The first ninety days of a new compliance function define everything that follows. Get them right, and the function becomes an enabler. Get them wrong, and the business spends years correcting course.
The first ninety days of a new compliance function define everything that follows. Get them right, and the function becomes an enabler. Get them wrong, and the business spends years correcting course.
The first two weeks are about visibility. Before writing a single policy or implementing a single control, the compliance leader must understand the business — what it does, who it serves, where it operates, and what risks it faces. This means interviewing key stakeholders across business units, finance, operations, and legal. It means reviewing any existing governance structures, audit findings, or regulatory correspondence. And it means assessing the compliance culture: is compliance seen as an enabler or an obstacle? The answer shapes everything.
Weeks three through six are about framework development. The foundation is a comprehensive risk assessment — identifying the specific regulatory obligations that apply to the business, mapping the compliance risks (operational, financial crime, conduct), and documenting the gaps between the current state and what is required. Not all gaps are equal. A prioritisation matrix — ranking risks by likelihood and impact — determines where resources should be directed first. Leadership buy-in on this prioritised framework is essential; without it, the compliance function operates in a vacuum.
The code of conduct or ethics review comes early. It establishes the cultural foundation and provides the basis for the rules and controls that follow. If the business lacks a code of conduct, writing one is a priority. If one exists, it likely needs updating.
Weeks seven through twelve are about governance and team building. Establishing a Compliance Committee — or formalising an existing risk committee with compliance representation — creates the cross-functional oversight that regulators expect. Roles and responsibilities must be documented: who has authority to escalate, who approves exceptions, who reports to the board. If the team needs building or restructuring, that assessment happens now.
Technology assessment is part of this phase. What compliance software is in place? What is needed? RegTech is no longer optional for most regulated businesses — AI-enabled transaction monitoring, sanctions screening tools, and case management systems are baseline expectations in 2026.
Throughout all ninety days, one principle governs everything: documentation. From day one, the compliance leader should establish version control on all policies, decision logs for compliance decisions, workflow documentation showing how controls are implemented, and risk assessment templates for evaluating new products or markets. The gap between strong controls and weak evidence is the most common regulatory finding — and it is entirely preventable.
At Kybri Consulting Limited, we help businesses build compliance functions from the ground up — from risk assessment and framework design through to MLRO appointment, team structuring, and regulatory readiness.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
