Arnold Schilder: Banks and the compliance challenge
Speech by Professor Arnold Schilder, Chairman of the BCBS Accounting Task Force and Executive
Director of the Governing Board of the Netherlands Bank, at the Asian Banker Summit, Bangkok, 16
March 2006.
* * *
Compliance risk is becoming one of the major risks banks are facing. The increasing globalization,
issues with the corporate governance of complex institutions, changing laws and regulations, the
understanding of what constitutes sound risk management, and the continuous evolution of financial
products create complex situations for banks that operate on a cross border basis. One may wonder
whether the compliance framework in place is robust enough to effectively manage these rapidly
changing factors. Creating a "best in class" compliance framework seems to be the best way forward.
The development and implementation of such framework might well be a challenge equal to the
implementation of Basel II.
Introduction
The subject of my speech is the challenges that banks face today with respect to compliance. You
may wonder - why?
The main reason for delivering a speech about this topic is that we have all recently seen banks
involved in compliance related problems. Riggs Bank acts as a well known example of such problems.
In July 2004, the U.S. Senate Permanent Subcommittee on Investigations of the Committee on
Governmental Affairs published a report on Riggs Bank. The evidence reviewed by the Subcommittee
staff establishes that, since at least 1997, Riggs Bank had disregarded its anti-money laundering
obligations, maintained a dysfunctional anti-money laundering programs and allowed or, at times,
actively facilitated suspicious financial activity1. In a more recent case De Nederlandsche Bank,
together with the relevant regulators in the United States, issued a Cease and Desist order with
respect to ABN AMRO Bank. The reason for ordering this Order had to do with compliance issues.
The problems ABN AMRO was faced with, albeit less far-reaching then those at Riggs Bank, act as
another example of compliance related deficiencies.
Another reason for this speech can be found in the publication of the paper 'Compliance and the
compliance function in banks' published by the Basel Committee on Banking Supervision (BCBS) in
April 2005. In the related Press Release of 29 April 2005, BCBS Chairman Caruana said: "Compliance
has emerged as a distinct branch of risk management within the banking system2." So it is fully
appropriate and timely to address this important topic in this Conference's broader context of sound
risk management in banks. Compliance risk is quickly becoming one of the major risks banks are
facing. So the efforts banks should undertake concerning compliance, may become comparable in
size and importance to the endeavours of banks in relation to the implementation of the new Basel II
Capital Accord.
However, unlike the various risks discussed by the new Capital Accord, holding additional capital to
'cover' compliance risks will not act as a mitigating factor. Other efforts are needed.
During the first part of this speech I will briefly discuss what should be understood under compliance.
Then I will go more in depth on the nature of the compliance related problems that not only banks, but
the entire financial world is encountering. Subsequently, a closer look at what compliance really
implies and what the international standard-setting bodies perceive as compliance. I will then discuss
some issues involved in the ABN AMRO case and lessons learned. I will conclude with some broader
perspectives on how to approach the challenges ahead.
Scope and definition of compliance
The notion of 'compliance' literally means 'obedience' or 'dutifulness'. It has a broad scope. As such it
is known to have various interpretations. To avoid any misunderstandings during my speech, I will
provide you with the definition used by the Basel Committee.
In its Compliance function paper, the Committee has defined compliance risk as being "the risk of legal
or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its
failure to comply with laws, regulations, rules, related self-regulatory organization standards, and
codes of conduct applicable to its banking activities"3. Hence, compliance generally covers matters
such as observing proper standards of market conduct, managing conflicts of interest and treating
customers fairly. Also, compliance typically includes specific areas such as the prevention of money
laundering and terrorist financing, and may extend to tax laws that are relevant to the structuring of
banking products or customer advice4. In my opinion, the compliance function should protect the
institution against unlawful behaviour and strengthen its ethical consciousness.
Drivers of compliance related problems
As supervisors we provide frameworks and guidance for the financial sector to facilitate the functioning
of the financial world - although I am aware that our efforts may not always be perceived as such by
the industry. In the end, however, the industry and supervisors serve the same goal, which is to create
a stable and prosperous financial industry worldwide. It is essential that clients are confident in the
solidity of financial institutions and that they are assured that their salaries paid into their bank
accounts are safe. So, the industry as well as standard-setting bodies should always reflect on
irregularities and consider whether the current risk control framework in place is still adequate and
warrants stability. By adequate I mean that the framework should be effective for the industry as well
as for the supervisory community. It is therefore essential to consider the possible underlying drivers of
recent compliance related irregularities.
