Enterprise Compliance Risk Management

An Essential Toolkit for Banks and Financial Services

Saloni Ramakrishna

• Publisher: Wiley
• Year: 2015
• ISBN:
  9781118550311
• Edition: 1
• Topic: Business
• Subtopic: Auditing
• Index: Business

The tools and information that build effective compliance programs

Enterprise Compliance Risk Management: An Essential Toolkit for Banks and Financial Services is a comprehensive narrative on managing compliance and compliance risk that enables value creation for financial services firms. Compliance risk management, a young, evolving yet intricate discipline, is occupying center stage owing to the interplay between the ever increasing complexity of financial services and the environmental effort to rein it in. The book examines the various facets of this layered and nuanced subject.

Enterprise Compliance Risk Management elevates the context of compliance from its current reactive stance to how a proactive strategy can create a clear differentiator in a largely undifferentiated market and become a powerful competitive weapon for organizations. It presents a strong case as to why it makes immense business sense to weave active compliance into business model and strategy through an objective view of the cost benefit analysis.

Written from a real-world perspective, the book moves the conversation from mere evangelizing to the operationalizing a positive and active compliance management program in financial services. The book is relevant to the different stakeholders of the compliance universe - financial services firms, regulators, industry bodies, consultants, customers and compliance professionals owing to its coverage of the varied aspects of compliance.

Enterprise Compliance Risk Management includes a direct examination of compliance risk, including identification, measurement, mitigation, monitoring, remediation, and regulatory dialogue. With unique hands-on tools including processes, templates, checklists, models, formats and scorecards, the book provides the essential toolkit required by the practitioners to jumpstart their compliance initiatives. Financial services professionals seeking a handle on this vital and growing discipline can find the information they need in Enterprise Compliance Risk Management.

Part One
Introduction to Compliance in Financial Services

---

Practitioner's Note: The umbilical cord between business model and compliance

As a regulator and practitioner I have seen that organizations that miss or ignore the vital link between business model and compliance have had higher cost of compliance and lower return on investment, not to mention reduced business opportunities. Like Ms. Saloni Ramakrishna persuasively articulates, it is vital to understand the umbilical cord between business model and compliance.

There are two critical aspects to the business model (BM) of a bank. The first is the strategic business model defining what products, markets, customers, and regions the bank would like to be in subject to the Board's risk appetite. The second underpinning is the target operating model (TOM), which covers governance, decision making, recruiting, technology, human capital, legal structure, and operations. The objective of the bank is to execute its business strategy with an optimal TOM. Compliance lies at the heart of the TOM. The BM/TOM constrained by regulation must maximize its risk-adjusted return on capital (RAROC).

Compliance costs have spiraled upwards across the globe. The estimate is that over 30 percent of costs are spent on compliance. This has lowered revenue/cost ratios significantly, and it is estimated that compliance costs drive down ROE (Return on Equity) by a full six percentage points among the GSIFIs (Global Systemically Important Financial Institutions) and DSIFIs (Domestic Systemically Important Financial Institutions). Hence, it is critical as a long-term strategic imperative to get these costs down through changing the BM and ensuring that a firm has selected the most cost-effective TOM.

There are three core channels of impact on the financials. In simple terms, risk-adjusted profitability equals (R − C)/K, where R is revenues, C is costs, and K is a measure of risk-weighted assets (RWAs). Spending on projects drives up C. Furthermore, if the control framework and risk management are still poor, then the firm will suffer a drop of revenue through fines, penalties, licenses revoked, and lost customers. Firms that are found to have weak governance structures and incompetent risk management will be hit by both pillar one and pillar two capital charges. Finally, the valuation of share price will be lower if any of the aforementioned impacts are volatile. For example, continual penalties (like PPI (Payment Protection Insurance) or AML (Anti–Money Laundering) violations) will create excessive volatility, and profits will not be perceived as sustainable. The proactive compliance driven by business integrity that Ms. Saloni Ramakrishna strongly advocates as the vehicle for value creation is rooted in the impact it has on all of the three variables (R, C, and K) that have a bearing on the risk-adjusted profitability.

