Risk Management & Regulatory Compliance

As a big football fan, the mantra – from coaches and sports analysts alike – of how the defense protects your house and ultimately wins games has been imprinted upon me.

Change is a constant in the banking industry, with pressures coming from both internal and external directions.

A decade ago, banks expected regulators to arrive for scheduled routine examinations, where they would conduct external testing and point out any problems they uncovered. But as we look at today’s regulatory landscape, the scenario has flipped. Across the industry today, regulators increasingly expect banks to have robust risk management frameworks to proactively catch and resolve issues before anyone else identifies problems – and especially before any customer impact occurs.

The Consumer Financial Protection Bureau (CFPB) recently announced that it’s back to business as usual. 

Growth-oriented business owners regularly review key metrics and performance indicators to gauge their company’s financial health. But in today’s data-rich environment, the real advantage comes when leaders and analysts are focused on the right metrics.

Too often, banks – and their employees – think of traditional risk management teams as the heart of your organization’s defense. After all, aren’t they the ones responsible for making sure you follow the rules, mitigate risks and fix things when they go wrong (especially when it’s a big regulatory issue)?

In late March, several Spinnaker team members participated in ABA Risk 2021, both as panelists and attendees. This premier risk conference from the American Bankers Association combines enterprise risk management, insurance risk management and risk quantification, while delivering expert takes on current and emerging threats along with best practices.

Cutting-edge technology, coupled with the disruption of COVID-19, has driven significant change in the banking industry this past year. Consumers are now more apt to choose online banking services – a trend that’s been bolstered by the continued ingenuity of the fintech segment. And while customers are keeping banks on their toes with continued demand for new tech, we expect that demand to be accompanied by new policy and regulatory pressure in the next five years.

The Big Picture Digital transformations are designed to make things easier for customers and banks. In the process, however, companies often face unexpected hurdles. Using these moments to address emerging challenges is important, but there’s also much to gain from taking a step back – and, when necessary, leveraging an outsider’s eye and experience – to see if other meaningful opportunities have been overlooked.

Within days of the international declaration of the pandemic, federal leaders tossed a lifeline to small businesses in the form of the Paycheck Protection Program. But before the ink was dry on the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which offered forgivable loans to help eligible American companies keep their lights turned on and pay their employees, banks were stepping into a minefield of risk.

Every year, tens of thousands of pages are published in the Federal Register, with a good chunk of themdetailing what banks need to deliver in serving their customers. In the past decade, the Dodd-Frank Wall Street Reform and Consumer Protection Act came in at the equivalent of nearly 1,000 pages and prompted several thousand more pages of rules and regulations, including, as just one example, the TILA-RESPA Integrated Disclosure (TRID) rules. Tack on relatedregulations published as a result of the Dodd-Frank Act,other more recent regulatory amendments likethose made to the Fair Debt Collection Practices Act (FDCPA), as well as state-specific requirements, and you’ve got enough paperwork to fill a library.

For most of us, having 2020 in our rearview mirror is a welcome sight.

As most entrepreneurs will tell you, developing a business plan is one of the first critical to-do’s for establishing a new entity. Once that item is checked off the list, there’s often an eagerness to move straight into execution. But hammering out the details of your organization’s “what” is only a starting point. Particularly in professional services, there’s tremendous value in solidifying the very meaningful – albeit intangible – elements around team and culture, which are big drivers in enabling effective execution.

