Richard Wallace: Failure is not an option

The OCC (not to be confused with the Office of the Comptroller of the Currency) is, in its own words, “the seller to every buyer and the buyer to every seller,” for its various member firms, which collectively represent 13 options exchanges (a 14th exchange—ISE Mercury— will join on Feb 16), four futures exchanges and some 120 clearing member firms. If any of these clearing firms fails to honor its trade obligation, the OCC steps in to honor the guarantees that have been issued.

By acting as a go-between for derivatives trading, the OCC provides a critical layer of stability to the world’s financial markets. But with great power comes great responsibility, which is why this firm has the ongoing attention of financial services regulators such as the SEC. And while this has always been the case, in 2012, that attention grew by an order of magnitude when the OCC was declared a SIFMU—a Systemically Important Financial Market Utility.

SIFMU designation is an outgrowth of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which empowers the Financial Stability Oversight Council to assign special regulatory requirements on those firms that would threaten the stability of the United States’ financial system if they failed or faced serious disruption. To date, only eight firms have been given SIFMU designation, and the OCC is one of them.

Richard Wallace, senior vice president and chief compliance officer, is the person the OCC turns to make sure it is not just in compliance with SIFMU regulatory requirements, but is keeping the enterprise well ahead of the regulatory curve. As the leader of the OCC’s compliance program, Wallace works with regulators, advises the OCC’s board of directors and management team on compliance requirements, and oversees records management.

Wallace’s background uniquely suits him for the task of adapting the OCC’s business practices and culture to deal both with the firm’s past regulatory remediation efforts, as well as proactively addressing its current and future compliance challenges. Before joining the OCC in 2013, he was a partner at Foley & Lardner in Washington, D.C., where he represented and advised securities broker-dealers, securities exchanges and investment advisers and their employees. Before that, he spent 12 years at the Financial Industry Regulatory Authority as the vice president and chief counsel of its Market Regulation Department. He also spent six years as a branch chief and attorney with the U.S. Securities and Exchange Commission’s Division of Enforcement.

“Because of its role in the market, the OCC is really important to a lot of people, and if we go down, it’s a systemic problem. So with that comes higher expectations in terms of a whole list of areas such as risk management and governance,” Wallace says. Case in point: The OCC is subject to a much more robust examination presence, not just by the SEC and CFTC, but by the Federal Reserve, as well as being subject to Dodd-Frank regulations. “We have very high expectations put upon us,” Wallace says, “and we are subject to a rigorous external review of how we’re doing.”

According to Wallace, the firm struggled at first with its new level of required documentation and the heightened expectations of the regulators. The company was always committed to “doing the right thing,” he says, and getting to where the regulators needed the OCC to be. But there was a steep learning curve, and the firm had a difficult time keeping pace with current regulatory demands. This meant there had to be changes with how it handled compliance. Wallace himself joined OCC around that time and, about six months after he came on board, the OCC launched what Wallace describes as “a vigorous plan to get ahead of the regulatory cycle.”

The first thing the company did to help was to establish a rigorous system to verify that the improvements OCC put in place really worked and met regulator requirements. This became a good way to catch problems, as well as a way to educate people across the company as to what the new standards were that the company had to meet. It also provided to the OCC’s board and to regulators a high level of assurance that the changes the company made were sufficient and were working. “That process allowed us to increase the regulator’s confidence that we were moving in the right direction,” Wallace says.  It was, as Wallace describes it, a kind of self-examination, in which the company set to tracking how it resolved the issues.

But it was only the beginning. In 2015, OCC launched an enterprise-wide plan to look at all parts of the company for areas to improve, and to bring its compliance practices to a level above what was required from regulators.

Another part of the process was to lay the foundation with the tools the OCC needed to allow ERM, audit, and compliance to do their jobs better. “We wanted to improve our records management, as well as provide a better understanding of old processes, documenting who was in charge of what, mapping them to requirements, building out an electronic enterprise GRC system that houses information on compliance, audit, and ERM needs … and link all of that together,” Wallace says. “These things were all coming together at the same time.”

