ells Fargo’s recent disclosure of regulatory investigations related to its anti-money laundering (AML) and sanctions programs and agreement to “work with U.S. bank regulators to shore up its financial crimes risk management” serves as a timely reminder of the ongoing importance of robust compliance measures in the financial sector.

These events underscore the need for vigilance at all levels of the industry, from major institutions to smaller financial companies, and further highlight the critical role of due diligence in selecting and monitoring payment solution providers for compliance officers, risk practitioners, and internal audit executives.

To that end, here are four essential questions to ask when evaluating potential partners, informed by the latest industry developments:

1. How comprehensive is the BSA/AML compliance program?

A robust Bank Secrecy Act and Anti-Money Laundering (BSA/AML) compliance program is vital to any financial institution’s risk management strategy. When evaluating a provider’s program, look for well-defined internal policies and controls. These should include a documented BSA/AML policy that outlines the organization’s approach to identifying, assessing, and managing money laundering and terrorist financing risks.

The policy should encompass clear customer identification procedures, risk-based customer due diligence processes, and transaction monitoring systems. Additionally, it should detail suspicious activity reporting procedures and record-keeping practices that meet or exceed regulatory requirements. Equally important is a defined process for staying current with regulatory changes and implementing updates promptly.

A dedicated compliance officer should oversee these efforts. This individual should possess relevant experience in BSA/AML compliance, appropriate certifications, and have direct access to senior management and the board of directors. They should be empowered to implement necessary changes across the organization.

Another crucial element is ongoing, comprehensive training. Look for providers that offer role-specific training tailored to different departments, annual refresher courses for all staff, and ad-hoc training to address new regulations or emerging risks. The training program should include testing to ensure comprehension and retention of key concepts, with all activities documented for audit purposes.

Finally, the provider should conduct rigorous auditing and monitoring. This includes regular internal audits of all BSA/AML processes, periodic independent third-party audits, and continuous monitoring of transactions and customer activity. There should be a straightforward process for addressing and remediating audit findings, with regular reporting to senior management and the board on audit results and program effectiveness.

2. Who comprises the compliance team?

The expertise of the compliance team is crucial in navigating complex regulatory landscapes. Look for a diverse team with a mix of legal, financial, and technological expertise.

A well-rounded team might include a chief legal & compliance officer, corporate counsel, senior compliance analysts, a finance settlement manager, information security leaders, and an operations director. This diversity helps ensure a comprehensive approach to compliance and security, reducing the risk of oversight that could lead to regulatory issues.

3. How does the organization embed compliance responsibilities across all departments?

Compliance should not be confined to a single department but should be integrated throughout the organization. A company-wide commitment to compliance should be evident through clear statements from leadership emphasizing its importance, inclusion of compliance objectives in departmental and individual performance metrics, and regular compliance updates in company-wide communications.

Training should extend beyond the compliance department. Look for providers that offer role-specific training illustrating how compliance impacts different job functions. Scenario-based learning can help employees identify and respond to potential compliance issues. The use of multiple training formats can cater to different learning styles, ensuring comprehensive understanding across the organization.

Clear communication channels for reporting potential issues are essential. This includes an anonymous whistleblowing hotline or reporting system, a defined escalation process for compliance concerns, and protection for employees who report potential violations. Regular reminders about these reporting channels reinforce the importance of speaking up.

A culture of compliance is characterized by the incorporation of compliance considerations into all business decisions and processes. This might include recognition for employees who demonstrate strong compliance behavior, zero tolerance for willful non-compliance regardless of an employee’s position, and regular compliance “town halls” or Q&A sessions to foster open dialogue about compliance matters.

4. What is the approach to regular internal audits and regulatory examinations?

In light of increased regulatory scrutiny, regular, independent audits are crucial. Inquire about the frequency and scope of their audits, including how often internal audits are conducted, what areas they cover, and how findings are categorized and addressed.

The provider’s relationship with regulatory bodies and sponsor banks is also important. Ask about their interaction with regulators outside of formal examinations, participation in regulatory outreach events or industry working groups, and their track record with past regulatory examinations.

A strong provider will have a formal process for reviewing and acting on audit and examination findings. This should include tracking and validating corrective actions, measuring the effectiveness of implemented changes, and sharing learnings across the organization.

