Modern Compliance Wherever You Are

Radar has not been idle during lockdown – to follow is a summary from our recent roundtables of how buyside and sellside Compliance professionals have handled this unusual time, and what practices are emerging and becoming permanent on both sides of the Atlantic.

SELLSIDE TRENDS OF NOTE

Technology – Enabler or Stumbling Block?

Almost everyone has been pleasantly surprised at how their technology has adapted to the switch to distributed teams. While there was an initial frantic rush to source the right hardware for people to set up a comfortable home office, access to systems and data (Bloomberg Anywhere has been doing some good business) has been solid.

A number of compliance heads were wary of the monitored universe at their firms and the extent to which everything was being captured — retrospective reviews will be needed here. The main issue with personal hardware and software at home is the availability of help from the IT team, which has led to some DIY approaches. 

One global investment bank had made some errors in its earlier systems implementation. 

“When something like this happens, there is nowhere to hide. We detected that some of the jobs meant to run at midnight weren’t completed before the next job started, so we were only getting half the data into our surveillance. This period has magnified a few design failures but this has seemed to be an exception to the rule generally,” the European head of surveillance said.

Virtually everyone confirmed that there was still a need for IT people on-site to maintain servers, enable access for new joiners, and run point on any issues. Most firms had created a rota, where those with the easiest/safest commute could be in the office. Knowing who to contact in IT if there was any issue seemed to have been problematic when lockdown began.

A Restricted Line of Sight with WFH? 

Most of the compliance heads were remarkably relaxed about no longer being amongst the traders and brokers. There was an acceptance that policing the access or exchange of information might call for enhanced monitoring and that this is not a perfect science. They had employed a variety of approaches. Tactics included increasing the sample size for review, or extensive random sample reviews of certain desks, even reviews based on the length of calls, and reviews focused on certain times of the day.

“We always try to look for a needle in a haystack. Now we are looking for possibly more needles in a bigger haystack so arguably this has worsened the odds for success,” one Compliance head cautioned.

Others have been taking their tactical fixes and tuning them to account for the unusual market conditions, working with the business to get their guidance on the right focus. 

“These are the good stories that we will tell when the regulators come knocking about what we have done in this time and what we learnt. We will do more loopbacks from a trade surveillance perspective and be more targeted with our comms surveillance,” the head of monitoring at a European Investment bank said.

The use of personal devices has changed dramatically and this looks to be permanent. One firm made a rapid switch to account for wfh traders and salesfolk. 

“Pre-covid our policy was that that they all had firm-issued mobiles that could not be used on the trading floor and these were not recorded and were not in our surveillance program. We relied on adherence with that policy and seeing how people behaved on the floor and the policy being enforced by a combination of managers and compliance. We just issued about 350 SIM cards in three days. We are recording all of these and using a sample-based methodology to monitor this. This is a tactical fix but I expect this to be permanent now. That was, and is, a big and fast change for this firm.”

Others confirmed this trend, saying there had been an element of “risk acceptance” to allow business continuity. 

“We are using Skype for calls and video externally and debated to what extent traders can use this externally from home. But we then limited them to using certain recorded phone lines and are using everything else if it is recorded and BAU,” a large Commodities Trading firm analyst stated. Some are exploring how they can get social media apps to be compliant but affirm it is policy as usual until they can get that cleared. 

Alerts Backlog Cleared Now?

Initially, every monitoring team experienced a huge volume of alerts. 

“Our triage teams were dying under this,” one busy Compliance person said. One firm said that their FX alerts had increased a staggering 1000 times! Their e-communication alerts had risen between four and 10 times for other asset classes as well. A different firm said their systems were, at one point, creating 3000 alerts a day when they would normally get that number in a month. All these firms had been risk-ranking their alerts and inspecting models for instances where the volume was triggered by nothing more than extraordinary market conditions. They could then close these alerts quickly without any further action. 

“For EMEA we have about 3000 alerts open and in total we have about 18000 now, down from 30000 two weeks before,” one monitoring head described the deluge. “We talked around our tactical alert review especially for certain areas like insider dealing with some big spikes in equity and fixed income. We did some statistical analysis across sectors to get comfort in a lookback from previous escalations. It needs a methodology that can be explained to regulators later.”

 Many referred to an accidental rise in sensitive information flow. Only time will tell if this has been abused, but the exposure of MNPI has been a concern where traders and salespeople are sharing accommodation with others not employed by the same business. The temptation to look at an open OMS, to act on a tidbit overheard during a call, or read documents left lying around at home, must not be underestimated. For now, the Compliance Department is hoping that most of the front office retains robust “compliance muscle memory.”

One compliance head predicts that most of her advisory chats will be about appropriate work-based behavior in the next three to six months.

“Lots of our people are not aware that so much is being monitored now and are used to much more face-to-face. People don’t realise what they are doing until it is played back to them or to their boss,” she said.

When these practitioners are asked how to cope with this surge in alerts in a distributed world, the answer often relates to better technology. 