According to Wallace, what sets the OCC apart from most other compliance departments is the focus on risk. “Corporate compliance is a different job wherever you go. At many firms it comes down to how you deal with customers. Are they getting the right information?” The regulations for clearinghouses require policies and procedures for the credit market, as well as for modeling risk in general and default risk in particular. This puts the chief compliance officer and the compliance department in the position of having to build a sophisticated system with ample bandwidth.

Part of that includes having sophisticated methods to deal with when a clearing member either defaults or has a serious disruption. It does not happen often—only a handful of times in the company’s 40 years of operation—but Dodd-Frank mandates that the organization has to be able to deal with it if and when such a failure does occur. The company has always had plans for such scenarios, Wallace says, but now it has a specific requirement to prepare for and to test on.

The stress testing the OCC uses for clearing members is organized and systematic, similar to how it uses models to set margin requirements and how much financial resources the company must have on hand. In addition, Wallace says, the OCC also has an in-house group of highly qualified quantitative analysts that reviews those models and validates them.

“I always say this isn’t rocket science, but we actually have rockets scientists on board,” Wallace says of the quants. These “rocket scientists” are in a separate group that reports directly to the chief risk officer. Wallace’s team, in turn, makes its own assessments on what the quants turn out. “How can we make sure that these Ph. Ds are going to do their job?” Wallace asks. “We are not qualified to review their math calculations, but we can look at their documentation, and how they justify what they do, and make sure that it’s clear to the regulators.”

Clarifying things for the regulators might just be the most important part of Wallace’s job. “I hope the regulators are very pleased with our trajectory, but we would be the first to admit that our compliance is still growing and maturing,” Wallace says. “Our emphasis is on a high level of transparency and cooperation, and we are doing our very best to get where they want us to be, and to be transparent about where we are at the current time.”

To that end, Wallace stresses the importance of communication. Wallace recalls spending much of his time, after joining the OCC, trying to get people to understand what compliance could do for them, and how it could make their professional lives better. He wanted to avoid a situation where people who were doing their best work were met by a new compliance head who sweeps in and tells them that they must all start doing something new that might not be intuitive to them. “You need to spend time with them to communicate that this is a hard change,” Wallace says. “That communication, especially when you are building a rapport with people within the industry … you’ve got your day job of reviewing this and approving that, and attending meetings, but the time spent with people working to that same end is crucial.”

That goes double when regulators are involved, Wallace says. When dealing with regulators, chief compliance officers can be a conduit for providing context about the business so the regulators can understand why certain decisions are made … and perhaps more importantly, so they can understand why something might not be as dramatic or as big of a problem as it appears from the outside. After all, there are always plenty of opportunities for regulators to become concerned over something that does not seem like a big issue to the business.

“When I was working as a regulator, I can think of several times when I was hopping mad about something a company did, but once they explained it, I thought, ‘Oh, now I get it!’ ” Wallace says. “And vice versa; there have been times when, as a lawyer, when I was representing organizations before the regulators, thinking, ‘If I could just get them to understand this …’ ”

One thing Wallace has found is that when regulators visit and want to know about some portion of the business, it pays to get it right the first time. If regulators walk away with a negative perception of some part of the organization because it might not have been explained properly or sufficiently, it can take 10 times as long to correct it after the fact, Wallace says.

Case in point: After Wallace joined the OCC, the company changed its incentive compensation to increase the focus on compliance and successful risk management. It was a starting point, Wallace says, and the way it was explained internally it was clearly understood to be a single part of a broader set of initiatives. But when the OCC explained it briefly to the regulators, the regulators immediately had concerns about how this new program was going to work.

“Luckily for us, the issue came up shortly after we explained it, and we were able to put more information around it, and got a response of ‘Oh, okay, that makes sense,’ ” Wallace says. “From our vantage point, everything looked clear, but from their vantage point, it evoked this ‘What are you thinking?’ response. That was our fault.  So you need to practice good communication skills to check up after an initial explanation. If you can express things to their understanding, in their words, it will help.”

Another part of dealing with any regulator, Wallace notes, is that saying something to the policymaking end of things does not mean that the examination end of things will get the same message. “Regulators are like any other organization,” Wallace says. “so you probably need to over-communicate several times to make sure that everyone understands. It’s kind of impossible to over-communicate.”