Download The Mobile Messaging Enablement Guide for Security and Compliance Teams Today

    Executive Summary

    Financial firms often feel like they are forever playing catchup with evolving compliance regulations. Regulators like the SEC, the Federal Reserve, and FINRA are always looking to implement new, up-to-date and often stricter laws and regulations regarding financial services compliance. This can feel like a real operational burden.

    However, finserv companies don’t need to think of compliance as simply an obstacle or annoyance. Instead, financial services compliance requirements can be an opportunity for the finserv industry to transform their businesses and services. However, they require the right solutions and tools to enable this transformation –  solutions that leverage automation and ML to enable key benefits like unified visibility, efficient collaboration, and the removal of the compliance barrier.

    Studies have shown that many firms are struggling to keep up with ever-changing compliance requirements.

    With finserv solutions like banking-as-a-service (BaaS) rapidly expanding, financial institutions must keep a sharp eye on regulatory compliance in the coming years to stay ahead of intensifying scrutiny and capitalize on emerging opportunities.

    Banks face rigorous oversight regarding deterring money laundering, safely depositing customer funds and adhering to credit granting practices. A key focus of this scrutiny includes ensuring that all policies meet the standards outlined by the Bank Secrecy Act while ensuring consumers are well-informed about their financial decisions. As David Sandler, co-head of financial services investment banking at Piper Sandler, said in an interview:

    “Regulators are going to spend time making sure that the institutions that are providing these kinds of services to third parties who are interacting with customers on their behalf are in a position to be as compliant as they would be in any other business lines.”

    This is because compliance departments, especially within financial service organizations, are increasingly dealing with risks that are now beyond what was traditionally under the purview of compliance.

    David Stapleton, CISO at CyberGRX, outlined in his Forbes article that the financial services industry is becoming more dependent on third parties, making risk management and mitigation more crucial than ever. Smart organizations should dedicate the necessary resources to identify potential risks early - ultimately helping them stay compliant while avoiding costly cybersecurity crises.

    Let’s explore some of the most important financial services compliance regulations and the bodies that govern them. We will also discuss what triggered stricter regulations, and how you can ensure your business remains compliant.

    So what is financial compliance? As defined by the Corporate Finance Institute (CFI):

    “Financial compliance is the regulation and enforcement of the laws and rules in finance and the capital markets.”

    Every business, enterprise, or organization that handles its client’s finances or provides services to augment or improve financial management is subject to financial compliance. Compliance also covers various aspects of financial management from retail banking to investment banking practices.

    The significance of financial compliance lies in the fact that it is needed to maintain public trust with regard to the capital markets and the banking system. But how did modern financial services compliance regulations come about? What triggered the strict regulations that we’re seeing today?

    From 2007-2009, the world suffered a major Global Financial Crisis. During this time, US GDP declined by 0.3% in 2008 and 2.8% in 2009, while unemployment briefly reached 10%. Why did the recession happen? Financial experts believe there were four main reasons for the recession:

    1. Failure on the part of the government to regulate the financial industry, which included the Federal Reserve’s inability to curb toxic mortgage lending;

    2. Too many financial firms taking on too much risk (through investment banking);

    3. Excessive borrowing by consumers and corporations, and;

    4. Lawmakers who did not fully understand the collapse of the financial system.

    In the aftermath of the Great Recession, financial compliance became a serious matter for regulators and other concerned parties, hence the establishment of stricter regulations for financial institutions and service providers. Three of the most notable ones are:

    Non Traditional Lenders_Dark_RGBThe Emergency Economic Stabilization Act (EESA)

    Passed by Congress in October 2008, EESA provided the US Treasury with about $700B to bail out institutions like the American International Group Inc., Bank of America, Citigroup, JPMorgan, and General Motors by purchasing their bank shares and mortgage-backed securities. This was also known as the Troubled Asset Relief Program.
     

    Wealth Management_Dark_RGBThe American Recovery and Reinvestment Act of 2009

    This fiscal stimulus bill signed by former President Barack Obama in February 2009 consisted of more than $800B in tax cuts/credits, unemployment benefits, and expenditure earmarks for healthcare, infrastructure, and education.
     