Staying updated on regulatory changes and industry best practices is crucial. Look for providers that subscribe to regulatory update services, have relationships with outside counsel or consultants for complex regulatory matters, and participate in industry associations or forums.

Finally, inquire about their approach to continuous improvement. This might include using data analytics to enhance compliance programs, conducting regular risk assessments to identify potential gaps or emerging risks, and benchmarking their practices against industry peers.

Proactive Compliance in a Complex Regulatory Environment

The recent Wells Fargo disclosure reminds us that compliance is an ongoing process requiring constant attention and proactive measures. For compliance officers, risk practitioners, and internal audit executives, this underscores the importance of thorough due diligence when selecting and monitoring payment solution providers.

By asking these four key questions and critically evaluating the responses, you can significantly mitigate risks and ensure a more secure financial ecosystem for your organization. Remember, in today’s regulatory environment, compliance isn’t just about meeting minimum requirements—it’s about fostering a culture of integrity and security that permeates every aspect of your operations.

As you evaluate potential payment solution providers, look for partners who share this philosophy and demonstrate a commitment to excellence in compliance and security. In doing so, you’ll not only meet regulatory requirements but also build a foundation of trust with your customers, stakeholders, and regulators—a crucial asset in navigating today’s financial landscape.  

Anna Fron is Chief Legal and Compliance Officer at Dash Solutions, a platform that provides digital payments and engagement program management to thousands of customers.

The post Compliance Lessons from Wells Fargo: Four Questions to Ask Your Payment Solution Provider appeared first on Compliance Chief 360.

anadian-based TD Bank will pay more than $3 billion in a historic settlement with U.S. authorities who said that the financial institution’s lax practices allowed significant money laundering over multiple years. The bank pleaded guilty to conspiracy to commit money laundering, the largest bank in U.S. history to do so, Attorney General Merrick Garland said.

“TD Bank created an environment that allowed financial crime to flourish,” Garland said. “By making its services convenient for criminals, it became one.”

TD Bank, the 10th largest bank in the United States, agreed to pay over $1.8 billion in penalties to resolve the Justice Department’s investigation into violations of the Bank Secrecy Act (BSA) and money laundering, the Justice Department said in a statement. A TD Bank statement said the full expense would exceed $3 billion for the firm, which must also upgrade its current anti-money laundering operations. It also will face a more stringent approval process for new products, stores, services and markets.

The bank pleaded guilty to conspiring to fail to maintain an anti-money laundering (AML) program that complies with the BSA, fail to file accurate Currency Transaction Reports (CTRs), and launder money.

TD Bank’s guilty pleas are part of a coordinated resolution with the Board of Governors of the Federal Reserve Board (FRB), as well as the Treasury Department’s Office of the Comptroller of the Currency (OCC) and Financial Crimes Enforcement Network (FinCEN).

“By making its services convenient for criminals, TD Bank became one,” . “Today, TD Bank also became the largest bank in U.S. history to plead guilty to Bank Secrecy Act program failures, and the first US bank in history to plead guilty to conspiracy to commit money laundering,” said Garland. “TD Bank chose profits over compliance with the law — a decision that is now costing the bank billions of dollars in penalties. Let me be clear: our investigation continues, and no individual involved in TD Bank’s illegal conduct is off limits.”

“For years, TD Bank starved its compliance program of the resources needed to obey the law. Today’s historic guilty plea, including the largest penalty ever imposed under the Bank Secrecy Act, offers an unmistakable lesson: crime doesn’t pay — and neither does flouting compliance,” said Deputy Attorney General Lisa Monaco. “Every bank compliance official in America should be reviewing today’s charges as a case study of what not to do. And every bank CEO and board member should be doing the same. Because if the business case for compliance wasn’t clear before — it should be now.”

‘Pervasive and Systemic Deficiencies’

According to court documents, between January 2014 and October 2023, TD Bank had long-term, pervasive, and systemic deficiencies in its U.S. AML policies, procedures, and controls but failed to take appropriate remedial action. Instead, senior executives at TD Bank enforced a budget mandate, referred to internally as a “flat cost paradigm,” requiring that TD Bank’s budget not increase year-over-year, despite its profits and risk profile increasing significantly over the same period. Although TD Bank maintained elements of an AML program that appeared adequate on paper, fundamental, widespread flaws in its AML program made TD Bank an “easy target” for perpetrators of financial crime.

