Financial reporting standards now work in much the same way, with considerable management discretion required. This is a sensible approach, given that operating models and business strategies differ from one bank to another. Prescriptive rules, especially if they are rigid, are always ill-suited if intended for all institutions, as they often lead to numerous exemptions, waivers or perverse outcomes. So, even if we exhaustively pursue prescriptive rules to secure financial stability, there will inevitably be areas where allowance for judgement is necessary. Regulators have a keen interest in the development of a strong compliance function within banks given the more complex rules, combined with the wider use of principle or outcome-based regulations. The compliance function plays at least three critical roles. First, to ensure a bank’s operational frameworks are consistent with the intentions of regulatory standards. Second, to provide a level of independent assurance on the processes behind detailed calculations of regulatory ratios and limits. And third, to support consistent and wellreasoned applications of management discretion and judgement. The existence of a strong compliance function, therefore, protects the integrity of the regulatory framework. We should be mindful that when banks’ internal functions cannot be relied on to achieve financial stability objectives, experience shows that regulation will then tend to be more intrusive. In the process of intervening to remedy such gaps in the stability framework, tensions often surface over the delicate balance in regulation.
In earlier times, the compliance function was largely left to a single, usually mid-level, individual within the organisation, whose principal job was to serve as a contact point with the regulator, or to handle matters relating to anti-money laundering and counter financing of terrorism. Today, almost all financial institutions have a compliance function, staffed with whole teams dedicated to all aspects of a firm’s compliance with relevant laws, regulations and internal policies. Indeed, we have progressed. Many efforts have been taken to continuously strengthen the supervisory framework. Bank Negara Malaysia has identified the compliance function as one of the key control functions in a financial institution – right up there with senior management, risk management function, and finance and reporting functions. In 2015, we issued the compliance standard for financial institutions, which raised our expectations of boards and management to address the full breadth of structural, operational, resource and process issues that go into assuring compliance. We also issued strengthened corporate governance standards which reinforce the accountability of the boards in overseeing an effective compliance function. While it should be obvious why compliance is so important, I think it bears repeating. If motivations for an increased focus on compliance are exclusively driven by the avoidance of regulatory fines, then we are missing the big picture. We should be aware that a strong compliance function and culture makes good business sense. Today I would like to address the following matters: i.