    ExecutiveProtection_Dark_RGBThe Dodd-Frank Wall Street Reform and Consumer Protection Act

    Also known as the Dodd-Frank Act, was signed into law by former presidents George W. Bush and Obama in July 2010. It introduced steps that would regulate the financial sector's activities and protect consumers, like limiting speculative investments and monitoring designated systemically important financial institutions (SIFIs).

     

    w

    w

    Image
    Image

    Adequate financial compliance in 2008 might have saved people’s retirement funds, houses, and pensions, and decreased the overall magnitude of the Great Recession. However, due to the stricter regulations, finserv companies now have a lot on their plate with regard to ensuring finserv compliance. 

    According to a Thomson Reuters report regarding compliance in the financial services industry in 2022:

    • Compliance teams, on average, spend about 1-3 hours per week tracking and analyzing regulatory developments (42% in 2022). 

    • 55% of businesses expect more compliance involvement related to assessing cyber resilience in the next 12 months. Practitioners also expect more compliance involvement in data analytics, communications, social media, public exposure, and more.

    • 47%, on the other hand, expect an “implementation of a demonstrably compliant culture.” That includes communication and collaboration between departments that stay compliant through a security and compliance solution.

    • 40% of US-based firms and 39% of Continental Europe-based ones expect resources devoted to conducting risk issues to remain the same in the next 12 months. 

    • Unfortunately, only 31% of these businesses have discarded a potentially profitable business proposition due to culture and/or conduct risk concerns.

    The fact of the matter is that most businesses are still willing to risk non-compliance or security issues to take advantage of a profitable business opportunity. Unfortunately, the result of this over-leniency to and circumvention of security and compliance protocols results in news reports such as these:

    • On September 2022, US regulators issued an unprecedented fine to sixteen financial firms – including prominent names like Citigroup, Morgan Stanley, and Bank of America – for a collective total of $1.8 billion in penalties. The action was taken after investigations revealed that traders had been discussing confidential deals through their personal devices and messaging apps, violating SEC and CFTC regulations.

    • Meanwhile, US Bank experienced a security incident in October 2022 that resulted in the unauthorized access of personal information for 11,000 customers. The details accessed by hackers included names, Social Security numbers and closed account balances – valuable data that could compromise customer identities if misused or sold on the dark web.

    • Banks and financial institutions faced hefty fines of nearly $5 billion that year for anti-money laundering violations, sanctions skirting, faulty KYC compliance measures, and other illicit behaviour. This brings total penalties since the global financial crisis to a staggering almost $55 billion - an increase of over 50% on the previous year’s figures.

    Financial services compliance regulations vary internationally, and they cover a broad spectrum. In the US alone, several organizations take charge of finserv companies and impose compliance regulations.

    The Federal Reserve
    The Federal Reserve is, for all intents and purposes, the central bank of the United States. It regulates the country’s monetary policy and ensures that inflation is maintained at around 2%.

    The organization also decides how much money to print, and regulates the federal funds rate. The Reserve’s Board of Governors currently has five individuals that ensure the organization fulfills its purpose.

    Moreover, the Federal Reserve is not influenced by other branches of government, such as the Secretary of the Treasury and the President. This independence helps ensure the stability of the US economy.

    Securities and Exchange Commission (SEC)
    SEC is a regulatory agency that oversees the US securities market, monitors security exchanges, and enforces securities law. It is an organization independent of the government, and its main goal is to establish transparency throughout the securities market.

    When monitoring security exchanges, the SEC looks for signs of front running, trading on public information, fraud, and corporate malfeasance. SEC also requires public companies to file quarterly and annual financial reports, which are and should be available to the public.

    Federal Deposit Insurance Corporation (FDIC)
    On the other hand, the FDIC aims to preserve and promote the public’s confidence in the US financial system. The organization provides deposit insurance of at least $250,000 for accounts with banks and thrift institutions.

    The FDIC only insures deposit accounts such as checking accounts, savings accounts, and certificate of deposits (CDs). It does not insure stocks, bonds, and mutual funds. 

    Among its purposes in helping the financial compliance of the US financial system, the FDIC examines over 4,000 banks for operational safety and soundness.

    The Financial Industry Regulatory Authority (FINRA)
    This private, independent US corporation acts as a self-regulatory organization that regulates member brokerage firms and exchange markets. FINRA oversees more than 3,400 brokerage firms, 152,000 branch offices, and nearly 617,550 registered securities representatives.

