an intermediary unless he is in compliance with such standards of examination, continuing professional education requirements and such other qualifications as NISM in consultation with SEBI may specify.

In plain words: NISM runs the certification process. With SEBI, it can set standards for any category of associated persons. A person who does not meet them cannot be employed, engaged or continued in that role.

Note "or continued to be employed" — certification is not merely an entry requirement.

3.2.1 Who must be certified

Regulation 3... provides that SEBI may by notification in the official gazette require such categories of associated persons to obtain the requisite certificate for engagement or employment with such classes of intermediaries and within such time as may be specified.

A transition rule for existing staff: an associated person employed or engaged by an intermediary prior to the date specified by SEBI may continue to be employed or engaged by the intermediary if he obtains the certificate within two years from the said date.

Two years for someone already in post.

And no duplication: an associated person, who as on the date specified by SEBI, holds a certificate for a category as recognised by SEBI shall not be required to obtain a fresh certificate for the same category during the validity of such certificate.

Six considerations decide whether a person needs a certificate — whether he:

(a) as part of his work or operation, deals or interacts with the investors, issuers, or clients of intermediaries.
(b) deals with assets or funds of investor or clients.
(c) handles redressal of investor grievances.
(d) is responsible for internal control or risk management.
(e) is responsible for compliance of any rules or regulations.
(f) is engaged in activities that have a bearing on operational risk of the intermediary.

Note (e) — a compliance officer is himself squarely within the certification net.

3.2.2 How the certificate is obtained

Regulation 4... specifies the manner of obtaining the certificate the first time.

Category	Routes available
A Principal	Passing the relevant certification examination · successfully completing a related CPE Program · delivering at least four sessions in a specific CPE program
A person other than a principal, who has attained 50 years of age or who has 10 years of experience	Passing the relevant certification examination · successfully completing a related CPE Program
All other persons	Passing the relevant certification examination

Three routes, two routes, one route — the concession narrows as seniority falls.

Who is a Principal: a person who is actively engaged in the management of the intermediary's securities business including supervision, solicitation, conduct of business, and includes: a) Sole Proprietors, b) Managing Partners and c) Whole Time Directors.

3.2.3 Validity

The certificate given under regulation 3 of SEBI (CAPSM) Regulations, 2007 is valid for 3 years from the date of the grant of the certificate or revalidation as the case may be.

Three years — the fourth review question.

Upon the expiry of the validity of the certificate possessed by the associated person, the certificate shall be revalidated for 3 years provided the associated person successfully completes a programme of continuing professional education as specified by NISM.

And the consequence of letting it lapse: no associated person engaged in any of the activities mentioned in clauses (a) to (f) of sub-regulation (4) of regulation 3 shall continue to be so engaged unless such a person holds a valid certificate as specified by the Board.

A lapsed certificate means the person may not continue in that role.

3.2.4 Continuing professional education

Upon expiry of the validity of the certificate possessed by an associated person, the certificate may get revalidated, provided the associated person successfully completes a programme of continuing professional education, as may be specified by NISM during 12 months preceding the date of expiry of the certificate, or by passing the relevant NISM Certification Examination before the expiry of the existing certificate.

In plain words: there are two ways to revalidate. Complete the CPE programme in the 12 months before expiry. Or pass the relevant NISM examination before expiry.

Two windows — a CPE programme during 12 months preceding the date of expiry, or the examination before the expiry.

The certificate will be revalidated for three years from the date of expiry of the existing certificate.

From expiry, not from the date of the CPE — so completing CPE early loses nothing.

Revalidation routes mirror the first-time routes, with one difference:

Category	Revalidation routes
A Principal	Examination · CPE Program · delivering at least four sessions in specific CPE program
Non-principal aged 50 or with 10 years' experience	Examination · CPE Program
All other persons	Examination · CPE Program

Note the change for "all other persons" — on revalidation they gain the CPE route, which was not open to them the first time.

