Compliance breach register: the fields that stop repeat alerts

A compliance breach register is the record of every confirmed breach of an investment limit: which fund or mandate, which limit, when it began and was found, why it happened, how it was cured, what it cost and who was told. Most registers are kept to answer a regulator's question at quarter-end. A register kept to fix causes goes further: it records why each alert fired, separates the breaches that were real from the alerts caused by a coded rule or a data feed, links every repeat to the first time it fired, and turns the patterns into work for the people who can stop them. France's AMF found only one of five managers it inspected analysing its breaches that way, and called the practice good. Botminds' Investment Guideline Monitoring keeps that kind of register as a by-product of working the alert queue: every close carries a reason code, every breach its cause and clock, and the agents draft a rule fix wherever the same false alert keeps coming back.

The screens show the solution's sample data on a fictional manager and its fictional clients. Regulatory text is quoted from the FCA, the SEC and the AMF.

Breach register meaning: what counts as an entry

In investment compliance, a breach register means a log of breaches of investment limits: regulatory limits such as the UCITS diversification rules, the restrictions in a fund's prospectus, and the guidelines in a client's investment management agreement. It is not the register of personal-data breaches kept under data-protection law, though the two are often confused in search, and it is wider than a trade error log, which records the manager's operational mistakes in trading; a guide to the trade error log covers that one.

The entry is the confirmed breach, not the alert. But the alerts belong next to it: an alert closed as false is the most useful thing a register can record if it says why, because the reason is what predicts the next one. The AMF found that the five managers it inspected kept their breaches in spreadsheets, and that the way a register is built decides whether it can be analysed at all. One manager logged the status of each breach every day, so "a single overrun may appear several times if it has lasted several days", and its breach count could not be calculated (AMF summary, §4.3.4).

What should a breach register include?

At minimum, the fields the AMF found in the better registers: the limit breached and its nature, the fund, the valuation date on which the breach was found, its extent, the date it was resolved and the time that took. One manager's reports to its own management added the portfolio, the threshold, the last value recorded, start and end dates, the number of days in breach and whether it was active or passive. The AMF called it poor practice to omit the nature of the limit, regulatory, statutory or internal, and a unique identification key for each breach.

Two fields in the template do most of the work against repeat alerts. The coded rule that tested the limit lets the register count breaches and false alerts by rule, which is how a rule coded differently from its clause is found. And the root cause, kept apart from the active-or-passive label, separates the breaches the market caused from those a feed or a rule caused; a passive breach caused by a stale classification is a data defect, and should be counted as one.

Compliance breach log template: log the false alerts too

A breach log that records only breaches cannot stop a repeat alert, because a repeat alert is not a breach. The log that can is one where every closed alert carries a reason code: a repeat of an open alert, a stale or wrong price, a rating feed the agreement's rating method overrides, a sector code a vendor changed, a corporate action not yet booked, a value inside the warning band, or a clause that rules the alert out. Counted by rule and by feed each month, those codes show which rules and which feeds generate the noise.

In the solution's sample October, three patterns stood out: a credit floor coded on the lowest of three ratings when the agreements use the middle one, 61 false alerts across 23 mandates; sector remaps from one classification vendor, 41 across 77 mandates; and cash measured before FX settlement where the agreements value it on trade date, 22 across 31 mandates. Each pattern reached the register as reason codes on individual closes; together they became three rule-fix requests with the clauses attached.

The register the morning's work produces: breaches with their clocks

FCA breach register: what makes a breach significant

A UK firm keeps a breach register largely to make and defend one judgement: whether a breach is significant enough to notify the FCA. The rule requires notice of "a significant breach of a rule", immediately, and the guidance says how to judge it: "significance should be determined having regard to potential financial losses to customers or to the firm, frequency of the breach, implications for the firm's systems and controls and if there were delays in identifying or rectifying the breach" (FCA SUP 15.3.11R and 15.3.12G).

Each of those four factors is a field. Loss is the impact and compensation; frequency is the repeat link and the count by rule; the implication for systems and controls is the root cause; delay is the gap between the date a breach began, the date it was found and the date it was cured. A register without those fields leaves the significance call to memory, and the frequency factor in particular cannot be judged from a single row. When a breach is notified, the register also holds what the guidance asks a notification to include: the circumstances, the rule, and the steps taken to put it right.