“At this point you are probably not going to solve this with more bodies. More sophisticated tech is the best solution. AI, ML and cognition techniques will help to prioritize alerts and use a risk-based approach. It is best to compartmentalize what are high, medium and low risk alerts using tech to do this. That is a sensible starting point,” a compliance monitoring head at a US investment bank said.

Risk Assessment Reboot?

Regulators have been hinting that firms might want to open their risk assessments to account for these new conditions. The practitioners accept that this is the right thing to do strategically, but point out that it is something that requires months of effort and needs to be approached desk by desk. Variations of this theme have seen some make tactical changes, using desk P&Ls as a starting point to prioritize who to focus on most. Unusual revenue might be easily explained in strange market conditions, but there is no harm in identifying it and asking that question. The current risk assessment can be a valuable guide. Anything deemed as “high risk” in the last 12 months could be the first port of call. It is also worth considering any physical supervisory tools that might be compromised by wfh, such as information barriers, desk-based supervision, and on premise recorded channels.

Many have certainly taken a risk-based approach in clearing alert backlogs. The monitoring team doesn’t like to describe it as “bulk closure” as that suggests a lack of proper consideration. They talk more about “quick wins” that allow more time for the higher risk, high-quality alerts. 

Watching the shifts in market opportunity also seem a common approach. Risk increases in line with the opportunity to make money. With a significant amount of debt issuance predicted, teams are now turning their eye to comms monitoring of syndicate teams and salespeople on the credit side. 

Regulator Relations

Management and compliance heads have been proactive in staying in touch with understandably concerned regulators. Practitioners with experience have been open about their approach and any problems. They have taken the view it is better to be accurate and complete than to rush or neglect reporting and process. 

Everyone is aware that recordkeeping and governance are paramount at this time. There must be an audit trail of decisions made and explanations that can be presented to regulators at a later date (“future proofing”). Some governance decisions have been expedited, but no corners should be cut. Digital records are a “must have” for changes agreed over email rather than in meetings. The regulators have shown interest in any thinking behind streamlined alert reviews, calibration reports, and sampling.

Wellbeing

Zoom and MS Teams fatigue seems the most common ailment right now. Managing a team has become more time-consuming, but many have valued this time as an opportunity to get to know their colleagues individually. The sheer volume of alerts has been daunting, so encouragement and collaboration, as well as drafting in some help, have been required to bolster morale. 

After initial high-touch communication, many have found the right level and are trying to shift their approach to get the most value out of the increased number of team gatherings. 

The biggest concern is that people have been working too hard and are finding it too difficult to separate office from home, a trend that their managers believe is not sustainable. 

“No one in my team has been hiding or shirking. In fact it is the opposite. This can only go on for so long before there are consequences. More than three months of this and it might be a problem,” a Compliance Head from a U.S. Investment bank said. 

Risk Function Interactions

Interaction with other teams from Internal Audit and Financial Crime has not taken a backseat. But it does take more effort to set up a call and go over the issues than it does to run across the office to see someone. It requires more focus due to the volume of issues and disconnects with the other risk functions. 

With increased credit and market risk, and a lively M&A market, there is greater demand for enhanced due diligence from a financial crime and transaction monitoring perspective. No one should be tempted to deviate from a longer process when its importance is more significant.

While many have missed the ability to talk face-to-face, they have also had better access to people they had never interfaced with before. 

Long Term Change

The eventual return to the office will see less compliance desks on the trading floors. Some are predicting 70 percent less presence. Travel and safety issues will determine who goes back and when. The expectation is that many in compliance will only spend 20 percent of their time in the office in the future. 

Everyone is considering the last three months and assessing how to adapt and use this experience to ensure they can start faster and change quickly if there is a recurrence. The shift to emergency mode needs to be more natural and automatic. 

The extreme volatility and volume was different this time. Previously it is one system or one asset class that cannot cope. In this case, it was almost ubiquitous. The team needs to manage for the unexpected becoming the norm on a long term basis. Resilience tests of vendors and server capability will be required. Even stress-test requirements in regulations such as MiFID II proved wholly inadequate in the recent market mayhem.

BUYSIDE TRENDS OF NOTE

Technology – Enabler or Stumbling Block?

The rather rushed flight to wfh has opened up some level of risk in the use of personal computers and devices from a security perspective. Are these out of date? Do they have updated antivirus software? Are they shared with others in the family? For privacy reasons, these cannot be accessed remotely. The same issue applies to personal mobiles. Some firms have questioned how secure their cyber perimeter is now that network access is being allowed from remote locations.

The lesson from this first test has been the need to supply employees with company-sourced hardware and software over which the business has essential rights of access. There has also been some vulnerability exposed to servers that are on premise. 

 Some big advances have been made at firms that have introduced new technology incredibly fast to accommodate the change. 

“We have deployed MS Teams in two months and that would normally have taken two years to introduce due to the usual security concerns,” a CCO at one traditional asset manager confirmed.

