+ All Categories
Home > Documents > Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a...

Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a...

Date post: 03-Jun-2020
Category:
Upload: others
View: 2 times
Download: 0 times
Share this document with a friend
46
Page | 1 _____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP) Monday, October 15, 2018 Top 10 risk and compliance related news stories and world events that (for better or for worse) shaped the week's agenda, and what is next Dear members and friends, Modelled after SaaS (Software as a Service - a software distribution model in which third-party providers host applications and make them available to customers over the Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor humiliation and market share increase, etc. Only imagination is the limit. Website owners that offer HaaS can be aiding and abetting criminal solicitation. Hiring someone to commit a crime is itself a crime, but dark web gives some chances for anonymity, or this is what some believe. HaaS “services” include gaining access to the social networking accounts of other entities or persons, distributed denial of service attacks, infrastructure attacks, telephone number hijacking, call blocking, and unauthorized access. According to the UK National Cyber Security Centre (NCSC, part of the GCHQ), a Latvian resident was sentenced to 14 years in prison for his e-crime service, “Scan4you”. Advertised as a legitimate penetration testing service, Scan4you was in fact a counter antivirus operation. The service enabled cyber criminals to test their malware against antivirus software, especially those used by the US retail sector, but also governments and financial institutions. Operating from 2009 to 2016, Scan4you is believed to have assisted with the theft of over $15 billion. The “service” was reportedly used by the cyber criminals behind the Citadel malware, responsible for infecting over 11
Transcript
Page 1: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 1

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Monday, October 15, 2018 Top 10 risk and compliance related news stories and world events that (for

better or for worse) shaped the week's agenda, and what is next

Dear members and friends, Modelled after SaaS (Software as a Service - a software distribution model in which third-party providers host applications and make them available to customers over the Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor humiliation and market share increase, etc. Only imagination is the limit. Website owners that offer HaaS can be aiding and abetting criminal solicitation. Hiring someone to commit a crime is itself a crime, but dark web gives some chances for anonymity, or this is what some believe. HaaS “services” include gaining access to the social networking accounts of other entities or persons, distributed denial of service attacks, infrastructure attacks, telephone number hijacking, call blocking, and unauthorized access. According to the UK National Cyber Security Centre (NCSC, part of the GCHQ), a Latvian resident was sentenced to 14 years in prison for his e-crime service, “Scan4you”. Advertised as a legitimate penetration testing service, Scan4you was in fact a counter antivirus operation. The service enabled cyber criminals to test their malware against antivirus software, especially those used by the US retail sector, but also governments and financial institutions. Operating from 2009 to 2016, Scan4you is believed to have assisted with the theft of over $15 billion. The “service” was reportedly used by the cyber criminals behind the Citadel malware, responsible for infecting over 11

Page 2: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 2

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

million computers and attributed with $500 million in fraud losses. Law enforcement worldwide are tackling the enablers of cybercrime who sell their services to aid online criminals. This sentence reflects the seriousness with which courts are tackling such offences. Welcome to the Top 10 list. Best regards,

George Lekatis President of the IARCP General Manager, Compliance LLC 1200 G Street NW Suite 800, Washington DC 20005, USA Tel: (202) 449-9750 Email: [email protected] Web: www.risk-compliance-association.com HQ: 1220 N. Market Street Suite 804, Wilmington DE 19801, USA Tel: (302) 342-8828

Page 3: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 3

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 1 (Page 8)

Basel III Monitoring Report, October 2018

Highlights of the Basel III monitoring exercise as of 31 December 2017 Fully phased-in final Basel III capital shortfalls more than 70% lower for large internationally active banks compared with end-2015. To assess the impact of the Basel III framework on banks, the Basel Committee on Banking Supervision monitors the effects and dynamics of the reforms. For this purpose, a semiannual monitoring framework has been set up on the risk-based capital ratio, the leverage ratio and the liquidity metrics using data collected by national supervisors on a representative sample of institutions in each country. For the first time, the report also captures the effects of the Committee’s finalisation of the Basel III reforms. This report summarises the aggregate results using data as of 31 December 2017. The Committee believes that the information contained in the report will provide relevant stakeholders with a useful benchmark for analysis.

Number 2 (Page 11)

Annual Report Trust Services Security Incidents 2017 October 2018

Electronic trust services are a range of services around digital signatures, digital certificates, electronic seals, timestamps, etc. which are used in electronic transactions, to make them secure. eIDAS, an EU regulation, is the EU wide legal framework ensuring interoperability and security of these electronic trust services across the EU.

Page 4: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 4

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 3 (Page 14)

In praise of popularization Lectio magistralis by Mr Salvatore Rossi, Senior Deputy Governor of the Bank of Italy and President of the Institute for the Supervision of Insurance (IVASS), at the Ca' Foscari University of Venice Department of Economics, Venice.

“Opinions and decisions are, of course, shaped by cognitive processes and inspired by religious or political persuasions, but the information that we use is their main sustenance. Combined with our pre-conceptions, they lead us to think one thing or another, and to decide accordingly. And yet, at this historical juncture, Western democracies appear to have a problem regarding the quality of the information that is made available to the public.”

Number 4 (Page 18)

EIOPA reinforces cooperation in the supervision of cross-border insurance distribution

- The application of new provisions under the Insurance Distribution

Directive and increasing cross-border activities require reinforced cooperation between national competent authorities.

- Close and timely collaboration is crucial to achieve a high level of

consumer protection independent from where the distribution services are carried out and customers have their residence.

Page 5: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 5

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 5 (Page 20)

Get Cyber Skilled! October 05, 2018 marks the kick-off of week two of the European Cyber Security Month, when ENISA, the European Commission, and European Schoolnet will focus on expanding the digital skills and education of citizens across Europe.

‘Get cyber skilled’ is a campaign that aims to support the advancement of cybersecurity education and skills to the next generation.

Number 6 (Page 22)

Preparing the workforce for a changing financial industry Ravi Menon, Managing Director of the Monetary Authority of Singapore, at the Institute of Banking and Finance Distinction Evening 2018, Singapore.

“There is much celebrate. Singapore's financial centre is doing well. Growth in financial services in H1 this year was 8%, nearly twice as fast as the overall economy. In fact, the financial sector has been growing faster than the overall economy in 6 out of the last 7 years.”

Number 7 (Page 26)

Remedies and Relief in SEC Enforcement Actions Steven Peikin, Co-Director, Division of Enforcement

PLI White Collar Crime 2018: Prosecutors and Regulators Speak

Page 6: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 6

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

“Many of those who closely follow the work of the Enforcement Division tend to evaluate its effectiveness based on metrics such as the number of enforcement actions the Commission brings each year and the total amount of penalties and disgorgement ordered by the Commission or federal district courts.”

Number 8 (Page 36)

Global liquidity: changing instrument and currency patterns Iñaki Aldasoro, Torsten Ehlers, BIS

International (cross-border and foreign currency) credit, a key indicator of global liquidity, has continued to expand in recent years to 38% of global GDP.

