Risk Management in a Retail Investment Program

Transcription

1 Risk Management in a Retail Investment Program By Kevin Maas, JD Pohl Consulting and Training, Inc kmaas@pohlconsulting.com Pohl Consulting and Training, Inc. Page 1

2 Overview Banks, thrifts and credit unions should epect that the review, both internal and eternal, of how the risks of a non-deposit investment program are managed will be more focused and more specific than encountered in the past. One reason for the likely increased attention to the non-deposit investment program is the January 2015 release by the Office of the Comptroller of the Currency (OCC) of a new Comptrollers Handbook booklet titled Retail Non-Deposit Investment Products. This paper provides an analysis of the risk assessment, risk management, compliance program, and internal controls which are necessary and appropriate in a retail non-deposit investment program. Introduction Since the mid-1980s, banks, thrifts and credit unions have been engaged in making retail nondeposit investment products (NDIPs) available to their customers, credit union members and the public at large, either directly or more commonly through arrangements with affiliated or unaffiliated broker-dealers, registered investment advisers, and/or insurance agencies. In January 2015, the Office of the Comptroller of the Currency (OCC) released a Comptrollers Handbook booklet titled Retail Non-Deposit Investment Products (Booklet ). 1 The 2015 OCC booklet applies to NDIP activity that falls within the scope of the Interagency Statement on Retail Sales of Non-Deposit Investment Products (Interagency Statement). 2 In that the Interagency Statement continues to be acknowledged as the source of regulatory guidelines applicable to NDIP activity and the 2015 booklet is consistent with the OCC s 1994 guidance provided in Booklet , 3 the release of this updated booklet serves mainly as a reminder of eisting guidance and not as an introduction of new regulatory requirements. A networking arrangement for making non-deposit investment products available on financial institution premises is not only a collection of complicated-sounding words, but also a specific and defined business activity, which must operate within a specific set of banking and securities laws and regulations. In a networking arrangement, the financial institution enters into a specific type of contract called a networking agreement with a firm (Networking Firm) that sells NDIPs directly to customers. The networking agreement calls for the Networking Firm to sell non-deposit investment products from the bank s premises. Non-deposit investment products, as the name indicates, are investment products that are not deposit products under the Federal Reserve s Regulation D. 4 The types of products that are non-deposit include individual securities (offered by broker-dealers), investment advice (provided by registered investment advisers) and insurance products (offered by insurance agencies). 1 Comptroller s Handbook booklet: Retail Non-deposit Investment Products OCC Bulletin Interagency Statement on Retail Sales of Non-deposit Investment Products (dated February 15, 1994), formerly contained in section 413 of the Comptroller s Handbook for National Bank Eaminers and OTS Thrift Bulletin 23-2, can be found as an appendi to OCC Booklet , Non-deposit Investment Sales Eamination Procedures: Interagency Statement. 3 OCC Bulletin 2015 rescinds OCC Bulletin the prior guidance on NDIP sales programs CFR 204 (Reserve Requirements of Depository Institutions), commonly referred to as Regulation D. Pohl Consulting and Training, Inc. Page 2

3 In order to make securities, investment advice and/or insurance products available to the investing public, including the financial institution s customers or members, the financial institution will enter into an agreement with a broker-dealer, registered investment adviser and/or insurance agency to work directly with the investing public on financial institution premises. In echange for allowing the Networking Firm to offer NDIPs on the financial institution premises, the financial institution will receive (pursuant to the terms of the networking agreement) a portion, normally epressed as a percentage, of the Networking Firm s revenues derived from the Networking Firm s activities from the financial institution premises. While the history and evolution of networking arrangements for banks and credit unions would be a real page-turner, sadly this paper will not dwell on history. The NDIP guidance provided by the OCC in Booklet is specifically applicable to nationally chartered banks and federal savings associations. However, given the similarity of the NDIP activity and the shared applicability of the Interagency Statement to state chartered banks and thrifts, Booklet and this paper will also be of value in monitoring NDIP offerings at state charter financial institutions. History and the customer-protection focus of Booklet also suggest that the various state financial institution departments, the National Credit Union Association (NCUA) and the FDIC will either formally or informally continue to maintain a similar approach to NDIP programs. Credit unions are not subject to the Interagency Statement; however, the NCUA s guidance in NCUA Letter is consistent with the Interagency Statement. 5 This paper will refer collectively to all financial institutions as Financial Institutions unless there is a specific need to differentiate. The Comptrollers Handbook sections, including Booklet , are written for use by OCC eaminers in connection with their eamination and supervision of national banks and federal savings associations. A significant, and certainly intended, 6 benefit of the Comptrollers Handbook sections is that they also provide ecellent practical guidance on how banks can effectively and appropriately address their regulatory obligations. Booklet provides a wealth of background and practical guidance on how Financial Institutions can properly establish, support and monitor an NDIP program. However, it is important to understand that Booklet , in its comprehensive approach to NDIP programs, creates opportunities for confusion in the application of the Booklet s guidance and the underlying regulatory requirements to the NDIP program at a particular Financial Institution. 5 While the regulatory guidance applicable to credit unions is not shared with banks, the credit union applicable guidance provided first by NCUA Letter 150 and more recently by NCUA Letter aligns with the Interagency Statement guidelines. 6 OCC Booklets ranging from those addressing Agricultural Lending (OCC ) to Service Members Civil Relief Act of 2003 (OCC ) contain a statement that the Booklet is intended to provide guidance to eaminers and bankers. Pohl Consulting and Training, Inc. Page 3

