Compliance Risk Assessment Fall 2016 Class 8 Stephen Paine Diane McEnroe, Guest Lecturer Compliance Risk by Area: An Overview of Pharmaceutical Industry Regulation Recap of Class 1 Pfizer Case Study and Compliance Risks Legal and Regulatory Incentives/Conflicts of Interest Political Failure of Controls Reputational Recidivism Point of Sale/Distribution Definitions Compliance Risk is the risk of failing to comply with applicable legal or regulatory requirements resulting in a material loss (financial or reputational) or legal/regulatory sanction A Compliance Risk Assessment is a framework to enable the evaluation and analysis of the overall Compliance risk (both inherent risks and control effectiveness) associated with a particular business area Recap of Class 2 The Five Elements of an Effective Compliance Program Tone at the Top Enron Chronology: July 1985 Enron established through merger and by November 2006 entire senior management team has either been indicted or convicted with Enron and Arthur Andersen no longer operating Corporate Culture and Communication Codes of Conduct set the values for employees to follow and those values are based on Compliance Risk. 3. Compliance Risk Assessment 4. Testing and Monitoring 5. Chief Compliance Officer Case Study: HSBC Financing drug cartels Permitting sanctioned regimes to process dollar payments Claw back of compensation (including Compliance Officers) Criminal charges for “failure to maintain an effective AML program” Recap of Class 3 Compliance Tools/Controls Advisory Function Coverage of Front Office and Technology, Finance and Operations Conflicts of Interest -- A Deep Dive Conflicts of interest are inherent in the financial services business Historical success of the industry has been managing these conflicts by eliminating or disclosing them Top to bottom review of business operations to address conflicts of interest of every kind Risk Assessments Follow-Up Policies and Procedures Education and Training Compliance Surveillance and Business Unit Review and Testing ‹#› Recap of Class 4 A Compliance Risk Assessment is a framework to enable the evaluation and analysis of the overall Compliance risk (both inherent risks and control effectiveness) associated with a particular business area 1. Identifying Business Area(s) and Metrics 2. Mapping Applicable Rules 3. Identifying Key Compliance Risks and Themes 4. Defining a Controls Inventory 5. Rating Control Effectiveness 6. Determining Residual Risks 7. Scoring, Rating and Reporting It’s All About the Questionnaire . . . Compliance Risk Assessment Steps Identify Business Area and Metrics Map Applicable Rules Identify Key Compliance Risks & Themes Define Controls Inventory Rate Controls Effectiveness Determine Residual Risk Score, Rate and Report Phase 2 of the Course Assi ...

1. Compliance Risk Assessment
Fall 2016 Class 8
Stephen Paine
Diane McEnroe, Guest Lecturer
Compliance Risk by Area:
An Overview of Pharmaceutical Industry Regulation
Recap of Class 1
Pfizer Case Study and Compliance Risks
Legal and Regulatory Incentives/Conflicts of
Interest
Political Failure of Controls
Reputational Recidivism
Point of Sale/Distribution
Definitions
Compliance Risk is the risk of failing to comply with applicable
legal or regulatory requirements resulting in a material loss
(financial or reputational) or legal/regulatory sanction
A Compliance Risk Assessment is a framework to enable the
evaluation and analysis of the overall Compliance risk (both
inherent risks and control effectiveness) associated with a
particular business area

2. Recap of Class 2
The Five Elements of an Effective Compliance Program
Tone at the Top
Enron Chronology: July 1985 Enron established through merger
and by November 2006 entire senior management team has
either been indicted or convicted with Enron and Arthur
Andersen no longer operating
Corporate Culture and Communication
Codes of Conduct set the values for employees to follow and
those values are based on Compliance Risk.
3. Compliance Risk Assessment
4. Testing and Monitoring
5. Chief Compliance Officer
Case Study: HSBC
Financing drug cartels
Permitting sanctioned regimes to process dollar payments
Claw back of compensation (including Compliance Officers)
Criminal charges for “failure to maintain an effective AML
program”
Recap of Class 3
Compliance Tools/Controls