If we look at the financial world of today, one of the greatest challenges is the rapid globalization of the
world economy. New economies such as China and India are emerging, and are rapidly attracting
investors and financial institutions. This globalization does not only take place in a traditional way, i.e.
through businesses ́ presence in the countries concerned.
What I personally find fascinating is the current trend with regard to outsourcing, offshoring and 'smart
sourcing'. Not too long ago, I myself observed how service providers in India even play along with the
different time zones their customers are located in by tailoring work shifts of their employees to these
time zones.
A first complication that globally operating financial institutions are facing as a consequence of the
globalization, relates to corporate governance, and especially head office oversight. Of course, a
board of directors should approve and oversee the bank's strategic objectives, and set a desired
compliance culture. Also, the board should ensure the institution has adequate policies and
procedures to ensure head office oversight of the activities carried out by the various business lines.
However, given the increasing complexity of 'cross border' institutions, this sounds easier than it is.
The board should ensure that adequate controls are in place to oversee the decisions made by its
senior management, and to ensure that the entire organisation acts in line with the set objectives, and
the desired compliance culture. This raises all kinds of organisational and managerial questions,
varying from the amount of autonomy that the business lines should have, to issues with regard to
control frameworks and reporting lines. There is no easy answer.
Secondly, financial institutions have to make sure that they comply with applicable laws and
regulations in the jurisdictions where they operate. As a result of the increasing globalization, financial
institutions nowadays have to make sure that they are compliant with laws that have extraterritorial
effects. These different legal requirements pose a challenge for institutions operating cross border.
Another challenge is that our understanding of what constitutes sound operational management is
continuously changing. What we all understood to be sound operational management five years ago
no longer applies. The recent best practices papers produced by the Basel Committee sustain the
view that the understanding of adequate operational management is rapidly changing5. The number of
standards and regulations that banks have to adhere to, is tremendous and not by definition in
accordance with how banks in practice have been conducting their businesses.
The development of new products and the increasing complexity of the products being offered by
financial institutions, are making life even more difficult. The specific risks of these complex products
and their global distribution, should be analyzed by banks and be included in their global risk
management framework. Given the ongoing evolution of the financial markets in Asia, it is essential for
your institutions, like ours, to analyze the compliance risks that relate to the financial products sold by
them, especially since these products will continue to evolve.
The increasing globalization, issues with the corporate governance of complex institutions, the
continuously changing understanding of what constitutes sound operational management, changing
laws and regulations, as well as the ongoing evolution of products - combined with a determination
with governments and regulators to fight money laundering, terrorist financing and other illegal
financial transactions - all create complex situations for banks that operate cross border. The
unavoidable conclusion is that banks need to address these compliance challenges in their risk
management programs on a global basis, and that the most stringent requirement quickly becomes
the benchmark.
When reflecting on these challenges, one may wonder whether the compliance framework in place is
robust enough to effectively manage the challenges and risks that financial institutions face. What,
then, are the latest developments concerning such compliance framework?
Closer look at compliance
During the last couple of years, various international standard-setting bodies have published papers
on compliance related issues. For instance, as a response to the increasingly sophisticated
moneylaundering techniques the Financial Action Task Force has revised its recommendations in 2003. Also,
the Basel Committee on Banking Supervision published a paper on customer due diligence in 2001
and the Consolidated Know Your Customer paper in 20046. The cause for these papers was that
supervisors around the world were increasingly recognizing the importance for banks to have
adequate controls and procedures in place so that they know the customers who they are dealing
with. Also, the Basel Committee published a paper on the compliance organization and the
compliance function in 2005. This paper provides guidance on embedding a compliance organization
within credit institutions.
The compliance definition used by the Basel Committee considers the sanctions, or loss to reputation,
that an institution may suffer as a result of failure to comply with laws, regulations and standards. As
the laws, regulations and standards are continuously changing, compliance becomes a moving target.
The question that arises from this observation is that one should continuously ask oneself: "how can I
be sure that my organization is compliant"? The changes occur at such a high-speed that one may
well be "compliant" today but no longer so tomorrow. Today's challenges are tomorrow's history.