Number 9 (Page 39)

Federal agencies issue a joint statement on banks and credit unions sharing resources to improve efficiency and effectiveness of Bank Secrecy Act compliance

Page 7: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 7

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

The federal depository institutions regulators and the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) have issued a statement to address instances in which certain banks and credit unions may decide to enter into collaborative arrangements to share resources to manage their Bank Secrecy Act (BSA) and anti-money laundering (AML) obligations more efficiently and effectively.

Number 10 (Page 41)

Discovering New Molecules for Military Applications AI chemistry program aims to accelerate creation of novel, high-performance molecules for defense needs

The efficient discovery and production of new molecules is essential for a range of military capabilities—from developing safe chemical warfare agent simulants and medicines to counter emerging threats, to coatings, dyes, and specialty fuels for advanced performance. Current approaches to develop molecules for specific applications, however, are intuition-driven, mired in slow iterative design and test cycles, and ultimately limited by the specific molecular expertise of the chemist who has to test each candidate molecule by hand.

Page 8: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 8

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 1

Basel III Monitoring Report, October 2018

Highlights of the Basel III monitoring exercise as of 31 December 2017 Fully phased-in final Basel III capital shortfalls more than 70% lower for large internationally active banks compared with end-2015. To assess the impact of the Basel III framework on banks, the Basel Committee on Banking Supervision monitors the effects and dynamics of the reforms. For this purpose, a semiannual monitoring framework has been set up on the risk-based capital ratio, the leverage ratio and the liquidity metrics using data collected by national supervisors on a representative sample of institutions in each country. For the first time, the report also captures the effects of the Committee’s finalisation of the Basel III reforms. This report summarises the aggregate results using data as of 31 December 2017. The Committee believes that the information contained in the report will provide relevant stakeholders with a useful benchmark for analysis. Information considered for this report was obtained by voluntary and confidential data submissions from individual banks and their national supervisors. Data were provided for a total of 206 banks, including 111 large internationally active (“Group 1”) banks, among them all 30 G-SIBs, and 95 other (“Group 2”) banks. Members’ coverage of their banking sector is very high for Group 1 banks, reaching 100% coverage for some countries, while coverage is lower for Group 2 banks and varies by country. In general, this report does not take into account any transitional arrangements such as phase in of deductions and grandfathering arrangements.

Page 9: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 9

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Rather, the estimates presented generally assume full implementation of the Basel III requirements based on data as of 31 December 2017. No assumptions have been made about banks’ profitability or behavioural responses, such as changes in bank capital or balance sheet composition, either since this date or in the future. Furthermore, the report does not reflect any additional capital requirements under Pillar 2 of the Basel II framework, any higher loss absorbency requirements for domestic systemically important banks, nor does it reflect any countercyclical capital buffer requirements.

• Compared with the previous reporting period (June 2017) the average Common Equity Tier 1 (CET1) capital ratio under the fully phased-in initial Basel III framework has increased from 12.5% to 12.9% for Group 1 banks and from 14.7% to 16.0% for Group 2 banks. • All Group 1 and Group 2 banks (including all 30 G-SIBs) would meet the CET1 minimum capital requirement of 4.5% and the CET1 target level of

Page 10: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 10

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

7.0% (ie including the capital conservation buffer). This target also includes the G-SIB surcharge where applicable but does not include any countercyclical capital buffers. • Applying the 2022 minimum TLAC requirements and the fully phased-in initial Basel III framework, eight of the 25 G-SIBs reporting total loss-absorbing capacity (TLAC) data have a combined shortfall of €82.1 billion, compared with €109.0 billion at the end of June 2017. • Group 1 banks’ average Liquidity Coverage Ratio (LCR) decreased by 1.0 percentage point to 133.0%, while the average Net Stable Funding Ratio (NSFR) decreased from 116.9% to 116.0%. For Group 2 banks, there was an increase for both LCR and NSFR. To read the report: https://www.bis.org/bcbs/publ/d449.pdf

Page 11: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 11

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 2

Annual Report Trust Services Security Incidents 2017 October 2018

Electronic trust services are a range of services around digital signatures, digital certificates, electronic seals, timestamps, etc. which are used in electronic transactions, to make them secure. eIDAS, an EU regulation, is the EU wide legal framework ensuring interoperability and security of these electronic trust services across the EU. One of the goals of eIDAS is to ensure that electronic transactions can have the same legal standing as traditional paper based transactions. eIDAS is important for the European digital market because it allows businesses and citizens to work and use services across the EU. The eIDAS regulation was adopted in July 2014 and came into force in 2016. Article 19 of the eIDAS regulation sets security requirements for trust service providers. National supervisory bodies have to supervise the trust service providers in their country to ensure that they fulfil these requirements. Cooperation and agreement on how to do this in practice is important not only to create a level playing field for providers operating out of different EU countries, but also to protect transactions based on these services. If there is, for instance, a cyber-attack on a trust service provider in one Member State, then this could have an impact on organizations in other parts of the EU who rely on the provider’s trust services. An important part of Article 19 is the mandatory security breach notification requirements: Trust service providers must notify the national supervisory body about security breaches, if there is a significant impact on the trust service(s) they provide.

Page 12: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 12

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Article 19 requires national supervisory bodies to inform each other and ENISA if there is cross-border impact. Annually, the national supervisory bodies send annual summary reports about the notified breaches to ENISA and the European Commission. This document, the Annual Report Trust Services Security Incidents 2017, marks the second round of security incident reporting for the EU’s trust services sector For 2017, the national supervisory bodies reported 13 security breaches with a significant impact on trust services. We can draw the following conclusions: - Notification increase: The number of notified security breaches

increased significantly, in comparison to the previous year. This is not a sign of decreasing security, but rather shows that the implementation of the breach reporting requirements is maturing. Trust service providers are more aware of their breach reporting obligations and are becoming more familiar with the procedure. This leads to more notifications to the supervisory bodies.

- E-signatures and e-seals most affected: Almost half of the notified

breaches, 43%, involve certificates for electronic signatures and electronic seals.

- Most common causes are system failures, third party failures: System

failures, third party failures are both responsible for 36% of the breaches. Human errors are more rare (21%). Only 7% of the breaches are caused by malicious actions.

- Many security breaches had cross-border impact: Almost half of the

notified breaches, 46%, had an impact across borders. This shows that indeed the EU trust services sector is cross-border. Many providers (and their suppliers) are offering services across the EU. Half those were severe, i.e. 50% the cross-border incidents had the highest severity rating (5- disastrous).

