REUTERS/ TORU HANAI

COST OF COMPLIANCE SURVEY 2012

Stacey English and Susannah Hammond

Thomson Reuters GRC surveyed more than 500 compliance practitioners from financial services firms around the world between November 2011 and January 2012 to canvass their views on the costs of compliance and their greatest challenges for the year ahead. The results reflect the continued focus on regulation and compliance in the aftermath of the global financial crisis and the ever-increasing complexity and volume of requirements. Similar research was undertaken in prior years and comparable results are included where applicable. The responses received covered Europe, the Americas, Australasia, Asia, Africa and the Middle East. They represented firms from across the financial services sector, including banks, insurers and fund managers. Feedback came from financial services firms of all sizes, ranging from those whose compliance departments comprised just one person to global conglomerates with much greater resources. It is clear from both the number of respondents and the frankness of the detailed comments received that compliance officers from all regulated firms are, more than ever, under severe pressure. It is evident from the responses that many compliance officers have now reached saturation point. Firms executive management and regulators alike need to understand and address the increasing strain on compliance. A vital factor in easing the pressure on the compliance function is the provision of adequate skilled resources to meet the growing demands and challenges. The often under-valued task of compliance can be made substantially easier where senior managers visibly and vocally demonstrate support for the compliance function and promote a compliant culture. Similarly regulators around the world must start to take account of the relentless pressure on compliance functions to assimilate and drive the implementation of the ever-increasing burden of regulatory change, if that change is to be effective.

Typical week of a compliance officer

TRACKING AND ANALYSING REGULATORY DEVELOPMENTS BOARD REPORTING AMENDING POLICIES AND PROCEDURES LIAISON WITH CONTROL FUNCTIONS

OTHER COMPLIANCE TASKS INCLUDING: COMPLIANCE RISK ASSESSMENT REGULATORY LIAISON AND EXAMINATION MONITORING AND TESTING INVESTIGATIONS TRAINING PROVIDING ADVICE TO THE BUSINESS RESPONDING TO PROPOSED LEGISLATION REGULATORY REPORTING

TRACKING, ANALYSING AND INFLUENCING REGULATORY CHANGE

Tracking potential and actual change is essential to ensure that the firm is aware of and prepared to meet regulatory requirements. Compliance officers around the world are under no illusions that 2012 will bring even more regulatory information from both regulators and exchanges. Almost half of respondents thought that the level of regulatory information would be significantly higher over the next year. Overall, 84 percent of compliance officers surveyed believed the flow of regulatory information would increase in 2012. These expectations have steadily risen over the past few years and are supported by nearly a 16 percent increase in the number of regulatory alerts tracked by Thomson Reuters GRC year on year. Over the next 12 months, I expect the amount of regulatory information published by regulators and exchanges to be:
1% 1%

A Chief Compliance Officer who does not have the full support and engagement of senior management and the board is not going to be effective.
Carlo V. di Florio, Director, Office of Compliance Inspections and Examinations, U.S. Securities and Exchange Commission, January 2012. The majority of the respondents had fewer than five people in their team to manage the ever-growing compliance obligations for their organisation. The survey asked about the proportion of time spent on key compliance activities and the chart above provides a snapshot of the average compliance week based on the most popular responses. While this illustration covers core activities, it is only a proportion of compliance obligations. When other crucial value-added roles and activities are also factored into the working week activities such as dealing with queries from the business, undertaking investigations or past business reviews, and managing regulatory visits and relationships it is clear why compliance teams are so stretched. On average, half of the typical compliance officers working week is taken up with the bare non-optional basics. This result again leads to the conclusion that many compliance officers are reaching breaking point.
2 COST OF COMPLIANCE SURVEY 2012

