Trading Controls: Lessons to be Learned from WhatsApp fines?

As I spend my days meeting with clients, chatting with partners and speaking at conferences, I've noticed a considerable shift in attitudes towards pre-trade controls. There is a tacit acknowledgement that regulators are preparing to crack down in this area. In effect, regulators, led by the UK’s PRA (and soon to be followed by the Fed and ECB), want to see more systematic evidencing of preventative controls.

A few years ago, most firms were employing what I call the "sticking tape and superglue" approach to pre-trade controls. This consisted of a “control framework”, typically based on regular training and an annual attestation confirming traders would act in accordance with relevant policies and regulations. Additionally, the framework included “detective controls”, which involve retrospectively examining a small sample of trades, often days, weeks or even months after the trade date.

Fast-forward to today, however, and regulatory expectation has shifted to a much more proactive stance. Regulators want to see a “belt and braces” approach that incorporates the application of preventative controls, via hard- and soft-blocks, that can be systematically evidenced. Detective controls still have an important role to play - but ones which are much more robust, real-time and complete than before. 

Lessons to be learned from recent WhatsApp fines? 

As I think about the ongoing trading controls paradigm shift, I see real parallels to recent events in the compliant communications space. Five years ago, regulators around the world made it clear they expected firms to implement robust controls for blocking non-compliant communication through messaging systems such as WhatsApp. Many banks at that time felt that it would be sufficient for controls to be primarily based on training and attestations, rather than fundamentally and comprehensively addressing the issue by investing in technology solutions. 

Today, however, I think it’s safe to say that the “Collective $1.8bn in punishments doled out to a group consisting of names such as Barclays, Citigroup, Goldman Sachs, and Morgan Stanley” has changed the mindset. My sense is that pre-trade controls will follow a similar path. Sooner or later the regulators will say to banks, “How did you think your largely detective- and attestation-based pre-trade controls, which you’ve been using for the past 10 years, were still effective and sufficient today?” - and they will start to issue fines accordingly.

Technology as a key enabler for effective, scalable trading controls

Some firms have now woken up to the need to get the right technology in place to properly address the issue. In my previous roles as Sales COO or Head of Digital Transformation, I would emphasise to my team the need to fundamentally address the issue once and for all - and that means investing in the right technology, which can also efficiently scale as regulations further evolve in the future.

Firms need to be able to evidence effective controls that ensure a trader can only deal in permitted products with permitted clients via permitted legal entities. While establishing preventative controls for electronic trading flow is relatively easily dealt with by implementing a high-performing decision engine into the RFQ flow, the challenge remains of how to address voice trades. Of course, they can have a user interface to check trades manually, but this risks slowing down the execution process, thereby negatively impacting client experience, trader agility and general productivity. 

However, by connecting the same decision engine into the trade blotter, 100% of the trade population (voice and electronic) can be run against the complete set of policies in quasi-real-time. If any anomalies are detected, they can be automatically escalated to the appropriate supervisor and, if necessary, unwound before markets have had a chance to significantly move (i.e. before banks are exposed to potential unwind costs). Having such a robust, real-time and complete detective control should enable banks - when combined with such strong preventative controls for electronic business - to “risk accept” that not all voice trades need to be checked manually.

Traders can act with confidence, safe in the knowledge they won’t be hauled in front of conduct risk committees for inadvertent mandate breaches. Similarly, senior managers can sleep better knowing that, should the regulator ever come knocking, they can easily defend each and every trade with just a few clicks.

Common excuses used for not tackling the problem strategically, which really don’t hold water!

Time and again I hear from banks that their data is uniquely architected or siloed, and is ultimately messy. They are convinced that this disordered data needs to be fixed before proceeding with more effective trading controls. Whilst understandable, by delaying in this manner (and using more sticky tape and super glue), banks are only making the problem worse for themselves down the road.

By using a purpose-built decision engine like Droit Adept, we can help banks identify the minimum data inputs required in order to meet their regulatory obligations. It’s much more efficient to go looking for a specific, small subset of required data points, rather than trying to clean up ALL the legacy data in a bank beforehand.

Additionally, utilising a purpose-built solution to handle the technical aspect of compliant decision-making allows the bank to focus its internal resources on resolving essential data issues, rather than spreading itself too thinly by building home-made compliance technology in parallel.

The time is now

There is an approaching imperative for firms to invest in the right technology, especially because the onus is now directly on the COOs, Heads of Controls, Supervision and Compliance. Solutions have advanced rapidly over the past few years, meaning there is no longer an excuse for not upgrading to the right technology. And more to the point, can you afford not to?