Maker-Checker in Asset Management: A Practical Guide to Four-Eyes Control for Compliance Rules

Summary: This guide explains how asset managers can apply maker-checker, also called four-eyes review, to investment compliance rules. It covers where the control belongs, what US, UK and EU regulators expect, what a reviewer should check, and how the control supports owner-driven compliance and AI-assisted rule creation. It is written for compliance officers, heads of compliance and operations leaders at asset managers, fund administrators and management companies.

Maker-checker is a simple control: one person makes a change, and another independently reviews and approves it before it takes effect. Asset managers use it for sensitive activities such as cash movements and pricing overrides. It’s just as important for investment compliance rules, which determine which trades a firm can make.

Also known as the four-eyes principle or dual control, maker-checker helps prevent errors and unauthorized changes from going live without review. 

Compliance rules deserve particular attention because errors can be difficult to spot. A rule with incorrect logic may continue running without producing an error message. It might allow trades that should be blocked or flag trades that are perfectly valid. Either problem can persist for weeks before anyone notices.

The risk is growing as firms manage more regulatory changes and adopt AI tools to help translate investment mandates into compliance rules. Each new or modified rule creates another opportunity for an error, and another reason to require independent review.

For example, the SEC extended the compliance dates for the amended fund Names Rule to June 11, 2026, for larger fund groups and December 11, 2026, for smaller ones. In the EU, the April 16, 2026, AIFMD II implementation deadline introduced new requirements relating to loan origination and liquidity management. At the same time, AI tools that extract restrictions from mandates and propose compliance rules are moving into everyday workflows.

•  Separate creation from approval. One person prepares a change; another reviews and approves it before it takes effect.
•  Review the rule itself. New rules, threshold changes, scope changes and deactivations can all affect trading decisions.
• Check the logic against the source. A rule's name and description are not enough. The reviewer needs to verify that its logic matches the mandate, regulation or policy it implements.
• Keep a record. The system should capture the change, the approval, the people involved and the relevant timestamps.

• Keep accountability with compliance. The people responsible for investment restrictions should be able to create, test and review rules within a controlled system, an approach we call owner-driven compliance. 

  
  No major US, UK or EU rulebook specifically requires the term maker-checker for investment compliance rules. However, requirements relating to compliance controls, segregation of duties and change management make documented review an important part of a firm's control framework.
   

Maker-checker divides responsibility for an individual change between two people:

•  The maker creates or edits a rule and submits it for approval.
• The checker independently reviews the change and approves or rejects it.
• The system prevents the change from taking effect before approval and records who did what and when.

Maker-checker, the four-eyes principle, dual control and the two-person rule all describe this basic approach. Segregation of duties is the broader principle of dividing responsibilities so that one person cannot control an entire process.
 

Use maker-checker wherever a change could affect what a firm is allowed to trade, how it values a position or where its money goes.

Compliance rule changes warrant particular attention because a single rule may govern trades across many accounts. An incorrect payment can affect one transaction; an incorrect rule can affect every trade checked against it.

Rule changes can look administrative, but a small change can have far-reaching effects on trading activity.

Unlike a software error that stops a process, a compliance rule with incorrect logic may continue to run and return results. Consider a rule with the wrong denominator, a limit coded as exclusive instead of inclusive, or an asset-type filter that misses a newly introduced instrument. The system may behave exactly as configured while failing to enforce the intended restriction.

These errors generally cause one of two problems:

• False negatives: The rule allows a trade it should flag. The firm may not discover the breach until an audit, a client complaint or regulatory scrutiny.
• False positives: The rule flags a trade that is permitted. Analysts waste time investigating unnecessary alerts, making genuine breaches harder to identify.

The SEC has treated errors in investment-related code as a compliance issue. In 2011, it charged three AXA Rosenberg entities over an error in the computer code of a quantitative investment model. The firms agreed to pay $217 million to harmed clients and a $25 million penalty. The case also involved concealment of the error, but the SEC's findings highlighted the compliance risks of coding errors in a model represented to clients as accurate.

Investment compliance rules present a similar challenge. They must implement the restrictions they are intended to enforce. Independent review helps confirm that they do.

Regulations don’t generally prescribe maker-checker by name for investment compliance rules. Instead, they establish requirements around effective compliance policies, segregation of duties and controlled technology changes. Maker-checker can help firms demonstrate that appropriate reviews take place, although the specific requirements depend on the rules that apply to each firm.