4 To best understand the nature of the potential for confusion, it is important to individually identify and address the three main methods by which a bank may engage in NDIP activity as addressed in Booklet State and national banks and thrifts may directly, without the involvement of any other entity or any other qualifications beyond the bank charter, engage in sales of certain NDIPs. 7 The scope of these permissible bank direct NDIP activities was clarified and restricted in the Gramm-Leach- Bliley amendments to the Securities and Echange Act of 1934 ( 34 Act). Regulation R (Reg R), issued jointly by the Securities and Echange Commission (SEC) and the Federal Reserve, further clarifies the Gramm- Leach-Bliley amendments to the 34 Act. Under the 34 Act, permissible bank direct securities activities include trust and fiduciary activities, deposit sweep activities, and custody and safekeeping activities. Additionally, transactions in eempt securities (such as U.S. government securities), certain stock purchase plans, affiliate transactions, private securities offerings, identified banking products, municipal securities, and a de minimis number of other securities transactions may also be offered directly by banks without triggering the need to register as a broker or a dealer Banks 9 may enter into an arrangement with an affiliated firm 10 to engage in the offering and sale of NDIPs. This type of arrangement would be common in larger banking organizations. 3. Banks may enter in an arrangement with an unaffiliated Networking Firm whereby the Financial Institution may receive a percentage of the Networking Firm s revenue, without the Financial Institution being required to register as a broker-dealer, a registered investment adviser, or an insurance agency. This type of arrangement accounts for the majority of NDIP arrangements in community banks. In some sections, the opportunity for confusion eists because Booklet is addressing guidance that is applicable in Bank direct NDIP activity, but would not be applicable in a networking arrangement. It is not always obvious, absent a close reading of Booklet , which of the three methods for bank involvement in NDIP activity is being addressed by the risk management elements being discussed. 7 The Gramm-Leach-Bliley Act of 1999 (GLBA) amended the definition of broker and dealer in the Securities Echange Act of 1934 and replaced what had been a blanket eemption for banks from broker-dealer registration requirements with specific eceptions. These specific eceptions authorize banks to engage in only specified and limited securities activities without being considered broker-dealers, subject to registration with and the jurisdiction of FINRA and the SEC. 8 The Securities and Echange Act of 1934 contains separate definitions for broker and for dealer. A broker is defined in Section 3(a)(4) as any person engaged in the business of effecting transactions in securities for the account of others. Dealer is defined in Section 3(a)(5) as any person engaged in the business of buying and selling securities for his own account, through a broker or otherwise. In this paper we are only addressing the eception applicable to Financial Institution from the definition of broker. 9 Credit unions have a similar power to enter into NDIP arrangements under state and federal law, but are not addressed in Reg R. The NCUA s guidance on NDIP programs is provided in NCUA Letter Furthermore, the SEC has made clear that it views the principals of Reg R to be applicable to credit unions. 10 The GLBA s specific securities activities registration eceptions apply only to activities by the bank. Bank holding companies and bank affiliates that are engaged in securities activities must comply with SEC and FINRA registration requirements. Pohl Consulting and Training, Inc. Page 4

5 A key to limiting confusion is to closely read Booklet to ensure that the type of NDIP activity to which the guidance is applicable is understood. For eample, in a Bank direct sale of municipal securities it would be appropriate for the Bank to address the transaction risk associated with the direct sale of securities. However, where the Bank is engaged in a networking arrangement with a broker-dealer, whether affiliated or nonaffiliated, the transaction risk for the securities transaction would fall eclusively to the broker-dealer and not to the Financial Institution. As such, efforts by the Financial Institution to mitigate or control the transaction risk would be ineffective and as such would not be an appropriate internal control. 11 Later sections of this paper will address the reputation risk that is always present in a networking arrangement. However, the risk assessment, risk management and internal controls (effective in addressing reputation risk) are quite different from the measures appropriate for addressing other types of direct risks to the Financial Institution, such as transaction risk. This paper (and the Appendices) will provide analysis and guidance, based upon applicable banking and securities laws, regulations, rules and published guidance of the risk assessment, risk management, 12 compliance program and internal controls that are necessary and appropriate in a retail non-deposit investment program utilizing an affiliated or an unaffiliated Networking Firm. 11 The Institute of Internal Auditors Standard 2130 provides that the internal audit should evaluate the adequacy and effectiveness of controls in responding to risks Third-party relationships and vendor relationships are both within the scope of risk management addressed in this paper. Note that not all third-party relationships are vendors to the bank. As such, each relationship must be considered and addressed based upon the realities of that relationship. Pohl Consulting and Training, Inc. Page 5