Annexure 1 at the end of the workbook details the various SEBI mandated NISM certifications and the associated persons they are mandated for.

The chapter's review questions confirm four answers:

Compliance primarily involves conforming to a rule, policy, standard or law.
It is True that the SEBI (Intermediaries) Regulations, 2008 mandate the appointment of a compliance officer.
Money laundering activities are a matter for critical reporting. Submission of books of accounts and the sauda book is periodic mandatory reporting.
A CAPSM certificate is valid for 3 years.

Think of it like this

The first line regulator

The chapter gives the compliance officer a phrase that explains the whole role.

In other words, the compliance officer is the first line regulator and all regulations require the appointment of COs.

SEBI regulates from outside; the CO regulates from inside. SEBI cannot sit in every broking office reading every contract note — so the law places a person there who must.

What he watches: monitoring compliance with the provisions of the SEBI Act, 1992, rules and regulations thereunder, notifications, guidelines and instructions issued by the SEBI or the Central Government and for redressal of investors' grievances — extending to the rules, regulations and bye-laws of the concerned stock exchanges, or the Registrar of Companies, where applicable.

IOSCO put the function into five verbs. A compliance function identifies, assesses, advises on, monitors and reports on a market intermediary's compliance with securities regulatory requirements, including whether there are appropriate supervisory procedures in place.

Note the last clause. He does not only check outcomes; he checks whether the firm's own supervisory machinery is capable of producing compliant outcomes.

Why the role is treated as central: compliance looks into the different aspects of the culture and ethics of a market intermediary and is an important tool in managing the risk of legal or regulatory sanctions, financial loss, or loss to reputation resulting from the violation of regulatory requirements.

Culture and ethics — not merely paperwork.

And it protects the firm in both directions. Outward, from regulatory sanction; inward, since the CO is responsible for monitoring the internal standards and policies put in place by the intermediary that also involves protecting the firm from any liability arising from false claims/abuses committed by its customers.

Where the obligations come from. Five sources: SEBI, the stock exchanges, depositories with whom the intermediary has taken membership, as well as policies laid down by the Board of Directors (BoD) of the Company and other competent authorities.

And five actions discharge them: maintenance of records, adoption of policies and procedures, preparation of reports, taking actions and making submissions to the competent authorities.

Two reporting lines, and why both are needed

A compliance officer answers to two masters, and the chapter is careful about which gets what.

Under the Intermediaries Regulations: the compliance officer shall report to the intermediary or its BoD, in writing, any material non-compliance by the intermediary.

Under the Stock Brokers Regulations: the Compliance Officer shall immediately and independently report to SEBI any non-compliance observed by him.

And the chapter resolves the apparent tension — it is both, not either. The CO is appointed by an entity or its Board of Directors (BoD)... As such, the CO is required to report to the BoD of the Intermediary. However, where there is a non-compliance of the provisions of the SEBI Act or the allied regulations and rules, the CO is required to report to SEBI immediately and independently any non-compliance of the intermediary.

Restated once more: it is the duty of the CO to immediately and independently report any non-compliance observed to the BoD of the intermediary and SEBI.

Why a second line is necessary. A CO who reported only to his own board would be reporting the firm's failings to the very people who might have caused them. The external line means that a breach cannot be buried by the people it embarrasses.

Which is exactly the point the independence section makes: the direct line frees the CO from elaborate internal reporting procedures and protocol with the delays and inadequate attention to compliance matters.

Note the two adverbs, repeated every time: immediately and independently. Not after an internal review, and not through a superior.

And the two reporting types run in parallel to the two reporting lines: Mandatory reporting: Periodic submission of reports as per provisions of regulations, and Critical Reporting: CO must immediately and independently report to SEBI and BoD any non-compliance observed.

A third duty joins them: the coordination with the regulators under each law applicable to the entity is an important role of the Compliance Officer.

What makes independence real — tenure, rank and protected removal

Independence is easy to assert and hard to build. The chapter shows how it is actually constructed.