Over the last decade, TD Bank’s federal regulators and TD Bank’s own internal audit group repeatedly identified concerns about its transaction monitoring program, a key element of an appropriate AML program necessary to properly detect and report suspicious activities. Nonetheless, from 2014 through 2022, TD Bank’s transaction monitoring program remained effectively static, and did not adapt to address known, glaring deficiencies; emerging money laundering risks; or TD Bank’s new products and services. For years, TD Bank failed to appropriately fund and staff its AML program, opting to postpone and cancel necessary AML projects prioritizing a “flat cost paradigm” and the “customer experience.”

Throughout this time, TD Bank intentionally did not automatically monitor all domestic automated clearinghouse (ACH) transactions, most check activity, and numerous other transaction types, resulting in 92% of total transaction volume going unmonitored from Jan. 1, 2018, to April 12, 2024. This amounted to approximately $18.3 trillion of transaction activity. TD Bank also added no new transaction monitoring scenarios and made no material changes to existing transaction monitoring scenarios from at least 2014 through late 2022; implemented new products and services, like Zelle, without ensuring appropriate transaction monitoring coverage; failed to meaningfully monitor transactions involving high-risk countries; instructed stores to stop filing internal unusual transaction reports on certain suspicious customers; and permitted more than $5 billion in transactional activity to occur in accounts even after the bank decided to close them.

TD Bank’s AML failures made it “convenient” for criminals, in the words of its employees. These failures enabled three money laundering networks to collectively transfer more than $670 million through TD Bank accounts between 2019 and 2023. Between January 2018 and February 2021, one money laundering network processed more than $470 million through the bank through large cash deposits into nominee accounts. The operators of this scheme provided employees gift cards worth more than $57,000 to ensure employees would continue to process their transactions. And even though the operators of this scheme were clearly depositing cash well over $10,000 in suspicious transactions, TD Bank employees did not identify the conductor of the transaction in required reports.

In a second scheme between March 2021 and March 2023, a high-risk jewelry business moved nearly $120 million through shell accounts before TD Bank reported the activity. In a third scheme, money laundering networks deposited funds in the United States and quickly withdrew those funds using ATMs in Colombia. Five TD Bank employees conspired with this network and issued dozens of ATM cards for the money launderers, ultimately conspiring in the laundering of approximately $39 million. The Justice Department has charged over two dozen individuals across these schemes, including two bank insiders. TD Bank’s plea agreement requires continued cooperation in ongoing investigations of individuals.

As part of the plea agreement, TD Bank has agreed to forfeit $452 million and pay a criminal fine of $1.4 billion, for a total financial penalty of $1.8 billion. TD Bank has also agreed to retain an independent compliance monitor for three years and to remediate and enhance its AML compliance program. TD Bank has separately reached agreements with the FRB, OCC, and FinCEN, and the Justice Department will credit $123 million of the forfeiture toward the FRB’s resolution.

Partial Cooperation Credit

The Justice Department reached its resolution with TD Bank based on a number of factors, including the nature, seriousness, and pervasiveness of the offenses, as a result of which TD Bank became the bank of choice for multiple money laundering organizations and criminal actors and processed hundreds of millions of dollars in money laundering transactions. Although TD Bank did not voluntarily disclose its wrongdoing, it received partial credit for its strong cooperation with the Department’s investigation and the ongoing remediation of its AML program. TD Bank did not receive full credit for its cooperation because it failed to timely escalate relevant AML concerns to the Department during the investigation. Accordingly, the total criminal penalty reflects a 20% reduction based on the bank’s partial cooperation and remediation.

IRS Criminal Investigation, the Federal Deposit Insurance Corporation Office of Inspector General, and Drug Enforcement Administration investigated the case. The Morristown Police Department, U.S. Attorney’s Office for the District of Puerto Rico, Homeland Security Investigations, U.S. Customs and Border Protection, and New York City Police Department provided substantial assistance.  

The post TD Bank to Pay $3B in Plea to Settle Money-Laundering Case appeared first on Compliance Chief 360.

