Compliance

In the coming year, regulators will continue to prioritize review of innovative products and new technology.

● Expect a more nuanced approach for scrutiny of digital advisors and assets including review of the adequacy of compliance programs, use of service providers and mitigation of conflicts of interest. SEC Exam Priorities for Virtual Assets

● Recently, the NY DFS also issued proposed guidance on the adoption or listing of virtual currencies, updating its 2014 guidance on the regulatory framework for virtual currency (VC) firms. The NY DFS is accepting comments on two proposed coin/listing options that it wishes to make available to VC licensees. Read the guidance at the following link: comments are due by January 27, 2020! DFS Proposed Guidance

● Another important development to watch: This month in Paris, FATF organized a supervisors forum to make progress on global consistency for supervising digital assets and related service providers. Supervisor Forum 2020

● Check out the latest What’s Ethical podcast with Matthew Blake. Matthew shares his insights as Head of the Future of Shaping Financial and Monetary Systems at the World Economic Forum (WEF).

This year the SEC provided a steady stream of guidance illustrating which compliance and governance programs worked and which ones fell short. To help you plan for 2020, we have distilled the highlights in this Regulatory Year in Review. As you study enforcement cases, rule proposals and risk alerts, you’ll see there are trends for RIAs to consider in the year ahead.

Enforcement Wrap-Up

Registered investment advisors remained a top enforcement priority for the SEC with cases focused on failures with cybersecurity, fair valuation of assets and appropriate client and investor charges and fees. 36% of the 862 SEC enforcement actions pertained to investment advisors and investment company issues. See: SEC Enforcement Annual Report

Stand-alone enforcement actions pursued against investment advisers or investment companies totaled 191 which represents a nearly 77% annual increase compared to the 108 stand-alone enforcement actions filed in the 2018 fiscal year.

See page 23 for notable enforcement cases including an action against BMO Harris Financial Advisors and BMO Asset Management for failing to inform clients about certain aspects of how they selected investments in their advisory program, which included the selection of more expensive investments from which BMO profited.

For state advisors and brokers, there is a similar report from NASAA. See: NASAA Annual Enforcement Report

If you are an advisor that is focused on retail clients or senior citizens, you should expect your business model to continue to be a priority for the regulators. Regardless, it’s a good idea to calendar a way to stay on top of enforcement cases in 2020, so you can review and confirm you haven’t made similar mistakes within your own compliance program.

New Rules and Proposals 

One of the most important changes for 2019 will continue as a focus in 2020: the dual SEC releases in June which announced a new Part 3 to the Form ADV (Form CRS) and a new standard for broker-dealers under Regulation Best Interest. One of the biggest takeaways for you is to start your annual review of the Form ADV early and add a conflicts of interest review matrix to your compliance program if you don’t already have one. See: SEC Press Release Reg BI & Form CRS

In November, the SEC also announced proposed changes to the rules related to investment adviser advertisements and compensation for solicitations to include non-cash compensation.

The proposal covers many areas including permitting testimonials in certain circumstances, exempting unsolicited communications from the definition of advertisements and enhancing requirements and prohibitions related to use of gross and hypothetical performance. There is also a new requirement to disclose advertising practices on the Form ADV to facilitate SEC oversight. See: SEC Rule Proposal – Advertisements and Solicitors

If you are interested in the full list of proposals, the SEC publishes an index on their website.

Risk Alerts

Another key point from the SEC’s guidance this year is the importance of understanding and testing adherence with privacy, information security and cybersecurity including cloud storage as well as potential or actual conflicts of interest with clients.

