TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016

Transcription

1 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 NIALL COBURN The views and opinions expressed in this paper are those of the author and do not necessarily reflect the official policy or position of Thomson Reuters.

2 CONTENTS PEOPLE AND CULTURE... 3 CONDUCT RISK... 4 CYBER SECURITY... 4 ANTI-MONEY LAUNDERING AND TERRORIST FINANCING (AML/CTF)... 5 FINTECH... 5 RETAINING COMPLIANCE STAFF... 6 PRODUCT SUITABILITY... 7 THIRD PARTIES, ANTI-CORRUPTION AND MODERN SLAVERY... 7 SENIOR MANAGEMENT LIABILITY... 8 CONFLICT OF INTEREST... 8 CULTURE, ETHICS AND REINVENTION?... 9 ABOUT THE AUTHOR TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

3 2016 is going to be an interesting year for corporate compliance in the Asia-Pacific region. It will be more critical than ever for financial institutions and senior management to take a proactive approach to compliance and risk management. Heightened enforcement, rising penalties and an increasingly complex risk environment will all mean that no one can afford not to be reactive, or to ignore the need to improve ethical conduct was the year when some of the larger regulatory reforms were clarified, multi-billion dollar penalties were handed down and banks had their prudential requirements adjusted. This year will bring a renewed emphasis on ethics and customer responsibility, as regulators in the Asia-Pacific region expect financial institutions to focus more on consumer protection issues, with a special emphasis on product suitability and culture within firms to protect clients interests was also the year when the past caught up with many financial institutions, and some of their more senior staff, for misconduct. It marked something of a watershed with respect to the regulatory clean up which followed the financial crisis. Regulators and the judicial systems began hearing and deciding upon Libor and market manipulation cases, handing down some of the longest jail sentences ever witnessed in the financial sector is likely to see a move toward higher ethical standards. Financial institutions will need to get on with the job of improving their culture and ensuring that their interests are aligned with those of their clients. There will be much more emphasis on conduct risk, product suitability and compliance to ensure the interests of clients are better protected and managed. More focus will be placed on senior management responsibility and working with regulators. This article outlines 10 regulatory risk insights which the author has identified for the Asia- Pacific region during PEOPLE AND CULTURE Regulators internationally have made it clear that organizations must make culture one of their main priorities for 2016, and experts have said that there will be a lot of work to do. Banks have sustained considerable reputational damage over the past five years, and yet there continue to be episodes of serious misconduct, which further erode public confidence. Invariably, a bad culture at a financial institution leads to poor outcomes for consumers. Regulators now expect financial institutions to prove, by their conduct, that they have improved their culture, that their interests are aligned with those of their customers, and that customers are put first in all situations. Financial institutions are represented by their staff, and if those staff act unethically, this will affect the reputation of the whole organization. The actions of people and the culture of financial institutions are the big drivers of conduct in the financial services industry. The development of a proactive ethical culture that can be clearly demonstrated and evidenced to regulators will be a critical first line of defense for financial institutions. At a Thomson Reuters Regulatory Summit in 2015, 43 percent of the 500 delegates said that they were unhappy with the culture within their financial institution and that improvement was needed. Comparable statistics arose out of similar summits in Hong Kong and Singapore. 3 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

4 Compliance training plays a vital role in developing an ethical corporate culture, and financial institutions will need to focus on this as enforcement authorities review how culture influences the way business is conducted. Getting culture right and ensuring that staff are properly directed will require a paradigm shift for many financial organizations and for the board of directors who must steer the ship. Some Asia-Pacific regulators, such as the Australian Securities and Investments Commission (ASIC) and the Hong Kong Securities & Futures Commission, are now placing even more emphasis on culture. ASIC has said it intends to take enforcement actions against institutions where it finds that culture is driving bad outcomes. Directors of financial institutions will have to establish the appropriate tone from the top that cascades down to staff at all levels. 2. CONDUCT RISK The term conduct risk refers to the process that financial institutions must use to assess the way they conduct their business and the way regulatory risks and expectations are effectively managed within the organization. Many regulators in the region feel that firms still have a long way to go in terms of implementing conduct risk and that change does not seem to be happening quickly enough. Surveys carried out by Thomson Reuters in Asia have suggested that many senior bankers do not fully understand conduct risk and how it should be implemented and measured across business lines. Regulators will require financial institutions to determine what conduct risk means for their business and how risks to customers can be mitigated. Firms need to have compliance processes in place to ensure that their regulatory obligations are being monitored, analyzed and managed. Boards of directors and senior managers will have to play a much more active and critical role in ensuring that there is appropriate accountability and that conduct risk issues are managed competently throughout the organization. Senior management will need to look at product design risks, execution risks and environmental risks, such as product performance and regulatory focus. It will be essential for conduct risk to be implemented correctly across the organization and for it to be understood clearly on the front lines. Failure to get conduct risk right will result in regulatory intervention and reputational damage. 3. CYBER SECURITY Internationally, cyber attacks on organizations carry an estimated price tag of $100 billion a year. Cyber security presents major challenges for Asia, not only for financial institutions but also for regulators and law enforcement agencies, which must investigate cross-jurisdictional cyber attacks. Despite the enormity of the potential threat, however, the region still lags behind Europe and the United States in ensuring that financial institutions have appropriate systems in place to avert cyber attacks. Resources in this area have increased recently, notably through the establishment of the Interpol Global Complex for Innovation (IGCI) in Singapore to deal with cyber crime. More support is needed, however, and attempts to fight cyber crime across Asia are hampered by the culture of non-disclosure regarding cyber attacks on the part of both financial institutions and governments. This allows hackers to continue to operate almost undetected in the region and leaves its financial sector particularly vulnerable to attacks. 4 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