    Authorized by Congress to protect the interests of investors, FINRA also regulates the trade of corporate bonds, equities, options, and securities futures. 

    Certain regulators in and out of the country also have mandates regarding the retention, storage, and supervision of electronic communications, in order to ensure a business remains compliant. These include the following organizations:

    What are the compliance, recordkeeping, and consumer protection laws that banks are required to comply with? 

    1. Bank Secrecy Act 

    The BSA firmly established regulations for all U.S-based financial institutions to provide detailed documentation for cash transactions that surpass $10,000 or have a single buyer contributing more than this amount. This law is designed to ensure these organizations are not unwittingly laundering money and break up existing schemes where criminals may be trying to hide illicit funds.

    2. Community Reinvestment Act
    This act requires the Federal Reserve and other federal banking regulators to encourage financial institutions to help meet the credit needs of the communities in which they do business, including low- and moderate-income (LMI) neighborhoods.

    3. FCA/MiFID II
    This mandate is for European- and UK-based organizations to keep copies of electronic communications for 5 years, with the obligation to periodically monitor these records. So far, post-Brexit, nothing suggests that either the EU or the UK will repeal or change MiFID anytime soon.

    4. FINRA Rule 3110
    This rule requires businesses to supervise electronic communications related to the firm’s investment banking and securities business.

    5. FINRA Rule 4511
    This requires businesses to store relevant records in a non-rewritable, non-erasable format.

    6. Gramm-Leach-Bliley Act
    This US act mandates that banks and financial institutions safeguard sensitive customer data, as well as explain their information-sharing practices.

    7. SEC Rule 17a-4<
    This SEC rule requires organizations to retain copies of all business communications sent and received in a non-rewritable, non-erasable format

    8. Truth-In-Lending Act
    This act mandates lenders to provide their customers with loan cost information so that they can comparison shop for certain types of loans, protecting them against inaccurate and unfair credit billing and credit card practices.

    Authorization_Dark-2Know Your Client (KYC)

    Know-Your-Client is standard practice for investment advisors. They must be able to:

    • identify the client they are working with,

    • ensure the client is who they say they are,

    • know the client’s tolerance to risk, and;

    • gain awareness of the client’s financial position.

    KYC greatly assists in reducing fraud, ensuring the financial system is not being used for criminal activities like money laundering and/or forgery. It also protects clients by informing advisors of the investments that best suit their personal experiences.

    Threat_Dark-1Anti-Money Laundering

    As defined, money laundering is

    “..the act of illegally passing obtained funds through a complex system in order to make them appear legitimate and legal.” 

    Financial Crimes Enforcement Network (FinCEN) in the US oversees government efforts to combat money laundering. The organization detects, prevents, and deters money laundering and terrorist financing. FinCEN also has a couple more functions, including, but not limited to:

    1. Analyzing financial transaction reports;

    2. Identifying suspicious transactions;

    3. Ensuring compliance of reporting entities, and;

    4. Researching trends and patterns in money laundering and terrorist financing activities to combat them more effectively.

    The agencies and regulators previously mentioned work to mitigate unethical compliance practices in the capital markets and banking system. Some examples of these nefarious activities include:

    • Deceiving behavior to distort transaction prices or the value of any security.

    • Distorting or attempting to mislead the appearance of public trading in a security.

    • Entering an arrangement to attempt to manipulate the market or market prices.

    • Not accurately disclosing the magnitude of risk of a security to a client.

    • Aggressively pressuring clients into buying or selling securities that are not in their best interest.

    Often, these unethical practices are discussed privately by insiders through communication channels, or even through unsanctioned and insecure apps. These new communication channels do increase business agility and provide avenues for growth. However, how can you make sure you can trust these communications?

    The only way is to gain deep visibility to detect and respond to cyber threats and regulatory risks. Businesses need to find a solution that enables the following:

    • Unified Visibility into your communications to protect your workforce from credential theft, fraud, insider threats, phishing, and social engineering attacks.

    • Efficient collaboration across global teams and greater business agility with new communication technologies that support innovation.

    • Removal of the compliance barrier to authentic social engagement to build community and build a pipeline through Natural Language Understanding (NLU) capabilities.

    • Cross-Channel Event Correlation. Solutions that enable this functionality allow security teams to understand how each communication platform is connected to various compliance issues in financial services.