14%

45%

39%

SIGNIFICANTLY LESS THAN TODAY SLIGHTLY LESS THAN TODAY THE SAME AS TODAY

SLIGHTLY MORE THAN TODAY SIGNIFICANTLY MORE THAN TODAY

The change in 2012 will not just be in terms of volume and speed of developments but most crucially in the fundamental nature of many of the expected publications and announcements that will affect both regulators and firms. For regulators the biggest changes include the splitting apart of the UK Financial Services Authority, an increase in the direct regulatory power of the European Supervisory Authorities and the expansion of several new and existing regulatory agencies in the U.S. as a result of the Dodd-Frank Act. For firms, fundamental changes range from the proposed shift of the regulatory perimeter to include shadow banking to the forcible separation of wholesale and retail business for many banks and the increasingly global reach of regulations such as the UK Bribery Act and the U.S. Foreign Account Tax Compliance Act. Compliance functions devote extensive skilled resources to track and assess the impact of regulatory change. This continues to be an onerous task. More than a third of respondents spend more than an entire working day each week considering the changes and one fifth spend in excess of 10 hours during an average week. This level of activity is consistent with findings for the previous year. Despite the increasing volume of regulatory change, compliance teams do not appear to have the capacity to devote the extra resources needed to adequately consider these additional developments. While there are slight geographic variations in the results it is clear that the sheer volume of ongoing regulatory change is a global issue. The findings show that the issue is particularly acute in Asia, where a third of compliance officers are devoting more than 10 hours a week to tracking and analysing regulatory change. This is followed closely by the UK where 25 percent of firms devote in excess of 10 hours to this activity. In an average week, how much time does your compliance team spend tracking and analysing regulatory developments? (in hours)

In an average week, compliance teams spending more than 10 hours tracking and analysing regulatory developments (by region)

35% 30% 25% 20% 15% 10% 5% 0% UK US ASIA MIDDLE EAST REST OF WORLD

Compliance officers not only need to track and analyse actual and proposed regulatory change but must also stay up to date with where that change is coming from and how best to influence proposals on behalf of their firm. This, again, creates further demands on resources. A third of respondents anticipate that there will be a greater need to devote resources to influencing and lobbying the shape of future regulation this year. Two thirds of respondents, however, anticipate they will not have the capacity to influence regulatory developments another indicator that compliance functions have reached saturation point.

4% 22%

It is vitally important that the industry continues to invest time to engage. Well articulated pan-European industry input is carefully listened to and can influence policymaking. It is vital that the sector organises itself to contribute fully to such initiatives.
David Lawton, Acting Director, Markets, UK FSA, January 2012.

32%

UPDATING POLICIES AND PROCEDURES

15%

27%

LESS THAN 1 1 TO 3 4 TO 7

7 TO 10 MORE THAN 10

To coincide with changes resulting from the implementation of new rules, the compliance function is responsible for ensuring that the necessary updates are made to all relevant internal policies and procedures. The results of the survey show that 40 percent of all compliance functions spend at least half a working day every week on the burdensome, but important, task of updating and amending policies and procedures. This is to reflect the latest regulatory requirements as well as new business activities and actions arising from monitoring work and reviews. These policy and procedural changes generate a stream of other necessary activities, including the associated communication and training, the inclusion in all relevant monitoring plans, and the need to maintain an audit trail of changes. Consistent with previous years, the resources devoted to the ongoing maintenance of up-to-date policies and procedures remains high across the world. There are some regional variations. The results show that Asian firms in particular are devoting relatively more resources to keeping policies and procedures up to date, with nearly a third spending in excess of a full working day every week.

accelus.thomsonreuters.com

In an average week, how much time does your compliance team spend amending policies and procedures to reflect the latest regulatory rules? (in hours)

ALIGNMENT WITH OTHER CONTROL FUNCTIONS

9% 18% 8%

As important as the compliance function is to all regulated financial services firms, it is only one element of the overall control and corporate governance framework. It is, therefore, essential that compliance is aligned with internal audit, risk management and legal functions to help ensure there is a consistent, integrated and holistic approach to risk identification, management and mitigation. Only then will the business be able to focus on addressing the most significant areas of risk. The survey asked how much time the compliance team spent liaising with the legal, internal audit and risk functions on compliance issues. There has been little change in the time spent with risk management and legal teams since 2011, with a third of compliance functions across the world spending less than one hour consulting with both the legal team and the risk team. Overall the situation regarding coordination and alignment with internal audit is worrying. The time spent with internal audit colleagues has decreased with now more than half of respondents spending less than an hour each week liaising on compliance issues. There are marked regional variations in the results. At one end of the spectrum the situation is particularly poor with two thirds of UK firms spending less than one hour a week liaising with internal audit. Findings for Asian firms are slightly better with just a third of firms spending less than an hour. The situation is of particular concern as there has been no improvement year on year, but while this may be another symptom of the strain on resources, it does not change the need for compliance and internal audit to work more closely together. The situation in the UK is somewhat balanced out by the finding that UK firms are spending the most time with risk management colleagues. This may be a by-product of the regions implementation of risk-based capital adequacy regimes, including Solvency II, ICAS, Basel II and ICAAP, which require significant liaison between risk and compliance functions. In an average week, how much time does your compliance team spend creating and amending reports for the board? (in hours)

