Misconduct in the financial services sector can lead to fines and sanctions for a financial institution and a drop in the value of shares for its stockholders. On April 20, 2018, the Financial Stability Board (FSB), an organization of international financial regulators that monitors and makes recommendations about the global financial system, issued a set of options it is calling a “toolkit” to assist regulators in determining how best to address conduct issues in their respective jurisdictions. Financial Stability Board, “Strengthening Governance Frameworks to Mitigate Misconduct Risk: A Toolkit for Firms and Supervisors,” April 20, 2018. The document offers a wealth of information and sources on developing a workable corporate governance framework to address the causes of misconduct and how best to mitigate them.

This month's column will discuss the highlights of the toolkit.

What Is 'Misconduct'?

In order to fully understand the context of the toolkit, one must first understand what the FSB considers to be misconduct. The FSB defines it as “conduct that falls short of expected standards, including legal, professional, internal conduct and ethical standards.”

Areas of Importance

The FSB has developed 19 “tools” for financial institutions (“firms”) and/or regulators, falling into what it identified as three general categories: (1) cultural drivers of misconduct; (2) individual responsibility and accountability; and (3) the “rolling bad apples” phenomenon (where individuals who engage in misconduct in one place are able to obtain subsequent employment elsewhere without disclosing their earlier misconduct to the new employer).

Cultural Drivers of Misconduct

The FSB report notes that “a culture that values appropriate conduct can reduce incidents of misconduct, including by supporting and reinforcing governance frameworks.” The report cites three influential elements of culture as (1) leadership that sets the correct tone from the top, (2) a decision-making process that can resolve competing priorities, allow for challenge and debate and communicate clearly a firm's strategy and risk appetite and (3) a firm's values and behavioral norms that reflect and support the firm's purpose and its activities. Its recommendations or “tools” in this area aim to address all three of these areas.

The first three tools are for the firms themselves, recommending that they articulate, identify and act in developing the appropriate corporate culture.

Tool No. 1: Firm senior leadership need to articulate what it wants in terms of (1) aspects of corporate culture that can mitigate the risk of misconduct and (2) a clear cultural vision that will guide appropriate behavior at the firm.

Tool No. 2: Senior leadership need to identify significant cultural drivers of misconduct by using multidisciplinary techniques to identify and analyze the drivers of misconduct that are in conflict with the cultural vision of the firm described in Tool No. 1.

Tool No. 3: Senior leadership need to act to shift behavioral norms to the firm's cultural vision and reinforce governance frameworks developed to mitigate the “cultural drivers” of misconduct.

The next set of recommendations is aimed at regulators and how they can best motivate the firms under their jurisdiction to establish and further a corporate culture aimed at deterring misconduct in the first place.

Tool No. 4: Regulators should develop a supervisory oversight program that is focused on reviewing how firms have developed a corporate culture that mitigates the risk of misconduct.

Tool No. 5: Regulators should consider using a risk-based approach in order to prioritize for review those firms that display significant cultural drivers of misconduct. This review could be part of the regular examination process or part of a specific targeted review.

Tool No. 6: Regulators need to use a broad range of quantitative and qualitative information when they do review and assess a firm's “cultural drivers” of misconduct in order to determine how the governance process works at that firm.

Tool No. 7: Regulators need to be able to effectively communicate their findings and concerns to a firm's senior leadership regarding that firm's culture and any misconduct it has uncovered.

Strengthening Individual Responsibility and Accountability

In surveying different jurisdictions, the FSB found that regulators' ways of promoting a strengthening of individual responsibility and accountability usually involved the firm's need to identify and describe its key functions and responsibilities, then allocating those key functions and responsibilities to the appropriate individuals and holding them accountable for their actions.

The following three tools could be utilized by either firms or regulators because they could be implemented either by a firm itself or its regulator or a combination of both.

Tool No. 8: Identify key responsibilities at the firm, including those that can mitigate the risk of misconduct, and assign them to holders who will promote individual accountability and increase transparency. This can be developed by the firm itself, or set out in law or regulations.

Tool No. 9: Individuals in these key positions should be held fully accountable for their actions, either because it is mandated by regulation or required by the firm, such as through a contract with the employee clearly setting out the specific responsibilities of the position and acknowledged in writing by the employee.

Tool No. 10: Firms and regulators should regularly assess the suitability of individuals' assigned key responsibilities and whether they can fulfill them.

The last two are for regulators developing the appropriate supervisory framework.

Tool No. 11: Regulators need to develop and monitor a responsibility and accountability framework by incorporating the elements set forth in Tools Nos. 8-10.

Tool No. 12: Regulatory authorities need to coordinate amongst themselves to provide a unified approach to the designation of key positions and the accountability of those who hold them.