The Compliance function paper emphasizes that compliance starts at the top. Compliance will be most
effective - if not, will only be effective - in a corporate culture that emphasizes standards of honesty
and integrity. The board of directors and senior management should lead by example. The tone at the
top is vital for a culture of awareness. The board of directors is responsible for overseeing the
management of the bank's compliance risk. To this end, the board or a committee of the board should
at least once a year assess the extent to which the bank is managing its compliance risk effectively7.
Having said this, compliance requires continuous attention of the board of directors and senior
management; its responsibilities are not limited to the yearly assessment. Compliance implies a great
involvement of the board of directors, especially since it is widely accepted that the board is ultimately
responsible for the operations and soundness of a bank8.
Without disclaiming the ultimate responsibilities of the board of directors, the responsibility for the
effective management of the bank's compliance risk resides with the bank's senior management. One
of the most important responsibilities of senior management with regard to compliance is to make sure
that the main compliance risk issues an institution is facing, are identified and assessed on an annual
basis. Subsequently, senior management - with the assistance of the compliance function - has to
ensure that plans are prepared to manage these risks. Such plans should address any shortfalls
(policy, procedures, implementation or execution) related to how effectively existing compliance risks
have been managed, as well as the need for any additional policies or procedures do deal with new
compliance risks identified as a result of the annual compliance risk assessment9. This risk
assessment, together with the subsequent introduction of improvements to the control framework,
form an essential step in the ongoing process to ensure adequate control of the risks banks are faced
with.
Aside from the responsibilities of the board of directors and senior management, the paper also
mentions principles concerning the status and responsibilities of the compliance function. It is essential
that the compliance function has a formal status within a bank. This in order to give the compliance
function the appropriate standing, authority, and independence10. The responsibilities of the
compliance function should be to assist senior management in managing effectively the compliance
risks faced by the bank. Specifically this means that the compliance function should:
•
advise senior management;
•
provide guidance and education to employees on compliance issues;
•
identify, measure and assess compliance risks; and
•
monitor and test compliance and report the findings through the reporting line in accordance
with the bank's internal risk management procedures.
Once more, I would like to stress the importance of timely identification, measurement and
assessment of compliance risks. Citing the Compliance function paper "the compliance function
should, on a pro-active basis, identify, document and assess the compliance risks associated with the
bank's business activities, including the development of new products and business practices, the
proposed establishment of new types of business or customer relationship, or material changed in the
nature of such relationships". The paper continues by stating that the compliance function should
consider ways to measure compliance risk (e.g. by using performance indicators) and use such
measurements to enhance compliance risk assessment. It should assess the appropriateness of the
bank's compliance procedures and guidelines, promptly follow up any identified deficiencies and
formulate proposals for amendments11. Institutions are expected to tailor their control measures to the
risk classification of both their clients, and their products and to implement specific control measures
for the nature and severity of the compliance risks posed by each category.
Therefore, the question that each one of you will need to answer for his or her organisation is: "how
can I be sure that my organisation is compliant?"
The ABN AMRO case12
Recently, the importance of an adequate compliance function was illustrated by events that took place
within ABN AMRO, one of the largest credit institutions headquartered in the Netherlands, and one of
the large internationally operating banks worldwide.
Those of you who have read ABN AMRO's press release of 19 December 2005, the related website
publications of the regulators in The Netherlands and the United States, or subsequent press
publications, may already be familiar with this case. However, for those of you that are not, I'll provide
a brief overview.
In July 2004, ABN AMRO signed a so-called Written Agreement with US banking regulators
concerning compliance-related deficiencies, identified by the regulators at the US dollar clearing
activities of ABN AMRO in New York. These deficiencies were related to cases of non-compliance with
the United States' Bank Secrecy Act and OFAC regulations (the United States' sanction regime). This
Written Agreement, that addressed ABN AMRO's anti-money laundering policies, procedures and
practices, was designed to correct these deficiencies. In response to this Written Agreement, ABN
AMRO strengthened its compliance function and its anti-money laundering programme in New York.
Many measures were taken to achieve a best-in-class compliance programme. These measures
varied from a centralisation and increase of its compliance function to the implementation of new
ITsupport systems.