23%

42%

LESS THAN 1 1 TO 3 4 TO 7

7 TO 10 MORE THAN 10

In an average week, compliance teams spending more than 7 hours amending policies and procedures to reflect the latest regulatory rules (by region)
30% 25% 20% 15% 10% 5% 0%

9%
UK US ASIA MIDDLE EAST REST OF WORLD

8% 27%

REPORTING

Keeping executive management informed of regulatory issues and developments is a vital part of the compliance role. This can, depending on the size and complexity of the business, be an onerous task. As with maintenance of policies and procedures, compliance functions continue to devote significant resources to board and other reporting. This is borne out by the finding that nearly a fifth of respondents are spending more than a full working day every week preparing reports for executive boards. Conversely, more than a quarter of compliance teams are spending less than one hour a week reporting to the board, with marked regional variances in the results. In the U.S., for instance, more than half of firms surveyed regularly spend less than one hour a week on board reporting. Critically, at this lower end of the scale, this raises the question of whether executive management within these firms is sufficiently informed of compliance issues. Lower levels of compliance reporting are also likely to fall short of regulators expectations with regard to information for management.

21%

35%

LESS THAN 1 1 TO 3 4 TO 7

7 TO 10 MORE THAN 10

COST OF COMPLIANCE SURVEY 2012

In an average week, how much time does your compliance team spend consulting with the legal, internal audit and risk functions on compliance issues? (in hours)
TIME SPENT LESS THAN 1 1 TO 3 4 TO 7 7 TO 10 MORE THAN 10 LEGAL 30% 37% 18% 7% 8% INTERNAL AUDIT 52% 28% 12% 4% 4% RISK 30% 36% 19% 7% 8%

Over the next 12 months, I expect the time spent liaising and communicating with regulators and exchanges to be:
1% 2%

28%

28%

The need for firms to be aware of emerging risks and to use limited resources as efficiently and effectively as possible should encourage compliance functions towards close and continuous liaison with colleagues in the wider risk-management framework. Regulators expect regulatory risks to shape internal audits monitoring plans, so it is important that there is a consistent and joined up approach within the firm. For those firms where the relationship between compliance and internal audit continues to be limited, urgent reassessment is required. It could be considered a sign of senior managements failure to engage with risk and compliance if the control functions are not expected, nor indeed required, to work in close alignment.

41%

The SEC will focus most intently on firms where we sense that senior management and the board are not setting the appropriate tone and are failing to support key risk and control functions with adequate resources, independence, standing and authority.
Carlo V. di Florio, Director, Office of Compliance Inspections and Examinations, U.S. Securities and Exchange Commission, January 2012.

SIGNIFICANTLY LESS THAN TODAY SLIGHTLY LESS THAN TODAY THE SAME AS TODAY

SLIGHTLY MORE THAN TODAY SIGNIFICANTLY MORE THAN TODAY

MANAGING REGULATORY RISK

There has been no relief from the pressure of managing regulatory risk. Respondents expectations remain consistently high and in line with expectations for the previous year. Overall, 82 percent of compliance officers surveyed are expecting increased focus on regulatory risks in 2012. Half of these expect significantly more focus, particularly those in Asia and the Middle East. Compliance officers have attributed the anticipated heightened focus on risk to the scrutiny and criticism of the previous global regulatory approach which was held, at least in part, responsible for the depth of the recent financial crisis. Over the next 12 months, I expect the regulatory focus on managing regulatory risk to be:
1% 1%