- A third of the breaches were due to ROCA: A number of notified

breaches had the same underlying cause (the ROCA case). The general conclusion is that, particularly for security supervision of trust services, cross-border collaboration and information exchange between EU

Page 13: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 13

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Member States are very important and are starting to produce concrete results that are of value to the community. The eIDAS regulation, and Article 19 in particular, provides the legal basis for collaboration and information exchange between the supervisory bodies. Detailed discussions about security issues and supervision of the sector take place inside the ENISA Article 19 expert group, which is an informal group of experts from national supervisory bodies focusing on the practical implementation of Article 19. To read the report: https://www.enisa.europa.eu/publications/annual-report-trust-services-security-incidents-2017

Page 14: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 14

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 3

In praise of popularization Lectio magistralis by Mr Salvatore Rossi, Senior Deputy Governor of the Bank of Italy and President of the Institute for the Supervision of Insurance (IVASS), at the Ca' Foscari University of Venice Department of Economics, Venice.

This lecture stems from a reflection on the way in which we − all of us − form our opinions and make decisions. The question has many aspects, but here we will deal with one in particular: the information that we consume and the sources from which we gather it. This is a crucial aspect. Opinions and decisions are, of course, shaped by cognitive processes and inspired by religious or political persuasions, but the information that we use is their main sustenance. Combined with our pre-conceptions, they lead us to think one thing or another, and to decide accordingly. And yet, at this historical juncture, Western democracies appear to have a problem regarding the quality of the information that is made available to the public. A lot of this information, it is said, is false or misleading, either through ignorance, superficiality or malice on the part of those who produce it. The fake news phenomenon is part of this debate. Of course, Italy is not exempt from this problem. On the contrary, it is one of its main laboratories. The thesis of this lecture is that nowadays serious manufacturers of information, and scholars in particular, have what has become an impelling and absolute duty to disseminate their knowledge.

Page 15: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 15

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

This should be their main concern. In all fields. Before it is too late. Especially here in Italy. Especially when it comes to economics.

The high priests of knowledge versus democracy Fantastical stories and tall tales have always circulated widely among human beings, at all times and in all places. A defining feature of the modern era was the emergence and diffusion of Galilean science, according to which all claims must be subjected to careful empirical scrutiny and there are no absolute dogmas; put simply, we should not believe in fairy tales. Modern science, regardless of whether it is engaged in sending a rocket to the moon or in improving economic welfare, can sometimes be hesitant and imprecise, but it is the best that humanity can offer to draw closer to natural truths. It feeds on skills and talents, it seeks first and foremost to convince the rest of the scientific community of the validity of its findings (even at a long remove), it assigns no role to religions, political ideologies, fads or mass enchantments. For several years now, it has been claimed, in many public debates the opinions of qualified persons have been rejected, if not derided. An idea has gained currency that there is no such thing as difficult problems and complex solutions, and that everything is easy and within everyone’s grasp – both in terms of understanding problems and finding solutions − if only the group of so-called experts, who are only good at perpetuating their own power, can be defeated. The Internet appears to have played an important role in all of this. It lends a voice to anyone with access to as little as a cheap smartphone, even if they are typing in a far-flung corner of the globe. Anyone can write, photograph or film something that will become viral. The traditional intermediation of the experts, of qualified observers, of professional ‘sorters’ of information, has disappeared. It is a grand, liberating bonfire (but so were the book burnings organized by Nazi students in the spring of 1933).

Page 16: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 16

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

A revolution of this kind spares no branch of public activity. Economics and economic policy are deeply affected, at a time when these disciplines are at the centre, either directly or indirectly, of almost all the decisions of individual citizens and of governments − even ethical ones. Decade after decade, administrative and technical apparatuses have taken shape in the economic field alongside governments, building up a body of knowledge and practices of their own. This includes ministries, specialized institutes and agencies, independent authorities and central banks. They have developed an autonomous capacity to process information and take action. Until a few years ago, the balance between governments and administrative apparatuses was ensured by a sort of trust in the medium term on the part of the former towards the latter: governments only checked intermittently the validity of these apparatuses’ action − which at times was not merely administrative − limiting their role to that of setting broad political guidelines. But for governments to behave in this way they also had to be intermittently accountable to voters for their track record, for example on the occasion of general elections. Now, as long as voters’ judgement in Western democracies was mediated by the great ideologies that emerged at the turn of the 18th and 19th centuries, this form of intermittent control came naturally. Voters trusted that the people in government would, at least in the medium term, act in their interest; they did not seek to judge their performance in real time because the common ideological bond reassured them. When the ideologies weakened to the point of almost disappearing and the electorate morphed into the audience of a continuous and never-ending show, political marketing became the only language spoken to the masses by politicians operating in democratic systems, and the only language understood by those masses. Today, the conversation between the electors and the elected must be unceasing, uninterrupted and take place through any means of communication, especially ‘instantaneous’ ones such as social media. It is worth noting that this does not apply only to economic matters in a narrow sense, but also to other domains of administrative and political action, for example foreign policy.

Page 17: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 17

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

If a country’s international relations are constantly exposed to changing public preferences and whims; if, to give an account of the state of national interests and international relations, storytelling techniques − to be clear, the same as those employed in TV series – become widespread and are used to stir the public’s feelings; if what counts is the short-term audience share, regardless of the actual medium to long term reality of the national interest; then, a democratic country’s diplomatic apparatus will find it harder and harder to influence the action of a governing class interested only in the real-time advertising of its political stance for the benefit of current and potential voters. To read more: https://www.bis.org/review/r181009b.pdf

Page 18: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 18

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 4

EIOPA reinforces cooperation in the supervision of cross-border insurance distribution

- The application of new provisions under the Insurance Distribution

Directive and increasing cross-border activities require reinforced cooperation between national competent authorities.

- Close and timely collaboration is crucial to achieve a high level of

consumer protection independent from where the distribution services are carried out and customers have their residence.

Frankfurt, 10 October 2018 - The European Insurance and Occupational Pensions Authority (EIOPA) published a Decision on the cooperation of national competent authorities (NCAs) with regard to the supervision of cross-border insurance distribution activities of insurance undertakings and insurance intermediaries. The Decision replaces the former Luxembourg Protocol which had to be substantially revised as a result of: - The new regulatory framework for insurance distribution activities

under the Insurance Distribution Directive (IDD). - The recent supervisory experience with cross-border insurance distribution activities. The Decision aims to strengthen cooperation between NCAs and in particular to enhance the exchange of all relevant information, enabling NCAs to fulfil their supervisory tasks and to protect customer interests. The Decision is an important step to ensure well-functioning, risk-based and preventive supervision of the insurance market throughout the European Union. Gabriel Bernardino, Chairman of EIOPA, said: “Based on the supervisory experience gained and the recent entry into force of the Insurance Distribution Directive, efficient and close cooperation between competent

Page 19: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 19

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

authorities is key for the conduct of risk-based and preventive supervision. It is more important than ever to achieve strong and close cooperation between national comptent authorities to ensure an equal and appropriate level of consumer protection throughout the European Union. EIOPA will closely monitor the implementation of the Decision, and will use its tools to ensure a consistent application.” To read more:

https://eiopa.europa.eu/Publications/Protocols/Decision%20on%20the%20Cooperation%20of%20Competent%20Authorities.pdf

Page 20: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 20

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 5

Get Cyber Skilled! October 05, 2018 marks the kick-off of week two of the European Cyber Security Month, when ENISA, the European Commission, and European Schoolnet will focus on expanding the digital skills and education of citizens across Europe.