5 Financial institutions must ensure they have appropriate resources and systems in place to protect the business and must pay particular attention to customers personal data. In the UK and the United States, regulators are reviewing institutions risk management and data security policies to ensure they are sufficiently resourced and that staff have been adequately trained about the risks. Asian regulators are likely to follow suit. Responsibility for cyber security rests clearly with the board of directors and senior management is the year when financial institutions in the region must shore up their defenses and be more prepared for cyber attacks. 4. ANTI-MONEY LAUNDERING AND TERRORIST FINANCING (AML/CTF) There is considerable international determination to combat terrorist financing, and compliance staff need to stay on top of how regulators worldwide are interpreting the rules. Asian governments and regulators have adopted the standards set by the Financial Action Task Force (FATF) in varying degrees. There are two important issues in the region: the training of compliance staff in AML/CTF, and the need for financial institutions and government agencies to get better at sharing information to combat organized crime and terrorist financing. Finding ISIS accounts remains a high priority given recent terrorist attacks in Indonesia. Asia s financial institutions are the front line against money laundering and terrorist financing and are under increasing pressure to be far more effective in the way they assess clients, determine beneficial ownership and deal with suspicious transactions. Government agencies depend heavily for leads in investigations on financial institutions ability to report suspicious transactions or questionable beneficial ownership matters. Continuous training for compliance staff remains essential so that staff know when, and how, to escalate suspicious transaction reports. Nevertheless, the disjointedness in the application of FATF standards across the region gives rise to a number of challenges, such as a disconnection between financial institutions sharing information, sloppy assessments of beneficial ownership, and the hit-or-miss nature of coordination between law enforcement agencies across the various jurisdictions. For example, there is a complete lack of information available about the investigations, convictions or operations of money launders despite the heavy regulation. It is not for the want of regulators across the region emphasizing the need to improve AML/CTF requirements. Rather, structural issues or weaknesses seem to impair effective implementation of AML/CTF frameworks. For example, whereas only 13 percent of core FATF recommendations were rated noncompliant for Singapore and Hong Kong, Vietnam had 94 percent non-compliance with core recommendations. Thailand, the Philippines and Indonesia were more than 80 percent noncompliant. Put simply, these disparities need to be dealt with as soon as possible, since this level of disconnection allows organized crime to move money comfortably through the weaker jurisdictions and leaves a gaping hole in the AML/CTF framework in Asia. 5. FINTECH Financial technology, also known as fintech, is a line of business based on using recently developed software to provide financial services. It includes platforms that link individuals and companies involved in start-up operations such as peer-to-peer lending, crowd funding and a new range of remittance transfer services. 5 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