United States

SEC Rule 206(4)-7 under the Advisers Act and Rule 38a-1 under the Investment Company Act require investment advisers and registered funds, respectively, to maintain written policies and procedures designed to prevent violations and to review those policies and procedures at least annually.

When adopting these rules, the SEC identified portfolio management processes—including consistency with client investment objectives and applicable restrictions—as areas firms should address.

For automated compliance rules, a record of who changed a restriction, who reviewed it and when it became effective can help demonstrate that the firm's procedures were followed.

United Kingdom

The FCA's SYSC 5.1 sets out segregation-of-duties requirements for common platform firms and provides guidance for other firms.

Where a firm lacks sufficient staff to separate duties fully, the FCA describes compensating controls such as frequent review by senior management. Under the Senior Managers and Certification Regime, responsibility for these arrangements sits with named individuals.

European Union

The Digital Operational Resilience Act (DORA), which has applied since January 17, 2025, requires financial entities to manage ICT changes through formal processes.

The Malta Financial Services Authority's April 2026 guidance on DORA change management emphasizes separating approval from implementation and testing and approving changes before they go live.

Whether a compliance rule change falls within a firm's ICT change-management process depends on how the change is classified. Where production rule changes are treated as ICT changes, firms need to follow the applicable approval and documentation requirements.

Not sure how these requirements apply to your firm? Talk to our team.

A practical workflow covers the change from the original requirement through approval and recordkeeping. 

1. Document the requirement. Identify the mandate clause, regulation or internal policy that the rule implements. Record the source document and its version.
2. Draft the rule. The maker creates or edits the rule in a pending state. It must not affect live monitoring yet.
3. Test the rule. Run it against current holdings and, where possible, historical positions. Check which accounts and securities it flags. Investigate unexpected results before submitting the change.
4. Submit the change for review. Include the source reference, reason for the change, accounts in scope, proposed effective date and test results.
5. Review independently. A different person compares the rule's logic with the source document and checks the test results. The system should prevent the maker from approving their own change. 
6. Approve or reject. An approved rule takes effect on the specified date. A rejected rule returns to the maker with an explanation, and the record retains the rejected version.
7. Keep the audit trail. Record every version, the people who made and approved the change, timestamps and review comments. This gives compliance teams, auditors and examiners evidence of how the rule was changed and approved.

A review is only useful if the checker examines the rule's logic, not just its name and description.
The reviewer should compare the configured rule with the original mandate, regulation or policy and confirm that it will behave as intended.
 

 The checker should be able to explain why the rule is configured as it is, using the source document and test results as evidence.

Maker-checker can become a formality if firms do not build the right controls into the process.

The goal is to make sure the right person reviews the right change, with enough information to make an informed decision, before that change affects trading.

Maker-checker doesn't have to slow down compliance. The key is to make review part of the existing workflow rather than another step in a long chain of handoffs.

For example, if a compliance analyst has to send a rule change to IT or an outside provider for coding, then wait for the rule to be tested and corrected, even a simple change can take time. If compliance professionals can build and test rules themselves, a colleague can review the change directly. The firm keeps independent oversight without adding unnecessary delays.

Three practices can help:

Match the review to the risk. New rules, changes to thresholds or scope, and rule deactivations should receive a full review. Firms can use a lighter process for low-risk changes, such as correcting a rule description, if their written procedures allow it.

Make sure reviews happen promptly. Set clear turnaround expectations and give enough qualified people approval authority to prevent changes from getting stuck when someone is unavailable.

Account for the size of the team. In a two-person team, colleagues can review each other's changes. A one-person team needs another form of oversight, such as documented periodic review by a senior manager or an external reviewer.
 

AI can help compliance teams turn investment mandates into draft compliance rules, but an AI-generated rule should never go live without human review.

The AI can prepare an initial draft. A compliance professional then checks and edits it, takes responsibility for the proposed rule and submits it for approval. A second professional independently reviews and approves the change. The audit trail should capture the AI's suggestion, the human edits and the final approval.

This approach allows firms to benefit from automation without handing responsibility for compliance decisions to a model.

Compliance teams are already increasing their focus on AI governance. In the 2026 Investment Management Compliance Testing Survey, which surveyed 411 investment adviser firms, 72% reported increasing compliance testing around AI, and 59% had established a formal AI governance committee. US examination priorities have also focused on whether firms' actual use of AI matches what they tell clients and regulators.