6 Three-Dimensional Chess and Networking Arrangements While the character Spock in the original 1960 s television show Star Trek may have understood three-dimensional chess, most of us were a bit fuzzy on the game. A networking arrangement with a Networking Firm bears more than a little similarity to three-dimensional chess. The rules of the networking game eist in multiple dimensions, which we recognize as different regulatory schemes. The first dimension is the banking scheme, as represented by the Interagency Statement, the OCC s Booklet , and similar banking guidance are directly applicable to Networking Financial Institutions, but not applicable to the Networking Firm. 13 The second dimension is made up of the regulatory schemes applicable to the Networking Firm. A broker-dealer is subject to the SEC, FINRA, state securities department and Department of Labor regulations and rules. A registered investment adviser (RIA) is subject to the investment advisory regulations of either the SEC (for federal RIAs) or state regulations (for state registered RIAs), while an insurance agency is subject to the state insurance regulations. In a networking relationship, all of the SEC, FINRA, state securities, Department of Labor, state investment advisor and state insurance regulations are directly applicable to the Networking Firm, but are not applicable to the Financial Institution. The third dimension is represented by a wealth of requirements such as privacy requirements, data and information technology security, AML, OFAC, and CIP requirements. This third dimension, while generally applicable to both Financial Institutions and Networking Firms, is applicable to only one of the two entities depending upon the nature of the customer activity in question. In the case of a customer relationship for a savings account or a loan transaction, the Financial Institution is singularly responsible and must be in unilateral control of the compliance with all of the privacy, data and information technology security, AML, OFAC and CIP requirements. It must be equally clear that when a Networking Firm opens an investment or insurance account for that same customer, even though on the Financial Institution premises, the Networking Firm is singularly responsible for and must be in unilateral control of the compliance with all of the privacy, data and information technology security, AML, OFAC and CIP requirements as they relate to the customer s NDIP relationship with the Networking Firm. The goal of this three-dimensional networking game is to meet the needs of the investing public in a mutually beneficial (profitable) manner that is sustainable (in compliance with applicable rules and regulations), while at the same time, the Financial Institution and the Networking Firm work cooperatively and constructively together. A very comple game indeed. 13 Networking Firms engaged in networking arrangements have gone to significant lengths to address the requirements of the Interagency Statement. However, their actions are driven by business necessity not regulatory requirement. Note that brokerdealers do have similar networking requirements under FINRA Rule 3160, Networking Arrangements Between Members and Financial Institutions. Pohl Consulting and Training, Inc. Page 6

7 Clarity Through Distinction In order to make sense of the three-dimensional networking game and thereby effectively interpret and apply the abundance of regulatory guidance in the development of an effective risk management system, it is first necessary to understand the role of the Financial Institution and the role of the Networking Firm. The best way to understand the roles and responsibilities of the parties is to pull the roles and responsibilities out individually and eamine their distinct abilities and limitations in the networking relationship. Step One: Securities and Echange Act of 1934 Booklet points out that Financial Institution involvement in the sale of NDIPs is limited by the broker-dealer rules and registration requirements contained in the Securities Echange Act of The Gramm Leach Bliley Act of 1999 (GLBA) amended the 34 Act and established specific eceptions that authorize banks to engage in limited securities activities without being required to register with the SEC and FINRA as a broker or a dealer. This paper focuses only on the networking eception. The conditions of the networking eception authorized under the GLBA amendments to the 34 Act were augmented by Regulation R, which was jointly developed by the Federal Reserve and the SEC. For the purposes of this paper, we will refer to the networking eception of the 34 Act, as amended by GLBA and augmented by Reg R, as the GLBA amendments. The GLBA amendments provide an eception from broker registration when a Bank enters into a contractual arrangement with an affiliated or unaffiliated registered broker-dealer under which the broker-dealer offers brokerage services on or off the Financial Institution s premises. The OCC s Booklet summarizes the GLBA amendments requirements by stating, among other things, that the broker-dealer must be clearly identified as performing the brokerage services, each customer must be informed that the brokerage services are provided by the broker-dealer and not the Financial Institution, and that the Financial Institution may not carry a securities account of the customer ecept as permitted under the GLBA eceptions for trust, safekeeping or custody activities. The GLBA amendments clarify that in a networking relationship, the Financial Institution is not and cannot be a party to the securities transactions. Similarly, the Financial Institution does not have any involvement in the customer s NDIP account relationship with the Networking Firm nor is the Financial Institution a party to the contract that establishes the NDIP account relationship with the Networking Firm. A key risk management application of this concept arises in vendor management. Because the Financial Institution cannot be a party to the customer s securities activity with the Networking Firm, then the Networking Firm can only be providing its services directly to the customer. As such, the Networking Firm is not, in a networking arrangement, a vendor to the Financial Institution. Therefore, the oversight and monitoring of the Networking Firm under various banking regulatory guidance (most notably the OCC Bulletin addressing Third-Party Relationships) should not inaccurately assess the Networking Firm as a vendor 14 to the Financial Institution. That being said, the scope of Bulletin also addresses relationships with third parties that are not vendors to the Financial Institution. The distinction between a vendor relationship and a third-party relationship is important in determining appropriate controls to address the applicable 14 A vendor generally is a party that provides a service to or for the Financial Institution that the Financial Institution could have otherwise performed for itself. In a networking arrangement, the Financial Institution is prohibited from performing these functions itself (absent registration). Pohl Consulting and Training, Inc. Page 7

