As banks gird themselves for the Volcker Rule’s ban on proprietary trading, much of their focus has been on what particular instruments—collateralized debt obligations, for example—will or will not be exempt. Debates in Congress and the courts may keep that question alive for quite some time, but meanwhile, a core compliance requirement is nearing a July 21 deadline.

To find and stop impermissible trading, banks are required to use a sophisticated compliance system to do the job. The initiative must include policies, procedures, and controls that document, describe, monitor, and limit prohibited activities. “You’ve got to build an infrastructure around it,” says David Freeman, head of Arnold & Porter’s financial services practice group. “That’s a bigger effort than it sounds. It is very expensive and a tremendous amount of work.”

These new systems must identify, on a transaction-by-transaction basis, any buying or selling of securities and derivatives. “You need to build a program around that, have written policies and procedures, and ensure recordkeeping,” Freeman says. “There needs to be internal controls to make sure people are actually doing all the things they are supposed to do regarding Volcker. These procedures are relatively easy to write, but putting in ground-level controls is costly and requires a lot of thought and effort.”

“Right now, institutions are in a sprint to meet the July 21 end of the conformance period,” says Bob Maxant, a bank consultant and partner at Deloitte. “Now that we are nearing the compliance date some firms are realizing that the effort is bigger than they understood it to be. They underestimated the effort involved and their implementation will be less than robust.”

Banks are spending anywhere from hundreds of thousands of dollars to tens of millions just to build the initial program, Freeman says. “The lawmakers and regulators didn’t seem to realize that the worst part of Volcker isn’t what it says you can and cannot do; it’s building the systems to make sure you comply,” he says. “You could have told people in December 2013 what they had to get rid of and shut down, but making sure that happens, and building all these controls around it, has been the lion’s share of the work.”

“There are a lot of things banks have to do right now, and over time a much more significant infrastructure needs to be developed and integrated into all aspects of the business.”
Yousuf Dhamee, Partner, Stroock, Stroock & Lavan

“Institutions also have to put in place controls to ensure that there are no material conflicts of interest and high-risk trading strategies, exposure to high-risk assets, or threats to the institution or U.S. financial stability,” says Bob Ledig, a partner with the law firm Dechert. “They will have to decide how they satisfy these requirements for classes of transactions and individual transactions.”

The July deadline is about more than just identifying prohibited trading activity. Compliance programs must also establish tracking systems and training for both trading desks and management. “There are a lot of things banks have to do right now, and over time a much more significant infrastructure needs to be developed and integrated into all aspects of the business,” says Yousuf Dhamee, a partner at law firm Stroock, Stroock & Lavan. “The gathering and collating of data and information is an incredibly cumbersome process, especially when you are talking about institutions that are multinational.”

The largest institutions that are subject to the most prescriptive rules under the Volcker compliance program requirements “have vast resources and dedicated teams and have been living with this for some time,” says Cliff Stanford, chair of the banking practice at law firm Alston & Bird. “They are very far along in terms of developing all the data and reporting they need to show to prove compliance with the Volcker Rule,” he says. “There are still some uncertainties, however, that may need to be addressed regarding what compliance with a particular segment of the rule looks like.”

Banks one tier down, with assets from $10 billion to $50 billion, do have more flexible program requirements—but they also have fewer resources and greater uncertainty about regulatory expectations for what is appropriate. “Many are still wrestling with it, even at this late date,” Stanford says. His advice is to emulate the efforts underway at the big banks: Identify all trading desks and covered funds activities, and conduct a gap analysis against the program and policies required of the largest institutions.

Building on the Foundation You Have

No matter what their size, banks are not starting from scratch. Many already have legacy systems for data and recordkeeping that can be adapted to Volcker compliance, so the job is more about fine-tuning those systems and supplementing internal resources where necessary. “You don’t have to create an entirely new regime in most instances,” Stanford says. “You can rely on the backbone that you already have, supplement it, and make sure it can be tailored to compliance with the Volcker Rule.”

“This being a new rule, folks may have had beliefs about how much they could leverage their existing systems, but I think we are talking about functionality that is new and that means changes to existing systems and vendor software is still catching up with the requirements,” Maxant says.

By now, Stanford says, banks should be giving internal audit, risk management, and other “second line of defense” functions a chance to test the compliance program, to remediate any issues before July 21.