‘Get cyber skilled’ is a campaign that aims to support the advancement of cybersecurity education and skills to the next generation. European Commissioner for Digital Economy and Society Mariya Gabriel said: “Advancing cybersecurity skills and education of younger generations is important for keeping themselves and others safe. Just like the physical world, there are threats online that could pose a danger to children and young adults physically, emotionally and financially. Building cybersecurity skills and competences helps the younger generation to develop routine cyber hygiene practices, which they can then transfer to others and help protect society.” ENISA’s Executive Director Udo Helmbrecht said: “Cybersecurity is a cutting edge and fast paced field that is also about human behaviour and helping others. Nurturing cybersecurity skills helps individuals to defend themselves online enabling them to become more resilient, self-reliant and confident: all strong positive character traits for a young inspiring future generation. Together with the European Commission, we are running this campaign to support parents, teachers, guardians, role models and community leaders with developing cybersecurity education and skills in young people." The European Schoolnet Digital Citizenship Programme Manager Hans Martens said: “European Schoolnet is delighted to be involved in the ‘Get Cyber Skilled’ campaign as an aspect of European Cyber Security Month. Online security is increasingly seen as an important component of online safety, and our collaboration with ENISA on this learning event for teachers, delivered through the eTwinning platform, allows us to further disseminate the expertise developed within the Insafe network. By skilling educators on topics such as effective password security, privacy and good

Page 21: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 21

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

data management principles - and supporting them to deliver key messages in the classroom - we can in turn encourage children and young people to develop good cyber hygiene practices to draw upon throughout their lives, helping to protect both themselves and others online.” For this campaign, learning modules were created with European Schoolnet as part of the #SaferInternet4EU initiative launched earlier this year by Commissioner Mariya Gabriel. This initiative stems from the Digital Education Action Plan Priority – developing relevant digital skills and competences for the digital transformation. The modules are to be shared with teachers across Europe, who tailored them accordingly to create a study plan for their classes. Topics include password management, backing up data, privacy settings, and protecting against social engineering. ECSM is the European Union’s annual awareness raising campaign dedicated to promoting cybersecurity among citizens and organizations, providing up-to-date security information through education and sharing of best practices.

Page 22: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 22

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 6

Preparing the workforce for a changing financial industry Ravi Menon, Managing Director of the Monetary Authority of Singapore, at the Institute of Banking and Finance Distinction Evening 2018, Singepore.

Mr Chan Chun Sing, Minister for Trade and Industry, Members of the IBF Council, distinguished guests, ladies and gentlemen, Welcome to the IBF Distinction Evening 2018. We are delighted to have Mr Chan Chun Sing as our Guest-of-Honour. Minister Chan, as you know, has played a leading role in the labour movement, to help prepare our workers for the future. And now Minister for Trade and Industry, he is leading Singapore's economic development efforts. He will bring together his insights from these two important roles and share his thoughts later on building a smart workforce that is ready for the economy of tomorrow. The IBF Distinction Evening is probably the only large platform that brings together the entire financial industry - banks, insurers, asset managers, financial advisers. It is an opportune occasion - not only to catch up with colleagues and friends and celebrate our achievements as an industry - but to also reflect on the big drivers of change and key priorities for us as an industry. There is much celebrate. Singapore's financial centre is doing well. Growth in financial services in H1 this year was 8%, nearly twice as fast as the overall economy. In fact, the financial sector has been growing faster than the overall economy in 6 out of the last 7 years.

Page 23: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 23

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Year-on-year growth in the financial sector will moderate in H2 because of the high base last year and some maturing in momentum. MAS expects financial sector growth for the year as a whole to average around 6%. Not bad at all, considering the challenges facing the global financial industry still emerging from the long shadow of the global financial crisis. Slower trend growth, tighter regulation, keener competition, and increasingly technological disruption. We often talk about growth, regulation, competition, and technology. And indeed they are key drivers of the financial industry. But I think the issue that is of most relevance to the long-term prospects of our financial industry is people and skills. No matter how many robots and algorithms we use in our business in the future, our industry will remain a people-centred industry. The question is: - What kind of people? - Will they have the skills and aptitudes to harness the opportunities that

a rising Asia and the digital transformation are creating? We cannot transform the industry if we cannot transform our workforce. Technology alone will not do it. We need the people and skills to harness that technology - to serve our customers better and seize opportunities in new markets. There is another reason why investing in people and skills is of critical importance. There is growing anxiety the world over about the impact of globalisation and technology on jobs and livelihoods. The anxiety is not unfounded. If people cannot or do not adapt to meet new competition or integrate new technologies, they will be left behind. The answer is not to hold back globalisation or technology but to:

Page 24: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 24

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

- make globalisation and technology work for everyone; - use technologies to create new and better jobs; and - most important, equip our workers and professionals with the

capabilities to secure those jobs. Preparing the financial industry workforce for a future smart financial centre is the raison d'etre of IBF. The work we do together in IBF - involving all of us here in the industry - is critically important. And there is urgency to it. IBF's mandate has been expanded to help synergise the efforts of unions, financial institutions, and the government around workforce transformation. IBF is now the single point of contact for all matters relating to skills, careers, and jobs in the financial industry. By looking at skills development, career pathways, and job placements in an integrated manner, IBF is in a better position to help finance professionals in a more comprehensive and holistic way. IBF, MAS, the industry, and trade unions have been working together on several fronts to help equip the financial industry workforce for the future. We are systematically assessing current and future skills requirements in various job roles in specific financial activities. We are implementing Professional Conversion Programmes (PCPs) to pre-emptively re-skill employees whose roles are impacted by change. We launched the IBF Careers Connect two months ago to help our workforce navigate career changes, acquire relevant skills, and be job-ready. We are working with SkillsFuture Singapore (SSG) and Workforce Singapore (WSG) on a Skills Framework for Financial Services that will provide individuals with information on employment, career pathways, occupations, job roles, emerging skills and competencies, as well as relevant education and training programmes. As leaders of our institutions and businesses, we have a special role to play. If each of us can commit to plan for our own workforce, to develop them and give them the best opportunity to stay relevant, the transformation of our workforce will be that much smoother.

Page 25: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 25

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Let us mobilise and inspire our staff to inculcate a growth mindset to stay competitive and step up to take action. To help do that, IBF is pleased to launch of the #FutureMeNow movement. This is a call to action, for industry professionals and leaders to take ownership and contribute to enabling our workforce for the future. Individuals can pledge to learn something, talk to someone about their career plans or be a mentor. IBF will work with the pledgees to realise their pledges. There are about 500 of us gathered here today. I invite you as industry leaders here tonight to be the first to be active multipliers. Transforming our financial industry workforce for the future requires a collaborative partnership among all of us here: - where leaders provide the example and set the tone; - where financial institutions provide the opportunity to upskill and

reskill; and - where people take ownership of their own professional development. Thank you for taking time to be here this evening. I wish you every success as you build up your businesses and your people, and together we build up Singapore as a global financial centre offering good jobs and meaningful careers for our workforce.