The reason first: the gap between regulatory intent and compliance shall be minimal if there is a professional cadre of compliance officers in each organization of intermediaries. This is the rationale for the independent functioning of the CO.

And what it must survive: CO shall participate in the preparation of policies and procedures so that the internal affairs of the intermediary are aligned with the regulatory objective rather than business expediency in case of conflict between the two.

"In case of conflict between the two" — the drafters expected the conflict, and told the CO which side to take.

But an officer who can be dismissed the next morning cannot choose the regulatory objective. Which is why the RBI's September 2020 guidelines for banks are set out here as the model.

Selection: a chief compliance officer (CCO) selected through a suitable process with an appropriate 'fit and proper' selection criteria to effectively manage compliance risk.

Tenure: the CCO should be appointed for a minimum fixed period of three years.

Rank: in the rank of a general manager or not below two levels of the rank of CEO.

Removal: a CCO "may be transferred/ removed before completion of the tenure only in exceptional circumstances with the explicit prior approval of the board after following a well-defined and transparent internal administrative procedure".

Four protections — selection, tenure, rank, removal. Each answers a different way of neutralising an inconvenient officer: appointing a pliable one, waiting him out, burying him in the hierarchy, or removing him quietly.

Rank matters more than it looks. An officer two levels below the CEO can raise a matter with people senior to those he is reporting on. One buried five levels down cannot.

And the reporting structure completes the design: this necessitates the level of reporting by the CO to the BoD/owners and SEBI and other competent authorities.

Mandatory reporting or critical reporting — a calendar or a discovery

The chapter draws one clean line through everything a compliance officer sends out.

Mandatory reporting: Periodic submission of reports as per provisions of regulations.

Critical Reporting: CO must immediately and independently report to SEBI and BoD any non-compliance observed.

The test is what triggers it. Mandatory reporting is triggered by a date; critical reporting by an event.

Which is what the third review question is really asking. A sauda book and the submission of books of accounts are records filed on a schedule — mandatory reporting. A money laundering activity is a discovery, and must go out immediately and independently the moment it is observed.

The words matter. Immediately rules out waiting for the next filing cycle; independently rules out routing it through anyone who might prefer it unsent.

An example of mandatory reporting at its most formal is the annual certificate under Regulation 12 of the SEBI (Intermediaries) Regulations 2008 — a certificate on the 1st April of each year certifying... the compliance by the intermediary with all the obligations, responsibilities and the fulfilment of the eligibility criteria on a continuous basis, and that all disclosures made in Form A and under the relevant regulations are true and complete.

A fixed date, a fixed content — the definition of periodic.

Three further duties accompany it: prominently display a photocopy of the certificate at all its offices including branch offices · prominently display the name and contact details of the compliance officer to whom a complaint may be made in the event of any investor grievance · and maintain books, accounts and records as specified in the relevant regulations.

That middle duty is the CO's grievance mandate made visible — his name on the wall of every branch, because his responsibility also extends to ensure redressal of investors' grievances.

And alongside both types sits coordination: the Compliance Officer is responsible for all the compliances under various laws.

Three years, and the six questions that decide who needs a certificate

The CAPSM Regulations answer two questions: who must be certified, and for how long the certificate lasts.

The duration is simple. The certificate given under regulation 3 of SEBI (CAPSM) Regulations, 2007 is valid for 3 years from the date of the grant of the certificate or revalidation as the case may be.

Three years, and revalidation restarts the clock: the certificate will be revalidated for three years from the date of expiry of the existing certificate.

From expiry, not from the date the CPE was completed — so nothing is lost by finishing early.

Who needs one is decided by six questions. Whether the associated person deals or interacts with the investors, issuers, or clients of intermediaries · deals with assets or funds of investor or clients · handles redressal of investor grievances · is responsible for internal control or risk management · is responsible for compliance of any rules or regulations · or is engaged in activities that have a bearing on operational risk of the intermediary.

