An investment compliance monitoring tool beside your rules engine

An investment compliance monitoring tool tests portfolios against their investment limits and helps the compliance team work the alerts through to cure and notice. Most managers already have the first half: a rules engine, often a module of the order or portfolio management system, that runs the pre-trade check and the overnight post-trade test. Replacing it is expensive and risky, and rarely necessary, because the work it leaves undone is not the testing but what follows: reading each alert against the custodian file and the agreement, checking its inputs, classifying the breach, planning the cure and drafting the notice. Botminds' Investment Guideline Monitoring does that second half beside the engine. Its agents read the engine's alert file, the custodian and accounting positions, the price, rating and classification vendors, the security master and the governing documents through read-only access, and write back proposals and drafts for people to approve, so going live means connecting feeds and agreeing who signs, not migrating rules.

Screens show the solution's sample data on a fictional manager. Findings on how managers run their tools come from France's AMF, which inspected five managers' monitoring of fund limits in 2021–2023.

Does compliance monitoring software replace the OMS rules engine?

Not this kind. A tool that works the alert queue needs an engine to produce the queue, and the engine is where the pre-trade block lives, which no post-trade tool can provide. The AMF found that every manager it inspected configured its limits in a dedicated module of its order or portfolio management system, bought from a vendor at four of the five and built in-house at the fifth, usually integrated with order placement, which the AMF called good practice because risk control and portfolio management then work from the same view (AMF summary, §4.1.2). Those modules stay.

What changes is what happens to the engine's output. Today the alert file is read by people; with an agent layer it is read first by agents that recompute each alert from the custodian position and the clause, and hand people a proposal with its evidence. When a coded rule keeps firing for a reason the agreement rules out, the agents draft a fix with the clauses attached, and the people who own the engine decide whether to make it. The pre-trade side has the same architecture, described in the guide to a pre-trade compliance tool beside the OMS.

What data feeds does compliance monitoring need?

Six, all of which the firm already has. The engine's alert output and the order system's pre-trade overrides; custodian and portfolio accounting positions, with cash, FX and trade-date detail; the fund administrator's NAV and capital activity; pricing, rating and classification data from two independent vendors each; the security master's issuer hierarchy and guarantor links; and the governing documents in their original language. The second vendor is the one most firms lack, and it is the one that closes the most alerts.

Investment compliance monitoring systems: what the AMF found inside five

The inspection is the only regulator's look inside the systems that monitor fund limits, and it shows gaps a new tool must not reproduce. Vendors' modules covered natively between 20% and 64% of the limits the managers needed, by the managers' own estimates, and the AMF noted that publishers do not promise their ready-made ratios are complete or up to date with the latest rules; the rest had to be built. Depositaries' alerts arrived as non-standardised emails that could not be processed automatically, so the one manager with a central alert repository still could not load them into it (AMF summary, §4.3.1 and §4.3.4).

The continuity finding matters for any new layer. The AMF reminds managers that their business continuity plans must preserve essential data and functions, and found plans that did not cover the flows of alerts from valuers and depositaries, or the monitoring module itself. A tool added beside the engine is one more system in that plan: if it stops, the queue must still be worked, which means the engine's output and the people's access to it must not depend on the new tool.

How long does it take to implement compliance monitoring?

No regulator or independent study publishes implementation times for compliance monitoring tools, and vendors' figures are not comparable. What decides the time is not the software but three tasks on the firm's side: connecting the read-only feeds, mapping each coded rule to its clause, and running the agents beside the analysts long enough to trust them. The first is usually the shortest; the second depends on the number of mandates and how well their rules are documented; the third depends on how quickly enough alerts of each kind pass through.

The AMF's inspection gives one benchmark for caution rather than speed. One manager switched to an integrated pre-trade and post-trade tool in 2023 and, before it went live, had every configured limit reviewed, on its internal control's recommendation, against the funds' regulatory documents; it then planned to keep its old internally built post-trade tool running through 2024 to confirm the new one's results. The same manager had not updated the programme of activity it files with the AMF after the change, which the AMF noted: a system change at a French manager is also a regulatory one.

