How many compliance people does a supervised firm need? No rulebook hands out a number. Reviewers check something simpler and harder. They want proof that staffing covers the duties.
This guide walks through staffing models, sizing logic, and the records that back them. It is general information, not legal advice. Use it to frame your own plan with your advisers. Readers following this should also see How SR 11-7 Applies to AI Credit Models: Building a Compliant Model Risk Management Program.
What Supervisors Expect a Team to Prove
A supervised firm must be "aware of and take steps to comply with relevant laws". That goal needs owners. Someone must watch the rule set. Someone must run the checks. Someone must sign the reports.
Australia shows how examiners think. Per the regulatory compliance overview, funds there must show they hold "adequate resources (human, technology and financial), risk management systems, and appropriate skills and expertise". People come first in that list. That ordering is the point.
Size the Team From the Obligation Map
Start with your duties, not with headcount benchmarks. List the recurring work first. It usually includes monitoring, reporting, training, licensing tasks, and data upkeep. Estimate the hours each duty needs per month. Add review time and absence cover. The sum is the real workload.
Keep context in mind. "Regulatory compliance varies not only by industry but often by location." A broker, a lender, and a payments firm face different loads. A peer's org chart rarely fits.
Structures That Hold Up in Practice
Small firms often run one accountable compliance officer. Outside help can fill the gaps. The officer owns the duty map, the calendar, and the reports. This works while the duty list stays short. The risk is key-person dependency, so document everything the role does.
Larger firms usually split the work into lanes. Common ones are monitoring and testing, reporting, advice and training, and data quality. A senior owner then ties the lanes together. Clear handoffs matter more than job titles.
Consolidation helps at any size. As rule counts grew, firms adopted "consolidated and harmonized sets of compliance controls". The stated aim is meeting "all necessary governance requirements" without "unnecessary duplication of effort and activity". One control that serves several rules costs less than three near-copies.
Skills, Records, and Supporting Tools
Hiring should follow the map. Match skills to duties, and train to close gaps. Some regimes also vet the conduct of named individuals. Keep fitness records current for everyone in a compliance role.
Records deserve their own owner. Reference texts describe compliance data held in a separate store for reporting. "This store may include calculations, data transfers, and audit trails." Tools now carry part of the load. "Compliance software is increasingly being implemented to help companies manage their compliance data more efficiently." A tool without an owner is just another gap. This connects to our earlier piece, Designing Audit Trails for Regulatory Inspection: What Examiners Actually Look For.
International standards offer a sanity check. The ISO compliance standard is "one of the primary international standards for how businesses handle regulatory compliance". You need not certify against it to borrow its logic.
Warning Signs a Model Is Under-Strained
Some signals show up early. Reports go out late. Review backlogs grow. Training slips a quarter, then two. One person holds all the knowledge, and one vacation stalls the calendar. Each signal is staffing evidence in reverse. Treat a pattern of them as a prompt to re-size.
The fix is not always hiring. Consolidate duplicate controls. Automate repeat reports. Retire duties that no longer apply. Then re-run the hours estimate.
Conclusion: Staff to the Duties, Not to a Ratio
There is no universal headcount for a supervised firm. There is a test that always applies. Can you show, with names and records, that every duty has a competent owner? Size the team until the answer is yes. This article is general information, not legal advice for any specific firm.