8 risks to the Financial Institution. The application of the risk management guidance of OCC Bulletin to networking relationships is addressed in Appendi C for initial review and in Appendi E for ongoing review. Appendi D provides a checklist which addresses the various contract requirements that must be satisfied when entering into a networking agreement with a Networking Firm. Note that a relationship with an affiliated Networking Firm is subject to the same requirements and limitations as a relationship with an unaffiliated Networking Firm. Step Two: Interagency Statement Financial Institutions that engage in NDIP sales activities are directly subject to the guidelines established by the Interagency Statement issued by the federal banking agencies and the Joint Interpretations of the Interagency Statement on Retail Sales of Non-Deposit Investment Products (Joint Interpretations) dated September 22, 1995 (OCC Bulletin ). The Joint Interpretations provide further clarification of the Interagency Statement s guidelines. The Interagency Statement establishes minimum operating standards for Financial Institutions NDIP sales programs that help mitigate risks to Financial Institutions. The Interagency Statement and GLBA amendments contain many of the same requirements and are consistent with each other in their requirements to avoid customer confusion. In addition to these requirements, the Interagency Statement establishes Financial Institution investment program management guidance that addresses NDIP sales activities through arrangements with Networking Firms. The Interagency Statement contains disclosure requirements intended to inform the customer about the nature of the products and to identify the firm from which the NDIPs are purchased. Just as in the GLBA amendments, the banking regulators in the Interagency Statement call for clear identification and disclosure of the firm providing the NDIPs. As previously noted, in a networking arrangement, the NDIP activity is conducted by the Networking Firm and so the Interagency Statement disclosures must inform the customer that the Networking Firm (and not the Financial Institution) is the provider of the NDIP products. The Risk Management of NDIP Sale Program section of Booklet matches the sections and themes set out in the Interagency Statement. There were two topics added in Booklet that were not an area of focus in the Interagency Statement. The first, Independent Risk Management Program, discusses the more sophisticated and independent risk management functions that tend to be established at some large financial institutions. The second additional section addresses an Internal Audit Program. This additional Internal Audit Program section is entirely consistent with normal audit oversight. It states that the compliance, risk management, and internal audit areas of the Financial Institution should determine who is responsible for testing the Financial Institution s controls and responsibilities of the NDIP sales program. The internal audit s conclusions should be formally reported to independent eecutive management and the board s audit committee. There should also be an established process for escalating significant issues and following up on the Financial Institution management s corrective actions. As such, the addition in Booklet of the Internal Audit Program topic is best understood as a clarification of the Interagency Statement rather than a change. Pohl Consulting and Training, Inc. Page 8

