Implementing Regulatory Change with Speed and Absolute Certainty

Transcription

1 WHITE PAPER Implementing Regulatory Change with Speed and Absolute Certainty GDPR BASEL III IFRS17 PSD2 A framework for reducing the time and cost of change projects, while mitigating risk, for the financial services sector.

2 Staying up to date with new legislation and regulatory change has always been a challenge for organisations within the financial sector. However, in recent years the rate of these changes has steadily increased, as a consequence of the global financial crisis. In addition, financial services companies are under pressure to accommodate additional market and consumer demands that require a fundamental transformation of their digital strategy. The reality is that implementing these changes comes at a price even when those changes are ultimately designed to improve financial outcomes. Cost of Compliance The cost of compliance is increasingly rapidly. One estimate suggests that between percent of a financial institution s workforce is now dedicated to governance, risk management and compliance. Many institutions rely on third-party consultancies to keep on top of regulatory law, an industry now worth billions per year. Driving these cost increases is not only the sheer volume of new regulations, but also the increased level of granularity and complexity involved for each one. For example, according to one Thomas Reuters survey 1, the average cost to meet Know Your Customer (KYC) regulations is about $60 million. Of course, these regulatory housekeeping costs are small compared with the cost of non-compliance or rather, the cost of not being able to demonstrate compliance - a subtle, but significant, distinction. There is at least one high street bank 2 that is obligated to pay $1 million per year for regulator representatives to sit within the organisation as a result of non-compliance. An expensive babysitter when you consider they only missed one or maybe two regulations, and they ll face a multi-million dollar fine for missing those regulations next year. It s important to realise that this wasn t willful negligence on the part of the bank, they simply lacked the expertise and visibility to realise they fell short of compliance. The situation for many financial institutions today is complex, confusing and costly. And it s only going to get worse The Next Wave of Regulations to Have Huge Impact As mentioned above, new and modified regulations appear all the time. However, in the next few years, the financial industry is going to be hit by a new wave of regulatory heavyweights, namely: Basel III updates, MiFID update, IFRS 17, PSD2 and the General Data Protection Regulation (GDPR). Basel III is generally considered to be the most extensive regulatory change that the banking industry has seen in decades and will cut right to the heart of how financial institutions operate. Insurers will need to implement IFRS in 2019 to enable parallel running for two years before the 2021 deadline. Both the MiFID update and GDPR go live in 2018, although GDPR should already be adopted and in transition. In addition to these known issues, we are on the cusp of a rather big change in the UK. No one is yet certain how BREXIT will affect the financial sector, let alone the regulatory landscape.

3 The Challenge of Implementation New regulations are often introduced with aggressively short timeframes for implementation. To avoid penalties and even save reputations organisations must keep pace. However, this is difficult to achieve in a cost-effective way. A new approach is warranted, but to create one that makes sense, it s worth analysing in detail exactly why current change methodology is so problematic: regulation is also only understood when the work has been completed. One could imagine a situation where a new regulation has been implemented, seemingly successfully, only now the organisation is unknowingly non-compliant on a set of other regulations. Another issue is the ability to evaluate risk. Often compliance is a balance between cost and risk. It s difficult to analyse this sufficiently if the impact to the business is unknown. Unclear Business Requirements Difficult to Establish Business Impact In an ideal world, financial organisations would possess a comprehensive view of the impact and extent of new legislation before implementation, at the design stage. Unfortunately, for the majority of projects, this is not the case. This lack of foresight causes several problems. Unintended impacts of the change are not apparent, or understood, until the change has been made, leading to costly re-development and escalation of risk. This is further compounded because regulations overlap, so the impact of one regulation on another The widespread application of a regulation across the financial sector means that the detail is somewhat generic. Individual organisations are left to interpret the specifics to meet their own situation. When you consider many financial services organisations span countries, where each country may interpret the regulation differently or not at all, compromise and vagueness creep in. The reason this is such an issue is that at some point, a set of agreed business requirements need to be communicated to IT, so they can turn those requirements into rules and use them as a basis for system-level change. If this wasn t complicated

4 enough, often IT and the legal side of an organisation don t metaphorically speak the same language, so they misunderstand each other. IT goes ahead and builds a system based on what it understands the regulations to be, which is often incorrect. This only comes to light at the end of the change project, dangerously close to the regulator s deadline. Fundamental Implementation Inefficiencies Financial services organisations typically have percent of their resources tied up in run the bank (RTB) or business as usual (BAU) activities, which include dealing with regulatory change. This essentially cripples the organisation into running to stand still, with very few resources left over for change. However, many of the resources required for regulatory change projects are utilised on repetitive tasks, effectively duplicating effort across the business. An example of this is implementing the same set of logic code across multiple systems, or even areas of the same system (legacy systems and current systems). The majority of the effort is essentially manual, making it laborious, slow and prone to errors, usually relying heavily on end of development user acceptance testing. This can also result in an almost never-ending cycle of test modify test, causing budget overruns and missed deadlines. High Risk of Failure The goal of regulatory change projects is to demonstrate compliance and avoid hefty fines. But, despite the best intentions and large amount of resources dedicated to implementation, many projects fail. They either fail to meet the deadline, fail to adhere to the regulations adequately, or fail to demonstrate compliance in a verifiable way. In many cases, the risks don t materialise until user acceptance testing, by which time it s costly to remedy. Of course, the fact that impact analysis is difficult means that many implementation projects are flying blind to the outcome. Failure to demonstrate compliance can be as bad as non-compliance, and for many organisations, the problem is in the reporting structure. The reliance on static files, such as spreadsheets, or logs to relay information, means that the information is out-ofdate almost as soon as it is published. The problem with the current, standard methodology of new regulatory change is complex and requires a new approach to iron out the issues. With the most significant regulations to hit the financial services sector in decades just around the corner, a comprehensive transformation of regulatory change methodology is needed.

