BankThink

Is Outsourcing the Volcker Rule's Achilles Heel?

This is the fifth article in an eight-part series.

Anyone who argues that the Dodd-Frank Act kills jobs has not been monitoring the amount of hiring that banks are doing as they prepare to comply with the Volcker Rule. Banks are outsourcing Volcker Rule advisory and implementation assistance to an army of lawyers, accountants, compliance consultants and IT vendors.

Given how new the final rule is, it is unsurprising that banks do not have all the legal, accounting, compliance, and auditing skills necessary for Volcker Rule implementation in-house. But outsourcing is also a major operational risk. In previous articles in this series, I have argued that banks are struggling to implement the Volcker Rule due to important elements of operational risk management such as people, processes, and technology. However, it is badly-managed outsourcing that could end up being banks' Achilles heel.

Most large domestic and foreign banks in the U.S. say that they have initiated Volcker Rule compliance programs. This does not mean they necessarily have well-developed programs that have identified all the compliance gaps and the skills they need to outsource on a short- or long-term basis. And most banks lack clear guidelines about how to put together requests for proposals so that vendors can compete for projects. They also typically lack strong processes about how to monitor vendors who provide Volcker Rule services until they have completed their roles.

It is imperative that banks determine which staffers have the competency to conduct due diligence on whether potential vendors possess sufficient knowledge not only about the Volcker Rule but about how banks' securities and derivatives trading and hedge fund and private equity businesses work. Once a vendor is chosen, the bank's Volcker Rule program must have clearly-defined objectives about what the vendor must accomplish laid out in a well-written contract. Banks should also make sure that all vendors sign non-disclosure agreements as soon as they are hired, given all the confidential information they are likely to see. And they would do well to consult the Office of the Comptroller's vendor management guidelines.

A point person at the bank then needs to monitor how the vendor is meeting the bank's objectives in the written contract. Usually if a vendor is evaluated at all, it is with qualitative rather than quantitative metrics. The industry needs to change this so that it can determine if it really is spending its outsourcing dollars efficiently.

Banks also need to clarify with the vendor ahead of time how late or incomplete delivery of services will be handled. In addition, they should have a written process established as to how they will cut ties with a vendor if the vendor's services are found lacking.

Banks face another potential problem that is particularly common in outsourcing to IT firms: sometimes the IT firm may substitute the initial personnel who work on a project with others in order to serve the needs of additional clients. This has two drawbacks for banks: they may find themselves in the position of constantly repeating what services they need, and their confidential information may not be sufficiently safeguarded.

With a wide range of law firms competing for financial regulatory advisory work, banks need to establish firm guidelines as to how to best determine which one will provide the best quality services. Just because a law firm is good at understanding one aspect of Basel III or the Dodd-Frank Act does not mean it is automatically qualified to help with the incredible complexities of the Volcker Rule. Also, much of the work at law firms is done by associates who very likely have never worked at a bank or a bank regulatory entity. It is one thing to understand a law; it is another to understand the realities of securities and derivatives trading.

Even with senior partners, banks should ascertain how much of a priority they will be once the contract is signed. Will partners really be available to provide necessary competency on the Volcker Rule, or will they be out chasing new deals? I have heard repeatedly that because law firms are inundated with regulatory work, banks cannot always get their phone calls returned by lawyers on retainer as promptly as they would like.

It is inevitable that banks will want or need to get outside help in order to implement the Volcker Rule by the necessary deadlines. Yet a comprehensive plan for outsourcing is imperative, lest the bank magnify its operational risk, an area that tends to be weak at most banks.

Next in the series: The Volcker Rule and foreign bank organizations.

Mayra Rodríguez Valladares is managing principal at MRV Associates, a New York-based capital markets and financial regulatory consulting and training firm. Follow her on Twitter at @MRVAssociates.

For reprint and licensing requests for this article, click here.
Law and regulation Community banking
MORE FROM AMERICAN BANKER