According to FINRA’s order, the broker “facilitated at least 30 UBS customers’ investments in private securities transactions totaling over $7.2 million.” From 1997 to 2021, the UBS representative sold to at least 30 of his UBS customers a “fixed annuit” product offered by an entity formed by the rep’s college friend and business acquaintance. FINRA claims that although the UBS customers believed they were investing in a “fixed annuity” product, they were actually investing in riskier private securities.

FINRA is holding UBS responsible for the broker’s fraudulent practices on account for the fact that its supervisory systems were not reasonably designed to achieve compliance with the firm’s obligation to monitor transmittals of customer funds to third parties. Although the firm automatically flagged for heightened review wires that met certain criteria (e.g., the wire was the customer’s first domestic wire in six months), its automated system did not detect and monitor for instances in which multiple, unrelated customers transferred funds from their UBS accounts by check or wire to the same external party.

UBS Failed to Investigate the Private Transactions

FINRA also notes that UBS should have systems better designed to flag private securities transactions. For at least 17 of the wire transfers to the third party, the reason the customers provided for the wire transfer request was “investment.” UBS flagged the wires for additional review and approval but did not investigate why the representative’s customers were wiring money to the same external, non-UBS entity for an “investment.”

UBS also failed to reasonably investigate several instances from September 2010 to July 2021 in which at least two customers wired money to the third party within the same 30-day period. As an example, in March 2021, two unrelated customers wired a total of $47,000 from their UBS accounts to the third-party entity within eight days of one another. Although UBS flagged both wires for additional review and approval, the firm did not investigate why two of the broker’s customers were wiring money to the same external party.

As a result of UBS’s failures to monitor its customers’ wire transfers, the firms violated NASD Rules 3010 and 3012 and FINRA Rules 3110 and 2010. When the scheme was uncovered, it was discovered that the customers lost most of their funds and UBS repaid the customers more than $17 million in restitution.  

Jacob Horowitz is a contributing editor at Compliance Chief 360° 

The post FINRA Fines UBS for Its Failure to Monitor Customer Fund Transfers appeared first on Compliance Chief 360.

According to Goldman’s letter of acceptance to FINRA, it was charged with violating FINRA Rule 3110(a) and its predecessor, NASD Rule 3010(a) which requires banks to “establish and maintain a system” for the purpose of ensuring that each of its employees complies with the applicable securities laws and regulations. A violation of these rules is also a violation of FINRA Rule 2010, which requires members “to observe high standards of commercial honor and just and equitable principles of trade in the conduct of their business”.

According to FINRA, Goldman failed to include warrants, rights, units, and certain equity securities in nine surveillance reports designed to identify potentially manipulative proprietary and customer trading. “The firm failed to detect that nine surveillance reports for potentially manipulative trading excluded various securities types,” FINRA said. “By failing to have a reasonably designed supervisory system, Goldman violated NASD Rule 3010 and FINRA Rules 3110 and 2010.”

Goldman’s System Failures

As a result of the gaps in its surveillance reports, Goldman could not perform reasonable monitoring of trading activity for potential manipulation. The nine affected reports would have identified approximately 5,000 alerts for potentially manipulative trading activity in those securities from February 2009 through mid-April 2023. Goldman added the missing securities to the surveillance reports either in response to FINRA’s investigation or through the firm’s adoption of new surveillance reports. By April 2023, Goldman had finished remediating all surveillance reports.

Goldman’s supervisory system, including its written procedures, also did not require a review of its automated surveillance reports to ensure they included all relevant securities traded as part of the firm’s business. Because of this, the bank did not notice that nine surveillance reports, which could have indicated manipulative trading, overlooked warrants, rights, units, and specific equity securities.

Goldman Sachs encountered additional scrutiny from both FINRA and the U.S. Securities and Exchange Commission (SEC) due to lapses in reporting. In September, the firm settled with FINRA and the SEC, agreeing to pay a total of $12 million. The allegations centered on Goldman’s failure to fulfill its recordkeeping and reporting duties, as it provided inaccurate trading data in response to numerous regulatory requests.

The SEC and FINRA asserted that for approximately ten years, Goldman provided regulators with securities trading records containing inaccuracies or omissions related to millions of transactions involving the firm.  

Jacob Horowitz is a contributing editor at Compliance Chief 360°

The post FINRA Fines Goldman Sachs For Trade-Monitoring Failures appeared first on Compliance Chief 360.