The SEC announced its top findings in an important mid-year risk alert for RIAs covering supervision, testing and oversight, disclosures and conflicts of interest. See: RIA Exam Findings Risk Alert

For more information, below is a reading list of the 6 SEC Office of Compliance Inspections (OCIE) Alerts:

Nov. 7th

Top Compliance Topics Observed in Examinations of Investment Companies and Observations from Money Market Fund and Target Date Fund Initiatives

Sept. 4th

Investment Adviser Principal and Agency Cross Trading Compliance Issues

July 23rd

Observations from Examinations of Investment Advisers: Compliance, Supervision, and Disclosure of Conflicts of Interest

May 23rd

Risk Alert:  Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features

April 16th

Risk Alert: Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies 

Feb. 13th

Transfer Agent Safeguarding of Funds and Securities 

SEC (OCIE) Examination Guidance 

Finally, the SEC announced its examination priorities almost a year ago. We saw the results of those priorities in the enforcement cases and guidance issued throughout the year. You may want to review that report as we await the announcement of the 2020 priorities expected before year-end. See: SEC 2019 Exam Priorities

By way of reminder, the SEC indicated a focused commitment to retail investors and that examinations would focus on 9 specific areas. Three of which are identified below:

• Fees and Expenses: Disclosure of the Cost of investing: “For these examinations, OCIE will select firms with practices or business models that may create increased risks of inadequately disclosed fees, expenses, or other charges. With respect to mutual fund share classes, OCIE will continue to evaluate financial incentives for financial professionals that may influence their selection of particular share classes. In addition, OCIE remains focused on investment advisers participating in wrap fee programs, which charge investors a single bundled fee for both advisory and brokerage services. Continued areas of interest include the adequacy of disclosures and brokerage practices.” See: SEC OCIE 2019 Priorities Report (page 6)
• Conflicts of Interest:  The SEC identified three areas vulnerable to conflicts of interest for investment advisors. Examinations will review policies and procedures addressing the following: advisers using affiliates services and products; securities backed by non-purpose loans and lines of credit; and loans from clients. See: SEC OCIE 2019 Priorities Report (pages 6 and 7)
• Portfolio Management and Trading:  The SEC will also examine investment advisor portfolio recommendations to assess, among other things, whether investment or trading strategies of advisers are: (1) suitable for and in the best interests of investors based on their investment objectives and risk tolerance; (2) contrary to, or have drifted from, disclosures to investors; (3) venturing into new, risky investments or products without adequate risk disclosure; and (4) appropriately monitored for attendant risks. See: SEC OCIE 2019 Priorities Report (page 7)

We can expect to see a similar volume of developments in 2020, so you may want to calendar a quarterly review to ensure you are addressing compliance issues as needed.

1. Funding & Resources – When determining fines, prosecutors will consider whether “there has been sufficient staffing for compliance personnel to effectively audit, document, analyze, and act on the results of the compliance efforts” and whether “there been times when requests for resources by compliance and control functions have been denied, and if so, on what grounds.”
2. Behavioral Incentives – In their training, prosecutors learn that a “hallmark of effective implementation of a compliance program is the establishment of incentives for compliance and disincentives for non-compliance.” They will consider efforts to drive compliance by “providing positive incentives – personnel promotions, rewards, and bonuses for improving and developing a compliance program or demonstrating ethical leadership.”
3. Improvement & Sustainability – Prosecutors also learn that another “hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment… Prosecutors may reward efforts to promote improvement and sustainability. In evaluating whether a particular compliance program works in practice, prosecutors should consider ‘revisions to corporate compliance programs in light of lessons learned.’”

On June 4th, the SEC settled a case against the hedge fund investment adviser Deer Park Road Management Company LP (“Deer Park”). Deer Park’s missteps create a uniquely teachable moment for compliance-oriented professionals whose controls may not always focus as intently as they should on the technical details of their organization’s models and processes. While Deer Park’s compliance processes were unusually deficient, such professionals should take caution when deferring to the business on technical matters such as valuation. The devil often resides in such overlooked details.

In particular, Deer Park and its CIO were censured and fined for failing to maximize observable inputs while developing GAAP-compliant valuations for a portion of the residential mortgage-backed securities it managed. In such cases, traders were given undue authority to undervalue such securities or to misreport their value to the investment adviser’s outside pricing vendors. The CIO signed off on these valuations, directly implicating himself. As Daniel Michael of the SEC Enforcement Division’s Complex Financial Instruments Unit said of the case, “Deer Park’s pervasive compliance failures allowed its traders to mark assets up gradually instead of marking them to market, in violation of the accounting principles they were required to follow.”

