Does a finance company need separate compliance and risk officers?

Whether a Pakistani finance company must appoint separate compliance and risk officers depends on its licence category, size, governance requirements and the applicable SECP regulatory framework. The fact that compliance and risk management are distinct functions does not automatically mean every non-banking finance company must employ two different individuals under every licence. Equally, appointing a director as nominal compliance officer may fail a binding independence, competence or conflict requirement under particular regulations. The analysis must begin with the current instrument governing the entity rather than a general statement about best practice.

Identify the regulated entity

An NBFC providing investment finance services may be subject to requirements different from an asset management company, leasing business, modaraba manager or futures broker. The entity's exact licence, notified activity and applicable prudential rules are essential. A company holding only ordinary SECP incorporation is not automatically subject to the same officer appointments as a licensed intermediary. Identify every activity being performed and the law that regulates it.

Current NBFC regulations

SECP maintains the Non-Banking Finance Companies and Notified Entities Regulations, 2008, with an updated January 15, 2026 text. Relevant governance and risk obligations should be read from that version alongside the applicable NBFC Rules. Specific risk management obligations may turn on business category and scale. A compliance checklist copied from an unrelated bank or mutual fund manager may be inaccurate.

The purpose of compliance

A compliance officer generally supports interpretation of legal obligations, filing deadlines, regulatory reporting, monitoring and escalation of potential breaches. The officer should have adequate access to management and relevant records. A person appointed only on paper, with no resources or authority, may not fulfil an actual regulatory function. The governing rules can specify qualifications, independence or direct reporting arrangements.

The purpose of risk management

Risk management concerns identification, assessment, monitoring and control of financial, operational, credit, liquidity, market and other risks. A finance company may require an enterprise or specific risk function according to its regulatory regime. A manager responsible for originating loans may face conflicts when simultaneously asked to independently judge credit exposures. The board should consider whether separation is necessary to provide meaningful oversight.

Legal requirement versus governance preference

Regulations may prescribe a designated officer, while corporate governance guidance may recommend an independent structure. These should not be conflated. A law firm should distinguish what the statute mandates from what is commercially prudent. An SECP observation asking about separate officers may reflect a particular licence requirement or specific risk concern; the company should ask for or identify the actual cited provision.

Can one person hold both functions?

An entity may propose a combined role, particularly when operations are small. Whether permitted depends on the regulations and practical conflicts. Even absent an express universal prohibition, independence can be impaired if the same person performs transactions and certifies their own compliance. The company should document reporting lines, segregation of duties and alternate review arrangements before presenting a combined appointment as sufficient.

A director as compliance officer

A director may possess legal and financial competence but also participate in decisions requiring independent compliance scrutiny. The exact role, executive status and relevant regulations matter. A non-executive director's periodic board role is not necessarily equivalent to a full-time qualified compliance officer. If the law calls for independence, a nominal designation can fail despite formal board approval. The company should map actual duties, time availability and conflicts.

Fit-and-proper criteria

Where an officer is a regulated key management person, applicable fit-and-proper standards concerning qualification, experience and integrity may apply. A generic CV cannot substitute for proof of specified competence. Review any prescribed declaration and supporting evidence. The fact that an employee previously worked in accounting does not automatically qualify them to supervise AML systems or investment risks at every licensed business.

AML compliance specifically

Anti-money-laundering compliance may require a compliance function and designated personnel under SECP AML/CFT/CPF Regulations, 2020 as amended through July 2026. This is distinct from general enterprise risk management, although the functions interact. The company should identify the particular AML requirements applicable to the reporting entity and the resources needed for customer due diligence, monitoring and suspicious transaction escalation.

Reporting to the board

The board retains oversight responsibility even when functions are delegated. Written reports on compliance breaches, exposures, customer complaints and risk thresholds should reach appropriate committees or directors. A person who reports solely to a sales head with power to suppress findings may be structurally ineffective. Board minutes should record how significant risks were assessed and what corrective measures were approved.

Segregation of duties

The institution should ensure that transaction initiation, execution, approval, reconciliation and monitoring are suitably separated. Smaller firms may need compensating controls where staffing is limited, such as independent periodic review and restricted system permissions. The regulatory permissibility of a specific arrangement still needs verification. Cost savings cannot justify ignoring an express statutory requirement or concealing how functions actually operate.

Outsourcing and consultants

An outside consultant may assist with policies, training or specialist assessment, but responsibility for compliance remains with the regulated institution and its legally responsible management. A consultant's report is not a substitute for a qualified internal officer where regulations require one. Contracts should preserve access to records, confidentiality and regulator audit rights. An outsourced role must be analysed separately from whether a combined officer is permitted.

An NBFC licensing example

A proposed investment finance NBFC appoints a CFO to handle both loan approval and compliance reporting. Management argues this is efficient. The regulator may examine whether the arrangement meets the NBFC rules and whether self-review conflicts compromise controls. The company should identify the exact requirements and, if necessary, establish a separate compliance role or appropriate independent review rather than merely rename the CFO.

A futures broker example

A futures brokerage applicant proposes that one director also serve as compliance officer while managing customer onboarding. Its licensing regulations may specify eligibility and continuing obligations. The applicant should examine whether the dual appointment meets those requirements, particularly AML monitoring and segregation. A board resolution creating two titles for the same person cannot defeat a statutory requirement for independence or adequate staffing.

Deficiency letters and remedial planning

If SECP raises an objection, the company should respond clause by clause. Identify the applicable licence, quote the operative regulation and supply an organisational chart, job descriptions and evidence of qualifications. Where the role genuinely must be separated, appoint an appropriately qualified person and update filings. Where the regulation permits flexibility, justify the governance arrangement with actual controls instead of unsupported assertions of industry practice.

Documented policies and evaluation

Prepare a written compliance monitoring plan and a risk management framework tailored to the entity's assets and liabilities. Testing should include who identifies exceptions, who can halt risky activity and who reports breaches. A firm that has never assessed liquidity or client asset risk should not claim full implementation simply because a consultant provided an attractive manual.

Opinion and recommended course

Separate compliance and risk officers are not automatically required at every Pakistani finance company under one universal rule. The answer is licence- and function-specific, with particular attention to AML and independence requirements. Examine the latest SECP regulations, assess segregation and competence, and document a structure capable of actual compliance before applying for or renewing authorisation.

Principal authorities: NBFC Rules and NBFC Regulations, 2008, as updated January 2026; SECP AML/CFT/CPF Regulations, 2020, as amended July 2026; relevant futures and securities broker regulations; Companies Act, 2017.