3. Advisory Function
Coverage of Front Office and Technology, Finance and
Operations
Conflicts of Interest -- A Deep Dive
Conflicts of interest are inherent in the financial services
business
Historical success of the industry has been managing these
conflicts by eliminating or disclosing them
Top to bottom review of business operations to address conflicts
of interest of every kind
Risk Assessments
Follow-Up
Policies and Procedures
Education and Training
Compliance Surveillance and Business Unit Review and Testing
‹#›
Recap of Class 4
A Compliance Risk Assessment is a framework to enable the
evaluation and analysis of the overall Compliance risk (both
inherent risks and control effectiveness) associated with a
particular business area

4. 1. Identifying Business Area(s) and Metrics
2. Mapping Applicable Rules
3. Identifying Key Compliance Risks and Themes
4. Defining a Controls Inventory
5. Rating Control Effectiveness
6. Determining Residual Risks
7. Scoring, Rating and Reporting
It’s All About the Questionnaire . . .
Compliance Risk Assessment Steps
Identify Business Area and Metrics
Map Applicable Rules
Identify Key Compliance Risks & Themes
Define Controls Inventory
Rate Controls Effectiveness
Determine Residual Risk
Score, Rate and Report

5. Phase 2 of the Course
Assignments
Listen carefully in class as assignments will be based on
material from the sector presented.
Sector Risk
Listen and assimilate the material/lecture through the lens of the
types of risks each of the areas present, as well as the
corresponding controls – the 3/4 central boxes of the CRA
Diagram
Be a proactive listener and ask questions or provide comments
Make notes of questions that you have or comments to discuss
later
Compliance Risk Assessment Steps
Identify Business Area and Metrics
Map Applicable Rules
Identify Key Compliance Risks & Themes

6. Define Controls Inventory
Rate Controls Effectiveness
Determine Residual Risk
Score, Rate and Report
Recap of Class 5
Financial Services Regulation
Banking Services
Deposit Taking
Lending
Fund Transfers, checking
Securities and Investments
Buying and selling stocks, bonds
Participating in Capital Markets transactions
Investment Advisory Activities
Investment Company Activities
Federal Reserve, OCC, SEC, FINRA and CFTC, plus Exchanges

7. FINRA Regulatory Regime
Supervision
Self-Reporting
Case Study: Prospectus Delivery
‹#›
Recap of Class 6
Anti-Money Laundering and Financial Crime Risk and Controls
Anti-Money Laundering
Rule Mapping: Bank Secrecy Act, USA PATRIOT Act, EU
Directives Proceeds of Crime Act
Elements: Proceeds of crime used in banking system
Inherent Risks of Clients – Client Lifecycle (Onboarding,
Processing Transactions, Refreshing Information)
Geographical Location
Type of Client
Products and Services
Client Identification serves as the primary control: KYC --
Client Due Diligence and Enhanced Due Diligence
Sanctions
Rule Mapping: OFAC, United Nations and EU Directives
Elements: Penalties imposed by one country on one or more
other countries/individuals
Client Screening as a control
Anti-Bribery and Corruption (ABC)
To be covered in Class 7

8. Suspicious Transaction Reporting
Filing a report with the appropriate regulatory authority when
suspicious activity is identified
Strictly prohibited to disclose the filing of the report to parties
involved
‹#›
Recap of Class 7
Anti-Corruption
Rule Mapping
US Foreign Corrupt Practices Act
UK Bribery Statute
Travel Act, Mail/Wire Fraud and Money Laundering
A Closer Look at the FCPA
Anti-Bribery
Books and Records
Internal Controls
FCPA Elements
Offer, Promise or Give
Anything of Value
Directly or Indirectly with “Knowledge”
To a Foreign Government Official
To Influence the Official
To Obtain or Retain Business
Case Studies
Glaxo Smith Kline and Nu Skin
BNY Mellon, Och Ziff and Morgan Stanley
‹#›

9. FCPA Basics – Key Provisions
Cannot offer/give anything of value to foreign official for
purpose of obtaining/retaining improper business advantage
Must keep accurate and reasonably detailed books and records
Must maintain sufficient internal controls designed to prevent,
detect, and address FCPA violations, and enable accurate
financial reporting
Anti-Bribery
Books/Records
Internal Controls
FCPA: Elements of an Anti-Bribery Offense
Offer, Promise, Pay, Authorize, or Give
_______________________
Anything of Value
________________________
Directly or Indirectly with “Knowledge”
________________________
Foreign Government Official
________________________
Influence the Official
________________________
Obtain or Retain Business

