Defining compliance risk

Compliance risk can be defined as ‘the risk to earnings or capital from violations, or
nonconformance with laws, rules, regulations, prescribed practices, or ethical standards’
(OCC Comptroller’s Handbook, 1997). Compliance programs typically originate
to satisfy external laws and regulations. As programs become more developed, they
start to include monitoring of adherence to internal guidelines and management
directives. One stumbling block is that compliance risk is often not subject to
sufficient scrutiny. Instead, ‘compliance risk is often overlooked as it blends into
operational risk and transaction processing.’1
Focusing exclusively on satisfying external compliance is a necessary but perhaps
not a sufficient standard. The derivatives markets continue to outpace the regulators
and oversight often lags behind the creation of new products and markets. The ‘crazy
quilt’ structure of derivatives’ regulations tends to compound these compliance
risks since oversight gaps occur. Given the overlapping and sometime conflicting
framework of oversight, this can be a real challenge. (See the Appendix for an outline
of US and UK regulatory schemes.) Compliance controls remain a front-line defense
and the proper goals should be to help insure against large losses as well as prevent
regulatory violations.
The typical reaction to compliance standards is that one needs only to maintain
minimal standards. Cooperation from the business staff is often limited. Compliance
is not a particularly popular topic among traders and salespeople since they focus
on business targets leading directly to higher compensation. Only grudgingly will
employees focus on this type of risk and often, the focus is on the negative duties of
compliance. The reality is that compliance can ‘empower people’. These controls
enable people to accomplish goals and ensure closure. ‘It is only when procedures
are neglected or abused that they become an impediment.’2
The other extreme may occur where compliance controls represent a virtual
straitjacket. In some organizations, compliance standards to satisfy regulatory
requirements are set so high that they become obstacles to daily business. Typically
this occurs when a company has suffered a major loss and attempts to ‘overcompensate’
for past errors.3 A companion danger is when internal controls are so rigid, an
exception must be made for normal, large-sized transactions. The automatic granting
of exceptions can easily undermine controls or foster an attitude that all standards
can be negotiated.
The dramatic growth and widespread usage of derivative instruments as well as
the diversity of market participants have provided fertile ground for disputes. Given
the large sums of money involved and the relatively small amount of initial cash
outlays (i.e. leverage), compliance failures have been costly. This has been a major
risk in the derivatives world since the Hammersmith and Fulham case in the 1980s,
through the Procter & Gamble fiasco of 1994–5, to today where companies in Asia
are attempting to renege on losing derivatives contracts.
Hammersmith and Fulham was a municipal UK entity that engaged in swap
transactions. The English courts determined that the transactions were outside the
scope of the municipality’s charter (i.e. ultra vires) and the municipality was not
required to pay accumulated losses of several hundred million pounds. A more
thorough legal review of the counterparty’s ‘capacity to contract’ would likely have
limited the losses suffered by the counterparty banks.
Procter & Gamble was able to avoiding paying much of its swap losses due to the
failure of the counterparty bank to provide accurate valuations and full disclosure
as to transaction risks. A stricter control oversight of client communications and of
periodic valuations sent to the client would likely have limited these losses by the
counterparty bank. The current litigation involving Asian companies centers again
around similar issues of disclosure and fiduciary duties, if any, that exist between
the swap counterparties. In today’s litigious environment, compliance errors often
have expensive consequences. 493