    • Mitigate regulatory risk in your business communications ecosystem while reducing oversight costs by up to 80%.

     

     

    The good news is that certain compliance solutions have evolved to meet the demands of the finserv space. Such modern solutions are transforming businesses, leveraging automation and machine learning (ML) to rapidly reduce costs and time burdens for compliance teams. This addresses compliance teams’ most common pain point about being “stretched too thin” to worry about recording communication.

    With ML and automation, companies can: 

    • Dramatically reduce risks;

    • Achieve 100% compliance coverage; 

    • End reliance on sampling and proxy measurements;

    • Accurately measure regulatory risk exposure, and; 

    • Gain a faster time-to-value for investigations and discovery.

    Cloud-based solutions can also scale quickly to cover operations in and out of the country, assisting financial services compliance teams with risk assessment in various languages and multiple regulatory frameworks all at once.

    Want to see this in action? Feel free to schedule a demo here.

    When it comes to ransomware, avoiding becoming a victim is better than cure. Reducing the risk of ransomware incidents should be a priority for many businesses. However, should an organization be unfortunate enough and fall prey to ransomware, the following steps should be followed:

    1. Remove The Device From The Network.
      Ransomware on one device is bad, but ransomware proliferating through a network of devices is catastrophic. Employees should be trained to immediately disconnect their device from the network if they see a ransomware demand displayed on their screen. They should also do the same if they observe anything peculiar, such as an inability to access their own files. Employees must not attempt to restart the device; it should be sent immediately to the IT department.

    2. Notify Law Enforcement.
      Ransomware is a crime. Theft and extortion rolled into one make it a law enforcement concern. Organizations should all default to immediately contacting the police cybercrime department, should they fall victim to a ransomware attack.

    3. Use Digital Risk Protection to Establish The Scope of Attack.
      In the wake of a ransomware attack, security teams need to gather as much intelligence as they can, as fast as they can. This will help both internal IT teams and law enforcement agencies formulate a response. Enterprises should strive to figure out the nature of the attack: who is behind it, what tools they used, who they targeted and why. Answering such questions can help your IT managers and network administrators figure out the extent of the attack and protect networks from future attacks.

    4. Consult with Stakeholders to Develop the Proper Response.
      Enterprises suffering a bad ransomware attack need to answer a host of questions: Can they afford to lose access to the targeted files, either because they have been backed up, or because they are not of the highest priority? Can the organization afford the ransom? Is there any room for negotiation? All stakeholders, from shareholders to legal counsel, should be consulted.

    5. Get the Post-Mortem Right.
      The best way to resist a ransomware threat is to have learnt from the last one. After an attack, enterprises should task their IT technicians, network administrators, and cybersecurity teams with a thorough review of the breach. A meticulous assessment of an organization's infrastructure, practices, and processes is required to discover flaws in security, and reinforce an enterprise against existing and future threats.

    Fortunately, more companies are becoming smart enough to not give in to the threat of ransomware. As of Q4 of 2020, the average ransom payment is down by 34% ($154,108) from $233,817 in 2020’s Q3.

    The dramatic decline can be attributed to the recent instances of malware attacks where, instead of being deleted, the stolen data is released publicly, even when the affected organization or individual pays. Now, more victims of cyber extortion are saying “no” to ransom payments, and are becoming smarter in their cybersecurity efforts by creating backups of their data and following best practices.

    Hopefully, moving forward, more companies will proactively secure their data by following the best practices stated above and continue to resist being strong-armed by ransomware attackers. When cyber extortion loses its profitability, organizations win.

     

     

    With proper communication risk protection, organizations can detect and nullify ransomware threats before they become an issue. The SafeGuard Cyber platform can keep pace with the scale and velocity of modern digital communications, and detect phishing links and other indicators of ransomware attacks across the full suite of cloud applications. Threats are instantly flagged and quarantined before an unsuspecting human target clicks on anything dangerous.

    Secure Human Connections

    Ready to see how SafeGuard Cyber secures modern communication apps wherever they exist?

    Get a live platform demo

    We’ll work with you to better understand your business and recommend a solution to solve your security needs.
    Learn More

    Talk to a communication risk expert

    We're here to guide as you consider adopting new cloud communication apps.

    Get In Touch