Last fall, Bloomberg Law analysts covered potential avenues for simplified regulatory oversight of financial firms. Covid-19 has now raised a more pressing query: How do regulators oversee financial institutions during a pandemic?
While regulators are “open for business,” they are grappling with how to carry out core responsibilities such as rulemaking, investigations, enforcement, and examinations. The only thing for sure right now is that for the foreseeable future, it will not be business as usual.
Even with “robust remote work capabilities,” regulators face reduced access to personnel, records, systems, and information needed to carry out their responsibilities. Working remotely because of compulsory stay-at-home measures, financial services regulators will have to regulate their member firms in a new paradigm.
Below is an outline of considerations financial firms could integrate into planning and responding to regulator activity during the pandemic.
In general, regulators have adjusted some rulemaking priorities to account for the consequences of the pandemic, but forged ahead with others.
Currently, the rulemaking priorities seem to come down to party lines. For example, at the SEC, there are opposing views among two of the three commissioners: The Democratic commissioner is advocating a pause, while one of the Republican commissioners is pushing for rulemaking regardless of its purpose. Democrats in Congress are also calling for a pause on regulatory rulemaking. Some are asking the SEC to extend, postpone, or suspend non-critical rulemaking and others are asking banking regulators to prioritize a strong response to Covid-19 and suspend other efforts.
Financial firms know that an indefinite moratorium on all non-Covid-19 regulatory rulemaking is unlikely. However, they should expect regulators to understand the pandemic has left many financial institutions facing obstacles to compliance. If the relief they need is not granted, financial firms should proactively request the relief. Don’t forget, in seeking the relief, the regulator may want to know a firm’s interim measures and long-term plan to eventually comply with the rule.
Regulators have preliminarily provided conditional pandemic relief, while others have granted extensions to comply with certain filing and reporting obligations. This trend should continue.
Financial firms may need more flexibility on reporting requirements, and regulators should grant this relief. For example, regulators could push annual reporting and certifications due now or in the next 60 days to year-end. They can reduce the frequency of periodic reporting temporarily (e.g., eliminate Q2 reporting). If nothing else, they can (and should) waive fees for delays in reporting requirements. Once the virus is no longer a public health crisis, regulators can reinstate these requirements with sufficient notice to member firms to make the necessary operational adjustments.
Examinations and Enforcement
Regulators use examinations to assess a regulated institution’s health (e.g., financial, operational, compliance, governance). They can rely on virtual audits to make these assessments.
Financial firms can prepare for virtual audits that will rely on calls, emails, and video conferences to conduct the review. The exam may start with a questionnaire followed by requests for information, meetings, and interviews done via calls or video conferences.
Financial firms should remember that exams (virtual or in-person) are not synonymous with enforcement actions, and examiners are not adversaries. Every effort should be made to communicate with the exam team regularly and honestly. Provide timely responses to requests and seek clarification to avoid unnecessary delays. Also, schedule regular check-ins with the exam team to confirm they have the information they need.
In terms of the outcome of these examinations, firms should expect that regulators will weigh possible enforcement actions carefully. When and whether enforcement is appropriate requires consideration of the firm’s viability, disciplinary history, and the nature and level of non-compliant actions, among other factors.
Tracking regulatory focus is more important than ever during a crisis. Legal and compliance departments can help by actively monitoring what regulators are focusing on during the pandemic, including certain priorities, highlighted below.
Business Continuity. Regulators have updated pandemic guidance or issued reminders on business continuity plans (BCPs). Firms should update their BCPs as needed and expect testing of these measures in future examinations.
Fraud and Scams. Regulators will continue to prioritize Covid-19 scams, issuing ongoing notices and taking actions to hold these fraudsters accountable for their crimes. In a recent piece, I outlined measures that may help financial firms deal with these scams.
Cybersecurity and Privacy. Regulators have reminded firms to remain vigilant to increasing cybersecurity and privacy incidents during the pandemic. No doubt, there is an overcrowded plate of cyber and data privacy rules and guidance. Firms cannot ignore these risks as a result, but can still maintain their cyber and privacy controls by relying on risk assessments, current policies procedures, assigned roles and responsibilities, training, and reliable incident response procedures.
Outreach Programs. Regulators have offered to engage with their member firms to discuss any challenges or need for assistance. Financial firms should be proactive and request periodic calls with their designated regulatory coordinators. They can use the calls to: 1) conduct a status review, e.g., financial, operational, and compliance viability; 2) discuss any problems; and 3) consider and agree to potential areas of relief or solutions to address pandemic-related challenges.
The above discussion is not exhaustive of what remote regulation can look like. Ultimately, the successful navigation of this pandemic is for regulated firms and their regulators to communicate regularly, be open and transparent, and agree to reasonable measures to deal with the inevitable challenges that arise.
If you’re reading this on the Bloomberg Terminal, please run BLAW OUT <GO> in order to access the hyperlinked content.