•  In any event, compliance processes should clearly spell out the roles of independent control personnel and provide for appropriate separation of duties. A key point to make is that,  2  BIS Review 76/2006  regardless of the compliance risk management framework employed, business line managers continue to "own" the compliance risk in their areas and should suffer real consequences in the event of compliance failures. This responsibility cannot fall just on the independent compliance functions. Emerging practices - such as when firms explicitly factor internal compliance metrics into management compensation or into the allocation of capital among business areas - will underscore compliance accountability even further. •  Rounding things out, management information systems should be in place to adequately monitor and assess compliance risks. For example, the sophistication of monitoring for money laundering is rapidly increasing. Institutions are using specialized software and MIS reports to detect patterns of transactions that warrant investigation, to identify accounts that are the subject of repeated suspicious activity reports, and to build better escalation protocols. A key take-away from this is that compliance professionals must be on top of technological advances that would allow them to do their jobs more effectively. Turning more specifically to the operations of foreign banks in the US - a question we are sometimes asked is whether there is, from our perspective, a best way to structure the relationship between the locally-based compliance functions and the rest of the organization.

If so, then the firm becomes subject to more legal and regulatory requirements, some of which may be inconsistent with those applicable elsewhere. The result of the geographic expansion then is to increase the risk of possible compliance problems and to make the management of a global business that much more difficult. Deregulation within individual countries is also something of a two-edged sword. Clearly it affords greater business opportunities to a firm, but it also raises challenges in managing compliance risk across a firm’s business units. For example, as a result of the passage of the Gramm-Leach-Bliley Act in the US, a single firm can now engage in commercial banking, investment banking, and insurance activities. The implication for the compliance function is that it must not only keep on top of issues  BIS Review 76/2006  1  within each of these diverse business lines but also the interactions between them - for example, in policing potential conflicts of interest across the firm. Somewhat similarly, the overall compliance challenge for the firm is more than just the sum of the challenges from financial innovation, from globalization and from deregulation. There are interplays between these developments that add additional layers of complexity to the compliance challenge. Level of scrutiny The second broad consideration I mentioned is the increased level of scrutiny of compliance in the U.S. and in other major financial markets - scrutiny that is driven by major industry and political events that have changed the legal and regulatory environment over the past five years.