The modern U.S. regime of regulatory compliance is not easy, not cheap, and not popular—until you consider the alternatives. Then you can see that, as Winston Churchill once said in a somewhat different context, it's the worst system in the world, except for all the others.
Churchill's words stuck in my mind last week as we all witnessed that sexiest of companies, Facebook, begin its first serious flirtations with the public markets. The headlines said it all: Goldman Sachs pours $500 million into Facebook! Private clients at Goldman may get Facebook investment opportunity! SEC investigates disclosure rules for private companies! Facebook financials leaked in private document; IPO likely in 2012!
Immediately you heard the predictable complaints from the predictable corners, that the SEC was meddling in a perfectly viable private business and should leave it alone. They complained that Facebook could have filed for an initial public offering long ago, enriching itself and its investors like free markets should, were it not for nettlesome little things like the Sarbanes-Oxley Act and the cost of being a publicly traded company in the United States. This whole sordid mess, they claimed, demonstrates how regulatory compliance has gone too far.
Actually, no it has not. This whole sordid mess has demonstrated how regulatory compliance is working just as it should—even when nobody likes it.
For better or worse, we have moved over the last 30 years into a world of hyper-connected capital markets. At the same time, we have moved ever more of citizens' economic fortunes away from something constant (a defined-benefit pension plan, or a 30-year-mortgage) into financial products that hinge on the proper functioning of those capital markets (a 401(k) plan, or adjustable-rate mortgages refinanced time and again). The result is a world where investors are exposed to more and more risks—many of which he never asked for, and many he doesn't even know about. That's why stupid mortgage originations in Arizona in 2005 ended up wrecking the finances of municipal pension plans in Scandinavia in 2008: Hyper-connected investors did not understand all the risks that confronted them.
People fear that world, and Washington responds to that fear. It might respond in clumsy ways with ham-handed rules and painfully expensive regulation, but it does respond because the public wants it to respond. As a whole, we might all praise the benefits of risk, reward, and free-wheeling capital markets. As individuals, however, we never want our investment to end up in the next dot-com failure, Enron fraud, or credit-default swap fad. That's our livelihood and our future at stake, and we don't want someone else mucking it up. That's how the compliance community gets stuck with laws laudable in their intention, but awful in their implementation.
All that regulators have done here—either by boxing in Facebook's choices through the letter of securities law, or by subtle pressure from the SEC—is to force the company to give more disclosure of financial results. That's the price Facebook has to pay if it wants exposure to more investors; otherwise it can get a bank loan. (If its rumored financial results are anywhere near true, it should have an easy time finding banks willing to help.) The sad truth is that we've seen far too many examples in the past of fraud in the capital markets wounding innocent investing by-standers. Nobody wants to be that person.
Facebook, as I've noted before, has wisely refrained from going public prematurely, and should be praised for it. Now it needs more capital and wants to reach more investors, so it is making more disclosure. Eventually it will go public, and will need to live all the burdens of regulatory compliance. These are the growth pains of a large, successful company in hyper-connected capital markets.
I also thought about Churchill's words when attending our most recent Compliance Week editorial roundtable. We gathered more than a dozen compliance executives from financial firms to talk about challenges in implementing the Dodd-Frank Act and how IT systems can or cannot be adapted to meet those challenges.
At its core, the complaint of attendees was this: that regulators now want financial firms to provide reams of data, to help the regulators understand what the firms have been doing and what risks they might be introducing into the financial system. That's quite different than days of old when regulators only wanted evidence that your firm was following prescribed processes. But it's driven by the same dynamic that drove Facebook to go public: fear that investors might be exposed to risks they don't know about or understand, and a desire to disclose more so your risks might be less.
That's the world compliance officers are charged with delivering. Is it easy? No. But like I said, consider the alternatives, and ask yourself which world you'd rather live in.