Deer Park’s program also suffered from insufficient oversight of the valuation process, despite the firm’s pricing expertise. In this case, the SEC focused on the inadequacy of Deer Park’s valuation procedures and conflicts of interest that arose when the firm’s traders and CIO allowed themselves to disregard observable market inputs.

Moreover, it acknowledged Deer Park’s retention of a new CCO with relevant experience after the firm’s violation period as a remedial action. This specifically underscores this case’s relevance for Compliance: the case implies in order to avoid regulatory action, the CCO needed the expertise to confirm the adequacy of the controls.

Deer Park reminds us that what compliance professionals don’t know about the underlying business can hurt them. But help is always available.

Outside resources exist to help you stay current and informed. Know when to ask for help!

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

In the wake of the SEC’s dual release of Regulation Best Interest (“Reg BI”) for broker-dealers and its Interpretation of Standards of Conduct for investment advisers (“RIAs”), this is an opportunity to consider the efficiency and impact of compliance controls. For instance, are programs designed to quickly detect and prevent conflicts of interest (“COI”) that either act against the best interest of the retail investor, in the case of broker-dealers, or violate the fiduciary duty of RIAs? If not, Compliance Officers should implement strong behavioral incentives throughout the organization that can detect and/or eliminate COIs when they first arise.

Both Reg BI and the SEC Interpretation indicate the importance of such proactive measures in Compliance programs going forward. Take, for instance, the Interpretation’s mandate to “eliminate or at least expose through full and fair disclosure all conflicts of interest which might incline an investment adviser—consciously or unconsciously—to render advice which was not disinterested.” A top-down, reactive approach to compliance detection may cause friction without effectively addressing this comprehensive requirement. Before the implementation date, Compliance can begin to assess COI exposure using a sustainable governance framework during annual reviews, compliance testing and new product and business projects.

By implementing these six COI review projects early, Compliance departments can not only determine the impact of the SEC pronouncements, but buy precious time to efficiently align Compliance, operational and business controls:

1. an inventory of actual COIs
2. an inventory of potential conflicts that do not currently exist but might reasonably present themselves in the future
3. an inventory and schedule review of regulatory filings, client disclosures and agreements
4. a process for reviewing incentive compensation programs
5. a process for reviewing new business and products, including revenue sharing arrangements for conflicts
6. a process for reviewing personal COIs regarding non-cash compensation, gifts and personal investments

With an emphasis on horizontal engagement across departments, Compliance can assess the prevalence of COIs within business processes and design incentives, so COIs aren’t only found after they are baked into existing work flows.

Working alongside financial, product and sales experts, Compliance can use the results to assess and enhance Compliance and sales practices controls as needed; moreover, they can prepare to draft, file and deliver the new Form CRS Relationship Summary and other revised disclosures with greater confidence.

Finally, the effectiveness of Compliance efforts can be measured and fortified by the application of Compliance ROI calculations. These calculations not only illustrate how the investment of time and resources mitigates risks, but also reveals productivity gains and increased business opportunities afforded by the Compliance efforts. Metrics on prospective client inquiries, business engagement, behavioral incentives, efficiencies within operational processes, errors mitigated and IT and staffing budgets can substantiate the return on investment made on an improved COI framework.

Fraud and corruption exhibits a stubborn persistence throughout the world economy. Two-thirds of the world’s nation’s received a failing score on Transparency International’s CPI Statistics; all told, the world averages 43 out of a scale of 100. Prevention alone cannot shift these numbers; rather, financial professionals must be incentivized to do the right thing. Indeed, Reg BI and the Commission Interpretation indicates the time has come for a new approach to fighting COI; that’s where sustainable governance, horizontal engagement and Compliance ROI can improve our scores and our businesses alike.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

Federal, state and industry regulators mandate the timely and comprehensive execution of compliance risk assessments and conflicts of interest (COI) inventories. Naturally, compliance-minded professionals focus on performing due diligence and analysis of new laws and regulations these reports require. Yet merely presenting the risks, for instance, that a new global initiative or marketing campaign poses for the company can fall short. That’s where ROI assessments for compliance come in.

