Managing Hedge Fund Regulatory Risk in a Turbulent Market
The recent turmoil in the sub-prime and other credit markets highlights the importance of managing regulatory risk. The US Securities and Exchange Commission (the SEC) and other regulators are scrutinising financial institutions, including hedge fund managers, more closely than ever and managers that wish to avoid enforcement and other regulatory proceedings and actions need to focus on the management of this high-exposure area. This article discusses how to manage regulatory risk both prospectively (i.e. before regulatory scrutiny occurs and reactively (i.e. after a regulatory inquiry has commenced).
Running a successful hedge fund management business requires not only the generation of competitive returns and an effective marketing effort, but also a compliance programme or infrastructure that protects the business against inadvertent and intentional violations of applicable laws, regulations and fiduciary principles as the business grows and changes over time. This section identifies basic principles that should be incorporated into an effective compliance programme.
An effective compliance programme should actively seek to identify and assess the firm’s risks and conflicts of interests in all aspects of its particular business and operations. A manager should diagnose the potential areas of exposure in order to design safeguards and mechanisms to prevent, detect and correct violations of applicable legal standards. A broad group of personnel, including the firm’s chief compliance officer (CCO) can serve as the primary source for collecting and refining current information concerning the firm’s risk profile and conflicts of interest. This evaluation should cover the intersection of compliance obligations and the firm’s business, strategic, operational and client related risks.
From the information collected, careful consideration should be given to what kind of regulatory mishaps or self-dealing situations could arise from the total mix of arrangements, practices and incentives that comprise the firm’s business. A set of abstract policies and procedures that are not well connected to an identified litany of manager-specific risks and conflicts is not likely to be very effective in preventing compliance problems.
Documentation of material risks and conflicts in a format that will provide a master roadmap to mitigating and controlling those risks is key. This can take the form of a risk matrix chart or table. An effective working matrix should:
The firm should also assess and evaluate the severity of the risks and conflicts so that it can allocate the appropriate level of compliance resources to address and mitigate those risks and conflicts. A number of employees across different departments should help develop an organisation-wide perspective on risk. The firm could also establish a risk committee to spearhead the process and make final determinations. These determinations should be made periodically, as appropriate, on a real-time basis rather than merely at the time of an annual review.
Many managers launch their compliance programme by using an off-the-shelf compliance manual from a consultant or law firm as a reasonable and efficient starting point. Unfortunately, some managers stopped there and did not modify the canned provisions to fit the dynamics of the firm’s particular business. As a result, some managers may have a number of inapposite policies and procedures, or irrelevant sections or provisions within policies that are otherwise pertinent. A firm’s compliance programme must be customised to the business and operations of the firm to be effective. The most challenging aspect of this process is to refine existing content to proactively and intelligently account for the particular activities and operations that create risk for the firm.
Effective administration of a compliance programme includes a regular series of quality control transactional and forensic testing of the firm’s actual business activities. The primary purposes of transactional and forensic testing are to evaluate whether the results of operational and investment activities are consistent with the standards and expectations described in the firm’s compliance policies and procedures, and to confirm that the testing itself is effective in achieving that goal. A schedule of ongoing forensic and transactional testing should be established for the entire year and not merely on a sporadic basis or during an annual review, and should be correlated to the items identified in the firm’s risk matrix. The testing results should be recorded to identify trends in the firm’s compliance risk profile. Corrective actions and adjustments to the firm’s risk assessment should be taken where appropriate and should be well documented.
Documenting the actions taken to implement and administer the programme is essential to substantiating its functionality and effectiveness. Documentation that reflects a pattern of active oversight, regular testing and review, risk assessment and deficiency correction should pay dividends at the next SEC exam. One way to facilitate the documentation process is to prepare a series of standardised forms to accompany each procedure or test conducted. Also, in many cases compliance software applications can generate documentation for activities monitored by the application. Incorporating standardised forms into each procedure will streamline the record-keeping process.
Certain areas of the compliance programme may require real-time monitoring or review of a sizeable body of data, and it may be appropriate to use technologies and tools that are designed to facilitate the performance of these compliance functions. New software applications to address these needs continue to emerge. In other aspects of the business that are highly time sensitive, such as the trading desk, it may also be more effective to employ technology to automate verification of compliance with client portfolio composition requirements or trade allocation procedures or to detect unusual trading patterns.
