Compliance teams across the globe are writing personal account dealing (PAD) policies, circulating them, and collecting signed attestations confirming staff have read and understood them.
Yet according to analysis from MCO (MyComplianceOffice), there is often a real disconnect between what a policy says and what actually happens day to day. Recent enforcement action in the United States, United Kingdom, Australia and Hong Kong illustrates a widening gap between policy on paper and risk in practice.
Kroll director Alasdair Putt, speaking on an MCO webinar, said, “detailed, rigorous, and thorough policies and procedures in place,” are not enough on their own. Putt said, “if the senior management aren’t ensuring that staff understand the compliance framework and the obligations they have as employees of the firm… then it’s easy and very likely that the breaches of the company’s compliance policies or procedures start to happen.”
The case studies MCO highlights make the point concrete. In the US, the SEC fined a hedge fund adviser $6.5m in April 2024 after it failed to enforce its own code of ethics, leaving staff trading without pre-clearance. In the UK, the FCA jailed a research analyst for six years in 2025 after he routed trades worth more than £960,000 through family accounts to dodge monitoring. In Australia, ASIC jailed a corporate adviser in 2024 for trading on confidential deal information for a A$57,000 profit. In Hong Kong, the SFC fined a fund manager HK$2m and banned its former responsible officer for eight months after more than 2,500 unapproved personal trades over five years.
For global firms, MCO notes the risk compounds across borders. Kroll senior associate Kiana Leung said, “having written policies alone are insufficient,” warning that “policies are only aligned to lower local standards instead of the stricter global baseline.”
Leung said, “Regional offices fail to cross-reference global restricted lists, or staff in one country accessing non-public material information about a global client can still trade on the same stock because it’s permitted under the local PAD policies.” Her recommendation: “we have seen firms implementing a local addendum that overrides the global policies whenever Hong Kong law or the SFC regulatory requirements are more stringent.”
MCO’s research also stresses training and culture as controls in their own right. Putt said regulators expect “conducting regular compliance training for all employees, which would hopefully cover the fundamentals of all of their obligations as an employee of a regulated business,” adding that “the SFC… very much like to see that general compliance training is being conducted and at least I would say on an annual basis to all employees.” Breaches, he said, often trace back to “the compliance culture a firm is instilled, or maybe a lack thereof.”
For more insights, read the full story here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