10. Offer, Promise, Pay, Authorize, or Give
The mere promise or offer of an improper payment is itself
punishable
An attempt to bribe is punishable (thus no requirement that
bribe actually be paid)
No requirement that offer or payment be successful in achieving
the desired outcome
Serving as an authorizer of a bribe may lead to an FCPA
violation
Anything of Value
“Value” may be monetary or in-kind
No minimum (but must be enough to suggest possible corrupt
motive)
Examples:
Cash, checks, wire transfers, gift certificates, other cash or
monetary equivalents
Commissions or similar fees
Meals, travel, and entertainment expenses
Personal services, theater tickets, jobs
Tangible and intangible gifts and favors (e.g., unpaid internship
for relative of government official)
Political or charitable contributions
Directly or Indirectly with Knowledge
Liability for your own acts
Liability for acts of others if you have “knowledge”
If unlawful to make a payment directly, then unlawful to make
it knowingly through a third person or entity
FCPA does not require proof of “actual knowledge” of third
party’s conduct
“Knowledge” standard is loose – evidence of “willful
blindness,” “deliberate ignorance,” or a “head-in-the-sand”

11. sufficient to convict
Failure to investigate suspicious circumstances – “red flags” –
can amount to “willful blindness”
Foreign Government Official
FCPA does not apply to U.S. federal, state, or local officials
(but other anti-bribery laws do)
Term “foreign official” may include, regardless of rank,
personnel of or agents acting for
National, regional, or local government body – e.g., department,
agency, customs, tax, permitting agency
State-owned or -controlled company (e.g., state-owned airline)
Public international organization (e.g., UN)
Foreign political parties, party officials, and candidates for
office
Royal family members
Sovereign wealth fund employees
Private party engaged to carry out a government function
Influence the Official
FCPA violated if payment or offer made with corrupt intent to
influence official to:
Take any official action
Refrain from acting
Influence others improperly
“Corrupt intent” means motive to achieve quid pro quo in return
for giving something of value
Obtain or Retain Business
FCPA violated if intended result is to obtain new, renew, or

12. maintain existing government business
In addition, enforcement authorities take view that FCPA covers
efforts to obtain essentially any favorable government action,
not just winning business:
Permits/licenses
Taxes
Regulatory decisions
Customs/immigration
FCPA: Internal Controls and Record Keeping
FCPA requires issuers to maintain reasonable internal controls
aimed at preventing and detecting FCPA violations
FCPA requires issuers to “make and keep books, records, and
accounts, which in reasonable detail, accurately and fairly
reflect the transactions and dispositions of the issuer”
The US government will bring charges under the books and
records provisions even when anti-bribery charges may not be
appropriate
There are no state of mind or materiality requirements, making
any problems with internal controls and record keeping
potentially serious
Other U.S. Anti-Corruption Laws: Travel Act, Mail/Wire Fraud,
Money Laundering
Travel ActMail/Wire FraudMoney LaunderingIllegal to travel or
communicate (e.g., use U.S. mail, email, telephone, bank wires)
to violate state commercial bribery laws
Increasingly aggressive DOJ prosecutionsIllegal to defraud via
U.S. mail, email, telephone, bank wires

13. Encompasses theft of honest servicesIllegal to conduct financial
transaction with proceeds of crime
Intent to conceal source, ownership, or control of funds
“Laundering” illegally obtained money to make it look clean
Recap of Class 7
Insider Trading
Definitions
Inside Information is material information that relates to the
securities of an issuer that is not publicly known -- MNPI
What is Material?
Insider Trading is the buying or selling of a security with the
intent to deceive and in breach of a fiduciary obligation or
other relationship of trust while in possess of material non-
public information
Rule Mapping
Section 10(b) of the Securities Exchange Act of 1934 and Rule
10b-5 promulgated thereunder
Prohibits fraud in connection with a purchase or sale of
securities
Rule 14e-3
Prohibits trading when you have MNPI about a tender offer, if
you got that information directly or indirectly from someone
involved in the tender offer
Section 16
Insider liability for short-swing profits (purchase/sale within 6
months)
Regulation FD
Prohibits selective disclosure by companies
Controls
Information Barriers -- Private Side and Public Side
The Control Room

