The New York City Bar Association Goes to Bat for Compliance Officers

The New York City Bar Association Compliance Committee (“Committee”) recently issued a report encouraging financial regulators to provide a clear framework for when compliance officers may be held personally liable for the misconduct of their employing institutions.^[1] The Committee notes that, due to a recent increase in enforcement actions brought against compliance officers, there is a growing belief that individuals in compliance positions will face undue exposure for a company’s regulatory failures. 

At times, the confusion felt by compliance professionals has only increased despite regulators’ attempts to provide reassurances. For example, in 2015, the SEC’s Director of Enforcement outlined three circumstances in which the SEC will individually charge a compliance officer. While the first two circumstances (affirmative involvement in the misconduct and obstructing or misleading the SEC) were straightforward, the third (“a wholesale failure to carry out his or her responsibilities”), poses more questions than answers. Another reason for uncertainty related to increased exposure is the rise of attestation and certification requirements for compliance officers, such as when FinCEN added a requirement to the Bank Secrecy Act that financial institutions “establish and maintain written procedures” with respect to beneficial ownership of certain clients. This general perception of compliance officers is not purely the result of regulatory changes, however, but is also exacerbated by the fact that many compliance professionals are shut out of corporate decision making for which they will ultimately be held to account. Additionally, compliance officers have to make real-time decisions on sensitive compliance issues often without the benefit of regulatory guidance. 

The Committee highlights a number of trends that compliance officers can look to in determining when they may be held liable for institutional misconduct.  These include situations where the compliance officer: 

• fills multiple roles in the business at the same time ^[2];
• obstructs a regulatory investigation ^[3];
• is directly aware of the cause of the violation ^[4];
• fails to properly investigate wrongdoing ^[5]; or
• fails to implement reasonable written policies ^[6].

These trends have led to compliance officers facing liability regardless of whether they have prior knowledge of the facts underlying the misconduct. 

As a result of its review, the Committee offers a number of recommendations to regulators in order to provide compliance officers with a clearer framework for fulfilling their important functions within the current regulatory environment. These include:

• issuing formal guidance as to when compliance officers will be pursued in a personal capacity in regulatory action;
• providing added detail in enforcement releases, risk alerts, and other existing regulatory communications;
• increasing the channels of informal communication with compliance officers, similar to initiatives the CFTC has undertaken with fintech innovators and the roundtables hosted by FINRA; and
• creating advisory groups for compliance professionals.

It remains to be seen whether any regulator adopts the recommendations of the Committee, but it is clear from the report that personal liability is a sensitive issue for compliance officers throughout the financial services industry, and one that must be addressed in a clear and comprehensive manner.

Subscribe To Viewpoints