Linedata's own testing illustrates how AI can fit into a controlled workflow. In beta testing of an AI tool that extracts investment restrictions from mandate documents, the AI identified 95% of relevant restriction candidates in sample documents, averaging under eight seconds per restriction. A compliance professional reviewed every suggestion.

The benefit is a faster first pass through complex documents. Maker-checker provides the review process needed to turn those suggestions into approved, operational rules.
 

Owner-driven compliance is an approach to investment compliance in which the compliance professionals responsible for investment restrictions build, test and maintain the rules themselves, within a controlled system. The team that interprets a mandate, prospectus or regulation is the same team that turns it into a working rule and answers for how that rule behaves.

How it differs from IT-driven and vendor-driven models

Firms generally manage compliance rules in one of three ways:
 

In the first two models, the person who understands the restriction is usually not the person who configures it. Each handoff adds time to a change and is another point where the intent of a mandate clause can be misread.

Why maker-checker is the control that makes it work

Removing handoffs also removes a separate party who looks at each rule before it goes live. Maker-checker puts a formal review in its place. One compliance professional drafts and tests the rule; a second independently reviews it against the source document and approves it before it takes effect. The system prevents self-approval and records each version and decision. Accountability stays with compliance, and every change is still reviewed by someone who understands the restriction.

Linedata Compliance helps asset managers build, review and maintain investment compliance rules within a controlled workflow.
Key capabilities include:

• Maker-checker approval: New and modified rules go through independent review before taking effect.
• Rule building for compliance teams: Non-technical users can create and maintain restrictions using a library of more than 250 pre-packaged parameterized rules templates.
• Historical testing: Users can test rules against positions as of a past date before submitting them for approval.
• Audit trails: Rule history and breach management records support audits and regulatory examinations.
• Exception management: Configurable breach workflows help teams track issues from identification through resolution.

Together, these capabilities help compliance teams maintain control over their rules, reduce reliance on technical handoffs and document the decisions behind each change.

Linedata Compliance is used by more than 70 firms worldwide. At MUFG Luxembourg Management Company, which provides management company services to more than 150 funds, a relatively small compliance team uses the default rule templates to create and update rules. Read the case study.

What is maker-checker in asset management?

Maker-checker requires one person to prepare a sensitive change and another to approve it before it takes effect. Asset managers use it for compliance rules, restricted lists, pre-trade overrides, breach closures, pricing overrides and cash movements.

What is owner-driven compliance?

Owner-driven compliance is an approach in which the compliance professionals responsible for investment restrictions, rather than IT teams or outside vendors, build, test and maintain the rules themselves within a controlled system. Maker-checker provides the independent review that makes this safe: one compliance professional drafts the rule, and a second approves it before it goes live.

Is maker-checker the same as the four-eyes principle?

Yes. Maker-checker, the four-eyes principle, dual control and the two-person rule describe the same basic control. Segregation of duties is the broader principle; maker-checker applies it to individual changes.

Is maker-checker a regulatory requirement for investment compliance rules?

Not specifically by name. SEC rules require appropriate compliance policies and procedures, FCA SYSC 5.1 addresses segregation of duties, and DORA establishes ICT change-management requirements for covered changes. Maker-checker can help firms demonstrate appropriate review, depending on the requirements that apply to them.

Can the same person be both maker and checker?

No. The control requires independent review. Systems should prevent self-approval and use named user accounts so the audit trail identifies who made and approved each change.

How can a small compliance team implement maker-checker?

Two-person teams can review each other's changes. A one-person team needs compensating controls, such as documented periodic review by a senior manager or an external reviewer.

Which compliance rule changes need maker-checker?

At a minimum, firms should review new rules, threshold changes, changes to asset or account scope, changes to underlying data mappings and rule deactivations. A lighter process may be appropriate for low-risk edits, such as changes to a rule's description, if documented in advance.

Does maker-checker slow down compliance rule changes?

It adds a review step, but delays often come from handoffs between compliance, IT and outside providers. When compliance teams can build and test rules in the same system, a qualified colleague can review the change without sending it through a separate technical queue.

How should maker-checker work with AI-generated compliance rules?

Treat AI as a tool for drafting rules, not approving them. A compliance professional should review and edit the draft, and a second professional should independently approve the final rule. The audit trail should capture the AI suggestion, human edits and approval.

Scott Greenwald, CMO at Linedata, works closely with the company’s product and client teams to understand the operational and regulatory challenges asset managers face across the front, middle and back office. He writes about how investment firms can apply technology to investment compliance, operational oversight and the wider changes taking place in asset management.