6 Fintech is a wide-ranging phenomenon involving start-ups from Asia, Africa, Europe, the United States and Russia. International investment in fintech startups has increased significantly: It tripled between 2013 and 2014, from $4 billion to $12 billion. Some commentators have predicted that this is the start of a financial services revolution, while others have pointed out that these start-ups have only a small share of the market and have made little impact. Although there has been very little substantive research, it seems clear that fintech has begun to develop platforms that appeal to a younger generation of customers, are pushing regulatory boundaries, and have bankers scratching their heads. While traditional banks concentrate on fixing obsolete systems and attempting to merge outmoded technology with new systems, fintech companies are able to invent new systems and run forward looking for gaps in the marketplace. They are seeking out business opportunities that bypass the middleman and deliver services with substantially reduced costs to consumers. Regulators in Hong Kong, the UK, the United States and Australia are trying to accommodate and encourage fintech start-ups, and there have been many examples of regulators working to help this emerging sector build credibility and trust. Nevertheless, there remains a lot of ground to be covered. In particular, fintech raises know-your-customer and client suitability issues. Regulators may also need to resolve concerns about cross-border advice and harmonization of products. For example, a fintech company from Malaysia providing crowd lending services to a small business in Hong Kong will raise a number of regulatory issues, depending on the product and the circumstances. 6. RETAINING COMPLIANCE STAFF Maintaining good compliance staff will be a challenge for many financial institutions in Over the past five years, there has been a huge increase in demand for experienced compliance staff, and all the indicators suggest that this trend is only likely to increase in the Asia-Pacific region. This raises two important questions for this year: How do financial institutions move away from the revolving door syndrome, and how do financial institutions keep their compliance staff and ensure business continuity? Compliance staff are being placed under more and more pressure. Regulatory changes and numerous cross-border products have made compliance much more complex, and senior management have far higher expectations of the function. It is essential that senior management and directors emphasize to all staff just how important the role of compliance is to the business and that they demonstrate clearly that compliance has the board s full support. This message should cascade down to the most junior compliance officer. Good employees want to know what type of job they are doing and want to be recognized for it. Compliance professionals have to be seen as being supportive and as playing a significant role in product development. Financial institutions must be aware that if they fail to treat compliance staff properly or fail to provide sufficient development opportunities for them, they may lose the very skills they need to protect the organization. In the coming years, there may very well be a shortage of high-caliber compliance professionals, and institutions will have to do a lot more than they have done in the past to retain the best talent. 6 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

7 7. PRODUCT SUITABILITY Suitability remains an international theme for both retail and wholesale firms that have been called out for being less than scrupulous in the sale of financial service products. Regulators internationally have reported that firms need to make substantial improvements in gathering, recording and updating customer information. There have been numerous examples of financial institutions being involved in misselling. The Financial System Inquiry in Australia (FSIA) focused on the need for financial institutions to ensure good customer outcomes and noted that this was connected to a positive culture and conduct risk operations that ensured firms interests were in line with those of their clients. The FSIA emphasized the need for a more clientfriendly approach in the way documents are designed and explained. All too often, policies and procedures have been designed to ensure compliance with suitability obligations but ultimately have ended up suiting the particular operating model of the financial institution rather than starting with clients requirements and working back. This year will see a greater focus by regulators on product suitability and on how products are represented to customers. 8. THIRD PARTIES, ANTI-CORRUPTION AND MODERN SLAVERY In the UK and the United States, a raft of new anti-corruption laws in the past few years has made businesses more liable than ever for corrupt acts or acts committed by third-party associates such as suppliers and vendors. At the same time, reliance on third parties has increased, along with regulator scrutiny. Financial institutions need to understand how third parties deliver services and conduct due diligence on the supply chain and must also ensure that there are no elements of modern slavery in the supply chain. These have become reputational issues for organizations internationally. Corruption remains a very important issue for the Asia-Pacific region. A number of countries in Asia, notably Australia, China, Indonesia, Malaysia and Singapore, have stepped up their efforts to improve their legislation and hold companies accountable for corrupt practices. The main issue, however, is how to translate this into the culture of institutions across the region to encourage organizations to comply with international best practices. That said, one of the biggest criticisms of anti-corruption efforts in Asia has been weak enforcement; despite the new legislation, a number of high-profile companies have been found to be involved in corrupt activities. Even though many Asian nations have signed the United Nations Convention against Corruption, few have gone on to introduce legislation that is sufficiently strong to deal with corrupt companies and directors or provided appropriate resources to investigate and prosecute corrupt activities or examine slavery issues. Firms must be more diligent and ensure that they have strict anti-corruption practices in place, especially in foreign jurisdictions. The recent Senate Inquiry in Australia highlighted the importance that the government attaches to this area. Indeed, Australia and other Asian countries are likely to adopt U.S.- and UKstyle anti-bribery legislation that focuses on individuals and companies failing to prevent the crime. 7 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