The post J.P. Morgan Fined for Violating Whistleblower Protection Rules appeared first on Compliance Chief 360.

It specifically suggests that regulated financial firms establish a process for identifying, measuring, and controlling financial risks associated with climate change. These strategies should be reflected in the organization’s policies, procedures, and controls for the intention of providing boards and management with an understanding of how exactly to assess climate-related financial risks and their effects on their organizations. It also provides additional guidance on developing strategies for the effective management of climate-related risks and calls for the implementation of an internal control and risk management framework on climate change.

The new guidance is designed to support the efforts by New York financial firms to better manage their climate-related financial and operational risks, says the NYDFS. “To protect New Yorkers from financial harm, regulated institutions must anticipate and respond to new and emerging risks,” NYDFS Superintendent Adrienne Harris said in a NYDFS press release. “Today’s guidance provides these institutions with a balanced, data-driven approach to preserve safety and soundness and operational resiliency by addressing the risks posed by climate change.”

This newly adopted regulation addresses climate change components of risk management by banks—including corporate governance, internal control frameworks, risk management processes, and data collection and analysis—so that institutions will incorporate assessment of these risks into their existing risk frameworks.

“Regulated organizations should take a strategic approach to managing material climate- related financial and operational risks, considering both current and forward-looking risks and identifying actions required to manage those risks,” the guidance instructs. “Regulated organizations should consider questions such as: which business areas are or may in the future be exposed to these risks, what is the resiliency of the organization’s business models, what is the current or potential future materiality of the risks, and whether climate-related financial and operational risks require consideration across all business areas and processes, or only those areas or processes that are or may be particularly exposed.”

Climate-Related Internal Control Framework

The guidance also calls for the implementation of an internal control framework in order to “ensure sound, comprehensive, and effective identification, measurement, monitoring, and control of material climate-related financial risks.” The newly enacted regulation sets out “three lines of defense” in order to do so. The first line of defense advises that an organization consider climate-related financial risks when taking on new clients or reviewing a credit application. Such considerations include how climate-change risks may impacts its clients and their overall business environment. The second line of defense consists of a compliance system where an organization undertakes an assessment of climate-related financial risks. In this step, an organization should assess whether it is adhering to relevant climate-related rules and regulations. The third and final line of defense recommends that an organization conduct regular independent reviews and internal audits of its overall climate-related internal control framework.

The guidance also sets out a risk management framework that its regulated organizations are advised to implement. It recommends that this framework be designed for the purpose of identifying, measuring, and controlling climate-related financial risks. This includes the need to identify emerging and significant risks and how these risks may impact specific asset classes, sectors, and geographical locations as well as the need to establish, implement, and regularly review plans to mitigate exposure to climate-related financial risks.

Data Collection and Scenario Planning

The NYDFS guidance additionally suggests that its regulated organizations implement data aggregation processes that provide the ability to monitor significant climate-related financial risks. These processes should be designed for the purpose of producing information to the board in a timely manner in order for senior management to make well-informed and suitable decisions.

It also suggests that its organizations implement a “climate scenario analysis” into is internal risk assessment. By using a range of climate scenarios, organizations will be able to test the strength of their business models and strategies against climate-related financial risks. As a result of doing so, organizations will be better able to identify, anticipate, manage and measure such risks and adjust their strategies accordingly. Also, with such a tool, organizations will be able to identify and measure vulnerability to relevant climate-related financial risk factors, to estimate exposures and potential impacts, and to determine the overall significance of climate-related financial risks.  

Jacob Horowitz is a contributing editor at Compliance Chief 360°

The post NYDFS Issues Guidance for Banks on Navigating Climate-Related Risks appeared first on Compliance Chief 360.

These laws (specifically, Rule 17a-4(b)(4) of the Exchange Act and Rule 204-2(a)(7) of the Advisers Act) impose a broad requirement that a broker-dealer and investment adviser retain all communications of relevant employees while in their professional capacities. This enforcement action represents a long-standing effort by the SEC to crackdown on off-channel communications resulting from continuous employee communication through popular and modern messaging and texting platforms such as iMessage and WhatsApp.

