Compliance Risk Management

1
Compliance Risk Management

• Nina A. Nichols
• Assistant Director, Compliance Risk
• Division of Banking Supervision and Regulation
• Board of Governors of the Federal Reserve System
• nina.nichols_at_frb.gov
• AIBA Quarterly Meeting
• June 12, 2008

2
Federal ReserveRisk-Focused Supervision

• SR 95-51, Rating the Adequacy of Risk Management
  Processes and Internal Controls at State Member
  Banks and Bank Holding Companies (November 4,
  1995)
• Credit, Market, Liquidity, Operational, Legal,
  Reputational Risks
• Elements of Risk Management
• Board and management oversight
• Policies and procedures
• Risk measurement, monitoring, and MIS
• Internal controls
• Consistent with evaluation of U.S. branches and
  agencies of foreign banks
• SR 04-18, Bank Holding Company Rating System
  (December 4, 2004)

3
Risk-based Supervision for Compliance

• SR 95-51 applied with flexibility to match size,
  scope and complexity of operations
• BSA/AML
• FFIEC BSA/AML Examination Manual

4
Principles of Compliance Risk Management

• Basel Committee, Compliance and the compliance
  function in banks, 2005
• Common principles for compliance risk management
• Stages of implementation in different
  jurisdictions
• Varying levels of detail in statements of
  supervisory expectations across jurisdictions

5
Common Interpretive Questions Emerging Issues

• Responsibilities of Board and senior management
• Compliance function
• Status
• Authority
• Independence
• Monitoring and testing
• Assessing compliance risk
• New business compliance controls
• Outsourcing arrangements for compliance

6
Compliance Risk Management and Evolution of ERM

• Compliance risk management within ERM framework
• Firm-wide approach
• Size and complexity of organization
• Nature of compliance risks across
• Legal entities
• Lines of business
• Jurisdictions
• Compliance function
• Implementation of program
• Oversight

7
Compliance Risk Management for International
Operations

• Program designed to ensure compliance in
  different jurisdictions of operation
• Compliance function reflects size and complexity
  of operations, globally and within particular
  jurisdictions
• Some flexibility regarding structure of function
  and oversight mechanisms
• Role of directors and senior management