LIAISON WITH REGULATORS

It is unsurprising, given the strength of opinion that the volume of regulatory change will increase in the next year, that compliance officers and their firms expect to spend more time liaising and communicating with regulators. Predominantly this involves the resources at the most senior levels of compliance. Overall, nearly 70 percent of respondents foresee an increase, and more than a quarter expect the amount of time spent interacting with regulators and exchanges to increase significantly in 2012. These views are driven largely by anticipation of more onerous regulatory and reporting requirements, closely followed by recognition of the increased intensity of supervision. Compliance officers expectations for the year ahead are remarkably similar to their expectations for 2011 and, having seen a steady increase in expectations since 2008, this reinforces the reality of intensifying supervision and interaction. Of those practitioners that expected a significant increase in the levels of interaction, over half attributed it to the need to lobby and influence future regulation and to liaise with multiple global regulators. This years survey shows regional differences in expectations. Asian firms anticipate the greatest increase in interaction with their regulators, with 89 percent of compliance officers expecting a rise. Notably nearly half of firms in the Middle East expect this regulatory interaction to increase significantly this year. The increase in the complexities of dealing with regulators is no surprise. Regulators themselves are under greater pressure to implement national and international changes to regulation and deliver better regulation while facing their own internal organisation and staffing challenges. In the UK, for example, the regulator has to deal with both national supervision and the implementation of EU policy while undergoing its own internal reorganisation.

16%

38%

44%

SIGNIFICANTLY LESS THAN TODAY SLIGHTLY LESS THAN TODAY THE SAME AS TODAY

SLIGHTLY MORE THAN TODAY SIGNIFICANTLY MORE THAN TODAY

accelus.thomsonreuters.com

FINANCIAL COSTS AND BUDGET

Regulators will continue to expect sufficient resources and expertise to be given to the compliance function. The survey identified that, in practice, the vast majority (93 percent) of respondents expect their total compliance team budget to at least remain the same as for the previous year or to increase. It is a matter of potential concern that only 11 percent are expecting a significant increase in budget. This is despite the acknowledged rise in demand for experienced compliance resources. Firms and regulators will continue to compete for limited compliance expertise in the marketplace and it remains to be seen whether or not these budget levels are sufficient to cover the expected significant increase in the scope and volume of regulatory change. Over the next 12 months, I expect the total compliance team budget to be:
2%

this new approach will require greater resources and expertise and thus costs more than the old reactive model which existed prior to the crisis
Hector Sants, Chief Executive, UK FSA, February 2012. The majority of firms expect the cost of compliance resources to increase in 2012. Compliance officers in Asia and the Middle East expect to see the most significant rises in these costs and, correspondingly, also expect the biggest increases in their compliance budgets. It may be a side effect of the financial crisis that firms in these regions that faced relatively less troubled times are now able and willing to devote more resources to compliance. It will be a matter of continuing concern for any firm if it is unable to allocate resources and increase its costs sufficiently to attract and retain the required additional compliance expertise for the following year.

5% 11%

28%

54%

Adequate resources also include the allocation of an appropriate budget for the compliance function. The compliance officer should be consulted before the budget is determined. All decisions for significant cuts in the budget should be documented in writing and contain detailed explanations.
ESMA consultation on certain aspects of the MiFID compliance function requirements December 2011
THE CHALLENGES COMPLIANCE OFFICERS ANTICIPATE IN 2012

SIGNIFICANTLY LESS THAN TODAY SLIGHTLY LESS THAN TODAY THE SAME AS TODAY

SLIGHTLY MORE THAN TODAY SIGNIFICANTLY MORE THAN TODAY

Compliance officers were asked about the greatest challenges they face in the coming year. The sheer range and volume of issues highlighted demonstrates the everyday challenge that compliance teams face in managing and responding to competing priorities and stakeholders. The issues most often highlighted by firms for 2012 were, overwhelmingly, keeping on top of regulatory change and the perennial issue of resources. Specific regulatory challenges highlighted include: Foreign Account Tax Compliance Act Markets in Financial Instruments Regulation and Directive II Anti-money laundering UK Retail Distribution Review Dodd-Frank Wall Street Reform and Consumer Protection Act

Over the next 12 months, I expect the cost of senior compliance staff to be:
1% 2%

17% 27%

Basel III Sanctions Solvency II Data protection Undertakings for Collective Investments in Transferable Securities IV Directive

53%

European Market Infrastructure Regulation Remuneration Conflicts of interest Suitability