Of course, the use of unmonitored communication channels underscores the need for recordkeeping requirements, however that doesn’t justify the actions of the SEC to merely impose a fine and move on. Rather, the rise in off-channel communication violations highlights the need for the SEC to adapt to changing times and more recent communication technologies as it evidently shows that traditional regulatory measures are not fully effective in addressing the challenges posed by modern messaging platforms.

The SEC itself recognized that the use of off-channel communication platforms is pervasive within the financial industry. The Commission, however, fails to recognize that the pervasiveness does not necessarily stem from individuals intending to violate the Act, but simply from the convenience and effectiveness that such communication platforms offer. iMessage and WhatsApp offer easy and effective means through which broker-dealers and executives may conduct business. These platforms are used daily and on a worldwide scale; they are used for essentially every matter.

The SEC’s enforcement actions resulting from these violations are completely understandable in that they are, in part, efforts to safeguard the agency’s ability to exercise effective regulatory oversight. However, the SEC should be looking beyond these violations and to the root of the problem: the rise in technology. Rather than forcing these firms to pay for employing a modern, technological approach to communication, it should be focusing on adjusting its guidelines for digital recordkeeping in order to conform to the present era’s standards.

Ever since the COVID-19 pandemic, there has been a significant trend of working from home. As a result, many business-related text messages went untracked and unrecorded and thus the SEC enforcement actions resulted. However, it is undisputed that the “work-from-home” trend is likely to continue and perhaps even increase among broker-dealers and investment advisers who require only a computer and WI-FI to conduct business.

Work-From-Home Here to Stay

Bloomberg reported that just 20 percent of financial-services companies require that their employees come into the office five days a week, and two out of three banks offer full flexibility regarding their work schedule or some sort of hybrid work arrangement. Clearly the concept of remote work is not a trend but rather a common and permanent practice in today’s age. Popular communication platforms such as Zoom and Microsoft Teams are likely to only increase in use. This comes to show the everlasting effects that the pandemic had on the workplace and the standards of communication used by virtually every corporate firm. The SEC must recognize this clearly permanent change in the modern-day workplace and adjust its regulations to fit its demands.

Many will argue that although SEC’s regulations regarding off-channel communication are outdated, it would be impossible to implement changes that allow the agency to oversee actions that indicate unlawful behavior by brokers such as price fixing, insider trading, and manipulative trading practices. However, just as modern communication platforms pose an issue to the SEC, it also offers a solution. Some instant messaging platforms have begun to add features aimed at professional organizational industries, such as those designed to ensure compliance with the communication retainment requirement. Slack offers a good example of this.  Slack is a messaging app for businesses that strives to connect people to information. The company recognizes the need for record retainment and as a result implemented a feature that allows businesses to export conversations and retain them for eDiscovery purposes.

The SEC should look towards companies such as Slack as a representation of the ability ensure compliance with the Books and Records requirement all the while supporting modern technological developments. This is not to say that such a platform will completely deter broker-dealers from fraudulent behavior or communicating through off-channel communication platforms, as there will always be private alternatives. Employees communicate over iMessage or WhatsApp simply because it’s a common habit, given recent generational trends. However, by offering a regulatory alternative that is both capable of complying with record retainment requirements and conforms to the modern-day standards of communication platforms, firms will be more willing to comply with the SEC requirement, while maintaining an approach to off-channel communication used by broker-dealers for the purpose of conducting business.  

Jacob Horowitz is a J.D. candidate at the Benjamin N. Cardozo School of Law at Yeshiva University in New York.

The post Reform, Not Fines: The SEC Needs a New Approach to Off-Channel Communication appeared first on Compliance Chief 360.

In July, the company reported that it had received a proposed consent order from the Federal Deposit Insurance Corporation (FDIC) “in connection with consumer compliance.” But the company provided few details. In a recent regulatory filing, the credit card company said it had come to an agreement with the FDIC on the details of the consent order.

Discover stated that as part of the consent order, it will “improve its consumer compliance management system and enhance related corporate governance and enterprise risk management practices.” The company added that it will increase board oversight of its compliance systems. Discover claimed that it has been taking “significant steps” to strengthen its compliance management system and address other issues in the consent order. It also indicated that no monetary penalties were levied as part of the settlement.

The company also noted that the agreement is not related to a separate FDIC complaint that starting in 2007, Discover misclassified credit cards into its highest merchant and merchant acquirers pricing tier. Discover said that the investigation into that matter is ongoing and could result in “additional enforcement actions or other supervisory activity from the FDIC and other regulatory agencies.”