Nevertheless, during the remediation process ABN AMRO itself identified other shortcomings in one of
its overseas offices. Investigations from its audit department revealed that certain employees of the
branch, without the enforcement or knowledge of anyone outside the branch, were not observing the
bank's policies and standards in relation to certain US dollar payment instructions sent to the bank's
US dollar clearing centre in New York on behalf of Libyan and Iranian clients. Under EU legislation,
ABN AMRO was allowed to have dealings with said counterparties. Nonetheless, the United States'
OFAC regime imposed certain limitations. Further investigations by the bank made it clear that these
procedures were aimed at not including certain client-specific information from the relevant payment
instructions. As such, it was ensured that the payments would pass through the New Yorkbranch'
OFAC filter without being detected and blocked.
Having been informed by ABN AMRO about these procedures, the United States bank regulators and
De Nederlandsche Bank concluded that this constituted a pattern of unsafe and unsound practices
warranting further enforcement action13.
On 19 December 2005, an "Order to Cease and Desist" was issued by the joint regulators, requiring
ABN AMRO to undertake comprehensive additional measures - in addition to the measures it had
already undertaken in response to the Written Agreement. Amongst others, these additional measures
related to:
•
the submission of a U.S. Law Compliance Programme, ensuring continuous compliance with
state and federal laws of the United States;
•
the improvement of Head Office oversight to ensure effective control over and supervision of
its foreign branches; and
•
the completion of a written plan to improve the effectiveness of the management oversight in
the United States.
On top of the "Cease and Desist Order", the USbank regulators imposed a fine amounting to US dollar
75 million, and a voluntary endowment of US dollar 5 million to the Illinois Bank Examiners ́ Education
Foundation.
Lessons learned
It goes without saying that ABN AMRO's Supervisory Board and its Managing Board respectively,
have ordered detailed analyses of the compliance-related incidents, to ensure the lessons learned
would be beneficial in the future. In addition to the institutions themselves, the regulatory community
must learn from such incidents as well.
Given the severe impact of such incidents, it is important that the regulatory community and financial
institutions reflect on whether the so-called "principle based" approach is adequate in this area. The
reality is that appropriate compliance means adhering to many rules in various jurisdictions. So even if
supervisors apply a principle based approach, at least the financial institutions themselves need to
couple this with rule based instructions. Some banks have introduced a mix of risk-based and
rulebased compliance programs. My point is that both supervisors and the industry need to reflect on their
paradigms. It is not either principles or rules, but rather an intelligent combination of principles and
rules.
Another issue that warrants further consideration is that of "awareness cultivation". It is widely believed
that compliance should always be at the forefront of the employees' thinking. Nevertheless, the
modification of US dollar payment instructions acts as an example of deliberate attempts of employees
to dodge internal and external regulations. Clearly, these employees lacked the desired mindset.
Training and counsel remain very important tools to create the desired mindset: it helps employees to
better understand not only the requirements and regulations itself, but also the "why" of such
requirements.
Unfortunately, training alone will not always suffice to get the message through. It remains difficult to
deal with this issue, but alternative solutions are not inconceivable. You, as senior management of
supervised institutions, continue to have, of course, an exemplary role within your own organisation.
This enables you to influence your staffs ́ behaviour by acting as shining examples.
In addition, an interesting approach that you as senior management might want to consider, relates to
annual appraisals of staff members. In addition to the traditional commercial objectives that usually
dominate the appraisal process, one might consider including compliance-related objectives. Such
objectives, of course, remain difficult to measure and, therefore, require careful consideration; the
proverb "haste makes waste" is certainly applicable here. However, the growing usage of such
performance objectives by banks like ABN AMRO as a tool to further influence employees ́ behaviour,
illustrates that - if properly applied - they have their merits. I am convinced that the importance of such
factors will continue to grow, in the Netherlandsbut also in Asia.
In the end however, whereas the aforementioned factors undoubtedly contribute to the observance of
internal and external requirements and regulations, it is my belief that the tool 'par excellence' to
achieve compliance remains the combination of control and enforcement. "Control" to increase the
possibility of being caught, either by internal control bodies like the audit- and the compliance function
or by external authorities like the banking regulators. And "enforcement" to exact compliance with
rules, regulations and other requirements.
Parallel with Basel II
In the beginning of my speech I made a brief comparison between compliance and the new Basel
Capital Accord. I can imagine that you may wonder what the afore-mentioned has to do with the new
Basel Capital Accord. And yes, there seems to be little convergence between the capital requirements
laid down in the Accord, and today's challenges with regard to compliance. There are, however, some
interesting links that I would like to highlight.
