An enforcement action is one of the most painful experiences in the life of any institution. Enforcement actions come in all types, shapes and sizes—in areas ranging from financial crimes compliance to consumer protection to trading room misconduct. They may be informal and private, or formal, public and enforceable in court. They can result in reputational damage, fines and penalties, along with labor-intensive remediation, monitor and independent consultant activities—all impacting the bottom line. These activities command the immediate attention of team members, diverting them from maintaining and growing the business.
In a worst-case scenario, credibility with your regulators is damaged, sometimes requiring a change in senior management and even in the board of directors. In cases where a monitor is assigned by regulators or law enforcement agencies, interacting with them will require even more time and attention than working with internal audit staff. Examinations of banks under a formal or even informal action can be intense, broad-based, multi-year and expensive. Got your attention?
If you have already made a mistake in the eyes of regulators or law enforcement, do not make another by going into denial over a looming enforcement action. Too many companies do this. It delays rallying the necessary resources and funds to effectively and efficiently remediate the cited issues. Compounding your errors by refusing to recognize reality is a major misstep. Complaining about the situation and arguing with examiners is often counterproductive, because over the long term, you have to work with your examiners. Put anger and frustration aside and take time to understand what the issues are, including root causes. As much as six months may elapse from the time examiners first advise you of their concerns and the issuance of an enforcement action. Do not waste this time—use it to get started on remediating the regulators’ concerns. One of the most powerful things you can do is to let the regulators know that you get it and that you will take every action necessary to correct the problems.
Once you are cited, an investment is required to remediate the issues, so you need to accept that fact. Not only will you have to spend money to address and correct problems identified in the enforcement action, but the institution, as well as individuals, may also face fines and restitution. Get a forecast together and reserve for the worst case scenario. Make sure that you have the right people providing input. It cannot just be the finance department’s job to get a handle on the costs. Do not forget to con sider opportunity cost (the business you did not get and the loans you did not make because you were distracted or restricted by a compliance misstep). All stakeholders need to be consulted—from the business lines and executive leadership up to and including the board of directors. In addition, regularly refresh your budget.
Your institution probably lacks one or more of the appropriate staff, policies, procedures and tools for an effective program. This means that you will need to assess current staff, hire new staff in a highly competitive environment, and purchase and implement the automated tools necessary for your compliance program (e.g., anti-money laundering monitoring or Office of Foreign Assets Control [OFAC] sanctions administration). Not everything will go right either, particularly when you are dealing with data and systems. The board and senior management need to commit sufficient funds to strengthen a system of internal controls to ensure that it is appropriate to the risk profile of the institution. It is important that your institution be proactive in developing and executing a plan in a timely manner. Your monitor or independent consultant will guide you in this process through their independent reviews.
You will need staff who know he law and program elements and staff who know how to execute. Unfortunately, not every one has every attribute. In fact, more often than not you will find that most staff have one or the other. Execution is key; it is also where most institutions fail. Make sure you have the right complement of people with these attributes.
Project management is extremely important. There will be many issues to be addressed with far—reaching remediation efforts throughout the company. A project management office needs to be established, surrounding the entire remediation effort. This will help to ensure that the wing-to-wing remediation efforts of the firm are fully documented with sustainable corrective actions and tracked through closure. In turn, this documentation will provide senior management, the board, regulators and law enforcement with a much higher degree of comfort that you know what you are doing and are on top of every aspect of your program enhancements.
The board and the CEO must be investing in, committing to, and actively communicating the change in company culture, with a renewed pledge to maintain an effective compliance program and to support the compliance department. The tone from the top must cascade down and around the entire company so that it resonates with every manager and employee. Everyone needs to understand that there is a new culture and that it is here to stay. Enforcement in a consistent manner is equally important. Employees and contractors need to know that violations will be dealt with swiftly and appropriately. Too often culture is overlooked, with institutions merely changing policies, procedures and processes. This approach is a proven misstep, since without a strong culture of compliance, your new policies and procedures may look good, but have little or no effect. There are actually methods to assess culture.
Do not repeat past mistakes
You finally get through the storm, wake up and the sun is shining. The enforcement action has been lifted. Your pulse is racing and you immediately start thinking about how you can cut costs. You begin rationalizing your staff and looking for further efficiencies. Time out. While it is generally a sound business practice to continuously seek efficiencies, do not fall into the trap of cutting costs or staff in a way that undoes all the work you have done to get your enforcement action lifted. You simply cannot go back ward and expect that the same thing will not happen again.
Compliance departments are viewed as cost centers when they should be viewed as revenue guardians. Unless you have staff with the experience and tools to manage compliance, your institution is at risk of being sanctioned by any number of regulators and law enforcement agencies, to the detriment of your business. In the end, it is much less expensive to invest and get it right than to get it wrong. Thus, if you are hit with an enforcement action, it is important to recognize the following five points:
1. Invest—Enforcement actions will cost money. Recognize that the approvers of the remediation are the regulators and the monitors or independent consultants they appoint—not you.
2. Think long-term—There are no shortcuts. Sustainable programs take time and money.
3. Partner and fix instead of opposing—Partner with external and internal stakeholders, honestly assess where you are and move to the target state.
4. Never let a crisis go to waste—Use it to restructure and streamline your people, processes and systems.
5. Hire the right expertise—Cheap is expensive. Hire the right people with the right tools and experience.