Details of Discover Bank’s Statement

Discover said in a regulatory filing that, “On September 25, 2023, following the consent of the Board of Directors of Discover Bank, the Federal Deposit Insurance Corporation issued the previously disclosed consent order to Discover Bank, a subsidiary of the Registrant. The consent order addresses shortcomings in Discover Bank’s compliance management system for consumer protection laws and related matters.”

“As part of the consent order, Discover Bank has agreed to improve its consumer compliance management system and enhance related corporate governance and enterprise risk management practices, and increase the level of Board oversight over such matters. Discover Bank has been taking significant steps to strengthen the organization’s compliance management system and address the other issues identified in the consent order.”

“Management and the Board are committed to ensuring that all of the requirements of the consent order are met. The consent order does not contain any monetary penalties or fines. As previously noted, the consent order does not address the card product misclassification matter disclosed by the Registrant earlier this year. As regulatory review of the card product misclassification matter is ongoing, additional enforcement actions or other supervisory activity from the FDIC and other regulatory agencies remain possible.”  

The post Discover Bank Agrees to Compliance Fixes, Avoids FDIC Penalties appeared first on Compliance Chief 360.

The firms admitted the facts set forth in their respective SEC orders and acknowledged that their conduct violated recordkeeping provisions of the federal securities laws. Many of the violations were related to “off-channel” communications by firm employees, including personal text messages, that were not preserved. The firms agreed to pay combined penalties of $79 million and have begun implementing improvements to their compliance policies and procedures to address these violations.

• Interactive Brokers agreed to pay a $35 million penalty
• Robert W. Baird agreed to pay a $15 million penalty
• William Blair & Co. agreed to pay a $10 million penalty
• Nuveen Securities agreed to pay an $8.5 million penalty
• Fifth Third Securities agreed to pay an $8 million penalty
• Perella Weinberg Partners agreed to pay a $2.5 million penalty.

The SEC noted that Parella Weinberg and its affiliates paid a lower penalty in part because the firm self-reported its violation. “One of the orders included in today’s announced actions is not like the others,” said Gurbir Grewal, director of the SEC’s Division of Enforcement. “There are real benefits to self-reporting, remediating, and cooperating.”

The SEC’s investigations uncovered pervasive and longstanding off-channel communications at all 10 firms. As described in the SEC’s orders, the broker-dealer firms admitted that, from at least 2019, their employees communicated through personal text messages about the business of their employers, and the investment adviser firms admitted that their employees sent and received off-channel communications related to recommendations or proposals made.

The firms did not maintain or preserve a majority of these off-channel communications, in violation of the federal securities laws. By failing to maintain and preserve required records, certain of the firms likely deprived the SEC of these off-channel communications in various SEC investigations. The failures involved employees at multiple levels of authority, including supervisors and senior managers.

Interactive Brokers, Baird, William Blair, Nuveen, Fifth Third, Perella Weinberg, and TPH were each charged with violating certain recordkeeping provisions of the Securities Exchange Act of 1934 and with failing to reasonably supervise with a view to preventing and detecting those violations. Baird, William Blair, WBIM, Fifth Third, and Perella Weinberg Capital were each charged with violating certain recordkeeping provisions of the Investment Advisers Act of 1940 and with failing to reasonably supervise with a view to preventing and detecting those violations.

In addition to the significant financial penalties, each of the firms was ordered to cease and desist from future violations of the relevant recordkeeping provisions and was censured. The firms also agreed to retain independent compliance consultants to, among other things, conduct comprehensive reviews of their policies and procedures relating to the retention of electronic communications found on personal devices and their respective frameworks for addressing non-compliance by their employees with those policies and procedures.

Separately, the Commodity Futures Trading Commission announced settlements with Interactive Brokers for related conduct.

Crackdown on ‘Off-Channel’ Communications

The charges are a continuation of a crackdown by the SEC on the failure to police text messaging among employees at financial firms as part of their recordkeeping compliance requirements. In August, the SEC announced charges against 11 other firms–including Wells Fargo, BNP Paribas Securities, BMO Capital Markets, and others, for similar recordkeeping violations.

