Compliance: Code Of Conduct
A code of conduct within a compliance framework establishes the behavioral, ethical, and operational standards that govern how individuals, organizations, and affiliated entities interact within a regulated sector. This page describes the structure, function, and regulatory grounding of compliance codes of conduct as applied across US industry and standards environments. Understanding the distinctions between voluntary and mandatory codes — and the enforcement mechanisms attached to each — is essential for professionals navigating accreditation, membership, and regulatory relationships.
Definition and scope
A compliance code of conduct is a formally adopted document that specifies the obligations, prohibitions, and behavioral norms applicable to a defined class of participants — employees, licensees, members, contractors, or regulated entities. Unlike general ethics policies, a code of conduct within a compliance context carries defined enforcement authority: violations can trigger sanctions, license revocation, or regulatory action.
Codes of conduct operate at three distinct levels in the US regulatory landscape:
- Statutory or regulatory codes — mandated by law or rule, such as the Standards of Ethical Conduct for Employees of the Executive Branch (5 CFR Part 2635), enforced by the US Office of Government Ethics (OGE).
- Industry self-regulatory codes — adopted by recognized self-regulatory organizations (SROs) such as FINRA, whose Code of Conduct rules govern member broker-dealers under SEC oversight.
- Voluntary organizational codes — adopted by professional associations, accreditation bodies, or standards organizations as a condition of membership or certification.
Scope is defined by the instrument's applicability clause, which identifies who is covered (natural persons, legal entities, or both), the geographic reach, and the duration of coverage. A code tied to compliance-member-obligations typically activates upon enrollment and remains in force through the term of membership, including post-termination confidentiality and non-disclosure obligations.
How it works
Codes of conduct function through a structured cycle of adoption, acknowledgment, monitoring, and enforcement. The operational phases common to most compliance frameworks are:
- Drafting and approval — the governing body or regulatory authority drafts the code, which may undergo public comment periods (required for federal regulations under the Administrative Procedure Act, 5 U.S.C. § 553).
- Acknowledgment and attestation — covered individuals or entities sign or electronically attest to the code, creating a documented compliance record. The compliance-recordkeeping-standards framework governs how these records are retained and audited.
- Training and dissemination — codes must be communicated in operational terms. The US Sentencing Commission's Guidelines Manual (Chapter 8, §8B2.1) identifies effective communication and training as a core element of an adequate compliance and ethics program.
- Monitoring and audit — ongoing behavioral monitoring identifies deviations. Internal controls, third-party audits, and hotline mechanisms are the primary instruments.
- Investigation and adjudication — reported or detected violations are investigated under defined procedures, with findings reviewed by designated compliance officers, ethics boards, or tribunals.
- Sanction and remediation — outcomes range from warnings and mandatory retraining to suspension, expulsion, and referral to external regulators.
The Federal Acquisition Regulation (FAR) at 48 CFR 52.203-13 requires certain federal contractors to maintain a code of business ethics and conduct, implement a training program, and establish an internal reporting mechanism — illustrating how codes are embedded into contractual compliance obligations.
Common scenarios
Codes of conduct apply across a broad set of operational contexts. The four most frequently encountered scenarios in US compliance environments are:
- Conflict of interest disclosures — a participant holds a financial interest that could influence a decision made in their official capacity. Resolution follows the procedures outlined in instruments governing compliance-conflict-of-interest, which typically require recusal, divestiture, or waiver.
- Confidentiality and data handling — employees or contractors access non-public information covered by privacy statutes (e.g., HIPAA, 45 CFR Parts 160 and 164; Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.). The code specifies permissible use, mandatory breach reporting, and penalties for unauthorized disclosure.
- Gifts, gratuities, and anti-bribery — sector-specific codes establish dollar thresholds below which gifts are permissible. The OGE's $20 per-occasion / $50 annual threshold under 5 CFR § 2635.204 is a widely referenced federal standard; private-sector analogs vary by industry.
- Retaliation and whistleblower conduct — codes that include reporting obligations must address anti-retaliation protections. The SEC's whistleblower rules (17 CFR Part 240, Rule 21F) prohibit employer actions that impede reporting, and the Sarbanes-Oxley Act (18 U.S.C. § 1514A) provides civil remedies for covered retaliation.
Decision boundaries
The critical classification decision in code of conduct compliance is determining whether a specific conduct standard is prescriptive (affirmatively required behavior) or proscriptive (prohibited behavior) — and which enforcement tier applies to each.
Prescriptive obligations require active performance: filing disclosures, completing training within defined timeframes, reporting known violations. Failure to perform is itself a violation regardless of any resulting harm.
Proscriptive prohibitions define conduct that must not occur: bribery, misrepresentation, unauthorized disclosure. These typically carry more severe sanctions because the harm is direct rather than procedural.
A secondary decision boundary concerns jurisdiction: when a code of conduct violation also constitutes a statutory or regulatory violation, the internal compliance process does not displace external regulatory authority. A broker's violation of FINRA Rule 2010 (Standards of Commercial Honor) may simultaneously trigger an SEC enforcement referral — internal adjudication and regulatory action proceed on parallel tracks.
Codes also delineate between individual liability and organizational liability. Under the US Sentencing Commission framework, an organization may receive credit for having an effective compliance program even when an individual employee commits a violation — provided the program meets the seven minimum criteria of §8B2.1. This boundary governs how compliance officers structure program documentation and remediation to protect the organization's posture before regulators.