CREATING VOLCKER COMPLIANCE

Below is a look at the six-point compliance program banks are required to implement to ascertain whether proprietary trading is taking place.
To assess whether proprietary trading prohibited by the Volcker rule is taking place, banks are required to implement a rigorous six-point compliance program by July 21.
That requirement comes from the Dodd-Frank Act and joint rulemaking approved by the Federal Reserve, Office of Comptroller of the Currency, Federal Deposit Insurance Corp., Securities and Exchange Commission, and Commodity Futures Trading Commission.
The required compliance program includes: the development of policies, procedures, and controls “reasonably” designed to document, describe, monitor, and limit prohibited activities; a governance framework for compliance accountability and reviewing compensation incentives; independent testing and auditing of the program; training for traders and management; and recordkeeping (documentation demonstrating compliance with the rule must be kept for five years and be available to regulators).
A recent advisory by Deloitte compared the requirements to the Three Lines of Defense model for risk management. “In the first line, the business line managers must create a culture of compliance for the desks, including implementing a compensation structure that rewards risk reduction and not risk-taking,” the advisory says. “The second line of defense focuses on the compliance function, which must monitor any breaches, ensure that false positives are clearly explained and documented, and that any true violations are promptly remediated and senior management is made aware. The third line of defense is the independent testing and audit required by the regulation.”
Larger banks, with assets of $50 billion or more, have “enhanced” requirements that require them to document policies on hedging and market-making and to monitor potential or actual material exposure to high-risk assets or strategies.
The CEO, or senior U.S. management officer at a foreign bank, must annually review and attest in writing to the firm’s primary regulator that the bank is meeting all compliance requirements. Additionally, the board of directors, or a committee of the board, must approve the compliance program and ensure that senior management is “capable, qualified, and motivated to manage compliance.”
Senior management is responsible for implementing and enforcing the compliance program and ensuring corrective action is taken when failures are identified. It must report to the board annually on the effectiveness of the program.
—Joe Mont

Also, institutions with multiple trading desks or that engage in hedging activities have been advised by examiners to designate a Volcker Rule compliance officer. “Just like with the Bank Secrecy Act and anti-money laundering compliance, there needs to be someone who is focused on it and can help shepherd your efforts going forward,” Stanford says.

Even with a program that passes muster, compliance won’t be easy. Foreign financial institutions and U.S. institutions with significant foreign operations will confront plenty of obstacles. “There will be the difficulty of addressing the regulation in the context of foreign legal regimes that may not be similar to the one contemplated in the United States,” Dhamee says. “There are also different market practices in different jurisdictions that make conforming to these new rules more of a challenge.”

Difficulties may also arise from foreign mutual fund holdings. “What people anticipated, or hoped would happen, is that foreign mutual funds, like U.S. mutual funds, would not be captured by the rule,” says Tram Nguyen, also a partner at Stroock. “They are discovering that because of the way they are structured, these mutual funds are still covered and captured by Volcker.”

Even though knowing what to screen for is a necessary part of the compliance program, guidance from bank regulators and the Securities and Exchange Commission has been sparse. To date, only 13 “frequently asked questions” have been released. “I can assure you that there are more than 13 questions,” Ledig quips. “That’s a really small portion of the questions people have had over the last year and a half.”

“In the absence of guidance, people are left with trying to make a reasoned judgment as to what is permitted and not permitted,” Nguyen says. “People see ambiguity and ask for guidance and interpretive law, but it hasn’t been forthcoming. That may be because of the volume and magnitude of the interpretive decisions that are open.”

Among the lingering questions are some fundamental debates. What exactly is an investment company in the eyes of regulators? When is a hedge not a hedge? There is also the vague prohibition of “evasive” activities to avoid rule restrictions, leaving open the question of what trading activities a bank can shift to a non-insured unit or overseas.

Banks did receive some good news from a decision by financial regulators in January to extend the deadline for conformance with the Volcker regulations on sponsorship and ownership interests in legacy covered funds to July 2017. The move took a lot of pressure off both banks and regulators. “Since legacy fund investments were made before the final form of the Volcker regulations were known, it seems appropriate to avoid fast divestitures that could adversely affect institutions,” Ledig says.