"Compliance risk" is swiftly becoming one of the most important risk drivers that credit institutions are
facing. Firstly, not having adequate controls to prevent, for example, money laundering or terrorist
financing will be unacceptable for regulators, who - as illustrated by the fines levied against ABN
AMRO in the United States- will not hesitate to take formal measures against your institutions.
Secondly, and perhaps even more importantly, involvement in serious compliance related incidents
can lead to reputational damage, the impact of which may be even larger than that of regulatory
interference. As confidence remains one of the financial sector's cornerstones, a substantial
impairment of an institution's reputation could very well lead to its collapse. Nevertheless, whereas the
Basel Accord, of course, requires institutions to set aside capital to cover credit-, market and
operational risk, "compliance risk" is not covered.
Is this a missed opportunity? Should the drafting panels of the new Capital Accord have spent time on
a concept like "compliance capital"?
In my opinion, requiring institutions to set aside capital to cover losses from compliance incidents is
not the issue. I believe that it is justified that the Basel Committee has not included compliance risk in
its Capital Accord. Whereas (potential) credit losses can be financially compensated by holding
additional capital, compliance incidents will not be mitigated by financial means. After all, compliance
incidents will impact the reputation of a credit institution, which cannot be measured in financial terms.
Compliance is not a financial matter, but a matter of principle. Nevertheless, the question about the
position of compliance continues to intrigue me.
You will undoubtedly be aware that Pillar II (the so-called Supervisory Review Process) of the new
Capital Accord deals (amongst others) with the treatment of risks that are not fully covered by the
requirements under Pillar 114. Under Pillar II, the Accord requires banks to address all material risks
faced in the capital assessment process, even those risks that cannot be measured or quantified
precisely15. Banks are expected to further develop techniques for managing unquantifiable risks like
reputational risk16. Although the language in the Capital Accord gives the impression that 'something'
needs to be done, it also implies that holding additional capital for unquantifiable risks is not the
solution. So, what then is the solution?
I would argue that, whereas it remains necessary to mitigate compliance risks, a more structured and
coherent approach is necessary. As previously discussed, banks are faced with challenges like the
increasing globalization, issues with the corporate governance of complex institutions, the
continuously changing understanding of what constitutes sound operational management, changing
laws and the ongoing evolution of products. At the same time, the requirements and best practices
imposed by legislators, supervisors and international standard setting-bodies are not necessarily
attuned to each other.
Those of you who work for an internationally active bank will recognize the difficulties that this brings
to day-to-day practice. One important step towards solving these difficulties will be to bring these
requirements and best practices together. This entails monitoring the implications of these
requirements and best practices and putting effort in finding workable solutions and where possible to
improve the consistency of standards already available. In my mind, this will be one of the bigger
challenges for the supervisory and legislative community for the upcoming years. But you know that
we are working hard here, amongst others through the BCBS Accord Implementation Group and the
Core Principles Liaison Group.
In the end such effort will as a result also entail new challenges for the banks themselves. It is widely
realised that implementing the new Basel Accord is a huge burden on financial institutions, not only
because of the complexity of the materials, but also because of the sheer size of the implementation
project.
The development and implementation of a consistent international compliance framework, might well
be a challenge of equal size. New policies have to be written, approved and implemented, procedures
have to be developed, IT-systems (e.g. automated systems to facilitate transaction filtering and -
monitoring) have to be installed, staff members have to be trained and control measures have to be
put in place to detect and correct deficiencies. The amount of work done by ABN AMRO in response
to the Cease and Desist Order resulted in comprehensive and extensive plans. This is illustrative of
the effort that might well be the desired benchmark for the entire financial industry.
Closing remarks
I have highlighted the challenges that banks are facing today with respect to compliance and the
compliance function amidst the ongoing increasing globalization, issues with the corporate
governance of complex institutions, the continuously changing understanding of what constitutes
sound risk management, changing laws and regulations, a continuous evolution of financial products,
and a determination of governments and regulators to fight money laundering, terrorist financing and
other illegal financial transactions. Therefore I expect that the importance of "compliance" will continue
to grow exponentially. At this moment, multiple requirements and best practices with regard to
compliance have already been issued. Nevertheless, it is my view that creating a "best in class"
compliance framework by integrating these requirements and best practices should become a main
priority, both for regulators and the industry. I realize that this will not be easy, but I am convinced that
this is the best way forward.