The term conduct risk is used when pay and appraisal design, training, monitoring of staff behavior, and complaint analysis are considered together as one framework for preventing inappropriate actions.

What conduct risk is

Actions that fall short of expected standards, such as legal requirements, internal rules and ethics, are generally understood as "misconduct"1. This page writes "conduct risk" for the risk that such actions occur.

The Financial Services Agency's (FSA) paper of October 2018 says that there are many cases in which corporate value is damaged significantly. Even where laws set no rules, the routes it names are actions that go against social norms, against business customs or market practice, or that do not take the user's perspective into account. As examples of where bad outcomes arise, it names three: the two in the figure below (user protection, and market fairness and transparency) and the institution's own reputation, which only the figure's description covers2.

UserCustomersFirmActionsMarketUser protectionFair markets
Figure 1Where the actions of officers and employees can lead to bad outcomes
Figure description

The figure shows, using the examples in the FSA paper, the cases where the actions of an institution's officers and employees harm user protection, market fairness and transparency, and the institution's own reputation. The arrows show where the bad results of the actions of the institution's officers and employees go; they do not mean the institution protects users or the market. The figure draws two of the three, users and the market. The third, the adverse effect on the institution's own reputation, is an example named even where no adverse effect on outsiders arises objectively, and it is not drawn in the figure.

The same FSA paper says that a common understanding of conduct risk has not necessarily formed2. In what the UK Financial Conduct Authority (FCA) heard from large wholesale banks in 2016, each firm's definition referred to outcomes for customers, and some also referred to market integrity or the sustainability of the business3. The FSA does not require institutions to use the concept or to create new internal rules. It treats the concept as something each institution builds up in the form that suits it, drawing on its existing risk management framework4.

Problems in the sources: sales, markets, and conflicts

The problems named in public sources can be read as three groups, which are sales to customers, actions that undermine market fairness, and failures to manage conflicts of interest.

Type What happens Examples in the sources
Sales The products the institution wants to sell are put ahead of what the customer needs. Pressure on sales staff makes this priority worse Inappropriate sales of products to retail customers5. Pay arrangements that put explicit or implicit pressure on sales staff to sell particular products6
Markets Market fairness and transparency are undermined Collusion to manipulate wholesale markets5, attempts to manipulate LIBOR6, and a case in which non-public information not yet released was passed to some customers (2018 supervisory year)7
Conflicts of interest One institution carries out activities with different aims for different customer groups or for its own account, which creates a risk that some customer groups are treated in a biased way Failures to manage conflicts of interest in wholesale markets are a major root cause of harm to both market integrity and customer protection (the FCA's 2013 assessment)6

In 2013 the FCA said that the root of much conduct risk is the abuse of conflicts of interest, and it saw culture and pay arrangements as making conflicts of interest profitable and entrenching them. In the same section, it names attempts to manipulate LIBOR, among others, as examples arising from products and arrangements built to exploit conflicts of interest and similar situations6.

The cases the FSA identified also show that complying with the law is not enough. In the case of passing non-public information not yet released to some customers, the FSA's summary is that the institution did not give enough thought to how it would be judged by the public, and stopped at the idea that following the existing rules was sufficient. This led to an action that could damage trust in the fairness of the capital markets7.

Individual cases are covered in Mis-Selling Cases.

The management framework

The FSA's basic policy broadly divides risk-based management into two processes, identifying and assessing risks, and reducing and controlling them. How they are carried out may differ with the institution's size and characteristics8. Internationally, the FSB has set out a toolkit on three subjects: culture, individual responsibility, and the moving of staff who concealed past misconduct from one employer to another. No single approach suits everyone, and each institution decides the combination9.

Risk identification

In what the FCA heard, the features that firms saw as effective included identifying their own conduct risks through a firm-wide self-assessment process, and recording and reporting on a firm-wide classification of risk types so that records and reports line up. Some firms saw benefits in comparing, so as to check whether a risk found in one business also exists in others10.

Culture and the attitude of senior management

The attitude of senior management is called the "tone at the top", and it has a large influence on corporate culture. The attitude of middle managers, who appraise front-line staff day to day, is also taken seriously, and the FSA paper refers to it with the phrase "tone in the middle". Corporate culture is the foundation that runs through the whole system of internal controls11. The FSB toolkit lists senior management setting out the desired culture, identifying the cultural drivers of problems from a wide range of information, and taking concrete actions that move behavioral norms12. The second of the FCA's questions asks how people in the front, middle and back offices, control functions and support functions can be made to take responsibility for the conduct of their own work13.