Page 26: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 26

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 7

Remedies and Relief in SEC Enforcement Actions Steven Peikin, Co-Director, Division of Enforcement

PLI White Collar Crime 2018: Prosecutors and Regulators Speak

I. Introduction Thank you for that kind introduction, and thank you for inviting me to speak here this morning. Before I begin, I am required to give a standard disclaimer that the views I express here today are my own, and do not necessarily represent the views of the Commission or its staff. My remarks today come a little over a year after Stephanie Avakian and I were appointed Co-Directors of the SEC’s Division of Enforcement and just a few days after the close of the first full fiscal year in which we have held our positions. So this is a fitting time to look back on the work of the Division of Enforcement over the past year and to discuss the Division’s priorities over the next year. Many of those who closely follow the work of the Enforcement Division tend to evaluate its effectiveness based on metrics such as the number of enforcement actions the Commission brings each year and the total amount of penalties and disgorgement ordered by the Commission or federal district courts. These quantitative metrics are of some value in assessing the work of the Division; they certainly provide a rough measure of our overall activity level. But statistics such as these do not provide a full and meaningful picture of the quality, nature, and effectiveness of our efforts. Indeed, in my view, when numbers are the primary lens through which our work is viewed, that perspective can be counterproductive. So to assess whether the Division’s work is effective in accomplishing the Commission’s mission, Stephanie and I have been moving the conversation to a different set of questions, namely the following:

Page 27: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 27

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

- Are our efforts protecting retail investors? - To what extent is the Commission holding individuals accountable for

violations of the law? - Are we keeping pace with technological change? - Do the remedies we recommend effectively further enforcement goals? - And, are we efficiently allocating the Division’s resources? This morning, I’d like to focus my remarks on how we think about one of these questions – that is, how particular remedies and relief that the Division of Enforcement recommends to the Commission advance our goals. In thinking about the effectiveness of the remedies and relief available to the Commission, it is tempting to focus solely on the Commission’s ability to obtain significant financial penalties in enforcement actions. Large dollar figures attract headlines and some view them as a proxy for how tough we are, and, relatedly, the effectiveness of our enforcement efforts. Penalties are important to an effective enforcement regime because they punish wrongdoers and send a message of general deterrence – ensuring that others know that violating the federal securities laws is a losing proposition. And our activity over just this past year reflects our view that in many instances, to be effective, such penalties need to be substantial. In fact, just last week, the Commission assessed eight-figure penalties against Walgreens and Tesla, which I’ll address in more detail later this morning. While we do seek and obtain some form of monetary relief – whether disgorgement, penalties or both – in most of our actions, non-monetary relief can be highly important to achieving the Commission’s overall goals as well. For that reason, a case-specific approach to remedies and relief is important, and is exemplified by a number of Commission actions that I will describe during my remarks today.

II. Non-Monetary Relief When we think about what overall relief makes the most sense in a given case, we’re guided by these questions: Does the relief punish bad actors and restore money to harmed investors? Does it advance the goals of specific and general deterrence? And does it put into place meaningful protections for investors going forward? If we have secured a good set of remedies, we can answer each of those questions affirmatively, and to do so often

Page 28: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 28

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

requires looking not just to penalties and disgorgement, but to forms of equitable or remedial relief that are available to us. First off, what do I mean by non-monetary, equitable relief? To me, that term includes the full range of remedies the Commission has at its disposal, beyond the ability to seek penalties and disgorgement. When thoughtfully deployed, non-monetary remedies give the Commission latitude to craft an outcome that best matches the facts and circumstances of a given case. So what are the non-monetary remedies that are critical to our enforcement efforts? Today, I’ll highlight a few forms of non-monetary relief that are of particular significance – undertakings and conduct-based injunctions, and bars and suspensions.

Undertakings and Conduct-Based Injunctions In civil injunctive actions, the federal securities laws permit the Commission to seek – and federal courts to grant – any equitable relief that may be appropriate or necessary for the benefit of investors. In practice, two of the most effective forms of equitable relief in Commission enforcement actions are undertakings, which require a defendant to take affirmative steps – either in conjunction with entry of the order or in the future – in order to come into and remain in compliance with the specific terms of the court’s order, and conduct-based injunctions, which prohibit a defendant from engaging in conduct that, while otherwise legal, poses risk of harm to investors in the future. The Commission also has authority to impose similar obligations in administrative and cease-and-desist proceedings. For example, the Commission recently secured a conduct-based injunction in its settlement with Billy McFarland, who, according to the SEC’s complaint, fraudulently induced more than 100 investors to put over $27 million into his companies, including Fyre Festival LLC. In addition to ordering that McFarland and his companies were liable for full disgorgement, the final judgment in the SEC’s matter against McFarland included a conduct-based injunction, enjoining McFarland from directly or indirectly participating in the issuance, purchase, offer, or sale of any security, except for his own personal account. With respect to undertakings, many require the settling party to retain a compliance consultant or monitor to make recommendations to the issuer and report to the Commission on terms specifically defined in the settlement papers.

Page 29: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 29

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Such undertakings make it possible for an SEC action to seed change in a corporation’s processes in a way that serves the long-term interests of investors. Undertakings are a forward-looking remedy; they are specifically designed with an eye toward what happens after the settlement. So when they are well-crafted, they unquestionably provide unique benefits to investors in the long term. In addition to undertakings requiring the retention of compliance consultants or monitors, we have also tailored other types of undertakings to accomplish remedial objectives that were specific to the wrongful conduct at issue. In March, the Commission charged Theranos, Inc., a private company, and its founder and CEO Elizabeth Holmes with raising more than $700 million from investors in an elaborate, years-long scheme involving exaggerated claims about the company’s technology, business, and financial performance. Aspects of the Theranos matter have been covered extensively in other forums. But for today’s purposes, one of the most important elements of the Commission’s settlement with Holmes were undertakings that (1) required her to relinquish her voting control over Theranos by converting her supermajority shares to common shares, and (2) guaranteed that in a liquidation event, Holmes would not profit from her ownership stake in the company until $750 million had been returned to other Theranos investors. In Theranos, the Commission confronted a situation where, because of the capital structure of the company, Holmes had nearly complete control of the company. And given what we alleged had occurred, it was appropriate to seek relief that protected investors from potential misuse of that controlling position going forward. The undertakings were designed to do exactly that. In another example, late last week, the Commission charged Elon Musk, the Chairman and CEO of Tesla, with fraud for Tweeting a series of false and misleading statements about his plan to take Tesla private. The Commission also charged Tesla with failing to maintain disclosure controls and procedures with respect to Musk’s communications. To settle the SEC actions, Musk and Tesla agreed not only to pay significant penalties, but also to a set of comprehensive undertakings. If approved by the court, the undertakings will require, among other things,

