FRM Part II · FRM Exam Part II

Case Study: Investor Protection and Compliance Risks in Investment Activities: formula sheet

Full chapter guide

Key formulas

IOSCO regulatory objectives: Protect investors + Fair, efficient, transparent markets + Reduce systemic risk; Three objectives. Learn all three; exam options often swap in a wrong one such as maximising firm profit.
Compliance risk: Risk of sanctions, loss or reputational damage from non-compliance with laws, rules and standards; Rule-focused. Test is: was a rule or standard breached?
Conduct risk: Risk of poor client or market outcomes from firm behaviour, culture or incentives; Outcome-focused. Can exist without a specific rule breach.
Suitability principle: Recommendation must fit the client's objectives, risk tolerance, knowledge and financial situation; Requires know-your-client information before advice.
Suitability test: Suitable = fits objectives AND risk tolerance AND capacity for loss AND knowledge/experience; All parts must be met. Failing any one makes the recommendation unsuitable.
Appropriateness test: Appropriate = client has the knowledge and experience to understand the product's risks; Used for non-advised sales of complex products. If it fails, the firm must warn the client.
Protection by client type: Retail > Professional > Eligible counterparty; Protection falls as assumed expertise rises. Retail is the highest protection.
Disclosure standard: Information must be fair, clear and not misleading; Covers risks, costs, fees, conflicts and how the firm is paid.
Risk tolerance vs capacity: Willingness to take risk ≠ ability to bear loss; Assess both. The lower of the two should limit the risk taken.
Insider trading test: Insider trading = trading or tipping + material + non-public information; All elements must be present. Public or immaterial information does not create a breach.
Market manipulation test: Manipulation = actions that give a false or misleading signal about price, supply or demand; Intent to mislead or a misleading effect is the focus. No inside information is needed.
Conflict management hierarchy: Identify → Avoid → Manage (control and disclose) → Decline to act; Disclosure alone is rarely enough if the conflict cannot be managed fairly.
Three lines of defense: 1st line: owns and controls risk | 2nd line: oversees and challenges | 3rd line: independent assurance; Compliance sits in the second line. Internal audit is the third.
Compliance risk process: Identify → Assess → Control → Monitor → Report; Use this order to structure any framework question.
Failure chain: Trigger → Root cause → Control failure → Harm → Penalty → Remediation; Use this order to structure any case answer. The fix must match the root cause.
Root-cause categories: Governance + Culture + Incentives + Controls; Most cases involve more than one. Pick the one the scenario emphasises.
Total cost of a failure: Total cost = Fines + Customer redress + Remediation cost + Legal cost + Lost business; Fines are only one part. Redress is often larger.
Redress estimate: Redress = Σ (Client loss + Interest) over affected clients; Compensation aims to put clients back where they would have been had the sale been suitable.
Three lines of defense: 1st line: business owns risk | 2nd line: risk and compliance oversee | 3rd line: internal audit assures; Identify which line failed when answering.
Three lines of defense: 1st line = owns and manages risk; 2nd line = oversight and challenge; 3rd line = independent assurance; Internal audit sits in the third line. Compliance sits in the second line.
Control types: Preventive (before) | Detective (during or after) | Corrective (fix and learn); Surveillance is detective. Pre-trade limits and restricted lists are preventive.
Surveillance cycle: Data capture → rule or model alert → analyst review → escalation → regulator reporting if required → tuning; Poor data or unmonitored channels create blind spots.
Whistleblowing essentials: Confidential channel + protection from retaliation + independent investigation + board visibility; Missing any element reduces staff willingness to report.
Culture test: Tone at the top + incentives aligned with conduct + accountability for breaches; Written policy alone is not a strong culture.

Quick revision

Investor protection aims to protect clients, keep markets fair and sustain trust.
Suitability means advice or products must fit the client's needs, objectives, knowledge and risk capacity.
Disclosure must be clear, fair and not misleading, and must cover costs, risks and conflicts.
Client classification, such as retail versus professional, decides how much protection applies.
Treating a retail client as professional without a proper basis is a serious red flag.
Compliance risk is the risk of sanctions, losses or reputational harm from breaking rules or standards.
Conflicts of interest should be avoided, managed or disclosed, and unmanaged conflicts drive many failures.
Most case failures trace back to culture, incentives, weak supervision or poor controls.
Remediation usually includes client compensation, control fixes, governance changes and monitoring.
The three lines of defence separate ownership, oversight and independent assurance.
Fines are a consequence, not the root cause, so always look for the underlying failure.
Digital resilience and new technology add investor protection risks, such as opaque models and weak disclosure.

Common mistakes

Treating conduct risk and compliance risk as identical. Fix: Compliance is about breaching rules. Conduct is about harmful behaviour and outcomes. Decide which the question emphasises.
Listing the wrong IOSCO objectives, such as profit maximisation or price stability. Fix: Remember the trio: investor protection, fair, efficient and transparent markets, and reduced systemic risk.
Treating suitability and appropriateness as the same test. Fix: Suitability needs advice or management and covers objectives and finances. Appropriateness covers knowledge and experience only, for non-advised sales.
Assuming a professional client needs no protection at all. Fix: Professional clients still get fair, clear and not misleading communication. Only some duties are relaxed.
Calling any profitable trade before news insider trading. Fix: Confirm the information was material and non-public and that the trader used or passed it on.
Treating market manipulation and insider trading as the same. Fix: Insider trading is an information advantage. Manipulation distorts price or volume signals. Both are market abuse.
Naming the symptom as the root cause, such as saying the cause was high complaint numbers. Fix: Ask why complaints were not acted on. The cause is usually weak governance, culture or incentives.
Blaming one rogue employee. Fix: If the behaviour was widespread or rewarded, the failure is systemic. Look at incentives and oversight.
Treating internal audit as part of the second line. Fix: Audit is the third line and gives independent assurance to the board. Compliance and risk are second line.
Calling trade surveillance a preventive control. Fix: Surveillance mostly detects misconduct after or as trades happen. Pre-trade limits and blocks are preventive.

Exam tips

Expect case-style questions that ask you to classify the failure, then pick the control or objective.
Memorise the three IOSCO objectives word for word; distractors often swap one.
When both conduct and compliance seem right, choose the one that matches whether a rule was broken or an outcome was harmful.
Watch for absolute words like always or only. Protection levels depend on client type.
Link answers to governance: three lines of defence, incentives and risk culture.
Always read the client type first. It often decides which answer is right.
Look for the trigger word advice. It signals suitability rather than appropriateness.
Watch for distractors that rely on a signed disclaimer to excuse an unsuitable sale.