14. Watch and Restricted Lists
Employee Trading
Surveillance
Case Studies
Galleon
Merck
‹#›
What is Inside Information?
23
Relates to the securities of an issuer
Not publicly known
Has not been disseminated in a manner reasonably designed to
provide broad, non-exclusionary distribution of the information
to the public
Material
It has “market significance” (likely to affect the market price of
any outstanding securities of the issuer)
A reasonable investor would consider the information important
in deciding whether to purchase, hold or sell a security
Would be viewed by a reasonable investor as having
significantly altered the total mix of information made available
to holders of securities
Inside information is also known as material, non-public
information (or “MNPI”).
What is Material?
24
There is no statutory definition of materiality – it is determined
according to caselaw, with significant room for judgment.
Courts routinely reject bright-line mathematical tests for

15. materiality
Both quantitative and qualitative factors can be relevant to
materiality (5% rule of thumb)
Information may be material even if it relates to future,
speculative, or contingent events. When events are contingent
or speculative, the test for materiality depends upon a balancing
of both the probability that the event will occur and the
anticipated magnitude of the event in light of the totality of the
company activity (the “probability/magnitude test”).
Examples of Material Information
25
A planned offering of securities
Mergers, acquisitions, purchases or sales of assets, refinancing,
joint ventures
Calls of securities, repurchase plans, stock splits or changes in
dividends
Earnings estimates, changes in previously released earnings or
estimates
Changes in ratings of debt securities
Expansion or curtailment of operations

16. New products or discoveries or developments regarding
customers or suppliers
Changes in control or in management
Writedowns of assets, additions to reserves
Defaults on securities, bankruptcy or receivership
What is Insider Trading?
Buying or selling a security
With intent to deceive
In breach of fiduciary duty or other relationship of trust
While in possession of MNPI about the security

17. Legislative History
No specific prohibition on Insider Trading – prohibitions from
various statutes and caselaw.
Section 10(b) of the Securities Exchange Act of 1934 and Rule
10b-5 promulgated thereunder
Prohibits fraud in connection with a purchase or sale of
securities
Rule 14e-3
Prohibits trading when you have MNPI about a tender offer, if
you got that information directly or indirectly from someone
involved in the tender offer
Section 16
Insider liability for short-swing profits (purchase/sale within 6
months)
Regulation FD
Prohibits selective disclosure by companies
27
Insider Trading: Controls
What is the primary control for handling inside information?
Information Barriers
And how are information barriers managed?

18. The Control Room
Insider Trading
What does the Control Room do?
The Control Room is a central function that monitors the Bank’s
Information Barriers and the flow of inside information
throughout the Bank
The functions of the Control Room related to Information
Barriers include:
30
Development and maintenance of the Bank’s Information
Barrier policies and procedures
Maintenance of the Bank’s Watch and Restricted Lists and
approving Wall Crossings
Monitoring the integrity of the Bank’s Information Barriers
(i.e., surveillance of Firm, Employee and Client trading
activity)
Reviewing Equity and Fixed Income research for companies that
may appear on the Watch List or Restricted List

19. Pre-clearance of private side employee personal account trades
and certain Firm trades
Providing ongoing advice and training on matters related to
inside information and information barriers
Private Side vs. Public Side
31
Above The Wall
Private Side
Investment Banking Department
Public Side

20. Equities and Fixed Income Sales and Trading
Capital Markets
Research
Private Banking
Asset Management
Shared Services functions with no access to Inside Information
Internal Audit
Asset Backed Origination
Structured Lending
Solution

21. s Partners
Private Equity
Shared Services functions with access to Inside Information
Prime Services
Inside Information Barriers
Manage the flow of inside information to prevent its inadvertent
spread and misuse
Restrict the sharing of inside information from employees on
the “private side” of the Bank (e.g., those employees working in
an investment banking or origination capacity) to employees on
the “public side” of the Bank

22. Consist of:
Policies & Procedures
Physical Barriers
Electronic Barriers
Monitoring
Training
32
Watch List
The Watch List is a confidential list of issuers with respect to
which the Firm possesses inside information that has not yet
been publicly disclosed, or for which a transaction has not been
publicly announced
Enables the Control Room to monitor sales, trading and research
activities in a subject company’s securities, and to validate the
integrity of the Firm’s information barriers
Generally does not impact the sales, trading and research
activities of the Firm, except in limited circumstances
The Watch List is not published and can only be accessed by the
Control Room