The Big Picture Pick up recent copies of The Wall Street Journal or American Banker, and you’ll see headline after headline about consent orders and hefty fines issued by the Consumer Financial Protection Bureau to mortgage companies caught using deceptive advertising practices. This summer alone, eight have been issued. Two things immediately strike me when I see these stories: Many of these cases didn’t have to happen. And while these particular consent orders were concentrated in the mortgage sector, similarly problematic issues are most certainly occurring in other lending segments across the financial services industry. After a hundred years or so, you’d think we would know how to follow regulatory rules –particularly those put in place to protect consumers. Indeed, the first such laws were framed by the states before World War I – although the first meaty federal law, the Truth in Lending Act, wasn’t passed until 1968. Every new regulation layered in since then largely continues to further shield consumers from unfair practices – which often start with glossy ad campaigns designed to get them in the physical or digital door. The reasons why we’re still struggling with compliance aren’t too difficult to understand: turnover within organizations, competing priorities, a lack of sound controls, new staffers who are unfamiliar with existing regulations, and a never-ending list of new ones, including Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) and the Mortgage Acts and Practices (MAP) – Advertising Rule. There’s also often a gap between the intent of any new regulation and how marketing teams interpret it. The risks of not crossing every “t” and dotting every “i” are significant, as evidenced by these recent consent orders. Doing things the wrong way also can mean costly penalties, time-consuming regulatory remediation, and loss of customer trust – which can translate into higher complaint volumes and even lawsuits. Let’s explore some long-lingering myths about how banks advertise their lending products – and, more importantly, what your financial institution should be doing. MYTH: Legal and Compliance don’t need to review my ad since I’m the expert in marketing. FACT: This is the biggest myth that persists in financial services marketing and advertising. Every word you use to communicate has specific and nuanced meanings, and your legal and compliance teams have a responsibility to protect your company and consumers alike. No external ads or marketing materials should be released until you get signoff from your legal or compliance team. It’s not any more complicated than that. MYTH: Our marketing team knows what Legal and Compliance have told us. We get it, but we need leeway to make our ads eye-catching and even a bit sexy so we can get business in the door. One little word change doesn’t really make a difference. FACT: Remember how former President Bill Clinton faced legal drilling over his interpretation of the word “is”? You’d be surprised at exactly what a bank must validate before it advertises anything as “free.” That word “free” – and countless more – are triggers, often requiring specific disclosures on how they apply to what you’re advertising right at that moment. Ideally, your marketing and advertising teams should collaborate almost daily with your legal and compliance teams. Of course there’s going to be some friction between the advertising folks, who see in every color of the rainbow, and the legal and compliance folks, who typically only see in black and white. The important thing is to build processes and procedures that enable effective and efficient reviews of all advertising and marketing materials, and that begins with concepts. When you involve those responsible with compliance up front, they can help rethink an approach in ways that ensure the final ad meets regulatory requirements. Also, try taking their early “no” to mean “not yet” and be open to ideas on what could translate into an easy reframing. But go to them at the end with an ad that fails on every compliance front, and their “no” will be just that. When I was at a bank that now has more than $30 billion in assets, my compliance team worked diligently to become a strategic partner to the marketing team. It took some time, but our peers came to see that we never aimed to derail their vision. As our relationship evolved, so did our interactions. In fact, we created a desktop resource that allowed marketers to easily look up the latest laws or match sales terms with the necessary disclosures, delivering a self-service tool that also empowered them to create responsibly and expedite the review process. Rest assured, the goal of your bank’s lawyers and compliance officers is not to thwart creativity, but to ensure that amazing ad concepts give consumers precise, clear information about the company’s products and services, allowing them to make smart financial decisions. Believe me: Compliance teams want powerful, compelling and even award-winning advertising that brings more revenue in the door, because when you have that, everyone benefits. MYTH: Our market competitor ran an ad just like that. If they got away with it, then it’s OK and the legal and compliance team is overreacting. FACT: This is the corporate version of your mother asking you, “If everyone was jumping off a cliff, would you do it, too?” The only truth here is that your competitor ran an ad. You don’t really know if that financial institution “got away with it.” In fact, you might learn not too far down the road that your competitor actually got caught red-handed with a compliance violation. After all, the underlying premise of advertising is to spread the word, and regulators are paying close attention. Frankly, you should be analyzing what your competitors are doing, but I’m not talking about their advertising. Take a good look at every consent order or other regulatory action you hear about and compare it to what’s happening in your shop. Are you doing things the right way? Are you identifying and avoiding the possible risks in your process? In other words, consider that the teacher has given you every answer to the test, and you don’t want to fail down the road. MYTH: The bank’s advertising agency developed that campaign – not our internal team – so we’re not going to get in any trouble. FACT: Time and time again, oversight organizations stress that any third-party vendor – whether it’s an ad agency or a cross-sell phone queue – is a seamless extension of your financial institution. If they get it wrong, so do you. You don’t outsource the compliance responsibility along with the work. MYTH: All of that applies to my bank or mortgage company – not to me as a loan officer. I’ll post a special offer on my social channels just for my customers. FACT: Your very title of “loan officer” means you’re an officer of your financial institution, and the same exact requirements apply to you. Without question, the growing influence of social media makes consumer outreach easy, but the brevity and ease of these same platforms also make it more difficult to keep your team members from going rogue. The same compliance standards apply to all of your advertising, including any unsanctioned materials. Every employee needs to understand this responsibility. (BTW, don’t forget about old-fashioned tactics, such as a quick sales flyer that a teller might create and post in a branch. Whether that flyer meets your advertising brand standards is the least of your worries, because you’re most likely out of regulatory compliance.) MYTH: Getting an internal review takes so much time that we’re losing competitive advantage. FACT: Doing it right takes a fraction of the time needed to fix things – particularly if you’re cited for a regulatory infraction – and maintains your institution’s reputation. Yes, a legal or compliance review is another step in your marketing process, but it’s a short blip in the lifetime of a successful business. In my previous role, I was intentional about building interactions with the marketing team that served everyone’s needs as efficiently as possible. If a federal agency comes at you with a consent order or Matter Requiring Attention, you’re going to spend significantly more time finding the root issue, solving for your misstep, gaining regulatory signoff and getting back to work. You also can’t rebuild consumer confidence overnight – even with the most attractive offers in your marketplace. After all, if your customers know you’ve been under scrutiny before, do you think they’re going to trust that you’re being straight with them this time around?

