Category: Compliance Programs

Shifting Regulatory Landscape in the US and Abroad

PERE Real Estate CFOs Forum

This afternoon, I am speaking at the PERE Real Estate CFOs Forum in New York on the Shifting Regulatory Landscape in the US and Abroad.

Moderator: Gilbert D. Porter, Partner, Haynes & Boone LLP
Panel Members:
Andrea Carpenter, Director, INREV (European Association for Investors in Non-listed Real Estate Vehicles)
Doug Cornelius, Chief Compliance Officer, Beacon Capital Partners
R. Eric Emrich, Chief Financial Officer, Lubert Adler Partners, L.P

We are starting the discussion with the EU AIFM Directive and its potential implication on fundraising and operations in the European Union.  Then we move onto the four bills aimed at regulating private funds: the Hedge Fund Adviser Registration Act of 2009, the Hedge Fund Transparency Act of 2009 and the Private Fund Transparency Act of 2009 and the . Then we end with the SEC’s proposed Pay to Play rule and the Say on Pay bill.

I am leading the Pay to Play and Say on Pay discussions. Here is the slide deck that I am using:

Shifting Regulatory Landscape in the US and Abroad

Governing Corporate Compliance and New Governance

Miriam-Baer

Miriam Baer of the Brooklyn Law School published an interesting article on “New Governance”: Governing Corporate Compliance. The professor rejects the notion that adversarial relationships produce good regulation. She looks towards the “theory of regulation characterized by a collaborative tone between regulator and regulated entity, a problem-solving orientation, continuous assessment and revision of both expected outcomes and implementation processes, pooling of information by and among regulated entities and regulators, and inter-agency cooperation.”

She views compliance programs as “instrumentalities of hard law: formal regimes designed to supply internal monitoring and punishment, so that the firm can then assist the government in fulfilling its duties of external monitoring and punishment.” Of course you are not going to get a cooperative method of regulation when the primary response to corporate wrongdoing is the prosecution and punishment of individuals. Executives put compliance programs in place because it is good business. They also implemented them because they don’t want to go to jail. Executives are increasingly being punished for the bad acts of their frontline employees.

The professor advocates a model in which “regulators and regulated entities would treat compliance problems—even large scale violations of criminal law—as a symptom of a continuing problem to be addressed over time, rather than as a cultural failure that could be “cured” by some combination of prosecutorial threat and internal ethics remediation.”

Thanks to Ellen S. Podgor of the White Collar Crime Prof Blog for pointing out the article: .

References:

Pfizer and Compliance

pfizer-logo

Pfizer got itself in trouble for the way it was marketing some of its drugs. Enough trouble that they need to cough up a $2.3 billion fine to the Department of Justice. (Yes, that is billion.) Under its settlement with the DOJ, Pfizer will pay a $1.3 billion criminal fine related to the company’s illegal promotion of its now-withdrawn painkiller, Bextra, and $1 billion civil fine related to other medicines. It’s the largest health-care fraud settlement in the DOJ’s history.

But that’s not all.

As part of the settlement, Pfizer entered into a Corporate Integrity Agreement with the Office of Inspector General of the U.S. Department of Health and Human Services. The Corporate Integrity Agreement establishes some new internal structures and requires Pfizer to continue maintenance of a corporate compliance program for a period of five years.

Pfizer already had a compliance program, headed by a chief compliance officer, which trains employees on how to properly promote Pfizer’s products. The big change is that the chief compliance officer will no longer report to the general counsel, but will report directly to the CEO. The change is intended to eliminate conflicts of interest and prevent Pfizer’s in-house lawyers from reviewing or editing reports required by the Corporate Integrity Agreement.

If you wonder whether the compliance program should report to the general counsel, the Department of Justice says they should not.

References:

The SEC’s Madoff Report

madoff

The SEC decided to take a look at how it failed to uncover the Madoff fraud. The SEC’s Inspector General has been running an investigation and compiling information. The SEC Inspector General, H. David Kotz, released a public version of their report on August 31: Investigation of Failure of the SEC to Uncover Bernard Madoff’s Ponzi Scheme – Public Versionpdf-icon

The big question being whether it was case of internal corruption or just incompetence. Of course, hindsight is 20/20 and the fraud looks so obvious, you have to wonder how they missed it. I think it is more important to learn from the mistakes so they can avoid this happening again. But people are still looking for heads to put in the guillotine.

Senate hearing

Of course, politicians are looking to blame someone. Today at 2:30, the Senate Banking Committee will hold a  hearing concerning Oversight of the SEC’s Failure to Identify the Bernard L. Madoff Ponzi Scheme and How to Improve SEC Performance. The witnesses currently slated are:

  • H. David Kotz, Esq., Inspector General of the U.S. Securities and Exchange Commission;
  • Mr. Harry Markopolos, Chartered Financial Analyst and Certified Fraud Examiner;
  • John Walsh, Esq. Acting Director, Office of Compliance Inspections and Examinations, SEC
  • Robert Khuzami, Esq., Director of the Division of Enforcement, SEC

Was there corruption?

The investigation did not find evidence that any SEC personnel who worked on an SEC examination or investigation of Madoff had any financial or other inappropriate connection that influenced the conduct of their examination or investigatory work. The report also concludes that former SEC Assistant Director Eric Swanson’s romantic relationship with Bernard Madoff’s niece, Shana Madoff, did not influence the conduct of the SEC examinations of Madoff. The report concludes that no senior officials at the SEC directly attempted to influence examinations or investigations of Madoff and that there was no evidence of interference with the staff’s ability to perform its work.

How much did the SEC know?

The Inspector General found that the SEC received more than ample information over the years to warrant a comprehensive investigation of Madoff. Despite three examinations and two investigations being conducted, a thorough and competent investigation or examination was never performed. Between June 1992 and December 2008 when Madoff confessed, the SEC received six substantive complaints that raised significant red flags concerning Madoff’s operations. There was enough for SEC to question whether Madoff was actually engaged in trading.

What about private investors?

I found it unusual that the Inspector General includes information from private parties about their due diligence findings of Madoff’s operations. Many sophisticated investors gave significant money to Madoff. But there were traders, funds, investment banks, and other investors who thought something was not right with Madoff. They were concerned about the suspiciously consistent returns, the lack of transparency, the use of a small captive auditing firm, and the lack of an independent custodian.

The decisions to not invest were made based upon the same red flags that the SEC considered in its investigations, but ultimately dismissed. The Inspector General concludes:

The SEC examination program should analyze the approaches utilized by private entities who conducted due diligence of Madoff’s operations and apply these methods to strengthen their program. They should also seek to learn from these private entities through training mechanisms and in fact, several private entities informed the OIG that they would be willing to conduct training of SEC examiners in their due diligence approaches. Learning from private sector efforts would improve the SEC’s ability to conduct meaningful and comprehensive examinations and detect potential fraud.

References:

Respondeat Superior and Compliance

oil tanker

Back in January, a company was found criminally liable for the action of its employees. (Second Circuit Affirms Ionia Management Case.) Under respondeat superior (Latin for “let the master answer”) a company can be held vicariously liable for crimes committed by employees acting within the scope of their employment.

Ionia operates and manages shipping vessels which transport oil to the United States. These ships produce oil-contaminated bilge waste, which they have to store for proper disposal. The Act to Prevent Pollution from Ships, makes it a crime to knowingly dispose of this waste improperly.

Ionia’s engine room crew, under the direction and participation of the Chief Engineers and Second Engineer, routinely discharged oily waste water into the high seas through a “magic hose” designed to bypass the vessel’s Oily Water Separator, which would have cleaned the waste to prepare it for disposal as required by law. Furthermore, the Kriton’s crew made false entries in the ORB to conceal such discharges, and obstructed a federal investigation (a) by hiding the “magic hose” from Coast Guard inspectors during a March 20, 2007, inspection and (b) by lying to Coast Guard officials.

There was some hope that the court would alter the doctrine of respondeat superior and include a good faith defense or limit the doctrine to higher level employees. A company can be brought down by lower level employees violating company policies.

In One Rogue Worker Can Take an Entire Company Down Stanley A. Twardy Jr. and Daniel E. Wenner wrote that “the trial court charged the jury that a corporate defendant could be held criminally responsible for the conduct of a single low-level employee, even if that employee acted in direct contravention of corporate policy and a robust compliance program.”

I didn’t read the case as taking that position and I still don’t.

First, there was a structural problem in the appeal. Ionia did not challenge the jury instruction at trial, so the Second Circuit was limited to a review for plain error.

Second, Ionia took the position that corporate criminal liability can “can only stem from the actions of so-called ‘managerial’ employees.” That contention seems at odds with United States v. Twentieth Century Fox Film Corp., 882 F.2d 656, 660 (2d Cir.1989) In the Second Circuit, “[i]t is settled law that a corporation may be held criminally responsible for [criminal] violations committed by its employees or agents acting within the scope of their authority.” United States v. Twentieth Century Fox Film Corp., 882 F.2d 656, 660 (2d Cir. 1989). Regardless, evidence show that the Chief Engineers specifically directed the deck hands to commit the criminal acts.

Third, the prosecution does not need to prove as a separate element that the corporation lacked effective policies and procedures to deter and detect criminal actions by its employees. “A corporate compliance program may be relevant to whether an employee was acting in the scope of his employment, but it is not a separate element.” The mere existence of contrary company policies is not by itself a defense to criminal liability. Whether a company has an official position on the course of conduct undertaken by its agents is merely one factor to be considered when assessing whether to impose vicarious liability.

I think this case show the importance of a compliance program. Merely having policies in place in not enough to defend the company from criminal liability. Policies alone are not enough to cause employee behavior to conform to policy. Compliance programs need training, procedures and enforcement to be effective.

I am sure it was Ionia’s policy to not dump the untreated bilge water in violation of the law.  They just were not doing enough to prevent it.

References:

Fired for Foiling a Bank Robbery

key

Jim Nicholson was working at a Key Bank branch when a man entered the bank and demanded money. Rather than comply with the robber’s demands, Nicholson tossed his bag to the floor, lunged at the suspect and demanded to see a weapon. The man ran, and Nicholson chased him for several blocks before knocking him down with help from a passerby. Nicholson then held the suspect, Aaron J. Sloan, 29, until police arrived.

Two days later he was fired for violating company policy.

Is this the wrong result?

“Our policies and procedures are in the best interests of public safety and are consistent with industry standards. Money, which is insured, can be replaced. Lives cannot.” – Key Bank spokeswoman Anne Foster

“It really doesn’t matter if you’re a bank teller or a citizen walking down the street. Generally speaking, it’s best to be a good witness. And quite honestly, this is also true for people who are off-duty police officers too.” – Seattle Police Sgt. Sean Whitcomb

The policy clearly makes sense. There is no need for a bank employee to confront and chase a bank robber. Discipline was clearly the response.

The firing does send message to the rest of the KeyBank employees. Don’t do something stupid like confronting a bank robber. Focus on good identification so the police can find the robber. Let the police do their job.

What would have happened if the robber injured or killed Nicholson during the struggle? What is Nicholson injured or killed the robber?

Would a warning or suspension have been a better disciplinary action? Since the bank would presumably covered by insurance, there would have been no loss to the bank. So Nicholson endangered himself for no benefit to the bank. Any action that would encourage others would be reckless and endanger lives.

I think KeyBank did the right thing. But perhaps someone could help him find a new job.

What do you think?

Thanks to some Twitter followers for their thoughts:

  • @ComplianceWeek: I’d dock pay and make him employee of the month. Fired for bravery seems wrong.
  • @JennSteele: Something about the outright firing just sits wrong with me. Maybe it’s my American bent towards vigilantism
  • @Jeffrey_Brandt: Give him a reward before firing him
  • @BillWinterberg: Non-compliant bank teller could have turned out much worse. Bank policies exist for very good reasons.
  • @EthicsArbitrage: That’d be a real problem if carried out consistently. We’d run out of employees. Non-compliance=fired.
  • @DrewCollier: admire his bravery, admonish his disregard to policy. it’s a poor example to others and could get someone killed next time.

References:

Compliance, Van Halen and Brown M&M’s

You may have heard the story about Van Halen’s banning of brown M&M’s from its dressing room. I chalked it up to the pampered life of rock stars. (Especially, when compared to the more mundane life of a chief compliance officer.)

I just listened to the latest episode of  This American Life which revealed that the provision was not about pampering. It was about compliance.  Host Ira Glass talked with John Flansburgh (from the band They Might Be Giants) and he explained why the M&M clause was actually an ingenious business strategy. They recounted an except from David Lee Roth’s autobiography, Crazy from the Heat:

Van Halen was the first band to take huge productions into tertiary, third-level markets. We’d pull up with nine eighteen-wheeler trucks, full of gear, where the standard was three trucks, max. And there were many, many technical errors — whether it was the girders couldn’t support the weight, or the flooring would sink in, or the doors weren’t big enough to move the gear through.The contract rider read like a version of the Chinese Yellow Pages because there was so much equipment, and so many human beings to make it function. So just as a little test, in the technical aspect of the rider, it would say “Article 148: There will be fifteen amperage voltage sockets at twenty-foot spaces, evenly, providing nineteen amperes . . .” This kind of thing. And article number 126, in the middle of nowhere, was: “There will be no brown M&M’s in the backstage area, upon pain of forfeiture of the show, with full compensation.”

So, when I would walk backstage, if I saw a brown M&M in that bowl . . . well, line-check the entire production. Guaranteed you’re going to arrive at a technical error. They didn’t read the contract. Guaranteed you’d run into a problem. Sometimes it would threaten to just destroy the whole show. Something like, literally, life-threatening.

Van Halen used the candy as a warning flag for an indication that something may be wrong. I see some lessons to be learned.

Update:

Diamond Dave talking about Brown M&Ms.

Brown M&Ms from Van Halen on Vimeo.

(via NPR Music’s The Record: The Truth About Van Halen And Those Brown M&Ms by Jacob Ganz

References:

To Lead, Create a Shared Vision

Harvard business review january 2009

In the January 2009 issue of the Harvard Business Review is a short Forethought piece on the importance of leaders creating vision: To Lead, Create a Shared Vision.

James M. Kouzes and Barry Z. Posner emphasize the important of leaders creating vision for their organization and develop a forward-looking capacity. But rather than leaders thinking that they themselves need to be the visionary, the authors think it is more important to get input from the people in your organization to develop the vision.

Too many leaders act as “emissaries from the future, delivering the news of how their markets and organizations will be transformed.” Instead, “constituents want visions of the future that reflect their own aspirations. They want to hear how their dreams will come true and their hopes will be fulfilled.” The best way to lead people into the future is to connect with them in the present.

What does this mean for compliance?

When putting together and maintaining your compliance program, you need to seek input from as many people as possible. It is too late to get buy-in after the policy is already drafted. Send early drafts to a wide population of the organization for review and comment. They may surprise you by pointing out weaknesses and ambiguity in the policy draft.

By sending drafts, you also emphasize the importance of the policy and its existence.  Many studies have shown that people need to be exposed to a policy several times before they can even remember that it exists. Circulating drafts can accomplish some of that information awareness.

CCOutreach

sec-seal

The SEC formed the CCOutreach (yes, that is how they spell it) to promote open communications and coordination among securities regulators and the industry on mutual fund, investment adviser, and broker-dealer compliance issues. In addition to the national seminar in November of each year, they host regional seminars to enable Chief Compliance Officers to interact with the staff from their local SEC office. I attended the Boston Regional CCOutreach seminar. These are my notes:

To start off, there was the usual SEC disclaimer: The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its staff. The views expressed by the staff in these written materials are those of the staff and do not necessarily reflect the views of the Commission or of other Commission staff.

The presentations started off with some interesting statistics (as of 12/31/2008):

  • 11,292 Registered Investment Advisers
  • 1,521 exams of investment advisers in 2008
    • 64% resulted in deficiency letters
    • 4% resulted in enforcement referral
  • 1,082 Registered Investment Companies
  • 219 exams of investment companies in 2008
    • 67% resulted in a deficiency letter
    • 5% resulted in enforcement referral

Rulemaking

The presentation continued by highlighting some of the current rulemakings in process: the amendments to Form N-1A, the principal trading rule, and amendments to Part 2 of Form ADV. They also noted two rulemakings that should be popping up soon. First is a proposed regulation on money market funds. This is largely in reaction to the issues with those types of funds last fall.The second is a likely rule making on pay to play issues.

Enforcement

The presentation moved on to three types of current enforcement actions, with recent enforcement cases as examples.

The first type is prominent fraud cases, using the SEC v. Robert Brown case as an example. This was a classic Ponzi scheme. The promoter promised astronomical returns, but really used the money to pay off early investors and to pamper himself. When confronted by investors, he claimed the delay in returning the money was due to the Patriot Act.

The second type is compliance failure cases, using the SEC v. Locke Capital case as an example. In this case, the adviser had less than $175 million, but claimed to have over $1 billion under management in order to gain credibility and attract legitimate investors.

The third type is prominent fund failure cases, using the Evergreen case as an example. Evergreen had a fund experiencing some gyrations due to its mortgage-backed securities holdings. The company put together some talking points for investors who called to complain or called with questions. That resulted in selective disclosure of a material piece of information. There were also issues related to failures in their valuation methods.

Fiduciary Duty

The presentation turned to fiduciary issues. A particular issue was how clients got out of positions. This is a reverse of  IPO investigations by the SEC. With IPOs, the SEC investigated whether some clients got preferred access to IPOs and how allocations of IPO shares were made to clients. With the all of the illiquidity in the market, the SEC is now focused on who was able to get out of those illiquid positions and whether some clients got preferred access to the exit.

There was some discussion of the Hennessee case where the SEC brought action for an investment adviser failing to conduct diligence. There seemed to be some split on the panel. Some saw the case as a failure of fiduciary duty. Others thought it was merely a failure to do what the firm advertised it did (subject investments to a vigorous due diligence review).

The presentation moved to what the SEC is looking at during a review. They emphasized that the first step is reviewing the marketing materials and disclosure documents. The SEC wants to understand the company’s business model before the review. They don’t do a cookie cutter review, but a customized review tailored to the company’s business model. The next step is looking at the deficiency letters, their recommendations and what the company has done in response. (You have a target on your back if you have a deficiency and have not done anything in response.)

The panel turned to companies with dual registrations. If you are wearing two hats, you have a heightened level of disclosure. The SEC does not want to regulate the business model, but they do want to make sure you are fair and equitable. Dual registration is commonplace and clients are comfortable with it. But conflicts seem unavoidable, so there is a heightened need for compliance and disclosure.

The focus shifted to proxy voting and the issues associated with it. The panel highlighted the Intech case where the company was subject to a proceeding for failing to sufficiently describe its proxy voting policies and procedures and failing to address a material potential conflict of interest. Intech decided to vote in accordance with AFL-CIO-based proxy voting recommendations for all clients’ securities at a time it was currying favor with the union for more investment business. The panel had a general consensus that it was not wrong to follow a voting model as long as it is fully disclosed.  The panel was split on whether Intech could have disclosed their way out the problem. Some panelists thought the conflict was too much.

Deficiencies

Things turned to problems and how a problem can morph from a disclosure to a deficiency to an enforcement. One of the panelists rattled off a list of factors:

  • Were there deficiency letters?
  • Did you fix the deficiency?
  • Did people raise issues and you ignore them?
  • How long was the problem going on?
  • Were clients harmed?
  • Was it intentional or inadvertent?
  • How far off was the disclosure?
  • Did the firm profit from the problem?

“There is a difference between candid disclosure and clever disclosure.”

Portfolio Management

In the area of portfolio management the SEC found found these to be the most common deficient practices:

  • Failure to adopt or maintain policies and procedures relating to its investment decision-making
  • Failure to maintain required books and records to corroborate investment decisions
  • Failure to disclose all conflicts of interest

In the current market turmoil “drift” is a hot topic. The panel focused on inadvertent drift versus intentional drift. Intentional drift is bad, putting clients into investments that do match up with their investment needs. The panelists acknowledged that this is a tough area. The key is to focus on the goal at the time of purchase of the investment. Then there needs to be a periodic review. Drift review is also difficult. You need to document specific requests by the client and update the investment objectives of the client.

Service Providers

Compliance officers need to review service providers since they are a risk factor according to the panel. In particular, you need to be attentive  to the existence of kickbacks or soft dollars. They panel went so far as to recommend running searches against email traffic for the possibility of communications about kickbacks. Another red flag for the SEC is frequently changing service providers.

Safeguarding Client Assets

The centerpiece for this part of the discussion was the new custody rule that has been published for comment: SEC Releases Proposed Custody Rules for Investment Advisers. The SEC plans to go directly to clients, custodian, counter-parties, and other third parties without notifying the investment adviser. They are expecting a custodian review to be a lengthy, time-consuming process. The surprise review must a surprise and must be a review of 100% of the assets. Sampling will not be permitted. The auditor must also be truly independent. They are going to look towards Regulation S-X for the definition of “independent.”

Performance Claims

It sounds like the SEC is going to look closely at performance claims, both for fraud in the claim itself and for the claim as an indication of underlying fraud. (Like Madoff‘s performance claims.)

The panel indicated an intent to look closely at how the performance numbers are calculated. A particular hot button is how illiquid and hard-to-value assets are included in the performance calculations. The SEC plans to run some forensics to see if there was some smoothing in the performance and whether the performance was too consistent or too good given the underlying assets in the portfolio.

In addition to the performance numbers themselves, the SEC is going to look closely at the disclosure wrapped around the performance claims. They want to make sure the disclosure and qualifications are consistent.

They are also going expect records to be kept to back up the performance claims. If you are claiming 20 years worth of results, you need to keep 20 years worth of records.

They emphasized the need to separate the valuation team from the portfolio management and marketing teams to get as much independence as possible. Using a third party custodian to value assets is probably acceptable, assuming there is no fraud or improper influences on the custodian.

Post-Mortem

The program was good and worth your time if you are a compliance officer for an Investment Adviser or Investment Company. I attended because I thought it best to meet and talk with people when you are in the position to offer them some help instead of needing them to help you. It seems that Congress wants the SEC to regulate private investment funds.

In the interest of full disclosure, the SEC gave out an inexpensive pen and a magnet with with SEC seal to attendees. I don’t think these “gifts” have influenced my decision-making about the SEC.

Materials:

Principles of Federal Prosecution of Business Organizations

doj

At last week’s Compliance Week Conference, I saw a paradigm shift in thinking about the factors to be included in a compliance program. Most compliance programs have placed a lot of emphasis on the federal sentencing guidelines. After all, those guidelines give credit for having an effective compliance program. So you want to have an effective compliance program.

But by definition, the sentencing guidelines are only useful once the organization has been indicted and convicted with a crime. We are better off preventing the organization from being indicted in the first place. So, perhaps we are better off looking at the Principles of Federal Prosecution of Business Organizations (.pdf) from the Department of Justice.

The Principles are more nuanced than the Sentencing Guidelines. They take into account the issues of prosecutorial discretion. In contrast, the Sentencing Guidelines are a compromise between prosecutors, the defense bar and the judicial bench.