By Susannah Hammond
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
Collective blindspots have not only led to some of the biggest fines in regulatory history but also have driven fundamental regulatory change. The financial services industry around the world has attracted some of the brightest and the best but that has not stopped collective blindspots being an apparently perennial Achilles heel.
LIBOR
In 2012 the London Interbank Offered Rate (LIBOR) collusion came to light with evidence suggesting it had been going on for a decade. There was a collective blindspot amongst the risk and compliance community about the rate-fixing in which many of the world’s leading banks were implicated. Swathes of regulatory action followed including fines, legal action and other sanctions culminating in LIBOR’s validity as the global benchmark being irrevocably damaged. Costs were incurred by the entire industry as LIBOR was phased out by June 30, 2023.
The collective blindspot centered around whether the provision of the input into the LIBOR interest rate calculation was overtly regulated. The wider picture of potential collusion and fraud appeared to have been missed with neither the second (risk and compliance) or third (internal audit) lines of defense raising it as an issue.
Off-channel Communications
The off-channel communications debacle has played out mostly (so far) in the United States with close to $3bn in fines levied against firms for failing to capture and retain communications. One of the most striking features of the detail of the sanctions imposed is that so many senior people were involved in the rule breaches, the surveillance and oversight functions expressly included. It appears it simply did not occur to key individuals that conducting business communications through non-recorded channels, no matter what their internal policies and procedures might state, was not permitted.
The regulatory focus on off-channel communications is set to continue with ‘zero tolerance’ having been declared by the Commodity Futures Trading Commission for any future failings.
GRC and Helicopters
On the surface it might appear that there is little in common with the collective blindspots at the heart of the LIBOR and off-channel communications regulatory breaches; however, both appear to have occurred without warnings being raised by risk and compliance functions. That begs the question – why not? It is entirely possible that the GRC functionality within firms had not, for whatever reason, stepped back and taken a wide, helicopter view of the business and its risks.
That lack of a helicopter view was compounded by an apparent lack of root cause analysis which could have given an insight into possible widespread breaches.
Root Cause Analysis
Root cause analysis (or the fundamental reason for the occurrence of a problem) is an invaluable tool in the GRC arsenal for both robustly solving problems and also seeing if a root cause could be the source of an issue elsewhere in the business. A key example is a global firm that got fined on both sides of the pond for the same underlying issue. Great Britain’s independent energy regulator, Ofgem, fined the firm £5.41m in August 2023 for not recording and retaining electronic communications between January 2018 and March 2020. It was the first-ever fine issued in Great Britain under legal requirements to record and retain electronic communications relating to trading wholesale energy products.
Critically important are the dates of the wrongdoing.
In September 2022, the firm was one of 16 firms fined more than $1.1bn by the U.S. Securities and Exchange Commission. The firm itself was fined $200m for off-channel communications, recordkeeping breaches ‘from at least January 2018 to September 2021’. So, for much the same time period, the same underlying wrongdoing was happening in sectorally and geographically different parts of the same group.
Whatever happened or changed in January 2018, staff in multiple locations began ignoring internal policy and started using external (off-channel) means of communication. And the risk and compliance functions not only didn’t raise it as an issue that needed to be remediated but, at least in the U.S., were seen to be part of the problem.
Hindsight is a wonderful thing and in an ideal world the GRC functions within the firm would have spotted the off-channel communications early and then undertaken a firm-wide (global) root cause analysis to assess whether the issue had occurred elsewhere in the business. That review would have had the opportunity to nip the widespread breaches in the bud and saved the firm millions.
Share and Share Alike
Given the collective blindspot on LIBOR and off-channel communications were so pervasive, what could, in practical terms, be done to prevent a repeat? One option, which could have myriad additional benefits, is the (re)establishment of a routine and regular GRC inter-firm gathering behind closed doors. Trust would have to be built as well as a commitment to share emerging risks. It would not be a case of washing dirty linen in public but more a ‘have you seen/have you thought about’ discussion together with an open sharing of ideas as to both cause and remediation. It is entirely possible that if multiple firms had shared a similar possible concern that would have triggered risk and compliance functions to take a closer look.
As a matter of course, care would be needed to ensure no proprietary, inside or competitive information was shared. Approached in the right way, greater structured coordination and cooperation between risk and compliance functions could be achieved and future collective blindspots potentially averted.