Even a well-designed and implemented compliance programme will be inadequate if non-compliance, when detected, goes uncorrected or is only partially or inadequately addressed. Once a deficiency is ascertained, identify what went wrong and why, take prompt but considered action to cure the problem, and implement additional procedures reasonably designed to prevent the problem from recurring. The remediation process should also be fully documented, because SEC examiners will require confirmation that violations were corrected, that any clients who were harmed were made whole, and that additional or enhanced measures were adopted to prevent their reoccurrence.
Each organisation needs to determine the appropriate amount of human and financial capital to allocate to compliance. It is not uncommon for smaller organisations to have a CCO who wears multiple hats, often as a CCO and chief operating officer or CCO and general counsel. The size and scope of the firm’s business operations may not justify the appointment of a CCO dedicated solely to administering the compliance programme. Still, each firm should assess the adequacy of staffing at periodic intervals and the assessment should be part of the annual compliance review.
If the worst happens and you are faced with a regulatory inquiry there are steps you can take to minimise the firm’s exposure. This section outlines basic principles to help you prepare for regulatory inquiries.
All regulatory inquiries should be referred to a single point of contact in the company. This person may be the manager’s CCO or an internal lawyer (the contact). This will ensure that the business responds in a unified way and controls the provision of information in response to the inquiry. The contact is responsible for deciding how to handle the regulator’s requests, but may also involve counsel or other employees who have particular knowledge about the areas of inquiry.
When a regulator appears, the initial contact employee should ascertain with whom the regulator wants to speak, be polite and friendly but give no information, and immediately inform the contact.
Regulators may form a lasting impression based on a company’s willingness to cooperate from the outset, and therefore staff should be friendly and co-operative. No one other than the contact, however, should volunteer information. The manager and its staff should make it clear that they are willing to co-operate, while at the same time limit any information provided until the nature and significance of the inquiry have been established. If approached by regulators with questions, staff need not agree to be interviewed. Even if an employee does agree to be interviewed, the employee may terminate the interview at any time, and is entitled to have counsel present during the interview. Staff should not respond to any question unless sure that their response is complete and accurate. All substantive information should be provided by the contact. With inquiries that are unexpected, there will be little time to gauge the nature, scope, and significance of the inquiry and therefore all information should be provided cautiously.
Subpoenas for documents should be accepted politely but do not make any statements regarding the manager’s compliance with it. Only after counsel reviews the subpoena can the manager’s position be determined. Never provide any documents during the initial service of a subpoena or during an interview. While documents produced to a grand jury are afforded legal protections regarding their use, documents given to a regulator during an interview might not be subject to those protections. In the case of a search warrant, staff should not speak with the regulator regarding the information sought or respond to substantive questions.
The contact should find out who the caller or visitors are and whom they represent. Review their credentials and make a copy of them or write down the details. Ask the purpose of the inquiry. Determine if an individual, a third party or the manager is the focus of the inquiry. If the purpose of the inquiry relates to an individual employee, then major concerns include the privacy rights of the individual and the disruption of that person’s and the manager’s work. Remember, however, that even a matter involving an individual can have implications for the manager. Requests for manager records or information regarding the manager raise more complex issues depending upon the purpose for the visit.
Such inquiries may relate to the manager’s business operations, its relationships with other companies or individuals, or its relationships with staff. In matters that appear to involve only third parties (including clients and service providers such as broker-dealers), it is often unclear at the early stage of an inquiry whether the regulator’s investigation will directly or indirectly involve or implicate the manager as well.
After the basic information is obtained, and before any questions are answered, call legal counsel and inform counsel who the regulator is and what has been requested. You can defer all questions to counsel if you wish, and counsel talk to the regulator over the phone. If you do decide to defer all questions to counsel, do so in a way that makes it seem routine and in accordance with manager policy of deferring all questions from investigators to counsel.
The manner in which a manager responds to a subpoena for documents can affect the way in which a regulator views the manager and the case in development. Immediately safeguard all records arguably related to the subject of the subpoena. Take affirmative steps to ensure that computer records, including emails, are protected from inadvertent or routine, scheduled deletion. Full and complete compliance with a subpoena is essential; any omission in responding to the subpoena may result in additional difficulties.
This article contains general information and should not be relied upon as constituting legal advice.