A Chief Compliance Officer is the senior executive who makes sure a company follows the laws, regulations, and internal policies that apply to its business. So what does a Chief Compliance Officer do in practice? They map the rules that govern the organization, turn those rules into policies employees can actually follow, audit whether people are following them, investigate problems when they surface, train the workforce, and report independently to the board on how it’s all going. In regulated industries, federal law requires the role, and regulators have grown more willing to hold the person in it personally accountable when the program breaks down.
The Core Duties
The job starts with knowing which laws apply and tracking how they change. For public companies, Sarbanes-Oxley requires CEOs and CFOs to personally certify that financial reports are accurate and that internal controls over financial reporting are effective.1Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports The infrastructure that supports those certifications—the controls, the reporting procedures, the audit trails—sits on the CCO’s desk. The same framework requires each annual report to include management’s own assessment of internal controls.2Office of the Law Revision Counsel. 15 USC Chapter 98 – Public Company Accounting Reform and Corporate Responsibility
In financial services the footprint is larger. SEC Rule 206(4)-7 requires every registered investment adviser to designate a CCO, adopt written compliance policies reasonably designed to prevent violations, and review those policies at least once a year.3U.S. Securities and Exchange Commission. Compliance Programs of Investment Companies and Investment Advisers The Dodd-Frank Act extended the logic to derivatives markets, requiring every swap dealer and major swap participant to appoint a CCO who reports to the board, prepares annual compliance reports under penalty of law, and builds procedures to identify and remediate failures.4Office of the Law Revision Counsel. 7 USC 6s – Registration and Regulation of Swap Dealers and Major Swap Participants
Once the legal landscape is mapped, the CCO writes it down for the workforce: a corporate code of conduct, standard operating procedures for high-risk activities like financial reporting and customer data handling, and the day-to-day infrastructure that makes compliance part of normal operations. The U.S. Sentencing Guidelines describe what an “effective compliance and ethics program” looks like, and most CCOs treat the description as a blueprint, in part because a program that meets the standard can significantly reduce criminal penalties if the organization is later prosecuted. The guidelines call for written standards, board-level oversight, personnel screening, role-specific training, monitoring and confidential reporting channels, consistent enforcement, and prompt remediation after a problem is detected.5United States Sentencing Commission. USSG 8B2.1 – Effective Compliance and Ethics Program A single violation does not prove the program was ineffective; what matters is the overall design and good-faith implementation.
Policies on paper mean nothing without active oversight. The CCO runs regular audits across departments to check whether employees actually follow the procedures they were trained on. They operate confidential reporting channels, often called whistleblower hotlines, where staff can flag potential violations without retaliation. Sarbanes-Oxley makes it illegal for a public company to fire, demote, suspend, or otherwise punish an employee who reports what they reasonably believe to be securities fraud. When a potential violation surfaces, the CCO opens an internal investigation to establish what happened and how far the problem reaches. Dodd-Frank specifically requires swap dealer CCOs to establish procedures for remediating noncompliance identified through reviews, audit findings, self-reported errors, and validated complaints.4Office of the Law Revision Counsel. 7 USC 6s – Registration and Regulation of Swap Dealers and Major Swap Participants
Training is its own stream of work. Written policies only matter if people understand them, and generic slide decks clicked through once a year do not clear the bar. The Bank Secrecy Act requires every financial institution to maintain an anti-money laundering program that includes internal policies and controls, a designated compliance officer, ongoing employee training, and an independent audit function.6Federal Financial Institutions Examination Council. 31 USC 5318 – Compliance, Exemptions, and Summons Authority No federal rule prescribes an exact frequency; regulators expect the cadence to match the institution’s risk profile. Beyond industry-specific mandates, the CCO covers anti-corruption obligations, data privacy, conflicts of interest, and the handling of sensitive information.