Pay and appraisal

Personnel and pay systems act as incentives for officers and employees. The FSA points out that a system that gives heavy weight to short-term revenue while treating legal compliance lightly can create the motive to raise sales results even at the cost of misconduct14. Among the cases the FSA identified is a financial institution that set up a system in which, even if performance is high, the overall appraisal is low when the appraisal from the compliance or customer-focused viewpoint is low (2018 supervisory year)15.

The large wholesale banks the FCA interviewed looked at both financial and non-financial factors when deciding variable pay, and a growing number of banks split the appraisal of performance into "what" was achieved and "how" it was achieved (2016)16.

Training

Among the cases the FSA identified (2018 supervisory year) is a financial institution that stopped training that explained the frequently changing rules themselves and moved to a form in which officers and employees learn the purpose and background of the rules and think for themselves. Examples of the revision include moving to discussion sessions on cases where judgment is difficult, and adding integrity training to raise honesty and ethical awareness alongside conventional compliance training18. Some banks the FCA interviewed ran small-group training led by experienced practitioners who drew on their own experience. Those banks considered it considerably more effective than e-learning in which participants can click through screen after screen19.

Monitoring

In what the FCA heard, most banks produced management information centrally for desk heads, collecting measures of individual behavior and breaches of internal rules. The measures included training not completed or completed late, analysis of customer complaints, breaches of limits, and reports of suspicious transactions20. Among the cases the FSA identified is a financial institution that introduced a system to grasp staff behavior in one place, which displays a warning when it detects inappropriate behavior so that a manager checks the details (2018 supervisory year)21.

Complaint analysis

Among the cases the FSA identified is a financial institution that built a platform that classifies complaints from employees and customers by reason and analyzes which kinds of complaints are increasing, and the FSA notes that the analysis methods are still developing (2018 supervisory year)23. There is also a case in which, when a new product is launched, the institution looks at sales and at related complaints to check whether the product is being sold in a way different from what was assumed when it was designed (2019 supervisory year)24. The management information the FCA heard about also included analysis of customer complaints20.

Why the effect is hard to measure

The FCA said that firms were making progress, but that it was too early to judge how effective their efforts would be in the long term (as of the 2018 re-issue)25. On measures, the firms the FCA heard from said that more work remained, and that because behavior changes as staff come to understand what is measured, a firm that does not keep updating its measures risks false comfort26. In a case the FSA identified (2018 supervisory year), a financial institution uses AI to detect inappropriate behavior. It said that the system needs to learn many behavior patterns. Detection accuracy and coverage are not 100%, so for now it needs to combine AI with visual checks27.

Relationship to operational risk

Operational risk is defined in the capital adequacy notice as including legal risk and excluding strategic risk and reputational risk28. Conduct risk, on the other hand, also covers adverse effects on the institution's own reputation and actions that no law addresses2. It follows that there are parts that overlap with operational risk as the regulation defines it, and parts that do not.

In a footnote, the FSB writes that prudential supervisors, who supervise financial institutions from the viewpoint of soundness, consider conduct risk a subset of operational risk. In the same footnote the FSB explains that in the "grey zone" where no law is broken, institutions are allowed to take risks but are responsible for managing them appropriately, and that managing the risk does not necessarily mean avoiding conduct risk29. The classification of operational risk, and its management through loss data and self-assessment, are covered in Operational Risk in Derivatives.

Notes

  1. Financial Stability Board, "Strengthening Governance Frameworks to Mitigate Misconduct Risk", footnote 8, page 1 (PDF page 7). The FSB says that misconduct "can be generally understood as conduct that falls short of expected standards, including legal, professional, internal conduct and ethical standards." ↩

  2. Financial Services Agency, "コンプライアンス・リスク管理に関する検査・監督の考え方と進め方（コンプライアンス・リスク管理基本方針）" (Approach to inspection and supervision regarding compliance risk management (basic policy on compliance risk management), in Japanese; our translation) (October 2018), the "Conduct risk" box in III.2.(2) "Capturing and grasping a wide range of risks" (pages 11–12). ↩ ↩2 ↩3

  3. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision" (published April 2017, re-issued April 2018), "Defining conduct risk", page 8. ↩

