Culture of Compliance in AML and Sanctions

Jeff Lavine

JPL Advisory LLC

Original Publication: January 29, 2024 on LinkedIn

"The Law of Raspberry Jam: the wider any culture is spread, the thinner it gets."

ALVIN TOFFLER, The Culture Consumers

Compliance culture has been a consistent focus of US regulatory enforcement agencies. Improvement in compliance culture is a common mandate in enforcement agreements, and failure to improve has been frequently cited as a justification for fines when large banks have failed to remediate to the satisfaction of their supervisors. 

The change and development of corporate culture and the province of psychologists and sociologists are complex subjects. Unfortunately, supervisory guidance too often lulls us into hoping that a more muscular "Tone at the Top" will transform compliance behaviors in large or growing firms. It won't, and it sometimes backfires. 

A good culture of financial crime control occurs on its own. It is a subset of an organization's overall culture, and it must be deliberately established and maintained. 

What is Organizational Culture? 

Each organization has norms that influence employee behavior. Both policies and policing create norms. Employees and organizations learn which rules are enforced and which are ignored. 

Organizational culture also incorporates unwritten values that employees share and formally or informally communicate to new joiners. These values may stem from national or regional culture, corporate history, or type of business or industry. They may also prevent the behavioral tendencies of the employees attracted to certain types of industries. 

One such norm that psychologists have studied is risk-taking behavior. Such behavior can vary by firm and industry based on the employees they attract or recruit. For example, you would expect to find more risk-takers and, therefore, more risk-taking norms among high-frequency financial trading firm employees than at a community bank. Risk-taking is not inherently undesirable; in fact, it's reasonable and necessary. However, it must be understood, and its financial crimes compliance impact must be measured, mitigated, and monitored. 

How does Organizational Culture impact Financial Crime Compliance? 

Organizational cultures are stubborn once embedded and directly impact financial crime compliance. Narratives best illustrate the intersection of compliance and culture. 

Consider the stereotypical start-up risk-taking culture that encourages hustle and being fast to market at the risk of "breaking things." When those things are laws and regulations, culture directly impacts financial crime compliance. 

For example, a start-up was operating as an unlicensed money services business (MSB) but didn't think it mattered as they were "in beta." Also, the foreign bankers from a less-regulated market wanted a "license" to do foreign exchange trading in the US — activities they were already doing as the executives handed out business cards that said Senior US Foreign Exchange Trader and US Foreign Exchange trader. 

While a firmer tone from the top may have discouraged some of these situations, such a tone is not a panacea. In fact, it can backfire. For example, European bank employees interpreted tone from the top as zero-tolerance for financial crimes compliance failures. This tone made staff afraid to report issues for fear of reprimand or job loss. As a result, compliance-related job openings went unfilled because staff was afraid to take them. Further, the number of self-reported compliance issues fell as staff feared the impact of such reports on their careers. 

Additionally, a PwC study involving 2,431 managers from three UK financial services organizations raises even more dire warnings. When presented with situations highlighting the negative consequences or punishment for poor performance, managers were 15% more anxious than excited, making them more than twice as likely to behave unethically. 

How can you start to build a strong culture of Financial Crimes Compliance? 

In our experience, creating a compliance-supportive culture is not a top-down exercise. Tone from the top messaging is, at best, ignored and, at worst, counterproductive. Strongly worded emails remain unread. Public firing and shaming of non-compliers often only scare the compliant. We have found that the best way to change culture is to focus on behaviors and interactions in a day-to-day business. 

We focus on behaviors in "Moments the Matter" (MtM). Changing behavior is complex, but it becomes manageable by focusing effort iteratively on one or two MtM -- a specific and typical employee decision-making interaction. Changing one thing in one moment gets replicated in other moments. This change also impacts others and influences team and enterprise behavior. 

This ongoing training approach encourages individuals and teams to recognize specific moments, listen, stop, and think before acting or responding. Examples include how your employees react when deciding whether to on-board a potentially lucrative, high-risk client or approve an unexplainable transaction. It is "See Something, Say Something," tailored to a fast-paced business environment.

These moments become the focal point for building the financial crime compliance culture an organization seeks to drive. Individuals do not 'ring fence' their behaviors to a particular scenario or moment; they tend to snowball across the business to effect widespread culture change. 

How can you examine or test for a strong culture of Financial Crime Compliance? 

Technology, data, and new data mining methods can track how your culture is evolving – and whether it's moving in the right direction. Cultural measurement frameworks should incorporate the following:

• Metrics to monitor what influences people's behavior and how these are changing

• Tools and techniques to measure actual and perceived behavior across your organization 

• Outcome measures of your people's behavior to link your business priorities to your cultural change 

• Indicators of external perception of your organization's ethical behavior (e.g., social media)

• Surveys designed to measure psychological safety when employees speak up

A repeatable approach to measuring these key points will provide backward and forward-looking indicators for your senior management – and show regulators you're proactively looking at organizational culture.

Are there international regulators who have a good perspective?

The brute force approach to culture change is gradually giving way to more nuanced approaches rooted in psychology and behavioral economics.  A good example is the paper "Supervision of Behaviour and Culture" published by De Nederlandsche Bank (DNB), which explores the role of supervision in promoting positive behavior and culture within organizations. It emphasizes the importance of supervision in preventing misconduct and fostering a healthy work environment. The document discusses various aspects of supervision, including the role of leaders, the importance of clear expectations, and the need for ongoing monitoring and feedback.

The paper provides an overview of the key concepts and principles related to the supervision of behavior and culture. It highlights the significance of supervision in shaping organizational culture and preventing misconduct. It also delves deeper into the specific strategies and practices to enhance supervision effectiveness. It discusses the role of leaders in setting the tone and expectations, as well as the importance of ongoing monitoring and feedback to ensure continuous improvement.

Overall, this document provides valuable insights into the role of supervision in promoting positive behavior and culture within organizations. Despite its staggering 330 A4-size length, I recommend that the reader reads the whole document for a comprehensive understanding of the topic and to gain practical guidance on implementing effective supervision practices.

Conclusion

Building a strong culture of financial crime compliance is crucial for any organization. It requires sustained effort to change behaviors and interactions in day-to-day business operations. By emphasizing "Moments that Matter" and promoting a safe "See Something, Say Something" mentality, organizations can create a culture that encourages compliance and mitigates financial crime risks. It's a long-term effort, but with persistence and commitment, a culture of compliance can become embedded within an organization and help safeguard against financial crime.

If you would like more information on improving your compliance program, please contact me at jeff.lavine@jpladv.com.