Who the CCO Answers To
A CCO who answers only to the CEO has a structural conflict, because the CEO may be the source of the problem. Regulations in several sectors require the CCO to report directly to the board or a designated board committee, creating a line of communication senior management cannot filter. Federal rules for swap execution facilities give the CCO authority and resources to develop and enforce compliance policies, limit appointment and removal to the board or senior officer, and require the board to approve the CCO’s compensation as a buffer against retaliation for unwelcome findings.7eCFR. 17 CFR 37.1501 – Chief Compliance Officer Board members are prohibited from requiring changes to the CCO’s annual compliance report. Under Dodd-Frank, that annual report accompanies the firm’s financial filings and must be signed and certified as accurate and complete under penalty of law.4Office of the Law Revision Counsel. 7 USC 6s – Registration and Regulation of Swap Dealers and Major Swap Participants At board meetings, the CCO presents the organization’s compliance health: where the risks are, which investigations are open, whether controls are working, and what needs to change.
How the Role Differs From General Counsel
Companies sometimes merge the CCO and General Counsel into one job, but the positions serve different functions and carry different legal protections. The General Counsel gives legal advice and can invoke attorney-client privilege to shield sensitive communications during investigations. A standalone CCO who is not a licensed attorney cannot claim that privilege, so information gathered during compliance investigations may be discoverable in later litigation.
This matters most during internal investigations. Employees tend to be more forthcoming when an attorney leads the interview, because they understand the privilege can protect what they say. A non-lawyer CCO cannot offer that assurance. Combining the roles has its own risk: if the General Counsel gives advice that is purely compliance-related rather than legal in nature, the communication may not qualify for privilege, and a failed claim can weaken related communications. There is no universally right structure. It depends on company size, regulatory exposure, and litigation risk.
Personal Liability for the CCO
The role carries real personal exposure. Regulators have shown they will pursue individual CCOs when programs fail, especially when the CCO knew about problems and did not act.
In 2022, the SEC brought an enforcement action against Jeffrey Kirkpatrick, who served as both CCO and principal of a registered investment adviser. The SEC found that Kirkpatrick knew the firm’s compliance program was deficient but failed to make sufficient changes, including inadequate monitoring of an adviser representative’s outside business activities and unaddressed conflicts of interest. He was barred from serving in any compliance or supervisory role for five years and ordered to pay a $15,000 civil penalty.8U.S. Securities and Exchange Commission. Administrative Proceeding – Hamilton Investment Counsel, LLC and Jeffrey Kirkpatrick
FINRA has drawn a clearer line for broker-dealers. In Regulatory Notice 22-10, FINRA stated that a CCO’s role “is advisory, not supervisory,” and that FINRA will look first to senior business management when supervision fails. FINRA will pursue a CCO personally only if the firm assigned supervisory responsibilities to that CCO and the CCO failed to carry them out reasonably. That assignment can happen through written supervisory procedures, ad hoc delegation, or implied authority, so CCOs need to understand exactly which duties they have accepted.9FINRA. Regulatory Notice 22-10
The pattern across these cases points to one principle. CCOs face the greatest personal risk when they identify problems and fail to act, or when they accept supervisory duties that blur the line between advising management and managing operations directly. A CCO who flags risks, pushes for resources, and documents their recommendations is in a far stronger position than one who sees problems and stays quiet.
Qualifications and Compensation
Most CCO positions require an advanced degree. A law degree, MBA, or CPA is typical, and employers usually expect direct experience with the specific regulatory framework that governs their industry. Someone taking a CCO role at a bank needs to understand banking regulations intimately, not compliance theory in the abstract.
Professional certifications signal specialized competence. The Certified Compliance and Ethics Professional (CCEP) designation, administered by the Society of Corporate Compliance and Ethics, tests practical knowledge across regulatory domains including those covered by the SEC, DOJ, and HHS Office of Inspector General. The exam draws heavily on real-world compliance experience, and candidates typically need a combination of education and professional background to qualify.10SCCE. Certified Compliance and Ethics Professional (CCEP)
Compensation reflects seniority and personal risk. The Bureau of Labor Statistics reports a median annual wage of $75,670 for compliance officers broadly, with the top 10 percent earning above $123,710.11Bureau of Labor Statistics. Occupational Employment and Wages – 13-1041 Compliance Officers Those figures cover all compliance roles from entry-level up. CCOs at large firms and in financial services earn considerably more; salary surveys in 2026 place typical CCO compensation above $150,000, with top earners in high-cost markets exceeding $250,000. Industry, company size, and regulatory complexity all shape where a specific role lands.