The 'Rolling Bad Apples'

Despite the best efforts of firms to develop a corporate culture that values good conduct and sets out and communicates employee responsibilities clearly, there are always people who will engage in misconduct, exploit weaknesses in a firm's employment policies and procedures, and then just move on to a new firm and not disclose any former misconduct. The FSB refers to these people as “rolling bad apples” because they just keep moving from place to place and new employers fail to properly vet them before hiring them and do not receive any negative information from prior employers, either because the bad apple left before being detected, or the previous firm does not provide information that could alert the new employer to misconduct at the previous firm.

The FSB recommends several tools for firms to consider in their personnel procedures in order to prevent the bad apples in the first place, monitor employees during employment to stop bad apple behavior when detected, and, if possible, follow up on employees when they leave.

Tool No. 13: Firms can use the recruiting and hiring processes to clearly communicate expectations to potential employees to what is to be expected of them; perhaps this may deter bad apples from joining the firm in the first place.

Tool No. 14: Firms can improve their interviewing techniques for potential hires by training to detect behavioral characteristics and “red flags” to determine whether the potential hire will be able to adhere to the corporate values set by the firm.

Tool No. 15: Firms should take advantage of the wealth of data available on people to conduct adequate due diligence on potential hires, not just information gleaned from previous employers that may offer nothing but confirming when the employee worked there.

Tool No. 16: It is not enough for firms' senior leadership to feel that they have done all they could by front-loading due diligence on potential hires in an effort to stop bad apples from joining the firm. Bad apples can be home grown at a firm if the cultural drivers already are there, such as inadequate supervision. Firms need to reassess the conduct of their employees regularly to make sure they remain “fit and proper” for their positions.

Tool No. 17: Finally, after due diligence on potential hires at the beginning of an employee's tenure and periodic assessment of the employee's conduct thereafter, firms should consider having “exit reviews” when employees leave. This will help firms to maintain appropriate records on all their employees for their own potential benefit (e.g., ensuring more accurate reporting) or for future potential employers.

How can regulators help stop bad apples from rolling through various firms?

Tool No. 18: Regulators should review the policies and procedures firms have for due diligence on potential hires and for their periodic assessment of current employees in order to ferret out bad apples.

Tool No. 19: If there are laws and regulations regarding conduct-related information about applicable employees, then the supervisors should do what they can to enforce compliance with those legal requirements, including by fines and enforcement actions if necessary.

How Does the United States Stack Up?

In its toolkit, the FSB includes examples of how different jurisdictions address some of the issues discussed in the tools. One U.S. example cited favorably is BrokerCheck, maintained by the Financial Industry Regulatory Authority (FINRA), that maintains information on FINRA-registered broker-dealers and their registered representatives. Anyone can search BrokerCheck for free. Information in the database includes information about the broker-dealer's registrations, licenses, industry examinations, and employment history as well as any customer complaints, regulatory actions by other agencies, employment terminations, and judicial proceedings.

What about U.S. banking organizations and their employees? As part of their regular examination of a bank, bank regulators look closely at the bank's senior management. Examples of good management cited by the regulators include detailed position descriptions, carefully planned recruiting, appropriate training and performance reviews—some of the same suggestions noted above in Tools No. 13-16.

U.S. federal banking laws also allow the federal banking regulators to suspend or remove an “Institution-Affiliated Person” (IAP), which includes directors, officers, and employees, from his or her position at a banking organization, and/or further participation in the affairs of that or any other banking organization. Grounds for suspension or removal include a determination by the federal banking regulator that an IAP has violated any law, regulation, or final administrative enforcement order that caused loss or other damage to the banking organization, and the IAP demonstrated a willful disregard for the safety and soundness of the banking organization. 12 U.S.C. 1818. While taking such action generally is discretionary, action to remove an IAP is required if the federal banking regulator determines that the IAP has violated certain laws, such as federal anti-money laundering laws.

In addition, state banking laws, like those in New York, also may provide for removal and prohibition with respect to persons associated with state-chartered or state-licensed banking organizations.

Federal banking law also allows a banking organization that carries federal deposit insurance (and also uninsured branches and agencies of foreign banks) to “disclose in any written employment reference relating to a current or former [IAP] of such institution which is provided to another insured depository institution in response to a request from such other institution, information concerning the possible involvement of such [IAP] in potentially unlawful activity.” 12 U.S.C. 1828(w). However, the law also states that there is no affirmative duty to provide that information and as discussed in the FSB report, many institutions do not routinely provide such information for fear of litigation that could be brought by the IAP against the banking organization. This particular law also does not exempt the banking institution from potential liability if the disclosure is made with “malicious” intent.

Conclusion

The FSB has developed an ambitious set of tools to encourage firms to establish a good corporate culture aimed at mitigating misconduct that includes setting out clear responsibilities for senior management and holding them accountable, while also taking steps to weed out the “bad apples.” But it may be the regulators in the different jurisdictions that will need to be the ones to set their country's “tone at the top” and encourage, or require, their financial institutions to follow suit.

Kathleen A. Scott is a senior counsel in Norton Rose Fulbright's New York Office.