8 Internationally, China has emerged as the jurisdiction with the largest number of highprofile prosecutions against corruption involving local individuals. The government s continued determination to fight corruption has been achieved through a number of well-resourced agencies. More recently, China has introduced a Ninth Amendment to the PRC Criminal Law whereby organizations and third parties involved in corrupt activities will be subject to tougher sanctions; indeed, individuals can even be subject to the death penalty. Over the next year, financial institutions need to place more emphasis on dealing with corrupt practices and must train staff to be aware of the issues. Those that work with affiliates can expect more intensive scrutiny to ensure they are performing appropriate due diligence on all third parties. 9. SENIOR MANAGEMENT LIABILITY Many senior compliance professionals might have been expected to oppose the introduction of senior management liability. At the Third Australian Regulatory Summit 2015 held in Sydney in May 2015, however, 68 percent of attendees at the summit s Conduct Risk Panel voted to introduce senior management liability in Australia even though two very senior compliance professionals on the panel had said they did not see the need for it. There were similar results in Hong Kong. Compliance professionals appear to believe that senior managers should be on the hook if things go wrong and accountable for business operations, especially when there are known gaps in business operations or issues that have not been dealt with. In the UK, the reforms to senior management liability are due to take place in March They are designed to restore trust in financial services and to impose more personal risk on directors, providing regulators with a line of sight in relation to decision-making across the business. The UK s approach is not a heavy burden, however, and only applies to senior managers and directors in the most serious of cases where they have knowingly or willfully taken action, or failed to take action, that contributed to serious issues for customers or the institution. Enhancing individual accountability in financial institutions should help to introduce high standards of conduct and should positively influence the general culture within business operations because individuals will want to ensure that they adhere to compliance and regulatory requirements. Having clearer senior management functions and ensuring clear lines of responsibility can only contribute to making financial institutions stronger. Regulators expect a clear line of sight as to where responsibility lies for actions within financial institutions, especially where there have been detrimental outcomes to customer interests. 10. CONFLICT OF INTEREST Conflict of interest is a regulatory topic that has been at the center of many enforcement cases. In the United States and the UK, numerous highprofile firms have been sanctioned and fined for conflict of interest failings, and in Australia, Hong Kong and Singapore many traders or fiduciaries have been involved in insider dealing or placed their own interests first. Compliance functions should consider carrying out a review of the way their organization identifies and manages conflicts of interest as part of their monitoring plans for TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

9 Monitoring conflicts can be more effective when conducted by both business and compliance functions. Firms should ensure that they have appropriate controls and that they have compliance standards that manage conflicts in accordance with best practice and regulatory guidance. It is important for boards to have committees that are dedicated to conflict of interest issues and can identify and manage issues that come to their attention. Conflict of interest does occur; organizations need to consider how it is managed and how it is disclosed so that any situations that arise are dealt with fairly. CULTURE, ETHICS AND REINVENTION? 2016 will be a year for senior management to improve culture within their organizations and to ensure that ethics is a major consideration at every level. Developments in fintech and in the various new financial platforms will also demand considerable attention. Financial institutions have the opportunity to reinvent themselves in the public eye, and to set themselves apart by ensuring customers have suitable products and that improved compliance and ethical standards are at the very center of the organization. 9 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

10 ABOUT THE AUTHOR Niall Coburn is the Thomson Reuters regulatory intelligence expert for the Asia-Pacific region. He joined Thomson Reuters in 2013 from FTI Consulting where he was a managing director for regulatory investigations in Australia. Prior to that position, Niall was a senior specialist adviser to the Australian Securities and Investments Commission (ASIC) and director of enforcement for the Dubai Financial Services Authority (DFSA). He was part of an international team that wrote the regulatory and financial market laws and rules for the Dubai International Financial Centre. Niall is a barrister of the High Court of Australia and holds Bachelor of Arts (economics) and law degrees from the University of Tasmania, a Master of Laws Degree from Melbourne University and a diploma of business administration from Mt. Eliza Business School. Niall has over twenty years of experience in financial markets and international regulation. In 2002, he was awarded an ASIC Australia Day Honour Medal for his work in corporate investigations. Niall began his career as a legal aid lawyer and also worked with Aboriginal legal aid. Upon entering the Victorian Bar in 1987, he specialized in corporate law. He joined ASIC as a principal lawyer and was involved in a number of high-profile corporate investigations in Australia and internationally resulting in convictions. He has worked in the Middle East and Asia liaising with other international regulatory bodies and government agencies. Niall has published extensively on compliance and financial regulation internationally. He has written a book on corporate investigations and insolvent trading published by Thomson Reuters, and he has been a commentator in the Australian Financial Review on financial regulation and compliance. Niall Coburn Senior Regulatory Intelligence Expert, Asia-Pacific Thomson Reuters 10 TEN REGULATORY RISK INSIGHTS FOR THE ASIA-PACIFIC REGION IN 2016 JANUARY 2016

11 RISK MANAGEMENT SOLUTIONS FROM THOMSON REUTERS Risk Management Solutions bring together trusted regulatory, customer and pricing data, intuitive software and expert insight and services an unrivaled combination in the industry that empowers professionals and enterprises to confidently anticipate and act on risks and make smarter decisions that accelerate business performance. For more information, contact your representative or visit us online at risk.thomsonreuters.com ABOUT THOMSON REUTERS Thomson Reuters is the world s leading source of intelligent information for businesses and professionals. We combine industry expertise with innovative technology to deliver critical information to leading decision makers in the financial and risk, legal, tax and accounting, intellectual property and science and media markets, powered by the world s most trusted news organization. With headquarters in New York and major operations in London and Eagan, Minnesota, Thomson Reuters employs approximately 60,000 people and operates in more than 100 countries. For more information, go to thomsonreuters.com 2016 Thomson Reuters S030985/2-16