Given that compliance is in itself expensive, it makes sense to ensure that money is spent wisely so that major risks are avoided before they become a problem. Prevention is much cheaper than remediation, so choose the areas that give rise to the biggest risks and do not assume that the TOM is a given. It always pays to create a specific blueprint for the industry and firm and implement projects once! The three lines of defense model has its drawbacks. Often, the front office takes no responsibility for operational failures. Regulators are forcing changes in compliance where senior managers are being held accountable and have to self-attest that systems and controls are in order. For example, see the senior managers regime (SMR) in the UK: It is important that every control has an owner, a challenger, and assurance that this process is implemented. The blueprint that Ms. Saloni Ramakrishna details in the How part of the book captures these principles elegantly and fleshes them out through actionable templates.

Firms should adopt compliance as a core strategy, and expenditures should be targeted in the areas that have the largest breach risks such as mis-selling. In a compliance strategy the following three factors are critical. Firstly, a firm must account for compliance in their TOM and the knock-on impact on the BM. Secondly, compliance must not be executed as a box-ticking exercise, but rather project budgets should be aligned with the greatest risks to the bank in an optimal control framework. Finally, given the huge drain of resources, banks should prioritize projects. A bank that desires a stable profit stream needs to ensure that this can be delivered by a compliant target operating model. The new agenda for compliance is to ensure that it is in sync with the risk appetite of the firm, the conduct strategy, and the axis of the BM/TOM. “Active and positive compliance” is the core of sustained healthy growth of a financial organization and the theme of this book.

—Dr. Colin Lawrence

Dr. Colin Lawrence has a PhD in Economics from the University of Chicago. He is a partner with EY LLP, UK; former director of the Risk Specialists Division (FSA and PRA); and former strategic risk advisor to the Deputy Governor, Bank of England. Dr. Lawrence is a well-known practitioner with varied experience as a regulator, a banker (he was managing director in derivative trading at UBS and Global Head of Risk at Barclays), a consultant, and an academic.

---

Chapter 1
An Overview of Compliance in Financial Services

“Money plays the largest part in determining the course of history.”

—Karl Marx

It is a chicken-and-egg story: “Regulation influences banks' behavior by shaping the competitive environment and setting the parameters within which banks are able to pursue their economic objectives.”¹ Interestingly, however, banking crises have been the trigger for many, nay most of the regulations, more so in recent times. So it is difficult to say whether it is the regulations that are shaping the behavior of banks or banks breaching the expected fair business practices that is shaping the structure and content of regulations. Or it is the interplay of both that has created the complex structure and behavior of the banking industry and by extension the financial services and its regulations?

It is not an exaggeration to say financial services is perhaps the most regulated industry in recent years. There are more regulations, more expectation of compliance, and more supervision to ensure compliance. There is unprecedented scrutiny of the industry at national, regional, and global levels. This scrutiny and the host of far-reaching regulations together are of topical interest not only for the stakeholders but also to policy makers, politicians, and media, thus putting the spotlight on adherence or lack thereof to the set expectations.

“Financial services” is a broad umbrella term that covers different subsectors like banking, insurance, securities, investment management, and so on. The division into subsectors is more of academic interest, given the changing contour of financial services industry like:

• The emergence of financial conglomerates that are growing both in size and numbers
• Bank, insurance, and market intermediary linkages that are becoming commonplace
• Abolition of barriers/restrictions on investment/commercial banking combinations²

Unified or stand-alone, these sectors combine to form the economic vehicle of a country, a group of countries, or the entire globe to facilitate movement of capital and currency across. They help channel money from lenders to borrowers and vice versa through financial intermediation. It is no exaggeration, therefore, to say that they are responsible for the financial well-...

Table of contents

• Cover
• Advance Praise
• Title Page
• Copyright
• Table of Contents
• Dedication
• Preface
• Acknowledgments
• About the Author
• Opening Notes
• Design and Structure of the Book
• Part One: Introduction to Compliance in Financial Services
• Part Two: The What, Why, and Who of Compliance
• Part Three: The How of Compliance
• Part Four: The Compliance Risk Dimension
• Part Five: The Real World of Compliance in Financial Services
• Closing Notes
• Index
• End User License Agreement