The Compliance Ballgame
Doing business in an environment shackled by regulation where comply or perish seems to be the order of the day, getting it right is of utmost importance and priority to many financial institutions. Complying while keeping the business going as usual is crucial. In a rather interesting comparison, compliance is like a skirt – it should be long enough to cover the matter but short enough to be interesting. Nevertheless, it is easier said than done.
Today’s compliance landscape is crowded with heavy weights such as Basel II, anti money-laundering (AML), Sarbanes-Oxley, International Accounting Standards and a host of regional regulations such as the EU Savings initiative and the Markets in Financial Instruments Directive (MiFID). Apart from multiple regulations, multiple regulators and different flavours of the same regulation applied to different regions make things complicated beyond imagination, more so for global financial institutions.
As coincidence would have it, as I was writing this, a weekly news alert landed in my mail box and the first thing to catch my attention was a cto admitting that he can get the cfo and ceo to open their check books for almost any project if he says it falls under the definition of compliance. But the fact that compliance initiatives get an instant budget approval does not make things any easier in identifying and implementing an efficient compliance solution.
In the run up to being truly and efficiently compliant, here are a few things that financial institutions should do which are at least as important as hiring a chief compliance officer and buying the latest piece of software in the market.
For many institutions, inculcating a compliance culture starts and ends with a web based training on AML or Sarbanes-Oxley. But there is more to it than just that. Think of compliance as a culture rather than a report sent at the end of the day. Ingrain compliance in every process starting from the front office desk back through to your mail delivery. Assess your staff on how compliant they are when you assess them on their competence.
Though compliance culture sounds like a fluid concept, simply put, it is the attitude of each of your staff of doing not just what is required by the law but what is right. As Lori A Richards of the US’s Securities and Exchange Commission (SEC) often says: “What’s good for investors is good business for those who serve investors.”
With regulatory requirements increasingly becoming global, it pays to select the right approach for any compliance initiative. If you are a global bank that is trying to comply with a global regulatory requirement, ‘follow the sun’ should be the approach. Form a global team from across regions, create a set of global requirements and strive towards achieving a global solution. This harmonises not just your effort but also your systems, solutions and processes across the organisation and not to mention the cost advantage that is brought about by the negotiating power by coming together as a global institution.
While banking secrecy and customer data protection is still a hindrance to globally centralising processes, many of the global institutions are already getting their act together in the right direction for the day when this will be a reality.
A case in point is a large global investment bank that is already working towards centralising its anti money-laundering compliance efforts in its European head quarters. This would imply that all regulatory watch lists and rule engines will be maintained centrally and the transaction-monitoring tool will be compartmentalised to route transaction messages received from around the globe to the relevant compartments. The bank believes that this would result in creating a centre of excellence for AML compliance and a great amount of cost and operational efficiency. Most importantly, it would help the bank in complying seamlessly around the clock, which would otherwise have been impossible.
Complexity begets risk. The more complex the process, the more risks there are. Break down each process, study the pieces, get rid of the complexity and reengineer them to form a more meaningful and less complex process. Besides reducing risk, it increases transparency, gives more control to people in charge of these processes. Establish clear process description manuals and keep them updated so that people can be fungible across organisation. With all the emphasis placed on operational risk, there is clearly no better time than now to do this.
With an increasing number of new regulations, business as usual for many companies seems like a distant memory. Having spent millions of dollars in seamlessly connecting systems to ensure straight-through processing of trades, the new requirements to implement real-time transaction monitoring for AML or data extraction for Basel II (which has the potential of hampering STP of trades), is daunting.
It is very important to weigh all aspects of a new solution, system and process to ensure the right fit in the current landscape. While it may be great to have a tool with all sorts of fuzzy logic and neural network for monitoring your transaction, if it is going to be in the way of your STP, it is not doing anything great for your business. The trick of the trade is to find that right solution that will serve the purpose without having an adverse effect on your business.
Look at all your compliance activities in totality and identify duplication. This is imperative not only to cut cost and effort but also to have a consistent story. Is there a report that you produce for Sarbanes-Oxley that has the same content as one of your Basel II reports? If yes, then leverage. Make one team in charge of culling out data and preparing both reports. The last thing you want to see is two different data for the same parameter in two different reports, which will send out a clear signal that you don’t know what you are doing.
Banks and financial institutions are increasingly looking at forming cross compliance teams in their effort to leverage. Though it is a challenging task, the pay-off is immense.
Milk as much business benefits as possible from your investments in compliance initiatives. The amount of cross selling opportunities that can be created by simply exploiting the data collated for compliance is innumerable. Look up your client database; target that client who has just relocated for a mortgage or a personal loan. Who knows what opportunities are disguised beneath those gigabytes of data?
A largely used and well known example of this is the pay off from the customer profiling exercise of AML. While profiling customers into different baskets help in identifying and thwarting unusual behaviour, its business benefit is delivered when the bank knows its exact target for different services, thus reducing marketing spend on targeting wrong customer segments.
With all the complexity that has been created by the variety of regulations, recording and archiving anything and everything that will provide any kind of evidence that you were conducting your business by the letter of the law is imperative. Starting from customer data to transaction data, email correspondence, trade negotiation and the list goes on. While choosing a technical solution for storing information solves only half the problem, the ability of retrieving the exact information you want, when and how you want it should also dictate the solution.
Thanks to the big-ticket penalty for non-compliance, there are next-generation compliance tools that prevent your employees hitting the ‘send’ button in their email if it has offensive contents. While it may seem like active compliance, it may harm you in the long term by not unearthing the culprits in your organisation sooner.
Speak with your regulators and set an expectation of when and what you can do. Explain of any shortcomings of your new solution or process. When you give an undertaking for compliance, stick to it. Keep the dialog going with the regulators to anticipate what is to come in the future and network with peers to understand what others are up to.
It is commonplace that many of the regulatory requirements are as vague as they can get and do not provide any guidance on how to be fully compliant, with the constant explanation for this being the regulators do not want to be descriptive for this will lead to a tick the box approach. While the first reaction of many firms to complex regulations has been to hire the best consultant in town who probably is just as clueless they are, it is also very important to seek clarification from the respective regulator and provide constant feedback. Quite a few lessons have been learnt by the whole industry during the iterative dialogues, conferences and research that produced the final Basel II Accord and it is time we saw a similar approach across regulations and regulators.
One cannot emphasise enough the business benefits brought about by peer comparison and benchmarking in compliance initiatives, especially in an environment where any bit of clarification is highly sought after. With regulations such Pillar 2 of Basel II requiring financial institutions to establish the integrity of the models used in calculating their capital requirement, the industry does need a proven model, which can be used as a benchmark, at least till such time the banks are confident about their own bespoke models.
We all know too well that compliance at will as a concept is still far fetched. But increasingly there is a growing trend among institutions to want to be socially responsible to create a sane and stable market place. At the end of the day, compliance does pay. After all, you and I do prefer to conduct business with an organisation that respects the letter of the law and makes an honest effort to comply with it. Perhaps, the recent series of corporate failures is too fresh in our memories to forget the moral of this story.