5 Simplifying Change As we have seen, there is an immediate need to reduce the time, resource and cost of implementing regulatory change. This must be undertaken with the goal of mitigating risk there s little point in speeding up the change process if targets are missed. Therefore, rather than piecemeal improvements through change projects, a more fundamental shift in methodology and technology is needed. Sapiens DECISION, which utilises The Decision Model, provides these shifts through the following five elements: 1 A Means to Analyze Regulations or Policies Derived from Regulations. The Decision Model, the methodology underlying Sapiens DECISION, provides the means to analyse regulatory requirements, breaking them into logical constructs that may be assessed for logical consistency and clarity. These constructs eliminate the vagaries of language and bring the actual requirements of the regulation, or policy, into sharp focus. 2 Clear Foresight of What the Change Will Mean for Your Business Ahead of the Implementation. With a proven understanding of the outcome, you can plan and manage resources much more accurately. And it s far less likely that the actual implementation will generate anything unexpected. It s important to drill down to the detail, including determining the accuracy of your data. The more evidence you have on the outcome of implementation, the clearer your strategy for implementation will be, even if that strategy is pushing back on the regulator. 3 Absolute Clarity of Business Requirements for IT Implementation. Sapiens DECISION provides this crucial step, by taking the agreed approach from your impact testing and translating that into a set of business requirements in a format that IT can understand. It bridges the gap between the view IT has of the business (code-based rules) and the view from the legal side of the business (words and regulations), and ensuring nothing is misunderstood when the project flows from one area to another. The most effective way to do this is through clarity (be certain what you re trying to achieve), focus (agreement on the way forward) and simplicity (breaking down the complex regulation into a set of simple rules). Sapiens DECISION provides the ability to test interpretations of a new regulation and obtain a realistic view of the impact on specific processes and systems. This what-if? scenario testing becomes a benchmark for subsequent decision-making.

6 4 Make the Change as Easily, Quickly and Painlessly as Possible. In addition to the points above, which already help to facilitate rapid, right-first-time change, the method and approach of implementation is fundamental to smooth project execution. The goal is to reduce the number of steps and manual activities, from requirements to deployment. Fundamentally, this means moving away from the one thing at a time mentality and looking for opportunities to make multiple changes concurrently. Either making one change that applies to the same regulation across multiple disciplines, or the ability to support multiple regulatory changes all occurring at the same time. This is not a manual activity. Operational systems must be adapted at the code level to support widespread change, whether from a new regulation, or the ongoing developments of existing regulations. 5 Ensure all Change is Visible and Permanently Traceable. Having done the actual work, this element ensures full, unambiguous visibility to the regulator, to prove that the organisation has complied with regulations. Sapiens DECISION provides links from the code being executed, to the models contained in the model repository, and then to the written policies and/or regulations at a granular level down to section, or even paragraph of a section, in a given document. This provides the means to demonstrate to management, auditors, regulators and other interested parties exactly how the regulation has been implemented. even a single transaction. This involves a move away from a reliance on spreadsheets or other static documentation, and a move towards real-time, dynamic reporting instruments that are updated automatically and accessible to the regulator. As well as providing proof of compliance, this robust set-up can help to achieve outcomes through retention and re-execution of data against historic configurations. This five-element approach is essentially a twopronged system a shift in methodology and the addition of automation and self-testing to your existing platform. The Decision Model in Action If we accept that change will always occur, then dealing with this change should be part of our business as usual operational mindset. Within the very systems used to run the business, it s possible to create a change framework that exists in the actual code. It s this underlying framework, plus a unique methodology of clarity that allows us to simplify change, reduce the time and cost of making that change, and mitigate risk of noncompliance. This is the framework that helped one of the top five investment banks get to grips with KYC regulations. Specifically, this bank needed to implement KYC regulations consistently across eight business units. They also had a wider business need to quickly onboard new clients, eliminate compliance risks and bring escalating costs back under control. Further steps include the ability to visually display the impact of regulation at the granular level of

7 Working closely with the bank, Sapiens DECISION immediately created business logic models from the KYC regulations to a specific set of requirements, in-line with all eight business units. We created automated test cases to gauge impact before implementation, then generated and executed the code within the bank s existing platform. As a direct result, there was a 50 percent increase in default resolution timelines and a 60 percent decrease in exceptions. The bank saved over $10 million in ongoing operating costs, change management and compliance risks. This is just one example of the Sapiens DECISION framework The Decision Model bridging the gap between regulatory requirements and actual IT implementation. The platform significantly simplifies the process of planning, implementing and optimising regulatory changes by creating logical rules, based on the innumerable decisions that your institution makes daily. Reducing Risk Through Decision Empowered Regulatory Change TRADITIONAL APPROACH INCREASES THE IMPACT OF RISK Identify Impact of Change Establish Business Requirements Implement DECISION APPROACH TO CHANGE Test UAT RISK PROFILE? Avoid misunderstandings Avoid gaps Avoid duplications in logic REDUCES RISK Avoid multiple iterations of rebuild and retest

8 About Sapiens DECISION Sapiens DECISION is a platform and methodology that helps you to accelerate business change while mitigating risk. It smooths your IT implementation and operational deployment by enabling necessary system changes to be applied rapidly, accurately and with absolute certainty by your team. Implementing DECISION makes ongoing change easy, reducing your costs and effort by up to 80 percent on every project. It also minimises your risk, by providing full traceability of where every change has taken place. For more information, please visit: 1. Thomson Reuters 2016 Know Your Customer Surveys Reveal Escalating Costs and Complexity, bobsguide, 9 May, HSBC taking too long to tackle financial crime, The Guardian, 22 February, 2016.