The compliance function: a complete guide to structuring compliance in Algerian companies

A correspondent bank suspending a relationship, a European partner asking for your anti-corruption policies, an inspector requesting evidence of your controls: at such moments, one question confronts every executive. Who, within the company, is responsible for ensuring that rules are known, applied and verified? The answer is the compliance function, which in Algeria is still too often reduced to a job title without resources or a clear mandate.

With the AML/CFT reform driven by Laws No. 23-01 and No. 25-10, Law No. 25-11 on personal data and a removal from the FATF grey list that must now be consolidated, regulatory compliance has become a governance issue. This guide gives you the keys to building a credible function: missions, scope, positioning, organisation, tools and set-up steps, drawing on our experience in Algeria, Europe and the Gulf.

1. What is the compliance function and what is it for?

An operational definition

The compliance function aims to prevent non-compliance risk, that is, the risk of judicial, administrative or disciplinary sanctions, financial loss or reputational damage resulting from failure to comply with laws, regulations, professional standards or the company's ethical commitments. It does not replace operational staff, who remain accountable for their actions, but it gives them the framework, tools and oversight they need.

The five core missions

• Identify applicable obligations and track how they change (regulatory monitoring);
• Assess non-compliance risks through a regularly updated risk map;
• Advise and train management and staff, especially on new products and sensitive transactions;
• Monitor the effective application of rules through second-level controls;
• Report to senior management and the board of directors, and manage relations with the authorities within its remit.

Beyond regulatory pressure: business ethics

An effective compliance function does more than tick boxes. It spreads a culture of business ethics, protects the company's reputation and eases access to financing and international partners, who increasingly scrutinise the quality of their counterparties' frameworks.

2. The scope of the compliance function in Algeria

The scope depends on the company's sector and exposure, but four building blocks almost always appear.

AML/CFT

For entities subject to Law No. 05-01 of 6 February 2005, as amended, this is the core of the framework: risk-based approach, customer due diligence, enhanced due diligence, suspicious transaction reports to the CTRF, asset freezing. Law No. 25-10 of 24 July 2025 also requires a national and sectoral risk assessment shared with obliged entities, which should feed into your own analysis. Our guide to AML/CFT compliance in Algeria sets out these obligations in detail.

Anti-corruption

Law No. 06-01 of 20 February 2006 on the prevention of and fight against corruption sets the framework: conflicts of interest, gifts and hospitality, dealings with public officials, third-party due diligence. The High Authority for Transparency, Prevention and Fight against Corruption, enshrined in the 2020 Constitution and organised by Law No. 22-08 of 5 May 2022, is responsible for drawing up and monitoring the national strategy in this area.

Personal data and sector-specific regulations

Law No. 25-11 on personal data protection, published in Official Journal No. 48 of 2025, requires companies to map their processing activities, secure data and respect data subjects' rights. On top of this come each sector's own rules: the Bank of Algeria for banks and financial institutions, COSOB for financial markets, and the insurance or telecoms regulators.

3. Positioning, independence and reporting line of the compliance function

What Regulation No. 11-08 requires of banks

Bank of Algeria Regulation No. 11-08 of 28 November 2011 on the internal control of banks and financial institutions requires a framework for controlling non-compliance risk and the appointment of an officer responsible for ensuring its consistency and effectiveness. It also requires internal control documentation to describe the rules guaranteeing the independence of control arrangements. For other sectors, this text is a useful benchmark of good practice.

The three conditions for independence

• A senior reporting line: ideally to the chief executive, never to a sales department;
• Direct access to the board of directors or its audit committee, including without management present;
• Resources and access to information: budget, headcount, the right to consult any document and question any employee.

In our engagements in the Gulf, we have often seen regulators judge independence on concrete facts: who sets the compliance officer's pay, who can dismiss them, were their alerts acted upon? A flattering organisation chart is not enough.

The three lines model

A common mistake is to have compliance perform first-level controls, or even operational tasks such as entering KYC files. The function then loses its detachment and can no longer control what it produces itself.

4. Organising the compliance function according to company size

In a bank or a large group

A dedicated compliance department is essential, often organised into units: financial crime (AML/CFT, sanctions), regulatory compliance and professional ethics, data protection, and ongoing control. In a group, a central head sets the standards and relies on correspondents in subsidiaries or regions. A compliance committee, chaired by senior management, rules on sensitive matters.

In an SME

The principle of proportionality applies. The function can be entrusted to an existing manager, such as the legal counsel or chief financial officer, provided the mission is written down, real time is allocated to it and they have direct access to the chief executive. Occasional external support, for risk mapping or training, usefully compensates for the lack of a dedicated team.

Tools and reporting to the board

Whatever the company's size, a few tools are indispensable:

• a non-compliance risk map and an annual control plan;
• a set of policies and procedures approved by management;
• an internal whistleblowing channel for reporting breaches in confidence;
• registers (gifts, conflicts of interest, incidents, suspicious transaction reports);
• a dashboard presented to the board at least once a year, ideally quarterly to the audit committee.

A good board report fits into a few pages: key risks, incidents, progress on the action plan, control results and resource needs. It should enable directors to make decisions, not merely be informed.

The skills of a compliance officer

The ideal profile combines a solid legal and regulatory background, an understanding of the company's businesses, risk analysis skills and, above all, personal qualities: the courage to say no, a talent for explaining, integrity and diplomacy. Continuous training is essential, given how quickly the Algerian framework is evolving.

5. Setting up a compliance function in Algeria: the key steps

Step 1: start with an assessment

Before recruiting or drafting procedures, measure what already exists. A compliance assessment lists the applicable obligations, evaluates the maturity of the framework and identifies priority gaps.

Step 2: formalise the mandate

A compliance charter, approved by the board, defines the function's missions, reporting line, investigative powers and reporting arrangements. It protects the compliance officer and clarifies everyone's expectations.

Step 3: build the compliance programme

Risk mapping, policies, procedures, training, controls and a whistleblowing channel form the backbone of the compliance programme. It must be proportionate to actual risks, not copied from an international group.

Step 4: train and communicate

Training for all employees, supplemented by targeted sessions for exposed functions, builds the right reflexes. The message from senior management is decisive: without leadership by example at the top, no framework holds.

Step 5: monitor, measure, adjust

The first controls reveal gaps between rules and practice. Simple indicators, tracked over time, make it possible to demonstrate progress to the board and the supervisor, and then to adjust the framework.

Conclusion: making the compliance function a driver of trust

For exposed companies in Algeria, structuring a compliance function is no longer optional: it is the condition for demonstrable regulatory compliance, a constructive relationship with supervisors and lasting international partnerships. A well-positioned function, with a clear mandate, proportionate resources and direct access to the board, turns a constraint into a competitive advantage. Start by measuring your starting point, set realistic priorities and commit to the long term: that is how a strong culture of business ethics is built.

Fayçal Lounes

Founder of Hodemia Consulting

Nearly 20 years of international experience in regulatory compliance, risk and governance (EY in Luxembourg, San Francisco and London; Director, Regulatory & Compliance Services at KPMG Middle East). Certified coach, trainer and academic.