Better hardware has been provided to the key staff at their homes in the shape of screens and Bloomberg terminals. Firms are looking at this as a long-term investment rather than a short sharp shock. It signals a more permanent change to the way that firms will operate. 

A Restricted Line of Sight with WFH?

While a number of compliance practitioners are missing the face-to-face interaction with the analysts, traders, and portfolio managers, it is still possible to remind them that Compliance is very much in the room virtually. Gentle nudges might include querying why they have been using the printer so much or sending things to their personal email. 

“My biggest challenge is not being there physically and hearing what people are saying, just hanging out in the kitchen or reading the body language of people walking around looking excited or anxious. I am not getting that. For me that is the biggest risk,” a European hedge fund CCO said.

“You are missing that quick ‘run and talk moment’ which takes 10 seconds. You can still do it on Teams but it is very different to grabbing them and looking them in the eye,” another CCO at a big U.S. asset manager confirmed.

Lateral information flow that was natural in the office had to be recreated. One firm developed a regular newsletter. The sales team relates market color and the subscription and redemption makeup. The analysts chip in with ideas, while the Ops team contributes its own issues. The result is a communal update to create a rounded view. 

“This has helped break down the silo effect and was key for people to know that clients are not deserting us and once that gets confirmed people feel so much more comfortable,” a COO of a London fund stated. 

Others seem very comfortable performing their compliance duties from home if they have the right technology to perform appropriate monitoring. 

“There are tools now to plug almost every gap if you feel that is a risk,” a CCO at a big global multi-strat fund said.

The size of the front office is also a big differentiator compared to the sellside. Most of the compliance teams are fortunate enough to know all the traders and managers in their office extremely well. 

“I know who tries to push the envelope and who is less fastidious on documentation and contemporaneous recordkeeping. This drives who we have to focus on more and where we might need to up our game on comms surveillance and that is all feasible,” one European CCO said.

“We all want to be in the office and among the traders and PMs but that does not mean we would always pick up every wall crossing or MNPI breach there either. These people are smart so if they want to obviate the rules they will be far more creative and in ways we cannot control. It all comes back to the culture of the firm.”

The biggest challenge has been training and the cross-fertilization of ideas, which is much harder to replicate in a virtual environment. 

“You cannot poke your head in an office or lean over a divider and ask a question,” the global CCO of a fund group in New York said. “The formality of online means you lose some of the free flow discussion.” He added that while his firm has been functioning well so far, it has no real turnover as of now. That will not be the case in 12 to 18 months, and that is when getting to know new joiners and benefiting from the emulation aspects of training that are unavailable online will be crucial. 

“Career development is on pause right now. How do you engender and fulfil that?” another CCO asked. “These people don’t just want to be ticking over. Young analysts want to learn and become PMs right now but that is very hard to structure without face to face,” he noted.

There is no doubt that video conferencing is here to stay. The tech teams have reviewed the safest ones and are compiling user guides and training. Compliance has been establishing how to record, save, and transcribe. Some firms are sampling which channels are preferred by their clients and using that as a starting point. 

Enhanced Monitoring

Many of the buyside firms have undergone a huge cultural change in a short space of time. The monitoring of calls and communications, mostly on a sample basis, has increased significantly. 

Focus has been moved to those feeling more pressure (loss-makers) or those who have been unusually restricted, such as distribution teams. Some of these teams are pushing the boundaries in where they prospect for new business from both a client and regional perspective. 

Many are checking who are using the recorded channels, and any outliers are getting more attention from the Compliance team. Many compliance heads have been enjoying getting into the weeds again on trades. Some selective reviews of calls and emails have been revealing.

Another key development has been the drive to push video content through established monitoring channels. Many are establishing a perimeter for the communications channels that are compliant from a recordkeeping perspective. These can be part of the monitoring program. These need to record by default and not be open to manual adjustment by the user.

Any New Risks?

Compliance teams on the buyside have been creative as they evaluate new pockets of risk that might have emerged in these unusual market conditions.

“As repos are rolling on baskets of loans and bonds, we check the restricted list for securities related to the terms in the repos that might be a 10b-5 breach or market abuse,” the CCO of a big North Eastern U.S. fund said.

There are also significant concerns around MNPI, with more of it sloshing around the market. A good example has been private equity communication about portfolio company debt, revolving credit, and covenant breaches. Perhaps too much information is being shared and with the wrong people. 

Long Term Change 

Investment professionals will be returning first to the office as the exchange of their ideas is of most value to the funds. Infrastructure will be phased back more gradually with a staggered approach not dissimilar to that described above for the sellside. 

Many are saying this time will be the catalyst for the flexible working revolution in the asset management sector, which has previously been very “old school” in its approach to wfh. Firms are planning to always have backup traders, IT, and operations personnel in remote locations to ensure a seamless handover for future business continuity incidents. IT budgets will be bolstered, and procrastination on investment in the latest technology will be a thing of the past.