9 Step Three: Risk Management Now that we have pulled apart and clarified the roles of the Financial Institution and the Networking Firm in a networking relationship, we can turn our focus to how the Financial Institution can appropriately establish a risk management program which is effective in addressing the right risks in the right way. Risk Management: Which risks? The challenge of developing an appropriate and effective risk management program when entering into a networking arrangement with a Networking Firm has always been a part of the networking arrangements. Over recent years, the list of risk management items a Financial Institution must address has tended to become less focused, in large part, because Networking Firms and Financial Institutions have both become quite comfortable with the networking arrangements. As a result, some of the legal and regulatory distinctions have been overshadowed by the sales and marketing efforts of both parties. However, the legal and regulatory reality is that a Financial Institution (which has entered into a networking arrangement with a Networking Firm) is not directly, or indirectly, engaged in the sale of the NDIPs. As described in step one and step two, the GLBA amendments and Regulation R issued jointly by the Federal Reserve and the SEC (as well as the banking regulators Interagency Statement) make very clear that in a networking relationship, the customer disclosures must clearly and conspicuously inform the customer that the Networking Firm is the provider of the NDIP services and not the Financial Institution. The regulatory scheme that controls the actions of the broker-dealer, registered investment adviser and/or insurance agency is entirely separate and distinct from the Financial Institution s regulatory scheme. The good news is that as a result, the Financial Institution does not have legal, compliance, credit or transaction risk for the NDIP activity. Moreover, because the Financial Institution cannot legally be a party to the NDIP transaction, the customer in the NDIP relationship is not and cannot be a customer of the Financial Institution for purposes of the NDIP account. In the contet of the customer relationship, the Financial Institution cannot have legal, compliance, credit or transaction risk arising out of the NDIP customer relationship with the Networking Firm. The difficulty comes in making a distinction between the Financial Institution s wise and appropriate actions to address its reputation risk and the separate and distinct internal workings of the highly regulated Networking Firm engaging directly in account relationships with NDIP customers. The difficulty is compounded when many of the NDIP customers also have a separate relationship directly with the Financial Institution for traditional banking services. For eample, in addressing Financial Institution direct NDIP sales activity, Booklet appropriately discusses the Financial Institution s responsibility to ensure that transactions are appropriate for each customer. 16 Clearly, in a Financial Institution direct NDIP transaction, the risk rests solely on the Financial Institution and the Financial Institution must have systems and procedures in place (in addition to compliance and risk management functions) that are actively engaged in approving, monitoring and making necessary corrective action for all transactions. However, when the Financial Institution has entered into a networking arrangement with an unaffiliated or an affiliated Networking Firm, the Financial Institution is not a party to the securities or insurance transaction and does not have a role or a responsibility as part of the Networking Firm s compliance and risk management functions Pohl Consulting and Training, Inc. Page 9

10 such as the suitability 17 requirement under FINRA Rule The Financial Institution s compliance and risk management responsibility is rooted in its reputation risk and is best understood in the contet of the guidance of the Interagency Statement. In recent years, the focus of the risk management approach in networking relationships at many Financial Institutions has shifted toward a vendor management approach. OCC bulletin describes in detail the risk management epectations for third-party relationships. However, two elements of a networking relationship are frequently overlooked when a Financial Institution is establishing an NDIP risk management approach. First, the Networking Firm in a networking relationship is not a vendor of services to the Financial Institution. In a retail NDIP program, the Networking Firm does not provide brokerage, advisory or insurance services to the Financial Institution. In fact, in most networking arrangements, the Financial Institution has agreed, by contract, to be a vendor of services to the Networking Firm. Additionally, the Financial Institution processes the sales representative s compensation. 18 Secondly, the very appropriate focus by the Financial Institution on the quality of the Networking Firm in both an initial due diligence and ongoing monitoring and review of the Networking Firm is just one of many risk management obligations placed on the Financial Institution by the Interagency Statement, GLBA and Booklet While Networking Firm selection and ongoing monitoring are clearly factors in managing the Financial Institution s reputation risk, there are many additional risk management responsibilities and direct obligations of the Financial Institution which cannot be ignored. It is these direct obligations of the Financial Institution that provide the opportunity for the increased regulatory attention mentioned at the beginning of this paper. 15 Booklet pages 61 and Suitability is the fundamental determination that a broker-dealer must make in the contet of recommending a transaction or investment strategy involving securities. The suitability standard is focused on the specific and current customer information. One way to summarize the suitability standard is whether the particular securities activity being recommended is a good thing for this customer at this point in time (taking into consideration the customer s current financial and current investment goals). Suitability is addressed by FINRA Rule 2111 and a wealth of FINRA and SEC notices, investor alerts and disciplinary actions. 17 While the sales persons may be dual employees, their compensation as registered representatives, investment advisor representatives or insurance agencies can only come from the broker-dealer, the RIA or the insurance agency which they represent. While the Financial Institution s processing of the sales representative s compensation is of great value to the mutual success of the parties, nonetheless the compensation to the representatives for NDIP activity comes from the third-party. Pohl Consulting and Training, Inc. Page 10

11 Risks Associated with NDIPs Regulatory guidance on a wide variety of topics in recent years consistently begins with a statement that the Financial Institution should conduct a risk assessment and develop a risk management process designed to address the risks present to the Financial Institution. Both addressing Third-Party Relationships and Booklet state that a Financial Institution should...adopt risk management practices commensurate with the level of risk... Thus, the operative questions at this point are: what are the risks to the Financial Institution and what is the level of risk? The five risk categories identified in Booklet are: Compliance Risk Operational Risk Strategic Risk Reputation Risk Credit Risk The following section will provide guidance on the specific risks to the Financial Institution associated with an NDIP program and suggest appropriate means to manage each individual risk. Compliance Risk Financial Institutions should pay particular attention to compliance with the Interagency Statement and the statutory eceptions from the definition of broker under the GLBA amendments and the additional guidance provided by Regulation R. Particular care should be taken by Financial Institution risk management, internal audit, and compliance staff to ensure that each of the Interagency Statement guidelines applicable to Networking Firm relationships is addressed by the Financial Institution. Broker-dealers and their registered representatives must also comply with applicable securities laws, as well as FINRA rules, regarding their NDIP sales program located on the Financial Institution premises. 20 The Financial Institution should obtain appropriate assurances from the broker-dealer that the broker-dealer and its registered representatives are complying with all applicable SEC and FINRA rules and policies. Similarly, Financial Institutions should require representation from RIAs and insurance agencies engaged in an NDIP sales program that the RIAs and insurance agencies comply with all applicable regulatory requirements. 18 Booklet page FINRA Rule 3160 Pohl Consulting and Training, Inc. Page 11