Page 30: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 30

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

(1) Musk to resign as Chairman and be replaced by an independent Chairman, (2) Tesla to add two independent directors to its board, (3) Tesla to establish a committee of independent directors and adopt mandatory controls and procedures to oversee and Musk’s public communications about the company, and (4) Tesla to employ within its legal department an experienced securities counsel. These undertakings specifically target and attempt to address specific risks – in this case, the potential harm to investors caused by Musk’s communication practices and a lack of sufficient oversight and control of those communications. The undertakings were specifically targeted to put in place stronger corporate governance by increasing the independence of the Tesla board and imposing closer oversight and control of Musk’s communications. I believe these carefully tailored undertakings serve the Commission’s investor protection mission by specifically addressing the misconduct at issue. In these examples, the overall package of remedies also included monetary penalties aimed at punishing misconduct, and the benefit of such penalties for deterring misconduct should not be understated. But the equitable relief the Commission obtained was both forward-looking and precisely tailored to the facts and circumstances of the case, and for that reason, it stands to benefit investors over the long run.

Bars and Suspensions In addition to undertakings, the Commission can also seek or impose other forms of forward-looking or remedial relief, such as officer and director bars and associational bars and suspensions. Like undertakings, bars and suspensions are not a punishment. Rather, they serve a critical prophylactic function – preserving the integrity of our markets and protecting investors by limiting the activity of known bad actors by removing them from the industry or preventing them from serving as officers or directors at public companies. In actions authorized this fiscal year alone, the Commission is seeking in litigation, or has obtained in settlements, multi-year officer and director

Page 31: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 31

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

bars or industry bars and suspensions against hundreds of individuals. Some illustrations of the bars sought or obtained include: - Bars we are seeking in ongoing litigation against the former CEO and

CFO of one of the largest mining interests in the world, who allegedly misled investors about the rapid deterioration in the value of a business the company had recently acquired for $3.7 billion.

- Bars sought against CEO and COO who allegedly misrepresented their

company as a first-of-its-kind decentralized bank offering its own cryptocurrency to be used for a broad range of customer products and services.

- Bars secured in settlement with the former CEO of a NASDAQ-listed oil

and gas company who received over $1 million of undisclosed perks and compensation in a variety of forms, including lavish social events, first class travel, and an office bar stocked with high-end liquor and cigars.

- Bars secured against the former CEO of LendingClub Asset

Management LLC, who was charged with using the fund’s money to benefit LendingClub Corporation.

- And of course, we secured a ten-year officer and director bar against

Elizabeth Holmes, and are seeking an officer and director bar in our ongoing litigation against Theranos’ former President, Sunni Balwani.

It may not come as a surprise that many individuals as to whom we seek bars choose to litigate rather than settle with the Commission. As such, bars can be a resource-intensive remedy for the agency. But the flip side of the resources coin is a remedy that, like undertakings, can have direct, far-reaching, and positive effects for investors. As such, obtaining bars and suspensions, when warranted by the facts and circumstances, are a high priority for the Division.

III. Civil Penalties and Disgorgement Penalties I’d like to turn now to monetary relief. Since 1990, when the SEC’s current penalty regime came into effect, the Commission has often levied large penalties against regulated entities.

Page 32: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 32

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

That was true again this year, when multiple Wall Street banks, asset managers, and other market gatekeepers, including a regulated exchange, were assessed large money penalties. The rationale behind assessing money penalties in actions involving regulated entities is relatively straightforward. To preserve the integrity of our markets and protect investors, the Commission is charged with promulgating and enforcing rules governing certain of the business practices of the entities we regulate – including broker-dealers, investment advisers, asset managers, credit rating agencies, and exchanges. Penalties are one of the primary enforcement tools we have to incentivize regulated entities to remain in compliance with the rules that protect investors. Stephanie and I embrace this rationale, and you can expect us to apply it throughout our tenure as Co-Directors. But the analysis with respect to corporate issuers with a class of securities registered with the SEC often involves additional considerations that don’t uniformly apply in matters involving regulated entities. Such issuers are required by statute and regulation to file public periodic and annual reports and financials, and to have policies, procedures, and controls in place to enable them to satisfy their obligations concerning the accuracy, completeness, and timeliness of such filings. Using enforcement to promote the integrity of issuers’ public filings – which are central to the sound functioning of our capital markets – is a critical part of our mandate. So in matters involving corporate issuer misconduct, decisions about whether to recommend the assessment of penalties require careful and thoughtful balancing of many factors including, of course, the nature of the misconduct. We also consider whether application of the Seaboard factors is appropriate. This includes evaluation of the nature of remedial steps taken by the company, its own self-reporting and self-policing efforts, and the extent of its cooperation with the Commission and other law enforcement agencies. Over the last year, the balance of factors has led the Division to recommend substantial penalties against a variety of corporate issuers. I’ll touch briefly on four examples: In September, the Commission obtained a $20 million penalty from a publicly-traded biopharmaceutical company and two of its senior officers to settle charges that they misled investors about the company’s

Page 33: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 33

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

developmental lung cancer drug. The Commission alleged that the company’s investor presentations, press releases, and SEC filings stated that the drug was effective 60 percent of the time, far higher than suggested by actual results available internally. The Commission obtained a $34 million penalty against Walgreens Boots Alliance, Inc., in an action against the company and two former executives for allegedly misleading investors over multiple reporting periods about increased risk that the company would miss an important financial projection that it had announced simultaneously with the announcement of its merger with Boots. Altaba, the company formerly known as Yahoo!, paid $35 million to settle charges that it misled investors by failing to disclose one of the world’s largest data breaches, in which hackers stole personal data relating to hundreds of millions of user accounts. The Commission alleged that Yahoo!’s senior management was aware of the cyber intrusion, but failed adequately to investigate the breach or disclose it for a period of almost two years. And of course, the Commission secured a $20 million penalty against Tesla, whose governance failures allegedly enabled Musk’s fraudulent tweets. As we alleged in our complaint, for years, Tesla had relied on Musk’s Twitter feed – with its 22 million followers – to market the company and disseminate corporate news and information. But the company had no controls in place to ensure that his Tesla-related tweets were accurate and otherwise complied with the federal securities laws. The penalties in these cases served a strong deterrent purpose. That said, not every case warrants a penalty. As a counterpoint, last December the Commission issued an order finding that the CEO and CFO of an exchange-listed biopharmaceutical company received millions of dollars in undisclosed perks. The company undertook to fully remediate material weaknesses in its accounting controls – and undertook to retain an independent compliance consultant should its remediation efforts fail. The SEC’s order expressly acknowledged the extensive remediation efforts taken by the company, which included the institution of legal proceedings the collect repayments from its former CEO and CFO and replacing the firms that had provided or assisted with bookkeeping.