Mapping each coded rule to its clause: the longest task

Every alert the agents read has to be traced to the clause it enforces, so before go-live each coded rule is linked to its source: the prospectus article, the agreement section or the regulation. Most firms already have a map of some kind. All five managers the AMF inspected kept one in a spreadsheet, recording for each limit an internal code, a description, its type, its origin, the threshold and the severity of its alert. The sizes varied widely: one manager listed 1,312 limits, others 212, 110 and 77 (AMF summary, §4.3.1).

The AMF found the maps were where inconsistencies hid. Only one of the five maps was fully operational. At one manager a short-selling ban was not marked as regulatory in every fund's tab; at another, three codes pointed to the same prohibition on unauthorised funds; at a third, the map did not say which of its three funds each limit applied to. Client agreements add a further layer the prospectus does not show: one fund's prospectus required at least 60% in international equities, while its management agreement capped US equities at 50%. Mapping rules to clauses before go-live finds these, and every mismatch found is one fewer false alert, or one fewer missed breach, after it.

Shadow run, then go live by reason group

The safe way to go live is to let the agents propose while the analysts decide as they do now, compare the two for every alert, and hand over one kind of alert at a time. Repeats of an open alert are usually the first group: the proposal is mechanical and easy to verify. Stale prices and rating feed mismatches follow, once the second-source checks agree with the analysts' own. Alerts that turn on reading the agreement come later, and some kinds never: in the solution's sample settings, credit floors, derivatives limits, ESG exclusions, fund-law limits, any rule with a client notice clause and every pre-trade override always go to a person.

Every key limit recomputed from the custodian file before anyone arrives

The comparison during the shadow run is also the first measurement of the tool. Agreements between agents and analysts, disagreements, and the cases where the agents escalated rightly give the baseline that the guide to an investment guideline monitoring tool's KPIs carries into production, and the seeded test in the guide to post-trade compliance checks adds the cases neither side would have seen.

The controls examiners will ask about once it is live

Four questions come up whenever a new system sits in a compliance process. Who can change what: at the managers the AMF inspected, write access to the limit configuration was restricted to risk control, and one reviewed configuration changes every half-year; the AMF called it good practice to keep an automated audit trail of every limit created or changed. What it writes: an agent layer should read through service accounts that cannot write to the engine, the order system or the custodian. What it keeps: advisers must keep books and records for at least five years under the SEC's recordkeeping rule (17 CFR 275.204-2), so the evidence behind every close must last at least as long. And who approves the agents: a new agent version changes a control, so it should be approved like one.

The controls the agents work inside, changed only with the compliance officer's approval

Compliance monitoring software solutions: where this fits, and where it does not

A tool beside the engine fits a manager whose engine works but whose morning does not: a large overnight queue, mostly false alerts, evidence scattered across the custodian file, vendor screens and agreement PDFs, and notices written by hand. It fits less well where the engine itself is the problem, such as limits that cannot be coded in it at all; there the first project is the engine or the rules, and the rule work belongs to investment compliance rule coding.

It does not fit as a substitute for the pre-trade check, which must stop an order before it is placed, or as a way to avoid fixing data: the agents will flag the same missing guarantor link every morning until someone adds it to the security master. And it assumes the firm will keep a person in every decision. A tool that offered to close alerts and send letters on its own would be easier to deploy and harder to defend to an examiner.

Questions people ask

What is an investment compliance monitoring tool?

Software that tests portfolios against their investment limits and supports the work on the alerts: investigation, classification, cure and notice. Some tools are the engine itself, usually part of the order or portfolio management system; others, like Investment Guideline Monitoring, work beside the engine on the alerts it raises.

Can a compliance monitoring tool work with any order management system?

A tool that reads the engine's alert output and the order system's override log can work with any system that exports them. The AMF found every manager it inspected running limits in a module of its order or portfolio management system, so those exports normally exist.

Does an agent-based monitoring tool need write access to our systems?

It should not. Investment Guideline Monitoring reads through read-only service accounts and never writes to the engine, the order system or the custodian; cure orders are placed by the portfolio manager and notices sent by client service.

What happens to the engine's rules when the tool finds a mismatch?

The agents draft a fix with the clauses as evidence and send it to the rule-coding team and the compliance officer, who decide. Until the rule is changed, the alerts it raises are still proposed for closing with the clause cited, so the noise is handled but not hidden.

Where is the data kept?

In the sample configuration, in a choice of US East, EU West or Singapore regions, with the audit trail kept seven years. Where a firm has funds in several countries, the residency and retention choices should follow the strictest of the rules it is under.