12 GLBA/Reg R Compliance Booklet defines the compliance risk to the Financial Institution (under the GLBA amendments) by listing the conditions that must be satisfied by the Financial Institution. Those requirements are as follows: The broker-dealer must be clearly identified as the person performing the brokerage services. 2. The brokerage services must occur in a clearly marked area that is, to the etent practical, physically separate from the routine deposit-taking activities of the Financial Institution. 3. Any materials used by the Financial Institution to advertise or promote the availability of brokerage services under the arrangement must clearly indicate that the brokerage services are provided by the broker-dealer and not the Financial Institution. 4. Any materials used by the Financial Institution to advertise or generally promote the availability of brokerage services under the arrangement must comply with federal securities laws before distribution. 5. Financial Institution employees can perform only clerical or ministerial functions in connection with brokerage transactions, including scheduling appointments with the associated persons of a broker-dealer, ecept that Financial Institution employees may forward customer funds or securities and may describe in general terms the types of investment vehicles available from the Financial Institution and the broker-dealer under the arrangement. 6. Financial Institution employees may not receive incentive compensation for any brokerage transaction, ecept they may receive compensation for a referral of any customer if the compensation is a nominal one-time cash fee of a fied dollar amount, and the payment of the fee is not contingent on whether the referral results in a transaction. 7. Broker-dealer services must be provided on a basis in which all customers who receive any services are fully disclosed to the broker-dealer. 8. The Financial Institution may not carry a securities account of the customer ecept as permitted under the GLBA eceptions for trust, safekeeping and custody activities. 9. The Financial Institution or broker-dealer must inform each customer that the brokerage services are provided by the broker-dealer and not the Financial Institution, and that the securities are not deposits or other obligations of the Financial Institution, are not guaranteed by the Financial Institution, and are not insured by the FDIC. 21 Booklet page 18, 19 Pohl Consulting and Training, Inc. Page 12

13 Failure of the Financial Institution to follow the previously listed requirements would indicate a failure to comply with the GLBA amendments to the 34 Act and would require the Financial Institution to either register as a broker or cease the non-compliant activity. To manage this compliance risk, Financial Institutions should establish proper policies and procedures, as well as effective internal risk management and audit activities, as required by the Interagency Statement. Note that while the guidance from the GLBA amendments to the 34 Act and Regulation R are directed solely at the Financial Institution in a relationship with a broker-dealer, the Interagency Statement and Booklet are equally applicable to the Financial Institution when working with registered investment advisers and insurance agencies. Interagency Statement Compliance The Interagency Statement provides the federal banking regulators a road map to use in addressing compliance risk in Financial Institution NDIP activity. While the Interagency Statement is not a law, rule or regulation, it is nonetheless the guidance which banking regulators epect Financial Institutions to meet. The Interagency Statement road map is set out in a checklist format in Appendi A. While the selection of a Networking Firm for a networking relationship is important, the selection of a Networking Firm is just one of the many Financial Institution specific requirements set out in the Interagency Statement. Addressing the direct compliance risks identified by the Interagency Statement requires the Financial Institution to have board policies and procedures in place designed to ensure that Financial Institution personnel are properly informed about the Financial Institution s duties in a networking relationship. Similarly, the Financial Institution should have in place internal controls, subject to internal audit review, designed to support the Financial Institution s adherence to the board policies and procedures. A particularly interesting and common compliance risk and reputation risk that arises in a networking relationship involves the use of a private label name. A private label name is a marketing name used to identify the NDIP activity conducted on a particular Financial Institution s premises. The private label name is normally consistent with the Financial Institution s name and/ or other marketing activities. In and of itself, the use of a private label name is not a compliance problem. In fact, over the last 15 years, the use of a private label name in a networking relationship has become the norm across Financial Institutions of all sizes. As long as the guidance under the Interagency Statement is followed regarding which entity is providing the NDIP products, the private label name is acceptable. Problems arise in two main areas associated with a private label name. First, given the similarity of the private label name and the Financial Institution s marketing efforts, it is common for employees, managers and even the board of directors to begin to view the Networking Firm s NDIP activity on Financial Institution premises as direct NDIP activity of the Financial Institution. This misconception can lead to call report errors, such as including the NDIP holdings in a trust department s asset totals in Schedule RC-T. Marketing material may be produced that refers to NDIP activity as a direct activity of the Financial Institution. In their customer interaction, employees may discuss the availability of NDIP activity on the Financial Institution s premises as being a Financial Institution direct activity. Pohl Consulting and Training, Inc. Page 13