Page 34: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 34

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

In light of these extensive remedial efforts, combined with the undertaking agreed to by the company, we determined that it was appropriate not to recommend a penalty to the Commission. We made a similar judgment call with our recommendation in a case announced last week, which involved conduct by a publicly-traded pharmaceutical company that otherwise weighed in favor of a penalty recommendation. We credited new management’s significant cooperation – including its self-reporting of the misconduct – with the Commission’s investigation and its proactive remediation efforts in deciding against recommending a corporate penalty.

Disgorgement While there is a careful weighing of factors with respect to penalties, the other primary form of monetary relief – disgorgement – is handled quite differently. Even where a defendant or respondent cooperates and agrees to meaningful undertakings, it should not be entitled to keep its ill-gotten gains, which we are often in a position to restore to harmed investors. The Commission has obtained disgorgement in a wide variety of matters, including offering frauds, and most all FCPA resolutions. The Commission also obtained significant disgorgement in settlements with regulated entities that profited by their failures to adhere to the Commission’s rules and regulations. Earlier this year, for example, Deutsche Bank was required to disgorge more than $44 million of ill-gotten gains associated with its improper handling of pre-release American Depositary Receipts. The Commission secured similar relief in matters against a number of large broker-dealers this year. And of course, in offering frauds, where individuals obtain money directly from investors through fraudulent representations, disgorgement is a central component of meaningful relief and often the surest way to restore at least a portion of investors’ losses. As you probably know, the Supreme Court ruled last term in Kokesh v. SEC that disgorgement was to be considered a penalty for statute of limitations periods, and therefore the proceeds of misconduct obtained by a wrongdoer outside the statute of limitations were insulated from disgorgement. The impact of the ruling has been very significant and will continue to be. Take Kokesh, itself. That case involved an investment adviser who misappropriated from investors $34.9 million through a long running scheme that spanned 14

Page 35: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 35

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

years. Of that amount, $29.9 million was misappropriated as a result of violations that occurred more than five years before the Commission brought its action. In the end, Kokesh kept the vast majority of his ill-gotten gains, at the expense of innocent investors. The impact of Kokesh has been felt across our enforcement program. A few months ago, we calculated that Kokesh led us to forego seeking approximately $800 million in potential disgorgement in filed and settled cases. That number continues to rise.

IV. Conclusion So what is the takeaway of all of this? I think as you can see the Commission has at its disposal a wide variety of remedies and relief. And in the Division of Enforcement we think carefully about what of those tools to recommend to the Commission in every case. What we do not do is assess large penalties simply for the sake of counting them up at the end of the year For that reason, the effectiveness of our program cannot be measured with resort to any one quantitative measure, but instead requires a nuanced and qualitative evaluation of our overall impact on achieving our investor and market integrity protection mission. Thank you for your time today.

Page 36: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 36

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 8

Global liquidity: changing instrument and currency patterns Iñaki Aldasoro, Torsten Ehlers, BIS

International (cross-border and foreign currency) credit, a key indicator of global liquidity, has continued to expand in recent years to 38% of global GDP. This growth has been driven by international debt securities issuance, while the role of banks has diminished – both as lenders and as investors in debt securities. The aggregate trend has been more pronounced for advanced economy than emerging market borrowers. For individual countries, however, the growth of bank loans and that of debt securities have tended to move in tandem, highlighting the cyclical nature of global liquidity. The US dollar has become even more dominant as an international funding currency – in particular for emerging market borrowers. However, dollar exposures in emerging market economies vary substantially across countries and sectors.

Page 37: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 37

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Global liquidity – the ease of financing in international financial markets – remains at the centre of policy debates (Cohen et al (2017), CGFS (2011), Borio et al (2011)). In the run-up to the 2007–09 Great Financial Crisis (GFC), the supply of international credit – comprising cross-border credit and credit in foreign currency whether or not it crosses a border – expanded rapidly. When the crisis hit, international credit evaporated, exposing financial vulnerabilities in both advanced and emerging market economies (EMEs). Against the backdrop of major central banks’ highly accommodative monetary policies, this key indicator of global liquidity picked up markedly since 2010, in particular in EMEs. In contrast to the pre-GFC period, the increase in international credit since 2010 has been driven primarily by debt securities rather than bank loans (Avdjiev et al (2017), Turner (2013)). At the same time, the US dollar has become even more dominant as the prime currency of denomination since the GFC (Maggiori et al (2018)). This “second phase” of global liquidity implies that global financing conditions have become more sensitive to developments in the bond market, and even more tightly linked to US monetary policy (Shin (2013)). EME borrowers may be particularly vulnerable if they have relied heavily on US dollar-denominated debt securities, as international bond investors tend to retreat quickly when US rates rise. But EMEs’ US dollar debt exposures can differ substantially not only across countries but also across sectors. In some EMEs the private corporate sector has been the main borrower of US dollars, while in others it has been the sovereign. This feature documents and analyses the shift from international bank loans to debt securities in international credit, as well as the currency composition, building on the BIS global liquidity indicators (GLIs). The first section presents global trends and recent developments. The second contrasts the developments in advanced economies and EMEs. It documents how the shift away from bank loans towards debt securities has been more pronounced for advanced economies than for EMEs as a

Page 38: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 38

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

whole. At the country level, however, growth of bank loans and that of debt securities have moved in tandem for both advanced and emerging market economy borrowers. The third section focuses on EME foreign currency borrowing and highlights the different sectoral composition of US dollar credit across countries. To read more: https://www.bis.org/publ/qtrpdf/r_qt1809b.pdf

Page 39: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 39

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 9

Federal agencies issue a joint statement on banks and credit unions sharing resources to improve efficiency and effectiveness of Bank Secrecy Act compliance Board of Governors of the Federal Reserve System Federal Deposit Insurance Corporation Financial Crimes Enforcement Network National Credit Union Administration Office of the Comptroller of the Currency

The federal depository institutions regulators and the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) have issued a statement to address instances in which certain banks and credit unions may decide to enter into collaborative arrangements to share resources to manage their Bank Secrecy Act (BSA) and anti-money laundering (AML) obligations more efficiently and effectively. Collaborative arrangements as described in the statement generally are most suitable for financial institutions with a community focus, less complex operations, and lower-risk profiles for money laundering or terrorist financing. The statement, which was issued by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, FinCEN, the National Credit Union Administration, and the Office of the Comptroller of the Currency, explains how these institutions can share BSA/AML resources in order to better protect against illicit finance risks, which can in turn also reduce costs. Today's joint statement is a result of a working group recently formed by these agencies and Treasury's Office of Terrorism and Financial

Page 40: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 40

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Intelligence aimed at improving the effectiveness and efficiency of the BSA/AML regime. "This joint statement is part of a broader effort to work closely with our regulatory partners to strengthen the anti-money laundering defenses across the U.S. financial system," said Sigal Mandelker, Treasury Under Secretary for Terrorism and Financial Intelligence. "The joint statement allows community-focused banks and credit unions to share certain anti-money laundering resources in order to better protect against illicit actors seeking to abuse those types of institutions. Such resource sharing must be approached with careful due diligence and thorough consideration of the risks and benefits." Among other things, today's joint statement aims to: - Highlight the potential benefits of collaborative arrangements that pool

resources, such as staff, technology, or other resources, to increase operational efficiencies, reduce costs, and leverage specialized expertise; and

