Facing up to the new reality of conduct regulation

We saw the first stirrings of “behavior-based regulation” as a response to the Global Financial Crisis (GFC) in 2007–2008. Regulators were stung (reasonably enough) by public criticism that predicating compliance reports on value-at-risk had failed to prevent the crisis. Those same regulators and their government sponsors quickly cast around for a new set of lenses they could use to focus on whatever financial practitioners were actually doing that they hadn’t paid attention to before. Over the next 14 years, the scope and reach of what we now call conduct regulation have developed hugely. Add a recent nudge from citizens questioning certain brands’ corporate social responses to the pandemic, the war in Europe, employment practices, and social justice generally.

In 2022, any talk of good conduct in financial markets must now check the context of what regulators are doing collectively. Central banks, securities, and competition regulators in the United States, Canada, the United Kingdom, continental Europe, and Asia–Pacific’s (APAC) prime movers in Japan, Singapore, and Australia all now cite practitioner conduct as a focus of their attention. Conduct is now a global regulatory enterprise, with agencies syndicating their efforts to identify and attack the roots of conduct risk. Regulators take aim at many financial firms’ legacies of skewed, consequence-blind systems of value and reward, and any casually obnoxious workplace cultures that arise from such compensation cultures. Regulatory agencies and central banks are not only making common cause, but they’re also collectively developing and sharing tools and insights: conduct regulators from different jurisdictions talk to each other all the time, compare each other’s behavioral research, share notes on effective methods of prosecuting misconduct, and even collaborate on setting levels of penalties.

With the “conduct project” now enjoying coordinated support from regulators worldwide, it is rapidly expanding its toolkit. Prosecutors in some jurisdictions are already using innovative techniques, while their colleagues in other countries watch, learn, and seek ways to adapt these for local use. Techniques and tools including:

• Culture audits

• One-on-one “walkabout” interviews with front-office staff

• Prosecuting new offenses such as greenwashing (which is misconduct because it’s lying about your environmental, social, and governance (ESG) credentials)

• Diversity scorecards

• Personal ethics oaths and/or attestations to ethical values and skillsets

• Artificial intelligence–assisted thematic analysis of conversations from “unstructured data sources,” such as the social media hangouts Glassdoor, WhatsApp, GoodJobsFirst, and DidTheyCare.com

Faced with increased scrutiny of how they actually behave in the real world, financial industry folks’ first instinct is often to reach for one of their trusted panaceas. Typically, they expand the prescribed list of “acceptable answers to audit questions” (written in a nice, 20-page, conduct risk policy); and/or throw a seven-figure sum at a piece of shiny new regtech, or an advisory firm, or both, to make the problem go away.

While none of those responses is wrong, they don’t directly address the question, “What’s the regulator really looking for?” Funnily enough, this is the first question I’m often asked by practitioners attending my classes. So, let’s look at that.