14 The second and the most significant compliance risk created by the use of a private label name occurs when the private label name is positioned in disclosures or marketing materials as a function of the Financial Institution. This increase in compliance risk occurs where the private label name is identified as a department of the Financial Institution or as not affiliated with the Networking Firm to the networking relationship. To imply or outright state that the private label name under which the NDIP activity takes place and to which the sales personnel are connected in marketing material is a department of the Financial Institution is factually incorrect and a violation of the GLBA amendments to the 34 Act and the Interagency Statement guidelines as addressed in several places throughout this paper. Additional incorrect uses of a private label name would be to identify the private label name as a DBA of the Financial Institution or to identify the private label name as an entity such as a corporation or limited liability company. If the private label name is identified as Inc. or LLC, then that entity must be registered with FINRA (for the sale of securities); registered with the SEC, or the state securities department (for the offering of investment advice); and/or with the state insurance department (for the marketing of insurance products). The private label name, in order to avoid 34 Act violations and noncompliance with the Interagency Statement, can only be used to identify the activities of the Networking Firm in the networking relationship which is properly qualified to sell and process the NDIP activity in question. Financial Institution compliance and risk management staff should prohibit any effort (either internally or by a Networking Firm in a networking arrangement) to suggest that somehow the use of a private label name obviates the clear requirement to identify the Networking Firm in a networking arrangement as the party offering the NDIP activity. While it is always important that the Financial Institution s NDIP policies address training of staff and management regarding the appropriate role of the Financial Institution in making available NDIPs on Financial Institution premises, the compliance risk to the Financial Institution in a networking relationship is notably increased when a private label name is used. As a result, the Financial Institution s internal training of Financial Institution staff should be matched to the level of risk. Operational Risk Operational risk arises from inadequate Financial Institution oversight of NDIP Networking Firms or Financial Institution employees, sales practice misconduct, poor customer service, or adverse internal or eternal events. Third-party risk management is required in a networking arrangement with a Networking Firm. Appropriate risk management (in this contet) includes implementation of a due diligence process in selecting and monitoring Networking Firms for effective operational risk management. Third-party risk management is discussed in detail in OCC Bulletin , Third- Party Relationships: Risk Management Guidance and is summarized in Appendi C. However, Networking Firm risk management addresses just one of the many risk considerations facing the Financial Institution. A key component to managing the Financial Institution s operational risk is the availability of information reporting to Financial Institution management from the Networking Firm. Effective reporting provides not only an etensive list of readily available reports, but also the ability for authorized Financial Institution management personnel to access the Networking Firm s information system and create reports or search for specific data on an ad hoc basis. The day is long past where a list of canned reports is adequate to manage risk. Similarly, the speed at which investment activity occurs makes the Networking Firm s reports inadequate, even if sent daily. Pohl Consulting and Training, Inc. Page 14

15 An eample of the need for direct management access to data would be the NDIP accounts of senior citizens. Given the attention and concern applied to the handling of the NDIP activity of senior citizens and the speed at which investment activity occurs, it is appropriate for a Financial Institution to epect a Networking Firm to allow Financial Institution management direct access to data systems which provide search capability to Financial Institution management to monitor all NDIP transactions and holdings, including direct held mutual fund positions in a prompt manner. Put more directly, reporting that is delayed, or preprepared by the Networking Firm increases (rather than decreases) operational risk. Appendi E provides additional details on the ongoing monitoring as addressed in Booklet as well as practical guidance on the type of reporting that would be effective in managing operational risk. Strategic Risk Strategic risk can arise from a Financial Institution s NDIP sales program when business planning and implementation do not provide the required resources and risk management to properly manage and control risks associated with NDIP activities. A key element to addressing strategic risk is the initial planning that goes into establishing an NDIP program. The same topics and concerns addressed in planning a new program are appropriate for consideration in monitoring the NDIP activity of a current Networking Arrangement. Booklet states that the OCC epects each Financial Institution to conduct a comprehensive analysis of its securities activities to ensure compliance with the GLBA amendments and the Interagency Statement, and to maintain records to demonstrate compliance. 22 A Networking Financial Institution s comprehensive planning and implementation of actions to address GLBA and Regulation R requirements provides the foundation for the successful strategic operation of the NDIP activity. Appendi B contains a checklist of the factors identified in Booklet that should be included in a Financial Institution s strategic planning process. Reputation Risk Reputation risk is inherent and significant in a Financial Institution s involvement in the delivery of NDIPs. Making NDIPs available on the Financial Institution premises eposes the Financial Institution to potential reputational damage that results from unsuitable sales practices, client misunderstandings of the risks associated with the NDIP offerings, or poor customer service. Reputation risk can be eacerbated by overly aggressive marketing and advertising material that blur the line between the Financial Institution and the Networking Firm (that is actually engaged directly with the customers). To guard against this type of enthusiasm, the Interagency Statement has provided that, to the etent the Financial Institution is identified in materials (such as statements or trade confirmations), the Financial Institution is only identified as the location where the Networking Firm engages in NDIP activities. A common area of enthusiasm is the over reliance on a private label name. Over the years, the use of a private label name to brand an NDIP program has become quite common. While the use of a private label name is not in and of itself inappropriate, nonetheless, the use of a private label name is likely the single largest controllable risk to the Financial Institution s reputation. Pohl Consulting and Training, Inc. Page 15