- Outline risk considerations and mitigation measures associated with

the use of collaborative arrangements. The joint statement acknowledges that banks and credit unions may benefit from using shared resources to manage certain BSA/AML obligations more efficiently and effectively. However, it notes that financial institutions should approach the establishment of collaborative arrangements like other business decisions, with due diligence and thorough consideration of the risks and benefits. Banks and credit unions are encouraged to contact their primary federal regulator with questions regarding sharing BSA resources, and should refer to other relevant guidance. The Joint Interagency Statement on Sharing Bank Secrecy Act Resources: https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20181003a1.pdf

Page 41: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 41

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Number 10

Discovering New Molecules for Military Applications AI chemistry program aims to accelerate creation of novel, high-performance molecules for defense needs

The efficient discovery and production of new molecules is essential for a range of military capabilities—from developing safe chemical warfare agent simulants and medicines to counter emerging threats, to coatings, dyes, and specialty fuels for advanced performance. Current approaches to develop molecules for specific applications, however, are intuition-driven, mired in slow iterative design and test cycles, and ultimately limited by the specific molecular expertise of the chemist who has to test each candidate molecule by hand. Today, DARPA announced the Accelerated Molecular Discovery (AMD) program, which aims to develop new, AI-based systematic approaches that increase the pace of discovery and optimization of high-performance molecules. A Proposers Day webinar describing the goals of the program is scheduled for Oct.18, 2018. Details are available here: https://go.usa.gov/xPk5j “The ultimate goal of AMD is to speed the time to design, validate, and optimize new molecules with defined properties from several years to a few months, or even several weeks,” said Anne Fischer, program manager in DARPA’s Defense Sciences Office. “We aim to develop the AI tools, models and experimental systems to enable autonomous design of molecules to quickly meet DoD needs.” The program calls for teams of researchers to develop AI-based, closed-loop systems that automatically extract existing chemistry data from databases and text, perform autonomous experimental measurement and optimization, and use computational approaches to develop physics-based representations and predictive tools. AMD performers will develop tools, models, and experimental capabilities to rapidly design, validate, and optimize molecules. Government partners will evaluate performer developments and test their ability to identify new

Page 42: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 42

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

molecules with specific combinations of functional properties that may be relevant to specific DoD application requirements. “There are currently around 140 million known molecules, but the space of potential molecules is vastly larger than that, upwards of 1060,” Fischer said. “In DARPA’s Make-It program, we’ve developed advanced ways to efficiently synthesize known molecules. AMD is taking the next step, where we will rapidly be able to explore the unknown molecular universe to design and produce completely new molecules with specific desired functions.” The AMD program seeks expertise in chemistry and chemical engineering, computer science, AI/machine learning, and mathematics. A Broad Agency Announcement (BAA) solicitation with full details is expected to be published soon on FedBizOpps here: http://go.usa.gov/3W53j

Page 43: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 43

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Disclaimer The Association tries to enhance public access to information about risk and compliance management. Our goal is to keep this information timely and accurate. If errors are brought to our attention, we will try to correct them. This information: - is of a general nature only and is not intended to address the specific circumstances of any individual or entity; - should not be relied on in the context of enforcement or similar regulatory action; - is not necessarily comprehensive, complete, or up to date; - is sometimes linked to external sites over which the Association has no control and for which the Association assumes no responsibility; - is not professional or legal advice (if you need specific advice, you should always consult a suitably qualified professional); - is in no way constitutive of an interpretative document; - does not prejudge the position that the relevant authorities might decide to take on the same matters if developments, including Court rulings, were to lead it to revise some of the views expressed here; - does not prejudge the interpretation that the Courts might place on the matters at issue. Please note that it cannot be guaranteed that these information and documents exactly reproduce officially adopted texts. It is our goal to minimize disruption caused by technical errors. However, some data or information may have been created or structured in files or formats that are not error-free and we cannot guarantee that our service will not be interrupted or otherwise affected by such problems. The Association accepts no responsibility regarding such problems incurred because of using this site or any linked external sites.

Page 44: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 44

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

International Association of Risk and Compliance Professionals

You can explore what we offer to our members: 1. Membership – Become a standard, premium or lifetime member. You may visit: www.risk-compliance-association.com/How_to_become_member.htm Become a lifetime member of the association, and to continue your journey without interruption and without renewal worries. You will get a lifetime of benefits as well. You can check the benefits at: www.risk-compliance-association.com/Lifetime_Membership.htm 2. Weekly Updates - Subscribe to receive every Monday, the Top 10 risk and compliance management related news stories and world events that (for better or for worse) shaped the week's agenda, and what is next: http://forms.aweber.com/form/02/1254213302.htm 3. Training and Certification - The Certified Risk and Compliance Management Professional (CRCMP) training and certification program has become one of the most recognized programs in risk management and compliance. There are CRCMPs in 32 countries around the world. Companies and organizations like Accenture, American Express, USAA etc. consider the CRCMP a preferred certificate. You can find more about the demand for CRCMPs at: www.risk-compliance-association.com/CRCMP_Jobs_Careers.pdf For the distance learning programs, you may visit: www.risk-compliance-association.com/Distance_Learning_and_Certification.htm For instructor-led training, you may contact us. We can tailor all programs to meet specific requirements. We tailor presentations, awareness and training programs for supervisors, boards of directors, service providers and consultants.

Page 45: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 45

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

Some CRCMP jobs:

4. IARCP Authorized Certified Trainer (IARCP-ACT) Program - Become a Certified Risk and Compliance Management Professional Trainer (CRCMPT) or Certified Information Systems Risk and Compliance Professional Trainer (CISRCPT). This is an additional advantage on your resume, serving as a third-party endorsement to your knowledge and experience. Certificates are important when being considered for a promotion or other career opportunities. You give the necessary assurance that you have the knowledge and skills to accept more responsibility. To learn more, you may visit:

Page 46: Monday, October 15, 2018 - International Association of ... · Internet), HaaS (Hacking as a Service) enables everybody to hire hackers for financial gain, intelligence, competitor

P a g e | 46

_____________________________________________________________ International Association of Risk and Compliance Professionals (IARCP)

www.risk-compliance-association.com/IARCP_ACT.html 5. Approved Training and Certification Centers (IARCP-ATCCs) - In response to the increasing demand for CRCMP training, the International Association of Risk and Compliance Professionals is developing a world-wide network of Approved Training and Certification Centers (IARCP-ATCCs). This will give the opportunity to risk and compliance managers, officers, and consultants to have access to instructor-led CRCMP and CISRCP training at convenient locations that meet international standards. ATCCs use IARCP approved course materials and have access to IARCP Authorized Certified Trainers (IARCP-ACTs). To learn more: www.risk-compliance-association.com/Approved_Centers.html


Recommended