In the Financial Sector, the Most Intense Criticism Must Come From Within

John H. Walsh

Corporate Counsel

11-05-2012

This is the first in a series of columns presenting Dodd-Frank best practices for in-house counsel and compliance professionals.

This is a revolutionary time in financial regulation. The whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which are beginning to yield Securities and Exchange Commission actions and bounty payouts, represent a tipping point into a new era of ongoing, multifaceted scrutiny of financial institutions.

Criticism is nothing new in the financial sector, of course, but historically it came predominantly from aggrieved investors. Now, following 10 years of initiatives designed to foster and require self-reporting by regulated entities, the SEC has instituted a program of paying informants.

Under this new approach a whistleblower—even an anonymous whistleblower—who provides original information that leads to a successful enforcement action in which the SEC obtains monetary sanctions of more than $1 million may receive an award between 10 and 30 percent of the amount recovered. In certain instances, even information obtained by a whistleblower in breach of civil law, foreign law, or a judicial protective order can be used to earn a bounty.

The full scope of the program is difficult to predict, but given the SEC's willingness to pay for information—even information obtained illegally—the effect on the financial sector will be substantial. In just the program's first seven weeks, the SEC received 334 whistleblower tips, or nearly 48 per week. Further, an entire new bar of financial plaintiffs' counsel has sprung up and is working hard on how to use the new law to generate business. Once the first cases map the terrain, a large volume is likely to follow.

In this new environment the role of criticism, especially self-criticism, has been fundamentally transformed. To stay ahead of regulators a company will have to be more self-critical—i.e., more active in internal investigation and reporting—than ever before.

The concept of self-criticism for financial institutions has evolved over the past decade, with the SEC gradually adding new layers of scrutiny. In what is often called the "Cooperation Release", the SEC in 2001 said it would consider a variety of factors when exercising its prosecutorial discretion, including how the misconduct was detected, the steps the firm took upon learning of the misconduct, and whether the firm promptly made the results of its review available to SEC staff.

With the 2002 Sarbanes-Oxley Act, Congress required public company audit committees to establish internal reporting mechanisms and prohibited retaliation against the employees that utilized those mechanisms. In 2003 and 2004, the SEC adopted rules that require investment companies and advisers to designate a chief compliance officer and adopt written policies and procedures; and that require investment advisers to create a written code of ethics for their supervised persons.

In 2010, the SEC approved a Financial Industry Regulatory Authority (FINRA) rule that requires a member broker-dealer to self-report within 30 days when it concludes, or should have concluded, that the firm or an associated person of the firm has violated any laws, rules, regulations, or standards of conduct.

Now, with the SEC paying whistleblowers and regulated entities facing a short reporting window, companies will have to greatly intensify their internal compliance efforts, focusing on how investigations are conducted and where violations are most likely to occur—before the violation occurs.

Given the brief timeframe for self-reporting, conducting a thorough and definitive internal investigation is all but impossible for an institution that has not laid the appropriate foundation in advance. Reporting to the SEC with a partial or inaccurate assessment of violations can make matters worse.

In plain terms, if a company initiates its internal criticism at the first sound of a whistle, it is already too late.

In this new era of amplified criticism of financial-sector conduct, compliance is not merely a matter of installing appropriate guidelines on following the law. Corporate counsel and compliance officers must maintain substantive ongoing efforts to anticipate risk areas, actively monitor practices, and prepare appropriate responses in advance. To do less is to invite the scrutiny of those who have a vested interest in your failures.

John H. Walsh is a partner in Sutherland's Financial Services Group and a member of the Securities Enforcement and Litigation Team. As a 23-year veteran of the Securities and Exchange Commission, he played a key role in creating the Office of Compliance Inspections and Examinations, which administers examinations of the nation's registered entities, including broker-dealers, investment managers, funds, self-regulatory organizations, and others. He can be contacted at 202.383.0818 or john.walsh@sutherland.