Read them together and a pattern appears — every one identifies someone who can cause harm: to a client directly, to client money, to a complaint, or to the firm's control environment.

Note the fifth. A compliance officer is responsible for compliance of any rules or regulations, so he falls within the net himself.

And the consequence of letting a certificate lapse is severe: no associated person engaged in any of the activities mentioned in clauses (a) to (f)... shall continue to be so engaged unless such a person holds a valid certificate.

Not a fine — a bar on continuing in the role. Which is why NISM's standards may specify that no person may be qualified to be employed or engaged or continued to be employed or engaged by an intermediary without them.

Two easements exist. Someone already in post when a category is notified has two years from the said date to obtain the certificate; and a person already holding a certificate for the same category need not obtain a fresh one during the validity of such certificate.

Key terms in this chapter

Actions constituting compliance: Maintenance of records, adoption of policies and procedures, preparation of reports, taking actions, and making submissions to the competent authorities.
CAPSM Regulations and NISM: The SEBI (Certification of Associated Persons in Securities Markets) Regulations, 2007 delegate to NISM, by Regulations 7 and 8, the function of putting in place and implementing the certification process, procedure and policies, and the power in consultation with SEBI to lay down standards applicable to categories of associated persons and to provide that no such person may be qualified to be employed, engaged or continued in employment by an intermediary without complying with those standards of examination, continuing professional education and other qualifications.
Compliance: In general, conforming to a rule such as a specification, policy, standard or law. In the securities market, a set of actions by which registered intermediaries and issuer companies comply with the rules, regulations, notifications, guidelines and instructions of SEBI, the stock exchanges, the depositories where the intermediary holds membership, the policies of the company's board of directors and other competent authorities.
Compliance Officer: A person specifically designated by the regulated entity to monitor compliance with the SEBI Act 1992, its rules and regulations, notifications, guidelines and instructions of SEBI or the Central Government, and to secure redressal of investors' grievances. He also monitors compliance with the rules, regulations and bye-laws of the concerned stock exchanges or the Registrar of Companies where applicable, and is described as the first line regulator.
Continuing professional education requirements: A certificate may be revalidated if the associated person completes a NISM-specified CPE programme during the twelve months preceding the date of expiry, or passes the relevant NISM certification examination before expiry; revalidation runs three years from the date of expiry of the existing certificate. A principal may revalidate by examination, CPE programme or delivering at least four sessions in a specific CPE programme; a non-principal aged 50 or with ten years' experience by examination or CPE programme; and all other persons by examination or CPE programme.
Dual reporting line: The compliance officer is appointed by the entity or its board and reports to that board; but where there is non-compliance with the SEBI Act or allied rules and regulations, he must report it to SEBI immediately and independently. It is his duty to report any non-compliance observed to both the board and SEBI.
Independence of the compliance officer: The gap between regulatory intent and compliance is minimised by a professional cadre of compliance officers functioning independently. The officer participates in preparing policies and procedures so that the intermediary's internal affairs are aligned with the regulatory objective rather than business expediency where the two conflict, and the direct reporting line to the board, owners, SEBI and other authorities frees him from internal procedures that would cause delay and inadequate attention to compliance matters.
IOSCO definition of the compliance function: From IOSCO's 2005 discussion paper on the Compliance function at Market Intermediaries — a function that, on an ongoing basis, identifies, assesses, advises on, monitors and reports on a market intermediary's compliance with securities regulatory requirements, including whether there are appropriate supervisory procedures in place.
Mandatory and critical reporting: Mandatory reporting is the periodic submission of reports as required by regulations. Critical reporting is the compliance officer's duty to report immediately and independently to SEBI and the board any non-compliance observed. Alongside both, he is responsible for all compliances under various laws and for coordination with the regulators under each applicable law.