  4. Financial Services Agency, "Basic policy on compliance risk management" (see above), footnote 4 (page 12). ↩

  5. Financial Stability Board, "Strengthening Governance Frameworks to Mitigate Misconduct Risk: A Toolkit for Firms and Supervisors" (April 20, 2018), Preface, page v. ↩ ↩2

  6. Financial Conduct Authority, "FCA Risk Outlook 2013", 2.1 "Conflicts of interest" and 2.2 "Culture and incentives", page 19. ↩ ↩2 ↩3 ↩4

  7. Financial Services Agency, "コンプライアンス・リスク管理に関する傾向と課題" (Trends and issues in compliance risk management, in Japanese; our translation) (June 2019, partly updated July 2020), "Cases that led to problem events" (cases identified in the 2018 supervisory year, page 34). ↩ ↩2

  8. Financial Services Agency, "Basic policy on compliance risk management" (see above), III.2.(1) "Risk-based approach" (page 10). ↩

  9. Financial Stability Board, "Strengthening Governance Frameworks to Mitigate Misconduct Risk", "The toolkit", page 4; Phase 2, pages 2–3. ↩

  10. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", "Design of Conduct Risk Change Programmes", page 6, and Question 1, page 10. ↩

  11. Financial Services Agency, "Basic policy on compliance risk management" (see above), III.1. ("tone in the middle", pages 5–6). ↩

  12. Financial Stability Board, "Strengthening Governance Frameworks to Mitigate Misconduct Risk", Tools 1 to 3, pages 4–5. ↩

  13. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", "The 5 Conduct Questions", Question 2, page 4. ↩

  14. Financial Services Agency, "Basic policy on compliance risk management" (see above), footnote 1 to III.1. (page 5). ↩

  15. Financial Services Agency, "Trends and issues in compliance risk management" (see above), "Personnel and pay systems" (cases identified in the 2018 supervisory year, page 9). ↩

  16. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", Question 5, page 19. ↩

  17. Financial Services Agency, "Trends and issues in compliance risk management" (see above), "Personnel and pay systems" (cases identified in the 2018 supervisory year, pages 9–10). ↩

  18. Financial Services Agency, "Trends and issues in compliance risk management" (see above), cases of training (cases identified in the 2018 supervisory year, page 13). ↩

  19. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", Question 3, "Training", pages 14–15. ↩

  20. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", Question 3, "Supervision, procedures and management information", page 13. ↩ ↩2

  21. Financial Services Agency, "Trends and issues in compliance risk management" (see above), "Use of information and communication technology" (cases identified in the 2018 supervisory year, page 29). ↩

  22. Financial Services Agency, "Trends and issues in compliance risk management" (see above), cases in control departments (page 21; the "detection-oriented" and "awareness-oriented" approaches are cases identified in the 2019 supervisory year, and the mystery-customer checks are cases identified in the 2018 supervisory year). ↩ ↩2

  23. Financial Services Agency, "Trends and issues in compliance risk management" (see above), "Use of information and communication technology" (cases identified in the 2018 supervisory year, page 29). ↩

  24. Financial Services Agency, "Trends and issues in compliance risk management" (see above) (cases identified in the 2019 supervisory year, page 21). ↩

  25. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", Summary, page 4. ↩

  26. Financial Conduct Authority, "'5 Conduct Questions' Industry Feedback for 2016 Wholesale Banking Supervision", Question 3, page 14. ↩

  27. Financial Services Agency, "Trends and issues in compliance risk management" (see above), "Use of information and communication technology" (cases identified in the 2018 supervisory year, page 29; opinions to the same effect on page 28). ↩

  28. Financial Services Agency, "銀行法第十四条の二の規定に基づき、銀行がその保有する資産等に照らし自己資本の充実の状況が適当であるかどうかを判断するための基準" (Standards for determining whether a bank's capital adequacy is appropriate in light of the assets it holds, under Article 14-2 of the Banking Act, in Japanese; our translation; FSA Notice No. 19 of 2006), Article 1, item 111. ↩

  29. Financial Stability Board, "Strengthening Governance Frameworks to Mitigate Misconduct Risk", footnote 21, page 10. The footnote says that in the "grey zone" firms "are allowed to take risks but are responsible for managing these risks appropriately", and that this "does not necessarily mean the avoidance of conduct risk." ↩