“Compliance with the books and records requirements of the federal securities laws is essential to investor protection and well-functioning markets. To date, the Commission has brought 30 enforcement actions and ordered over $1.5 billion in penalties to drive this foundational message home. And while some broker-dealers and investment advisers have heeded this message, self-reported violations, or improved internal policies and procedures, today’s actions remind us that many still have not,” said Gurbir S. Grewal, Director of the SEC’s Division of Enforcement in a statement announcing the August charges. “So here are three takeaways for those firms who haven’t yet done so: self-report, cooperate, and remediate. If you adopt that playbook, you’ll have a better outcome than if you wait for us to come calling.”  

Joseph McCafferty is editor & publisher of Compliance Chief 360°

The post SEC Hits 10 More Financial Firms for Recordkeeping Violations appeared first on Compliance Chief 360.

• A top-tier bank was found to have no surveillance on its voice-brokered swaps desk, resulting in a $45 million fine for spoofing.
• FINRA warns about “non-specific surveillance thresholds” that are “not reasonably designed” based on their 2023 exam findings.
• The CFTC plans to invest in a “robust market surveillance unit” as part of its double-digit budget increase
• The SEC’s ambitious market structure proposals may have material consequences for trade surveillance parameters.
• The U.K.’s FCA Market Watch yet again reminds firms to conduct risk assessments and make sure their controls detect market abuse.
• Enforcement priorities across jurisdictions in APAC all cite concerns regarding market abuse, e.g., MAS in Singapore, SFC in Hong Kong, and ASIC in Australia.

While the compliance professionals I speak with are well aware of this regulatory scrutiny, are firms deploying trade surveillance resources efficiently to meet the risk?

As Eventus details in our recent report, global regulators are pressing compliance leaders to reassess their trade surveillance capabilities and to ensure they have tailored these systems properly to the new risks they face. For example, the SEC and FINRA said they examined nearly half of the 3,500 registered U.S. broker-dealers last year. These exams help the regulators collect information to promote compliance, prevent fraud, and monitor risk. Sometimes, these exams expose serious concerns that lead to wider enforcement investigations.

With time and experience, many practitioners note a pattern: new rules and guidance, followed by warnings, then, unsurprisingly, enforcement. Too often, updates in compliance systems, alert parameters and processes that could have prevented many headaches lag behind regulatory scrutiny.  The problems are well-known: pressure to lower the total cost of compliance operations, legacy technology that is unresponsive to ever-increasing false positives, markets that grow increasingly complex, and pressure to lower the total cost of operating.

My colleagues and I come from roles and organizations that have felt this pain. Today, I speak with a range of compliance leaders across the globe who are serious about compliance and care deeply about getting trade surveillance right. These are professionals in broker-dealers, banks, FCMs, exchanges, prop trading firms, and digital asset platforms.

Increased Complexity

One theme we continually hear is the need for flexibility in their compliance technology to empower their teams, not act as a barrier or burden. As shown in our recent survey, 94 percent of respondents cited the increased complexity and challenge of trade surveillance over the last three years. These leaders rarely believe that maintaining the status quo is the safe option and they want flexibility and expertise built into their systems.

As our recent report concludes, global regulators are scrutinizing firms with outdated parameters or alerts not tailored to their businesses. Like financial debt, being weighed down by technical debt can harm a firm’s bottom line and reputation.

The most experienced compliance teams–whether in broker-dealers, banks, or exchanges–look forward, with at least a five-year time horizon. They anticipate what behaviors their firms are exhibiting today that regulators might question in the near future. For example, the spread of encrypted mobile messaging apps a few years ago inevitably led regulators to crack down, issuing warnings and fines. Today, we can anticipate that issues like cross-product manipulation, multi-asset surveillance and having adequate explainability in machine learning will be part of investigations and enforcement cases for the rest of this decade. And, all of this while trying to lower the total cost of ownership.

The opportunity amid this challenge is that the industry has the expertise, experience, and now technical flexibility to build market surveillance for specific needs. There is a renewed desire to get to the risk quicker with top talent and improved efficiencies. The new paradigm dictates that compliance software be adaptable and allow teams to have a real say in how technology works for them.  

Joe Schifano is Global Head of Regulatory Affairs at Eventus

The post Practitioners Must Drive Trade Surveillance Compliance appeared first on Compliance Chief 360.