Manner of obtaining certification: Under Regulation 4, a principal may obtain the certificate by passing the relevant NISM certification examination, successfully completing a related CPE programme, or delivering at least four sessions in a specific CPE programme. A non-principal who has attained 50 years of age or has 10 years' experience may pass the examination or complete a related CPE programme. All other persons must pass the relevant certification examination.
Obligation to obtain certification: Under Regulation 3, SEBI may by notification in the official gazette require categories of associated persons to obtain the requisite certificate for engagement or employment with specified classes of intermediaries within a specified time. Someone already employed before the specified date may continue if he obtains the certificate within two years of that date, and a person already holding a certificate for the same recognised category need not obtain a fresh one during its validity.
Principal: A person actively engaged in the management of the intermediary's securities business including supervision, solicitation and conduct of business — comprising sole proprietors, managing partners and whole-time directors.
RBI chief compliance officer guidelines: Issued in September 2020, requiring banks to set up an independent corporate compliance function headed by a designated chief compliance officer selected through a suitable process against fit and proper criteria, appointed for a minimum fixed period of three years in the rank of general manager or not below two levels of the rank of CEO, and transferable or removable before the end of tenure only in exceptional circumstances with the explicit prior approval of the board after a well-defined and transparent internal administrative procedure.
Regulation 12 obligations: Under the SEBI (Intermediaries) Regulations 2008, an intermediary must give SEBI a certificate of its compliance officer on 1 April each year certifying its compliance with all obligations and responsibilities and fulfilment of eligibility criteria on a continuous basis, and that all disclosures in Form A and under the relevant regulations are true and complete; prominently display a photocopy of that certificate at all offices including branches; prominently display the name and contact details of the compliance officer to whom investor complaints may be made; and maintain books, accounts and records as specified.
Regulation 14, Intermediaries Regulations: Under the SEBI (Intermediaries) Regulations, 2008 dated 26 May 2008, an intermediary must appoint a compliance officer to monitor its compliance with the Act, rules, regulations, notifications, guidelines, circulars and orders of SEBI or the Central Government, or the rules, regulations and bye-laws of the concerned stock exchanges or SRO — though it need not appoint one if it is not carrying on the activity of the intermediary. The officer must report in writing to the intermediary or its board any material non-compliance.
Regulation 18A, Stock Brokers Regulations: Every stockbroker must appoint a compliance officer responsible for monitoring compliance with the Act, rules, regulations, notifications, guidelines and instructions issued by SEBI or the Central Government and for redressal of investors' grievances; and that officer must immediately and independently report to SEBI any non-compliance he observes.
Risks managed by compliance: Compliance examines the culture and ethics of a market intermediary and is an important tool in managing the risk of legal or regulatory sanctions, financial loss, or loss of reputation arising from violation of regulatory requirements. The compliance officer also monitors internal standards and policies and protects the firm from liability arising out of false claims or abuses committed by its customers.
Six certification considerations: Whether the associated person, as part of his work, deals or interacts with investors, issuers or clients of intermediaries; deals with assets or funds of investors or clients; handles redressal of investor grievances; is responsible for internal control or risk management; is responsible for compliance with any rules or regulations; or is engaged in activities bearing on the operational risk of the intermediary.
Validity and revalidation: A certificate under Regulation 3 is valid for three years from the date of grant or revalidation, and is revalidated for a further three years on successful completion of a NISM continuing professional education programme. No associated person engaged in any of the activities in clauses (a) to (f) of Regulation 3(4) may continue to be so engaged without a valid certificate.

Check you have understood it

The L1 test for this chapter has 9 questions. Score 60% to unlock L2 Application (worked numericals and scenarios) and then L3 Exam-Ready (NISM-style traps, timed, with this paper's real marking). Tests, the higher levels and full mock exams need a free account so we can track your progress.

Create a free account

Original explanatory writing based on the official NISM workbook for Series III-A, which is published and copyrighted by NISM. Check figures against the current edition at nism.ac.in.

Something look wrong? Report it