Business owners spend their days developing smart strategies, taking calculated risks and working hard to grow successful companies. When they decide to leave or retire, the last thing they want to see in the rear view mirror is their company starting to stumble. That’s why they should plan from launch day for two eventualities: their own personal retirement and the business’ future success.

The Big Picture In today’s heightened regulatory environment, it’s hard to imagine that just a decade ago, banks handed over charged-off accounts to outside recoveries agencies without much thought. After all, the bad debt had been written off and the banks had already invested considerable resources during the collections process trying to get those customers reestablished.

The Big Picture Suppose you go to your doctor with a nasty cough or nearly bent over with stomach pain. You wouldn’t be too happy if your provider barely looked at you, jotted off a quick prescription and sent you away. Instead, you’d want your doctor to do a full exam, check your lungs for that cough – maybe run a blood test or order some sort of imaging on your abdomen.

The Big Picture Aggressive growth is a great business goal, but to achieve it the smart way, organizations need to have their houses in order first. One Top 25 bank was recently moving forward with a growth plan when it was stopped in its tracks by a consent order. Rather than gearing up for expansion, the company found itself needing to implement and maintain an effective Compliance Management Program (CMP) to meet consumer protection regulations – and the team charged with the effort had limited bandwidth and expertise.

Market conditions are constantly changing, which means businesses must have the flexibility to adapt to operate successfully. But all the flexibility in the world could not have prepared businesses for the impact of the novel coronavirus. Almost immediately after COVID-19 began spreading across the United States, the economy took a huge hit that included major job losses.

Late last month, I had the pleasure of attending and facilitating a couple of on-demand panels for the American Banking Association’s (ABA’s) first-ever Risk and Compliance Virtual Conference.

Earlier this year, I was chatting with a prospective client whose professional experience looked much like mine, and many of our consultants, before coming to Spinnaker: a senior VP from a fortune 500 financial institution who’s hired countless consultants to solve complex problems.

Steady and reliable cash flow is essential to a company’s daily operations. Knowing when to expect revenue gives owners confidence in paying their own expenses, but understanding cash flow cycles is just as important to business growth – and having a buffer in case of a crisis. Good cash flow analysis can confirm that there’s money to keep the lights on, but deeper analysis can uncover ways to best capture cash from every revenue stream.

Ask Cara Williams what’s the one thing she’d take to a desert island, and you won’t be surprised to learn she’s packed a boat.

Credit Reporting Agencies are the backbone of our nation’s lending practices, as the information they deliver about a consumer’s financial profile often determines the terms of any loan and whether an application is approved. In normal times, as a best practice, banks and other financial institutions regularly furnish customer data to those agencies, also known as credit bureaus – but they maintain autonomy on what they furnish and to which agency.

Everywhere you turn or click these days, there’s a new story about how COVID-19 is impacting every aspect of the global workforce for the foreseeable future. Thanks to this giant disruptor, such is the case with Fortune 500 financial organizations who’ve uprooted Customer Service Representatives (CSRs) from contact centers into the comfort (or depending on their personality or circumstances, discomfort) of their home.

Following a period of rapid growth, a large US commercial bank realized it needed to rethink the way it organized its business units, as a means to create greater visibility into risk and opportunities. The organization’s Enterprise Risk Management (ERM) team tapped Spinnaker to help justify that transition and begin to envision what transformation might actually look like.

As the world braces itself for the economic impact of COVID-19, banks are looking to credit risk models in an attempt to quickly understand and forecast the effects of such rapid change. But putting these models to work is no easy task.

When a Top 25 US bank was issued a consent order to tighten its internal controls in order to better mitigate risk, the bank uncovered a need for defined processes and quality assurance protocols within its Trust department. Looking for immediate guidance and Trust expertise, the team brought Spinnaker on board to identify existing gaps, define procedures and create a path to compliance.

Normally, we don’t get confirmation from the National Bureau of Economic Research on whether we’ve hit a recession until long after its start. Whether that confirmation comes sooner during the COVID-19 crisis is beside the point – many experts agree that as of March 2020 we’ve entered a recession.

The European Union’s General Data Protection Regulation is just the tip of the iceberg when it comes to protecting consumer data. It’s by far the most comprehensive regulatory guideline to date, and its reverberations are already being felt stateside.

If you’ve spent any time in the last ten years in or around compliance, you’ve likely heard about the “three lines of defense” (3LOD) model – business units are primarily accountable for compliance and are considered the first line; the compliance team is the second line, checking the work for the first line; and internal audit operates as an independent third line assessing the first two lines. While the model has been widely accepted (and in most cases expected by regulators), the approach has been gaining some critics. The growth of the FinTech industry has caused many to question how viable and applicable the 3LOD model is for smaller organizations. While the concept is solid, it’s time to adapt the model to account for the wide array of organizations now operating in Financial Services.

An upcoming regulatory exam can strike fear into the heart of even the most confident and experienced business leader. And while there’s no trick that will make all of that anxiety go way, knowing what to expect when the examiners arrive on site can go a long way to alleviating your concerns. Here are a few steps you can take to better set you and your team up for a successful exam: