Category Archives: Emerging Risks

NY Financial Services Department Adopts Final Revisions to Cybersecurity Requirements

Posted on by

The New York Department of Financial Services (“DFS”) adopted final revisions to its new cybersecurity regulations, which apply to a wide range of insurance, banking and financial services companies (“Covered Entities”) under its supervision (see previous coverage of the proposed revisions). The regulations will take effect on March 1, 2017 and, starting in 2018, will require a Covered Entity to prepare and submit a Certification of Compliance annually by February 15 to the DFS concerning the firm’s cybersecurity compliance program.

Required elements of the program include (i) the means to prevent and detect cyber events, (ii) the development of a cybersecurity policy, (iii) the appointment of a “qualified” chief information security officer, (iv) testing programs, (v) audit trails and (vi) access controls.

New York Governor Andrew M. Cuomo praised the new regulations:

“These strong, first-in-the-nation protections will help ensure [the financial services] industry has the necessary safeguards in place in order to protect themselves and the New Yorkers they serve from the serious economic harm caused by these devastating cyber-crimes.”

 

Lofchie Comment: New York State has been very aggressive in regulating and sanctioning firms engaged in financial activities. In their original form, the rules proposed by New York State to regulate “money laundering” set impossible-to-meet compliance standards. (Ultimately, the rules adopted by New York State were less draconian than those that were proposed originally, but that is saying very little.) The adopted Cybersecurity regulations are open-ended, complex and burdensome and will result in creating many new ways for the government to collect fines when something goes wrong. The fact that New York State rushed to declare itself “first in the nation” to adopt such a detailed set of rules suggests that its local government is too eager to place onerous requirements on the financial sector and, as a consequence, expand opportunities to collect fines.

That said, firms must abide by the new compliance obligations and do their best not to give New York State an opportunity to collect.

CFTC Commissioner Bowen Describes “Four Disruptive Elements” Driving Regulatory Activity

Posted on by

CFTC Commissioner Sharon Y. Bowen identified “four disruptive elements” that are “substantially responsible” for recent regulatory activity: technology, demographics, economics and institutions. In a speech at Northwestern University as part of the 2017 Brodsky Family Northwestern JD-MBA Lecture Series, Commissioner Bowen described these “disruptive elements.”

  • Institutions. Commissioner Bowen contended that the United States is experiencing a “crisis in our institutions, and that is a crisis for our markets, for our government, and for our society.” In order to “increase trust in institutions,” Commissioner Bowen stated, the CFTC must be “willing to be more aggressive in enforcing our rules fairly, including being willing to take individuals and institutions to court rather than just settle with them.” She asserted that the CFTC should fulfill the Dodd Frank Act requirement to “promulgate a regulation to improve governance” and “rebuild faith in institutions.”
  • Economics. Commissioner Bowen urged market regulators to be more aware of “how the overall economy is functioning and what effect market regulations are having on the economy.” She highlighted position limits rulemaking by the CFTC as an example of “democratizing . . . markets and making them more accessible and fair to consumers and investors.”
  • Technology. Commissioner Bowen identified technology and cybersecurity issues as key marketplace disruptors. She expressed optimism that the CFTC will complete its work on Regulation Automated Trading, and noted that the CFTC adopted enhanced cybersecurity safeguard requirements. She urged regulators to be “mindful of the human dimension of these changes and watch for ways to encourage technology while also supporting the people displaced by it.”
  • Demographics. Commissioner Bowen called on regulators to respond to demographic considerations and encourage companies, nonprofits and the government to increase diversity.

Lofchie Comment: Here are four other factors that greatly affect the financial industry in general, and CFTC-regulated entities in particular: (i) the costs of regulation, (ii) the pace of regulatory change, (iii) declines in liquidity and cross-border markets caused by regulation, and (iv) uncertainty about the imminence and outcome of regulatory enforcement actions based on ambiguous trading requirements. Those might not be the most impactful factors, but they certainly are worth Commissioner Bowen’s consideration.

Commissioner Bowen should consider why the number of registered futures commission merchants has dropped so precipitously in the last few years. It isn’t because of demographics or a loss of trust; it’s because firms can’t operate profitably. (See, e.g., this information from the CFTC. Note that the data is from year-end 2014 and the decline has since continued.) In the absence of any meaningful evidence that more expensive regulatory requirements are necessary, the notion that imposing more of them (e.g., more rules on position limits) in order to help sustain futures seems ill considered. Commissioner Bowen should acknowledge the problem that futures commission merchants have become too big to fail because all but a few have shut down. In that regard, it seems ironic that the story of Commissioner Bowen’s call for more regulation appears on the same day as a story about a major firm dropping out of the clearing business.

Click here to read other news stories regarding Commissioner Bowen.

CFTC Commissioner Bowen Contends That “Transitions Present Opportunities”

Posted on by

In a speech titled “Transitions Present Opportunities,” CFTC Commissioner Sharon Y. Bowen outlined her views on Regulation Automated Trading (“AT”), cybersecurity, position limits and diversity.

Appearing before the Commodity Markets Council “Global State of the Industry” Meeting, Commissioner Bowen addressed:

  • Regulation AT. Commissioner Bowen stated that the supplemental proposal was revised to establish that firms using Direct Electronic Access to connect to commodities markets will not be required to register automatically, subject to certain conditions and that the second major revision of the supplemental proposal “would require that all electronic trading, algorithmic as well as non-algorithmic, . . . have two separate layers of pre-trade risk controls on it.”
  • Cybersecurity. Commissioner Bowen asserted that recent CFTC rulemakings are a “great first step” because they establish a comprehensive testing regime, require heightened risk management measures, focus on governance and are based on “well-regarded, accepted best practices for cybersecurity.”
  • Position Limits. Commissioner Bowen stated that “having position limits is essential,” and urged industry groups to help regulators “make one last push to get rules finalized that will help prevent the negative impacts of excessive speculation while allowing commercial end users to manage their risks.”
  • Diversity. Commissioner Bowen urged companies to “get buy-in from all relevant stakeholders for the diversity initiative and foster an environment that lends itself to inclusion.”

 

Lofchie Comment: One benefit of transitions is that they allow us to let go of the past. A preference for holding onto a failed theory is not unique to those in government. Indeed, one of the most famous works on the theory of knowledge and the course of scientific progress, Thomas Kuhn’s “The Structure of Scientific Revolution,” deals with precisely this issue (see Emory University Professor Frank Pajares’ Study Guide). If, after eight years of dedication to the proposition, proponents of position limits regulation could find no evidence that it served any purpose, then it is time to move on.

FINRA Prioritizes Compliance, Supervision and Risk Management in 2017

Posted on by

In a 2017 Regulatory and Examination Priorities Letter (“Priorities Letter”), FINRA identified compliance, supervision and risk management as primary areas for review.

FINRA stated that it will be focusing on the following issues, among others:

  • High-Risk and Recidivist Brokers. FINRA will enhance its approach to high-risk and recidivist brokers by reviewing firms’ (i) supervisory procedures for hiring or retaining statutorily disqualified and recidivist brokers, (ii) supervisory plans to prevent future misconduct, and (iii) branch office inspection programs and supervisory systems for branch and non-branch office locations.
  • Sales Practices. FINRA will evaluate firms’ (i) compliance and supervisory controls that are intended to protect senior investors, especially against microcap fraud schemes, (ii) reviews of product suitability and concentration in customer accounts, (iii) capacity to monitor the short-term trading of long-term products, (iv) procedures regarding registered and associated persons, and (v) compliance with social media supervisory and record-retention obligations.
  • Financial Risks. FINRA will examine firms’ (i) funding and liquidity plans, (ii) financial risk management practices, and (iii) implementation of the first phase of the new FINRA Rule 4210 margin requirements for covered agency transactions, which became effective on December 15, 2016.
  • Operational Risks. FINRA will assess firms’ (i) cybersecurity programs, (ii) internal supervisory controls testing, (iii) controls and supervision intended to protect customers’ assets, (iv) compliance with SEC Regulation SHO, (v) anti-money laundering programs, and (vi) application of exemptions and exclusions to municipal advisor registration requirements.
  • Market Integrity. FINRA will (i) monitor firms’ compliance with amended Order Audit Trail System rules, (ii) expand surveillance for cross-product manipulation to include trading in exchange-traded products, and (iii) supplement firms’ supervisory systems and procedures with “Cross-Market Equity Supervision Report Cards.” In addition, FINRA will (i) expand its Audit Trail Reporting Early Remediation Initiative to include Regulation NMS trade-throughs and locked and crossed markets, (ii) review firms’ compliance with Tick Size Pilot data collection obligations, and (iii) ensure that firms improve their Market Access Rule compliance by incorporating recommended best practices. FINRA also intends to review alternative trading systems’ customer disclosures and develop a pilot trading examination program in order to help “determine the value of conducting targeted examinations of some smaller firms that have historically not been subject to trading examinations due to their relatively low trading volume.” Lastly, FINRA will continue to expand its “fixed income surveillance program to include additional manipulation-based surveillance patterns, such as wash sales and interpositioning.”

Lofchie Comment: The new Priorities Letter offers a lot to talk about, since FINRA has managed to cover virtually every aspect of a firm’s business. It is incumbent on each firm to go through the letter carefully and scrutinize every relevant priority. The following areas might be of particular interest: (i) custody, (ii) seniors, (iii) improving the automation of “suitability” reviews (e.g., the ability to search for concentrated positions, or positions with excessive turnover), and (iv) cybersecurity training. Anti-money laundering enforcement actions have proved to be a treasure trove for financial regulators, so firms should continue to devote their attention to this area. Liquidity seems to be the odd item on FINRA’s list, since there are no real rules governing it, but rulemaking advances in that area should be expected in the near future, so regulators will be exploring ways to refine their understanding of best practices.

CFTC Chair Timothy Massad Resigns

Posted on by

CFTC Chair Timothy G. Massad tendered his resignation to President Obama. He will leave the CFTC on January 20, 2017. In a statement, which was accompanied by a 16-page summary of the CFTC’s accomplishments during his two-and-a-half-year tenure, Chair Massad asserted that the Commission had realized his agenda:

“I came to the CFTC with a number of priorities, and I am proud we have made significant progress in every area.”

Chair Massad highlighted accomplishments during his tenure. The CFTC:

  • ensured that “commercial businesses [could] continue using the derivatives markets efficiently and effectively to hedge routine commercial risk and engage in price discovery”;
  • “worked to ensure clearinghouses are stronger and more resilient through enhanced risk surveillance, new supervisory stress testing, and the development and completion of recovery and wind down plans and rules”;
  • “largely finished implementing the regulatory framework for swaps”;
  • “improved international coordination”;
  • “engaged in robust enforcement efforts”; and
  • took action to “address the new challenges and opportunities in the derivatives markets, particularly cyber threats, clearinghouse resilience, and the increased use of automated trading.”

Chair Massad emphasized that he “worked to make sure the rules focus on where the greatest risk exists, in transactions between large financial institutions,” and to ensure they were “largely harmonized with other domestic and international requirements.” He also noted that the clearinghouses are “stronger and more resilient,” through enhanced risk surveillance, new supervisory stress testing, and the development and completion of recovery wind down plans and rules.

Office of Financial Research Reports on Potential Threats to Financial Stability

Posted on by

The U.S. Office of Financial Research (“OFR”) reported that the U.S. financial system showed improved resilience over the past year but that it faces several threats stemming from global disruptions and “financial system evolution.” The findings were published in the 2016 Annual Report to Congress and in the 2016 Financial Stability Report.

OFR Director Richard Berner highlighted the key vulnerabilities uncovered by the reports:

“. . . Those created by global economic and financial disruptions, by continued risk-taking amid still-low long-term interest rates, by risks facing U.S. financial institutions, and by challenges in improving financial data.”

Both reports cited the following factors and developments as specific threats:

  • potential spillovers from Europe stemming from the long-term uncertainty posed by the Brexit vote;
  • credit risks in U.S. nonfinancial corporations posed by the rapid growth of high debt levels;
  • cybersecurity incidents stemming from electronic transactions;
  • the concentration of risk in central counterparties (“CCPs”) caused by clearing from CCPs;
  • pressure on U.S. life insurance companies;
  • systemic footprints of the largest U.S. banks and the substantial risks inherent in large bank failures; and
  • deficiencies in data and data management.

In the reports, the OFR also discussed the role of shadow banking in the financial system.

Lofchie Comment: A number of the systemic threats in the reports are due in large part to government intervention in the markets; e.g., the high debt levels that result from extremely low interest rates, and the increase in size of very large banks, which arguably is exacerbated by the costs of regulation that weigh most heavily on smaller firms.

The most notable threat acknowledged by the OFR is that which is created by central counterparties: “We are concerned that, although clearing swaps transactions through central counterparties reduces the risk from the other party defaulting in two-way swap transactions, it also concentrates risk in the CCP itself.”

“No kidding,” one is tempted to say. The government’s acknowledgment of this risk, which resulted from Dodd-Frank’s supposed magic bullet, is beneficial if remarkably belated. (Kudos to University of Houston Finance Professor Craig Pirrong, who predicted the threat many years earlier in posts on the Streetwise Professor blog.)

Federal Register: Banking Agencies Propose Enhanced Cyber Risk Management Standards

Posted on by

The Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the FDIC (collectively, the “Agencies”) requested comments on an Advanced Notice of Proposed Rulemaking (“ANPR”) that would enhance cyber risk management standards for large and interconnected entities under their supervision and those entities’ service providers. The agencies are considering more stringent standards for the systems of those entities that are most critical to the functioning of the financial sector in order to increase their operational resilience and reduce the impact they would have on the financial system if they experienced a cyber event. The request for comments was published in the Federal Register.

Comments on the ANPR must be submitted by January 17, 2017.

IOSCO Examines Corporate Governance Regulation

Posted on by

The Corporate Governance Task Force (“CGTF”) of the IOSCO Growth and Emerging Markets (“GEM”) Committee issued a final report in which it analyzed the following “key topics” of corporate governance: (i) board composition, (ii) remuneration and incentive structures, and (iii) risk management and internal controls. The CGTF based its conclusions on a survey of GEM Committee members, and of relevant institutions and market entities in over 30 jurisdictions.

In the report, the CGTF emphasized that “[c]orporate governance is a work in progress,” and stated that its recommendations are intended “to help regulators consider possible ways for improvements in their corporate governance regulatory frameworks” (emphasis in original). The CGTF also stressed the importance of the role of the regulator in incorporating jurisdictional best practices into larger regulatory frameworks:

Capital markets regulators should take a relevant role in ensuring the regulatory frameworks consider the best governance practices within their jurisdictions. Accordingly, their views should be an increasingly important reference on the subject in global debates.

Additionally, the CGTF recommended that regulators:

  • require companies to indicate as concisely as possible the “main risks resulting from the risk identification methodology adopted by the company[ies],” and to describe how those risks “affect the business”;
  • emphasize social and cyber risks, and sustainability, proportionately when regulating risk reporting and management;
  • encourage companies to adopt integrated reporting by interacting with their stakeholders, as well as through other means;
  • encourage periodic self-assessment reports by companies’ boards that address the “efficiency and appropriateness of companies’ systems and controls, including identified deficiencies and the appropriate corrective action to be taken”;
  • compare analyses of internal controls and systems reported by external auditors with companies’ descriptions and their boards’ self-assessment reports;
  • encourage companies to establish specialized subcommittees in order to support board performance; and
  • “consider market conditions and characteristics, segments and scale of companies, so that they do not impose excessive or unnecessary regulatory costs” in mandating specialized risk committee requirements.

Lofchie Comment: One of the more interesting parts of the CGTF’s report is the discussion of “diversity” in corporate boards of directors, since regulators from different countries expressed contrasting views on the meaning and significance of diversity, and the degree to which it should be treated as a governmental goal.

CFTC Commissioner Bowen Urges International Regulators to Adopt Similar Rules

Posted on by

CFTC Commissioner Sharon Y. Bowen argued that “regulations and international financial standards need to be broadly aligned, but also be strong enough to ward off undue systemic risk and flexible enough to allow for growth.” In an address before the CFTC Annual Symposium for International Market Authorities, Commissioner Bowen set forth her perspective on the remaining CFTC rulemakings concerning position limits, capital requirements for swap dealers, corporate governance, Regulation AT and cybersecurity. She also weighed in on international developments affecting U.S. markets that “underscore the need for cooperation.”

  • Position Limits: Commissioner Bowen asserted that “a strong position limits rule would not only work to reduce excessive speculation, which can be a major source of systematic risk, but would also make it more difficult for certain market participants to engage in market manipulation successfully.” She noted that CFTC staff has “included within the proposed rule various enumerated hedge exceptions, as well as a process and standard for exchanges to provide market participants the ability to hedge in certain situations.” She hoped that the rule would be finalized within the next few months.
  • Capital Requirements: Commissioner Bowen anticipates that the CFTC will propose capital requirements for swap dealers and major swap participants before the end of the year. While she acknowledged that imposing onerous capital requirements, “such as 35% or even 50% of a portfolio, would inhibit trading and could slow economic growth,” she noted that “[r]equiring a firm to hold a few million dollars in capital against a multi-billion dollar trading book isn’t a regulation that will actually reduce systemic risk and protect firms from imploding. Instead, that kind of de minimis requirement is just a fig leaf.”
  • Corporate Governance: Commissioner Bowen argued for a robust corporate governance rule, including fitness standards that require board directors to have a base understanding for matters under their review, limiting the tenure of independent members of audit and compensation committees, and requiring firms to disclose the level of diversity on their boards.
  • Regulation AT: Commissioner Bowen said that she was “particularly proud of how [proposed Reg. AT] addresses the massive dangers posed by faulty code within algorithmic trading systems.” She noted that the proposed Regulation AT would impose stringent testing requirements on algorithmic trading systems, including testing of new codes prior to use, and regular backtesting using historical data.
  • Cybersecurity: Commissioner Bowen stated that the proposed cybersecurity rule would impose specified testing requirements on DCOs, DCMs, SEFs and SDRs to address the threat of cyber breaches.
  • International Cooperation: Commissioner Bowen cautioned against regulators “drop[ping] to the lowest common denominator when it comes to regulation” and urged global regulators to “fight to craft regulations and international standards that are workable, but provide robust protections to the financial system and to investors.” She encouraged global regulators to consider adopting similar rules as those of the CFTC, emphasizing that: “[u]ltimately, we’re all in this together, and I’d rather have an excellent regulation that is widely adopted across the globe to a perfect regulation that is only adopted here in America.” Commissioner Bowen commended global regulatory cooperation during “Brexit” and opined that the incident demonstrates the importance of strong international cooperation.

Lofchie Comment: Commissioner Bowen’s warning that a single country’s regulators should not go it alone is true. The comment might best be directed at her own agency, the CFTC. There is no other regulator whose conduct has made it such an obvious target of her warning.

OFR Says “Brexit” Could Pose Risk to U.S. Financial Stability

Posted on by

The Office of Financial Research (“OFR”) asserted that “severe adverse outcomes in the U.K. from ‘Brexit’ could pose a risk to U.S. financial stability.”

In its biannual report, titled the Financial Stability Monitor, OFR provided the results of an assessment that focused on “vulnerabilities – weaknesses in the financial system that can originate, amplify or transmit shocks, potentially destabilizing the system.” The report was organized into five risk categories: macroeconomic, market, credit, funding and liquidity, and contagion.

The report found that risks to financial stability have stayed within the medium range, but also have risen as a result of the U.K. withdrawal referendum. The report specified that “Brexit” could pose moderate risks to the financial stability of the United States:

  • Trade: Although a recession in the United Kingdom or countries in the European Union would reduce the demand for U.S. exports, it is unlikely that the reduction would threaten U.S. financial stability due to the low percentage of U.S. exports to the European Union and vice versa. However, a reduction in exports could slow U.S. growth moderately.
  • Financial Exposures: The financial claims of the United States on the United Kingdom and, more broadly, the European Union could be vulnerable to losses due to (i) currency depreciations and volatility, (ii) declines in asset market prices, and (iii) increased defaults on debt claims.
  • Confidence and Indirect Effects: Financial instability in the United Kingdom or, more broadly, the European Union could do lasting damage to the confidence of global investors, and that damage could become “self-perpetuating.” Additionally, “U.S. long-term interest rates reached historic lows in the week after the [“Brexit”] referendum,” which in turn “underpin[ned] excesses in investor risk-taking.”
  • Funding and Liquidity Risks: Although “[k]ey funding risks are much lower than before the financial crisis due to major changes in short-term funding markets,” several vulnerabilities still persist. These include risks in certain money market funds and short-term investment vehicles, and sharp falls in market liquidity during certain moderate stress events.
  • Contagion Risks: “[C]ontagion risk is greater than available metrics indicate. . . . It is unlikely that the contagion risks disappeared as stress receded. It is more plausible that underlying factors – such as risky assets’ tendency to become more correlated during market stress – pose enduring contagion risks.”

The report stated:

Because the U.K. economy and especially the U.K. financial system are highly connected with the rest of Europe and the United States, severe adverse outcomes in the U.K. could pose a risk to U.S. financial stability.

 

Lofchie Comment: The value of these government reports is questionable. Statements in the OFR report like: “severe adverse outcomes in the U.K. could pose a risk to U.S. financial stability,” are trivial given the current economic environment, and they offer no useful insight for market participants. More remarkable, however, was the failure of the Financial Stability Oversight Council (“FSOC”) to identify “Brexit” as a risk in its own annual report, produced just before the “Brexit” vote. The OFR’s biannual report and FSOC’s annual report raise necessary but basic questions: (1) are these agencies particularly skilled at identifying risks before the fact, and (2) do they have anything useful to say about risks after the fact?