SIGNIFICANTLY LESS THAN TODAY SLIGHTLY LESS THAN TODAY THE SAME AS TODAY

SLIGHTLY MORE THAN TODAY SIGNIFICANTLY MORE THAN TODAY

Alternative Investment Fund Managers Directive Bribery and corruption

COST OF COMPLIANCE SURVEY 2012

A DECADE OF CHANGE TO COME

There is no doubting the depth and breadth of the challenge facing compliance officers and their firms in 2012. The sheer sweep of regulatory change is reshaping the world of financial services with potentially a decade of change still to come. Senior managers should be under no illusions as to the extra dimension these challenges bring to the successful management of regulatory risk. Good compliance officers are an increasingly valuable commodity and if their current firm does not take seriously the need to devote sufficient resources to compliance then it is all too likely that they will move on to another firm or regulator with more understanding of the importance of compliance. All financial services firms are under pressure and there are many functions which contribute to the ongoing success of a firm. But, as has been proven time and again, a firm will only thrive in the mediumand long-term if it builds a strong compliance culture and invests in compliance. Firms whose compliance officer has reached saturation point face a raft of unpleasant consequences. These range from a lack of capacity to track and implement regulatory change to the inability to influence developments, with a potentially detrimental effect on business plans.

They also face the threat of regulatory enforcement action arising from senior managers failure to engage with compliance. Another consequence could easily be that not only does the compliance officer leave but that other, good quality, compliance officers are unwilling to join. Regulators have a major part to play in helping to achieve the implementation of effective regulatory change. To ease the burden on compliance officers, regulators themselves must ensure that they are coordinated and coherent in agreeing international regulatory policy and its implementation. Firms have to make critical decisions about where to allocate scarce resources. Risk-aware firms will understand the need to invest in both people and technology to allow them to get the most from their inhouse compliance expertise. An effective compliance risk assessment which takes account of trends, changing regulatory expectations and benchmarks regulatory approach with peers is vital to help firms focus their limited compliance resources and achieve more with less.

COMPLIANCE CHALLENGES IN 2012

FATCA
RDR

UK regulator changes
Data protection AIFMD

Implementation of regulatory change

Arab crisis UK Bribery Act Conicts of interest

Sanctions

Tracking regulatory change

Fraud

Extraterritoriality

Monitoring

Compliance risk
AML
CFPB

More intensive supervision

Social media EMIR UCITS

Financial crisis

Dodd Frank
Solvency 2

MiFID II

FSCS

Basel
FINRA

Enforcement

Remuneration

SEC

Corporate governance
HFT MAS

Resources

accelus.thomsonreuters.com

THOMSON REUTERS ACCELUS Thomson Reuters Governance, Risk & Compliance (GRC) business unit provides comprehensive solutions that connect our customers business to the ever-changing regulatory environment. GRC serves audit, compliance, finance, legal, and risk professionals in financial services, law firms, insurance, and other industries impacted by regulatory change. The Accelus suite of products provides powerful tools and information that enable proactive insights, dynamic connections, and informed choices that drive overall business performance. Accelus is the combination of the market-leading solutions provided by the heritage businesses , , , of Complinet, IntegraScreen, Northland Solutions, Oden Paisley Wests Capitol Watch Business, Westlaw Compliance Advisor and World-Check . Westlaw THOMSON REUTERS ACCELUS For more Reuters Governance, Risk & Compliance (GRC) business unit provides comprehensive Thomson COMPLIANCE MANAGER ACCELUSinformation, visit accelus.thomsonreuters.com solutions that connect our customers business to the ever-changing regulatory environment. Accelus Compliance Manager is a connected solution that provides purpose-built GRC serves audit, compliance, finance, up the ever changing regulatory information and functionality that enables users to join legal, and risk professionals in financial services, law firms, insurance, and other industries impacted by regulatory workflow. connect it to their internal compliance business process change. As a comprehensive solution, the suite of is designed to serve as a regulatory intelligence portal,enable proactive The Accelus system products provides powerful tools and information that enable users to track and communicate regulatory change to organisational risks, document associated insights, dynamic connections, and informed choices that drive overall business performance. policies and controls and manage business processes withprovided by the heritage businesses Accelus is the combination of the market-leading solutions connecting workflow. Through a shared taxonomy focused on regulationsSolutions, Oden Paisley Wests common language , , , of Complinet, IntegraScreen, Northland and risks, the solution enables a Capitol Watch of compliance, shared methodology, and increased and World-Check . Westlaw Business, Westlaw Compliance Advisor visibility, transparency and insight. For more information, visit accelus.thomsonreuters.com

Visit accelus.thomsonreuters.com For more information, contact your representative or visit us online.
2012 Thomson Reuters L-372941/1-12

2012 Thomson Reuters 03-12