Building a Global Compliance Management Program for Large Banks

As global banks often have diverse lines of business and operate in multiple geographies, their regulatory ecosystem is both complex and very dynamic. Banks invest in multiple, disconnected programs each with their supporting technology infrastructure, to respond to specific compliance requirements; these could be from certain regulatory changes within a business line or a geography, or from a regulator. In many cases, these programs run independently, without any association across the programs or their underlying data. 

Leading banks with mature compliance processes have invested in a global integrated compliance management program that brings together the multiple compliance initiatives into a single source of truth, thus reducing redundancies and enhancing collaboration across all regulatory and corporate compliance processes.

The program is often driven by the chief compliance officer and involves participation from all the three lines of defense. It typically comprises of ten different functional tracks which work together cohesively. Given below are details of these tracks: 
 

Regulatory Rule Mapping

Operating in multiple geographies, and with different business interests (loans, credit cards, savings etc.), banks are governed by many regulators, each with a significant number of regulatory requirements. The complexity of managing this ecosystem of regulations is cost prohibitive and difficult to implement, and ultimately, not effective. Technology can help banks map their regulatory rules into a structured, multi-dimensional, relational, and non-redundant compliance data universe which serves as a common source of compliance data for all other functions.

Banks often maintain numerous databases, SharePoint sites, and Excel sheets containing the regulations, legislations, industry standards, and best practices that require compliance. Using technology, banks can consolidate a single source of obligations that could then be mapped to applicable lines of business, policies, controls, and other data elements. The centralization of the compliance obligations allows for the clear definition of the roles and responsibilities for maintaining and updating these requirements.
 

Regulatory Change Management

One of the core challenges faced by banks is to manage changes to the integrated compliance universe, especially as the regulators and legislators are many, and the pace of change for some obligations, frantic. Using technology, banks can set up regulatory feed channels which automatically pull regulatory updates from multiple external sources. Banks can track all changes comprehensively and efficiently ensuring that impacted stakeholders are involved in various stages of the regulatory development process. The tracking can streamline the process, including conducting an impact analysis, assessing the risks of a regulation, reviewing and approving change management tasks, and then updating policies, testing controls, and remediating any issues that may arise.
 

Compliance Risk Assessment

The compliance risk assessment and computations of banks are based on configurable methodologies and algorithms for inherent impact and likelihood. These include quantitative and qualitative rating of identified risk. Compliance risk dashboards can highlight areas that need attention using risk heat maps and color-coded charts to present simplified visualization of complex compliance and risk data, sorted by country, risk type, among others.
 

Policy and Document Management

Technology can be very effective in helping banks easily manage the lifecycle of organizational policies (policy creation, review, approval, communication, and attestation) across business units, divisions, and global locations, and enhance efficiency by standardizing policy management workflows for each policy category. By linking policies to regulations, risks and controls, and by conducting impact analysis surveys, banks can gain a clear understanding of the impact of regulations, risks, and controls on policies, thus helping the compliance team take the requisite steps to be audit-ready. 
 

Control Monitoring and Testing 

With the help of technology, banks can conduct first and second line control monitoring and testing on their internal controls, in addition to internal audit-led and mandated control tests. At the end of each test or self-assessment, non-compliance issues or control deficiencies can be captured, which then become part of the centralized issue remediation process. 
 

Compliance Case Management

The case management process - from case recording to case resolution – is simplified with technology. Intuitive reports and dashboards, help banks identify and track the cases that need immediate action and those that need further investigation with ease.
 

Compliance Advisory

Many financial institutions report that their compliance professionals spend a lot of time in giving advice on regulations, legislations, and industry standards to business and functional teams. With technology, banks can set a framework for compliance advisory services whereby the different lines of business within the bank can reach out to members of a compliance team to seek clarification on regulations, rules, laws, guidelines etc. as and when needed. The regulatory compliance team members often create advisory documents that are shared with the business to advise on the impacts to transactions, controls, policies and risks. They can capture the requests for advice from the business and route the request to the correct compliance subject matter expert. The compliance team can then respond with approved documentation. This documentation can be modified and used appropriately in each region or business. Technology helps the compliance team retain a secure repository of advice documentation and see the auditable trail of changes to the advice as it flows into various businesses and regions. Issues and actions can also be tracked based on the advice provided. 
 

Compliance Control Rating and Certification

Technology can also enable banks to conduct survey-based attestation/certification processes to check the effectiveness of controls. A questionnaire can be sent as part of control certification, and findings and actions can be tracked at the question level.
 

Regulatory Engagement Management

Documenting various regulatory engagement management reports and documentation related to regulatory exams and meetings becomes easier with technology. Also, compliance teams can manage tasks and sub-tasks, assign roles and responsibilities, track findings and action plans, report engagement data, and more – all from one single solution.
 

Compliance Issue Management

Technology facilitates the adoption of an integrated approach to compliance issue management, enabling cross-functional coordination and collaboration and helping align these processes centrally with corporate governance and reporting objectives

Technology enables banks to more efficiently track, monitor, and report on a broad range of compliance requirements, across geographies and businesses. An integrated platform for compliance and reporting in real-time can help banks achieve greater visibility into their end-to-end compliance management process, ensuring adherence to compliance standards. It lays the foundation for the banks’ compliance teams to track all relevant regulations, standards, and other compliance requirements they need to comply with, in the present, as well as in the future.