Making Regulatory Compliance Manageable

Introduction

 

Regulation is important. It ensures the integrity, safety and stability of the Financial Services sector and ensures that clients are treated fairly.
The continued evolution (and turmoil) of the financial services industry, along with the emergence of digital assets, distributed ledgers, ESG etc, inevitably means one thing – additional and changing regulation.

 

Every global market is regulated by their local regulators, and typically there are similar requirements across common themes, albeit a few key regulators (typically US, UK & EU) tend to lead the way and other jurisdictions follow.

 

Since 2008, over $300 billion of fines have been handed out to the world’s financial institutions, with the number of fines increasing in recent years. Fines span a breadth of non-compliance issues with some of the largest relating to Anti Money Laundering breaches. Examples include: Goldman Sachs was fined $2.9 billion relating to 1MDB, JP Morgan $2.6 billion relating to Madoff, Danske Bank $2.0 billion relating to Estonian payments. [Source US DoJ, Reuters]

 

Typically fines are multiples of $10 million, however, breaches can also lead to restriction of business which can be far more costly in the longer term. Needless to say, the cost of regulatory compliance is insignificant compared to the cost of non-compliance.

Typically fines are multiples of $10 million, however, breaches can also lead to restriction of business which can be far more costly in the longer term. Needless to say, the cost of regulatory compliance is insignificant compared to the cost of non-compliance.

Regulatory Themes

 

Across the range of global regulations, there are some key themes to the areas of compliance:

 

Reporting: regulatory reporting for financial services is a critical process that helps demonstrate compliance with various regulations and laws, as well as providing transparency and accountability to stakeholders. This process involves the collection, transformation, and submission of financial data to regulatory authorities; such as central banks, financial regulators, and government agencies. The scope and requirements of regulatory reporting differ across jurisdictions, but they generally cover areas such as trade reporting, capital adequacy, liquidity risk, market risk, and operational risk. Financial institutions must invest in robust reporting systems and processes, employ skilled personnel, and stay up-to-date with changing regulations to avoid penalties, reputational damage, and regulatory scrutiny.

 

Business Conduct: standards and principles that guide the behaviour of financial firms towards their customers and the broader market. The primary aim of these regulations is to ensure that financial firms act in the best interests of their customers, maintain fair and transparent markets, and avoid conflicts of interest. The key areas of focus in regulatory business conduct include market abuse, insider trading, conflicts of interest, fair dealing, and customer protection. Financial services firms must implement robust policies and procedures to comply with these regulations.

 

Financial Crime: aimed at preventing and detecting criminal activities including money laundering, terrorist financing, fraud, bribery, corruption, and tax evasion. Financial institutions are required to implement comprehensive anti-money laundering (AML) and know-your-customer (KYC) policies and procedures to detect and prevent these crimes. They are also required to report suspicious transactions and maintain transaction records to enable regulatory authorities to investigate potential financial crimes. Non-compliance with these regulations can result in significant legal, financial, and reputational consequences for financial institutions, including fines, sanctions, and loss of licenses.

 

Cybersecurity: cyber threats include hacking, malware, phishing, and ransomware attacks; which can result in data breaches, financial losses, and reputational damage. Financial institutions are required to implement robust cybersecurity policies and procedures to prevent and detect cyber attacks. They must also report any breaches or incidents to regulatory authorities promptly.

 

Financial Risk Management: financial risks include credit risk, market risk, liquidity risk, and operational risk. Financial institutions are required to have robust risk management policies and procedures in place to identify, measure, monitor, and control these risks. They are also required to maintain adequate capital and liquidity levels to ensure they can absorb potential losses and have clear recovery & resolution plans.

 

 

Sustainability & Climate: ensuring that financial institutions integrate ESG factors into their investment decisions and risk management practices. ESG factors include climate change, environmental impact, social responsibility, diversity, and corporate governance. Financial institutions are required to disclose how they consider ESG factors in their investment decisions and demonstrate their commitment to sustainable investing. The importance of ESG regulation is growing as investors increasingly focus on investing in sustainable and responsible companies.

Managing Regulatory Change

 

Staying on top of Regulatory Change can be challenging. This is a key area where we continue to work with our clients, helping them deliver against existing commitments along with establishing best in practice processes and governance to ensure new regulations are being managed pro-actively.

 

There are several key steps, that if implemented well, can ease the burden of managing ongoing Regulatory Change:

 

Regulatory Horizon Scanning: it is key for firms to be aware of upcoming regulation in order to plan and prepare for implementation. Typically regulators broadcast upcoming regulations several years in advance. Firms need to understand applicability and impact to their business and ensure adequate resourcing for i) initial assessment of regulation; ii) participation in industry and regulatory working groups and iii) assessment of draft texts and feedback on consultation papers.

 

In order to stay abreast of the largest potential impacts to our clients, Bailrigg maintains a view of forthcoming global regulations. Here’s a high level summary of those on the horizon over the next 2 years:

Bailrigg Horizon Scanning – Large Impact Regs 2023/24 (April 23)

Initiation: it is critical for firms to set themselves up for success, and regulatory initiatives are no different from other change programmes. As well as scoping out the new regulation, identifying impact, stakeholders and suppliers, it is important to agree suitable project methodologies (e.g. waterfall, agile etc) or combinations thereof to deliver the change. Work breakdown structure, project organisation and governance, and clear roles and responsibilities are all enablers for successful implementation and can avoid issues as the project progresses.

 

Execution: the initiation phase should define the overall approach for execution. The key factors for successful execution are to ensure effective governance, routines and status reporting throughout the life of the project in order for management to pro-actively manage risk, issues and items for attention as they arise.

 

Traceability: the most important thing with regulatory change is the ability to demonstrate to regulators, stakeholders and audit that the delivered solutions meet the underlying regulatory requirements. The most effective way to do this is using the “V-Model” whereby you have hard-wired traceability from regulatory text, through interpretation and the software development lifecycle, through to production deployment of solutions. This should also be used as a basis for communication of any gaps to regulators and to identify any follow-on remediation work for remediation.

 

Tooling: a whole host of tools and IT solutions are available and with practical application these can provide a robust, controlled and efficient way of managing regulatory change and ongoing compliance. Tools can be deployed for:

 

  • Programme management, MI & reporting – tracking delivery of milestones, plans, RAIDs, budget, scope and resource
  • Traceability from regulatory text to production deployment including change control and associated RAIDs
  • Validation and assurance via automated testing or quality assurance over production environments
  • Accelerating the control environment
  • Cross-jurisdictional management of regulatory rules to ensure consistency or “highest bar” where appropriate.

Conclusion

 

Regulatory Compliance is critical to an organisation’s risk management, profitability and longevity, along with that of their clients’. bailrigg+ have extensive experience implementing regulatory change, from strategy and governance through to delivery, quality assurance and remediation. In addition, we are regularly asked by clients to bring failing programmes back on track and ensure successful delivery.

 

If you require any assistance on this topic please contact Tom Hutchings, Head of Global Business Development

Author: Graeme Duffy – Regulatory and Business Change

 

April 2023