23. 33
Restricted List
The Restricted List generally reflects pending transactions in
which the Firm is involved that have been publicly announced
and in which we may have, or appear to have, inside
information
The Restricted List also may be used for other regulatory
purposes (e.g., to comply with the trading restrictions imposed
by Reg. M or by the tender rules, Section 16, or if we own a
large position or are an affiliate of the company)
The Restricted List limits certain marketing, research and
trading activity that could constitute misuse of inside
information or otherwise appear to be improper
The Restricted List is available to all employees via an internal
web page as well as via direct feeds to trading systems and
market data screens
34
Wall Crossings
Wall Crossing procedures must be followed when
communicating inside information to public side (i.e. sales,
trading and research) employees

24. All Wall Crossings require:
Prior approval by a designated senior executive;
Prior approval by an appropriate senior business line manager (a
“Conduit”) of the person being brought over the wall; and
Consultation with a member of the Control Room
35
Insider Trading: Surveillance
Overview
Monitor Firm, client and employee trading activity in the firm’s
divisions
Covers all products including equities, debt, derivatives and
bank loans
Types of reports include:
Restricted List
Watch List
Over The Wall
Research Frontrunning
Restricted List Lookbacks
Watch List Lookbacks

25. External Deals
37
Scope of Control Room Monitoring
38
Product Coverage
Equities, equity-related securities and related derivatives
Fixed Income securities and related derivatives
Bank Loans and related derivatives
Investment Banking
Private Banking & Wealth Management

26. Business Divisions
Account Types
Restricted List
Watch List
Wall Crossings
Bank deal lookbacks
Non-Bank deal lookbacks
Watch List lookbacks

27. Research front-running
Firm (proprietary, client facilitation, hedge)
Institutional Clients
Private Banking Clients
Discretionary Portfolios
Asset Management Funds
Deal Types
Employee

30. Insider Trading Controls: Personal Account Trading
Employee Personal Account Trading
1
Minimum holding periods apply and, where applicable, are
subject to pre-clearance (generally good until end of trading
day).
An Employee account:
Is an account that has brokerage capability in which an
employee has an interest or the power to influence investment
decisions
Includes employee’s spouse, partner and minor children

31. Trading is generally not permitted in securities of issuers on the
Restricted List.
Bank securities may only be traded during approved windows
and with pre-trade approval, where applicable.
Many regulators require banks to monitor the personal trades of
their employees.
In most jurisdictions1, employees are required:
To declare their trading account details to Compliance
To receive pre-trade approval for certain transactions
40
Wells Fargo Update
New facts emerge about the cross-selling scandal from former

32. employees
October 20, 2016 NYT Headline: “Lions Hunting Zebras”
Elderly with memory problems
College students with first account
Small business owners with multiple lines of credit
Employee Pressure and Stress (hand sanitizer and anxiety
attack)
City of San Francisco looking to end its business with Wells
Fargo
Senate Banking Committee has sent a follow-up letter with 58
questions
Justice Department is investigating
Wells Fargo Class Discussion
Do you think a well crafted CRA could have identified cross-
selling as a potential problem?
What would a such a CRA look like?
The Seven Steps . . .
Identify Business Unit and Metrics

33. Rule Mapping
Compliance Risk Themes
Controls Inventory
Effectiveness of Controls
What should peer banks being doing now?
Compliance Risk Assessment Steps
Identify Business Area and Metrics
Map Applicable Rules
Identify Key Compliance Risks & Themes
Define Controls Inventory
Rate Controls Effectiveness

34. Determine Residual Risk
Score, Rate and Report
Assignment 7
Develop a list of topical areas of risk that should be included in
a Compliance Risk Assessment for a pharmaceutical company.
Note the categories of information that you would obtain for
each and which would be quantitative and qualitative.
You did a similar exercise for a financial services company in
Assignment 4.
Based on tonight’s lecture, identify a minimum of four risk
areas for a pharmaceutical company and then drill down on the

35. categories of information you would need to obtain under each.
See this exercise as the initial step in drafting a questionnaire.
For class discussion.
‹#›