Frequency is one of the FCA's four tests of significance, and it is the one a register kept a row at a time can never answer.

One register, three sources: the manager, the valuer and the depositary

A breach may be found by the manager's own check, by the fund's valuer at the next NAV, or by the depositary several NAVs later, and a register that keeps them apart counts some breaches twice and misses others. At one manager the AMF inspected, depositary alerts were handled case by case by email, with no central record; the list it gave the inspectors was assembled for the purpose, and the depositaries' own records did not keep the reason for the breach, how it was resolved, or whether it was active or passive.

The AMF called it good practice to keep the depositaries' alerts in the same format as internal ones and to reconcile the two regularly. The unique key is what makes that possible: a valuer's or depositary's alert is matched to the breach the manager already found, or opens a new one, and either way it is counted once.

The register and the reports: counts that must agree

Every external report about breaches is a query on the register, and the AMF found reports that did not agree with their own source. At one manager the share of active breaches was 14.3% in the annual report to the AMF and 20.6% in the four quarterly reports for the same year; the same manager's quarterly reports had understated its active breaches by seven across two quarters. The AMF called it poor practice not to check the annual figure against the quarterly ones.

In the US the same register feeds the fund board. A fund's chief compliance officer reports each material compliance matter to the board at least annually (Rule 38a-1), and the SEC's 2003 release warned that matters not material on their own can together point to a material weakness in the compliance programme (68 FR 74714, note 84). A register that groups breaches by rule, feed and cause is how a compliance officer sees that pattern before the board does.

“Periodically carrying out a statistical analysis of the trends observed in terms of the ratio overruns investigated during the past period, in order to identify any structural anomalies linked to the ratios configured, manager behaviour or a flaw in the control system.”

AMF, good practice on investment ratio monitoring, February 2025

A month of the register: what to look for

The analysis the AMF had in mind is not elaborate. The one manager that did it presented, each quarter, the management units with the most breaches and the five breaches, by fund and limit, that took longest to resolve, to senior management and to the heads of those units at the monthly risk committee. The checklist below extends that to the questions a register built on the template can answer every month.

The register read as patterns: noisy rules with a fix proposed for each

Where Investment Guideline Monitoring keeps the register, and who acts on it

In the solution, the register is not a separate file someone updates; it is where the queue ends. An alert closed as false carries its reason code and approver; a breach carries its unique number, classification, cause, cure, compensation and notices, each with its date and approver; repeats are linked to the alert they repeat. The reports read from the same place, so the monthly patterns, the board draft and the examiner export cannot disagree with the register, because they are the register.

What the solution does with a pattern is propose, not act. The agents draft the rule fix with the clauses as evidence; the rule-coding team and the compliance officer decide, and the work of recoding, and of re-testing the changed rule, belongs to compliance rule coding. Data fixes go to the data team. The notices the register tracks are covered in the guide to investment breach notification requirements, and the measures it feeds in the guide to the KPIs to baseline first.

Questions people ask

What is the difference between a breach register and a breach log?

Mostly the name. Both record confirmed breaches; firms that call it a log often include incidents and near misses, and firms that call it a register often keep only confirmed breaches. The useful distinction is whether closed alerts are recorded with their reasons, because that is what lets the record predict repeats.

Do I need to record passive breaches in the breach register?

Yes. Passive breaches are not notified to the CSSF and are left out of the AMF's quarterly report, but they still have to be monitored until cured, and a passive breach left uncured can become active. At the five managers the AMF inspected, passive breaches were about four in five of all breaches.

How long should a breach register be kept?

At least as long as the longest rule it supports. US advisers keep books and records for at least five years, and a fund's compliance reports to its board are kept for five years too under Rule 38a-1; the solution's sample configuration keeps its audit trail seven years.

Who should own the compliance breach register?

The compliance or risk control function that investigates breaches, independent of portfolio management. At the French managers the AMF inspected, the same function that investigated breaches kept the record and reported it to senior management at risk committees.

Should near misses go in the breach register?

Not as breaches, but they are worth recording. A soft warning inside a warning band, logged with its value, shows where headroom is thin; one manager the AMF inspected had an early-warning level for 75% of its pre-trade limits and notified management when the same limit warned repeatedly.