An enterprise customer sent a two-hundred-question security and compliance pack and it is sitting in my inbox.
An outsourced compliance function: the policies, the register, the training, the evidence, and the person who answers the questionnaire. Built so it survives an audit rather than passing one.
Compliance as a Service is a retained function that builds and then runs a business’s compliance framework: policies, registers, training, monitoring, and the evidence pack behind customer and investor questionnaires. Dinmore Bell staffs it. Regulated approvals, audit opinions and formal officer appointments remain with the firms that hold them.
How we own it
The framework
Data protection, anti-money laundering where the business is in scope, information security, supplier due diligence, conflicts and complaints. Sized to the business rather than pulled from a template, because a template is transparent to anybody who reads for a living. The practical difference is the scoping conversation that comes first. A fifty-person logistics business with UK and UAE operations and no card payments does not need the framework a regulated payments firm needs, and being handed one is how compliance becomes theatre. What it does need is a data protection position that works across two jurisdictions, a supplier due diligence process proportionate to its actual supply chain, and a written answer to the six questions its largest customer will ask at renewal. Each policy is written so an employee can act on it. A policy that only makes sense to the person who wrote it is evidence of nothing, and it is the first thing an assessor will test by asking somebody junior what they would do.
Running it
Registers maintained, reviews scheduled, training delivered, incidents logged and closed. Compliance is a rhythm rather than a document, and the rhythm is what fails first when nobody owns it. In practice that means a fixed calendar: policy reviews on their due dates, training assigned and chased to completion, the risk register revisited rather than archived, supplier renewals checked against what was diligenced at onboarding, and incidents opened, investigated and closed with a record of what changed as a result. Every one of those is unremarkable on its own. The failure mode is never a single missed item, it is eighteen months of quiet drift discovered in a week by somebody with a checklist. The monthly report is short on purpose: what moved, what is overdue, what needs a decision from the board. A compliance function that produces a forty-page pack nobody reads has substituted volume for control.
Evidence on demand
Customer questionnaires, investor diligence and regulator correspondence answered by us, with the evidence already assembled rather than reconstructed under time pressure. This is usually the reason a business calls in the first place. An enterprise customer sends a two-hundred-question security and compliance pack with a fortnight to respond, and it lands on a founder or an operations lead who has neither the answers nor the artefacts. The pack is not really a test of the business’s security posture. It is a test of whether the business can evidence one, which is a different thing and much more tractable. Because the framework is already built and the registers are already current, the answer set exists before the question arrives. The work becomes mapping and attaching rather than writing. The same library answers the next customer, and the one after that, which is why the second questionnaire costs a fraction of the first. Investor diligence works the same way, with a different emphasis: what is the exposure, what has gone wrong before, and what was done about it. A compliance function that can answer the third question honestly is worth considerably more in a data room than one that has never had an incident to log.
Two jurisdictions, one function
For businesses operating across the UK and the UAE, the usual arrangement is two disconnected sets of obligations held by two sets of advisers who have never spoken. UK GDPR and the DIFC or ADGM data protection regimes, UK employment records and MOHRE requirements, UK AML supervision and UAE registration obligations where they apply. Holding both in one function is mostly about avoiding the gap between them. The obligations rarely conflict outright; what happens is that each adviser assumes the other has covered something, and a data transfer, a retention period or a registration falls into the space in between. One register covering both, with the jurisdiction marked against each line, removes the gap without pretending the regimes are the same.
What sits outside it
Being plain about the boundary is part of the service. Dinmore Bell does not hold FCA approved-person or senior-manager function roles, and does not take UAE-regulated officer appointments, unless that is individually agreed in writing. Statutory audit is performed by registered auditors. Tax computation and filing positions belong to the business’s accountants. Formal regulatory applications and enforcement responses are conducted with instructed specialists. What the function does is hold the whole picture, run the day-to-day, assemble the evidence, and instruct and manage those specialists at the point they are actually needed rather than after something has gone wrong.
Where specialists come in
We provide an outsourced compliance function and support. We do not hold FCA approved-person or senior-manager roles, or UAE-regulated officer appointments, unless individually agreed in writing; where an appointment is regulated, registered persons are provided or coordinated.
Related results
All results →Sectors we run this for
Related insights
All insights →Where nine per cent of your revenue goes
Contract value rarely leaks in a single expensive event. It leaks quietly, through renewal dates nobody owns.
Free zone or mainland: the question founders ask last
The decision is usually made by whoever incorporated first, then lived with for years.
- How quickly can a compliance framework be stood up from nothing?
- A working framework for a business of thirty to two hundred people is usually in place within six to eight weeks: scoping and gap assessment first, then policies, registers and the initial training round. The evidence library builds from there, and the first customer questionnaire answered against it is normally the point the investment repays itself.
- We already have policies from a template pack. Is that enough?
- For a first customer conversation, sometimes. For a serious security review or investor diligence, rarely, because template policies describe controls the business does not actually operate and an assessor tests the gap by asking staff what they do. The usual work is keeping the parts that reflect reality and rebuilding the rest around what the business really does.
- Who answers the security questionnaire, us or you?
- Dinmore Bell completes it and returns it for review, drawing on the evidence library rather than interviewing your team each time. Technical questions that require the engineering team are routed to them with the question already interpreted, which is usually the part that takes founders the longest.
- Does this replace our DPO or MLRO?
- It can provide the practical work those roles direct, and in many businesses the same person does both. Where a statutory appointment is required and must be held by a named individual with regulatory standing, that appointment is arranged and supported rather than assumed by Dinmore Bell unless separately agreed in writing.
- What happens when there is an incident?
- The incident is logged, contained, investigated and closed on a defined process, with the notification assessment made against the applicable regime and its deadline rather than in retrospect. The record of what changed afterwards is the part that matters most in later diligence, and it is the part most often missing.
- How does this work if we operate in both the UK and the UAE?
- One register, one calendar and one owner, with each obligation marked to its jurisdiction. The regimes differ but they rarely conflict; the risk is the gap between two advisers who each assume the other has it covered, and holding both sides in one function is what closes it.
- Is compliance work charged separately from the retainer?
- The running function sits inside the monthly retainer and is scoped before it starts. Defined projects such as a full framework build from nothing, a certification readiness programme, or an unusually large one-off diligence exercise are scoped and priced separately so the retainer stays predictable.
- What do you need from us to start?
- An hour with whoever currently answers compliance questions, access to whatever policies and registers already exist however incomplete, the last two customer questionnaires, and a list of the systems and suppliers that touch customer data. That is enough for the gap assessment.