ROI assessments simultaneously test and enhance the effectiveness of your compliance risk assessments and COI inventories in important ways. For compliance risk assessments, ROI assessments confirm business priorities and where compliance is spending its time while proactively finding efficiencies within business processes. In addition, ROI assessments can help create or update a COI inventory or identify a plan to address conflicts of interest. With Reg BI, conflicts of interest management will continue to be scrutinized.

Compliance risk assessments also endeavor to deter fraud and corruption. Deutsche Bank’s recent KYC initiative, affecting 1000 investment bank clients, highlights the urgency to these tasks. ROI assessments can demonstrate the wisdom a pre-emptive compliance program brings to your business. They suggest models for robust anti-corruption programs which meet evolving standards and ensure that conflicts are addressed and avoided.  

In the meantime, as you approach midyear, you may find Blackrock CEO Larry Fink’s letter to CEOs to be a helpful resource. Fink covers how best practices and good compliance initiatives may help with recruiting and long-term profitability.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

A Compliance ROI is the foundational component of Compliance as a Competitive Advantage, and like any new initiative, it requires a shift in perspective and focus. It requires a shift in emphasis away from one-day-at-a-time responsiveness towards building sustainable processes that also contribute to the business bottom-line. Federal authorities already recognize this value. The U.S. Department of Justice (“DoJ”) routinely instructs federal and state prosecutors to gauge the proactiveness and sustainability of a given firm’s compliance program when a violation is detected or reported. As the recently updated DoJ Guidance on Corporate Compliance Programs makes clear, the more sustainably a business is governed, the less likely it will be required to spend on fines and remediation.* Compliance programs can effectively demonstrate their ROI by mitigating such risks.

An organization’s routine compliance functions such as training, testing and the quarterly/annual reporting can serve as prime opportunities for evidencing a Compliance ROI.

But as the DoJ’s evaluation reminds us, this assessment should be ongoing so your compliance program is not static. Compliance issues, such as a cyberattack, can arise quickly. Internalizing Triple-Bottom Line Compliance means stretching any response above and beyond what is expected with a protection-only approach and applying new visions to find business benefits and operational efficiencies as well. That vision should be spearheaded by you, but fortified by experts and allies both within and without your organization. ROI is not only a proactive initiative, but a shared one as well.

*Further information on the DoJ guidelines can be found here.

Also consult Episode 10 of Warburton’s What’s Ethical podcast, where Craig Salm of Grayscale Investments gives valuable advice on how he delivers a ROI advising on digital assets.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

“A foolish consistency is the hobgoblin of little minds,” Ralph Waldo Emerson

Q: In your opinion, what are the most important skills a new CCO or compliance officer should master?

A: Above all, compliance officers are well-served if they remember that the control environment should be aligned with the business environment and both should develop as they learn from mistakes and successes.

As Ralph Waldo Emerson once warned, “A foolish consistency is the hobgoblin of little minds.”

There are three ways compliance officers can develop skills so that controls don’t remain static and contribute to repeated deficiencies, patterned behavior of apathy or a misconception that compliance is bureaucratic.

1. Avoid Predictable Surprises: Compliance officers safeguard not only their businesses but themselves against falling prey to Predictable Surprises. Referred to by Harvard Business Review as “the disasters you should have seen coming,” these surprises can only be effectively met by rooting out our own cognitive flaws that enable them and not agreeing to let known gaps persist. Your organizational controls should be revisited at least annually for relevance and effectiveness. Within the Circle of Compliance cycle, changes to the business and regulatory environment are constant and must be accounted for in procedures and risk assessments. And if you don’t have time, be certain to ask for help before your company falls behind.

2. Prioritize Risks: Compliance officers should know how to effectively position compliance risks within current industry developments. The recent OCIE Risk Alert on Regulation S-P Privacy Notice and Safeguard violations can illuminate improvements your business can implement. If it doesn’t, compliance officers only need to point to the estimated $5 billion fine Facebook must pay the FTC as a sobering example of consequence.

3. Track Industry Trends: No resource is more valuable to a compliance officer than up-to-date information. Be sure to attend conferences, roundtables and maintain networking. Fresh perspectives on one’s profession can prevent one’s own from becoming stale.

Beth Haddock is author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact, and advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.