A horse is a horse, of course, of course,
and no one can talk to a horse, of course.
That is, of course, unless the horse is the famous Mister Ed.
Those lines were the opening verse to the theme song of the TV comedy Mr. Ed, which we celebrate today with the passing of (non-horse) star Alan Young who died this past week. While the name Mr. Ed may not mean much to the current television watching audience, his role as Wilburrrr, the foil of that universally famous talking horse Mr. Ed, should bring a few smiles to faces out there. Mr. Ed had an initial run from 1961-1966 on CBS and then reintroduced itself to an entire new audience on Nickelodeon network on the ubiquitous Nick at Nite in the 1980s and 1990s.
Mr. Ed and his ongoing antics and shenanigans seemed a good introduction to the this issue of individual liability of a Chief Compliance Officer (CCO) in the financial services industry and whether that individual liability may bleed over into the wider anti-corruption compliance world. For when should a CCO have liability and should the regulators, whether in the financial services industry or in the broader anti-corruption world of the Foreign Corrupt Practices Act (FCPA), have such individual liability? While the financial services world is regulated by both the Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) they have specific regulations requiring companies they regulate to have anti-money laundering (AML) compliance programs, the FCPA does not have any such requirements, either written directly into the statute or by interpretation therefrom.
In late 2014, SEC Enforcement Chief, Andrew Ceresney, gave a speech where he laid out the three areas of potential individual liability for a CCO. He said that CCOs should be concerned: (1) where there is actual willful misconduct with participation in the illegal activity; (2) when they have helped misleading regulators; and (3) where there is the clear responsibility to implement compliance programs or policies and a wholly fail to carry out those responsibilities. I do not think there would be any debate that a CCO who engages in illegal conduct should be sanctioned or one who wholly fails to engage in the statutorily mandated duties of position. However, if regulators are going to move into evaluating the specific compliance program implementation and execution by CCOs, that would provide a sea-change in enforcement and potential personal liability for CCOs.
Last year there were two SEC individual enforcement actions against CCOs in the financial services industry. The two enforcement actions were styled Blackrock Advisors LLC and Bartholomew A. Battista (Blackrock) and SFX Financial Advisory Management Enterprises, Inc. and Eugene S. Mason (SFX). The Blackrock case involved an internal conflict of interest which led to a $12MM fine paid by the company. The company had a conflict of interest policy. However, according to the Cease and Desist Order, the CCO liability turned on “BlackRock’s CCO, Battista was responsible for the design and implementation of BlackRock’s written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules. Battista knew and approved of numerous outside activities engaged in by BlackRock employees (including Rice), but did not recommend written policies and procedures to assess and monitor those outside activities and to disclose conflicts of interest to the funds’ boards and to advisory clients. As such, Battista caused BlackRock’s failure to adopt and implement these policies and procedures.” Battista was fined $60,000 separately.
According to the SFX Cease and Desist Order, the company President, Brian Ourand, “misappropriated at least $670,000 in assets from three client accounts.” The company was ordered to pay a civil penalty of $150,000. However, the SEC accused SFX CCO Eugene Mason of three general violations. First, Mason did not effectively implement “an existing compliance policy requiring that there be a review of “cash flows in client accounts.”” Second Mason did not require an appropriate segregation of duties in that he did not guarantee that account cash flow reviews were done by someone other than the President. This caused the following statement in SFX’s brochure to be untrue: “Client’s cash account used specifically for bill paying is reviewed several times each week by senior management for accuracy and appropriateness.” Finally, and perhaps most troubling, while CCO he was in the midst of an internal investigation following the discovery of [the President’s] misappropriation, the company did not conduct an annual review of its compliance program. The SEC believed that “Mason was responsible for ensuring the annual review was completed and was negligent in failing to conduct the annual review.”
One of the difficulties with assessing these actions in the context of the role of a CCO in the broader FCPA world is that they are the end results of lengthy processes of negotiations. This is particularly true when it comes to the final resolution documents, such as the SEC Cease and Desist Orders, from both cases.
Last week there was an enforcement action initiated by the FINRA against Raymond James and Associates, Inc. and its former CCO Linda Busby (the “Raymond James matter”). Raymond James paid a fine of $17MM and Busby was fined $25,000 and banned from the industry for three months. The resolution was in the form of a Letter of Acceptance, Waiver and Consent (Letter of Acceptance). The facts laid out in the Letter of Acceptance were accepted and consented to by the defendants without admitting or denying same.
In the Letter of Acceptance, FINRA laid out the specific failings of Busby in her role as CCO. The basis of liability is FINRA Rule 3310 that requires a company to “develop and implement a written anti-money laundering program reasonably designed to achieve and monitor the member’s compliance with the requirements of the Bank Secrecy Act…” The required policies and procedures to detect and report suspicious activity and monitor transactions for specified red flags. If such red flags were detected, additional investigation was required and any clearance of such a red flag required documentation.
Busby’s role within the company, from 2002-2013, was to ensure that the company’s AML compliance program was “tailored to the Firm’s business and for appropriately monitoring, detecting and reporting suspicious activity.” Unfortunately for Busby, she was the Lone Ranger of Raymond James compliance from 2002-2012. She did, however, increase head count in the compliance function by 100% in late 2012 “by adding a second employee.” The size of this compliance function, when compared to the size of the company as laid out in the Letter of Acceptance, is stunning, “the firm’s “size increased from approximately 2,398 registered persons in 190 branches in 2006, to approximately 5,294 registered persons in 445 branches in January 2014.” Busby oversaw all of their work and one might see how her position was untenable to start with before there was any analysis of her work.
These head count numbers are rendered starker when one considers the number of transactions of the company. By 2014, the company had approximately 2.2 million accounts, generating “over 51 million transactions” annually. Busby and her team (such that it was) “were responsible for, among other things, reviewing more than a dozen lengthy AML exception reports for suspicious activity across the millions of accounts, filing suspicious activity reports (SARs), and communicating with branch managers and registered representatives regarding client actions and account activity.” It sure does not sound like a position set up for success.
Tomorrow, we will review that work and see what lessons may be drawn…stay tuned.
[View source.]