16 When a private label name is used, it is critical that the Financial Institution s policies, as well as the compliance, risk management and internal audit staff all understand the proper use and the limitations on a private label name in light of the Financial Institution s obligations under the Interagency Statement and the GLBA amendments. Clearly identifying the role of the Networking Firm and the role of the Financial Institution is needed to effectively manage reputation risk. In the event of a problem, a customer could infer that because they bought securities at a location identified by a private label name that is a division of the Financial Institution, then certainly the Financial Institution is in control of and responsible for the activity. An additional eample of a specific reputation risk comes from the identification of the NDIP sales staff. If the Financial Institution s marketing material refers to the NDIP sales staff as our sales staff, then the customer could understandably infer that the sales staff is employed by the Financial Institution and the Financial Institution is in control of and responsible for the salesperson s NDIP sales activity. Again, reputation risk to the Financial Institution is needlessly increased. This particular increase in reputation risk can be avoided by a slight adjustment in wording. Instead of: ZCY Financial Institution makes available NDIPs through our sales personnel conveniently located in our branches which is not only legally incorrect but also increases the Financial Institution s reputation risk, a better statement would be: ZCY Financial Institution makes available NDIPs through the sales personnel conveniently located in our branches which is not only factually accurate but also avoids increasing reputation risk. Credit Risk In a networking arrangement, the Financial Institution is not involved in the etension of margin credit to customers. To the etent that customers seek margin loans, those margin loans are provided directly to the customer by the Networking Firm without involvement of the Financial Institution. By avoiding Financial Institution involvement in margin lending, credit risk to the Financial Institution is also avoided. To the etent that the customer requests credit from the Financial Institution secured by securities, that transaction should be a separate loan unrelated to the networking arrangement. As such, that credit decision would be subject to the Financial Institution s obligations under Reg U 23 and not subject to the broker-dealer s obligations under Reg T CFR 221. Credit by Banks and Persons other than Brokers or Dealers for the Purpose of Purchasing or Carrying Margin Stock CFR 220. Credit by Brokers and Dealers (Regulation T) Pohl Consulting and Training, Inc. Page 16

17 Conclusion Regulatory pressure across all Financial Institutions activities is on the rise. There may be reason to believe that a Financial Institution s involvement in a networking arrangement may also see an increase in regulatory pressure. In fact, the publication of the OCC s Booklet and the closure in 2015 of a broker-dealer 25 that was engaged in a number of networking arrangements both point toward a likely increase in regulatory attention to networking arrangements. Even if there is no increase in regulatory pressure on networking arrangements, we know that the way in which risk is considered and addressed across the financial services industry has changed noticeably in recent years. It is necessary to be better informed and better prepared to identify and properly address the real risks associated with a networking arrangement. The key to running a successful NDIP program from a business and risk management standpoint is to avoid relying upon vendor management as measured by the pound. Many Financial Institutions are endeavoring to show compliance and risk management by focusing on vendor management. The largest pile of data and documents gathered from prospective or current Networking Firms only addresses one of many risks. The single risk addressed is that of Networking Firm selection. However, this leaves the long list of GLBA requirements, Regulation R and Interagency Statement compliance and risk management obligations (to which the Financial Institution is directly subject) unanswered. Financial Institutions should epect their primary regulator to be increasingly focused on the requirements detailed in the Interagency Statement. Even those Financial Institutions who are aware of the long list of additional compliance and risk management obligations arising out of a networking relationship are too frequently poorly equipped to identify and address the obligations. One reason for this situation is that the NDIP products and services offered to customers by the Networking Firm (as well as the applicable NDIP regulatory scheme) in networking arrangements tends to not be an area of eperience (or epertise) for the Financial Institution s compliance, risk management or internal audit staff. Additionally, since the late 1980s, networking arrangements have proven to be not only successful from a business standpoint, but also sales practice and suitability problems have been remarkably infrequent. As a result, customer complaints have been rare: customers have been happy and the Financial Institution has rarely seen a problem arising out of the networking program. Unfortunately, regarding customer happiness and regulatory attention, past performance is no indication of future results Minneapolis/ St. Paul Business Journal. September 24, Securities firm files for bankruptcy liquidation amid legal claims. Pohl Consulting and Training, Inc. Page 17