Compliance Obligation
A compliance obligation is a specific requirement that an organization must meet, arising from laws, regulations, licences, contracts, or internal standards. Compliance obligations are the building blocks of a compliance management program — each obligation must be tracked, assigned, monitored, and evidenced.
Compliance obligations come from multiple sources: regulatory requirements (laws and regulations), legal obligations (contracts and agreements), licence conditions, internal standards, and code requirements. Each obligation should have: a clear description, source reference, applicable jurisdiction, assigned owner, compliance status, evidence of compliance, and a review schedule. A compliance obligation register provides a centralized view of all obligations and their status, enabling proactive management rather than reactive scrambling.
Examples
- •A bank must comply with AML regulations requiring customer due diligence — this is a regulatory compliance obligation tracked in the register.
- •A vendor contract requires SOC 2 reporting — this is a contractual compliance obligation with periodic evidence requirements.
- •A financial firm must hold a valid operating licence — this is a licence condition compliance obligation with renewal tracking.