Sec Speeches Cryptocurrency Remarks at New York City Bar Association Compliance Institute

You may come across aspects of your firm’s business that you do not completely understand. That’s not an excuse to punt. Take whatever steps are necessary to learn and understand the issues.

Those of you who work in the compliance function are leaders inside your organization and through proactive internal engagement you will be better prepared to discharge your duties. This understanding is critical to designing and adopting meaningful policies and procedures.

In our 21F-17 example, it means working with your firm’s human resource and legal functions to make sure that your employment agreements and policies are up-to-date and not in violation of that rule.

But none of this can be a one-time thing. Your businesses and operations change, risk areas change, and enforcement priorities change. There is also new Commission rulemaking. So education and engagement always needs to be a continuing, ongoing effort.

Finally, adopting meaningful policies and procedures is only part of the battle. Effective execution is equally important.

Time and again, we see firms that have good policies, but fall short on implementation.

Our ongoing off-channel communications sweep to ensure that regulated entities, including broker-dealers and investment advisers, comply with their recordkeeping requirements is a good example.

Since December 2021, it has resulted in charges against 40 firms and over $1.5 billion in civil penalties for failures to maintain and preserve electronic communications.[11]

As the orders in these actions describe, in every case, the firms had policies and procedures in place, but employees nevertheless communicated through unapproved methods. That is because there was widespread failure in implementing those policies. In fact, as detailed in all the orders, the individuals charged with supervising employees to prevent this misconduct were themselves violating the procedures.

What these actions make clear is that adopting the policies is just the first step, not the last. Through leadership, training, constant oversight and the right tone at the top, you need to ensure that the policies are actually implemented and followed.

That’s what proactive compliance requires.

And if despite all of your efforts, you do detect a securities law violation, the best thing to do would be to self-report and cooperate. Because, even as we emphasize robust penalties, we have also aggressively rewarded meaningful cooperation, most notably by recommending that the Commission impose substantially reduced penalties—or even no penalties at all. We did this frequently this past fiscal year.[12]

The Commission’s public orders describe the kinds of steps that companies took to obtain this type of cooperation credit. For example, in our off-channel communications sweep, the penalties the Commission has ordered have, as I think all in this room would agree, been high – record penalties, in fact, for books and records violations. But one recent order was not like any of the others. It detailed Perella Weinberg’s self-report and cooperation.[13] In that case, the Commission ordered a $2.5 million penalty – a very substantial reduction from the penalties imposed on other broker-dealers and advisers.

Other types of behaviors that have resulted in reduced or zero penalties have included:

• preemptively remediating and ceasing the unlawful behavior;
• proactively providing compensation to victims;
• providing detailed financial analyses, explanations, and summaries of factual issues to the staff;
• proactively identifying key documents and witnesses that the staff has not yet identified; and
• facilitating interviews of former employees.

These orders should aid each of you who are counseling companies and individuals deciding between coming forward or sitting back and taking the chance – gamble, really – that we do not discover the violation or that a whistleblower does not report it.

Let me conclude by addressing the proverbial elephant that shows up in any room where a regulator like me is speaking to those working in compliance: when does the Enforcement Division recommend charges against a compliance officer?

The short answer is that we do not second-guess good faith judgments of compliance personnel made after reasonable inquiry and analysis.[14] That is why such actions are rare.

There are really three situations where the Commission typically brings enforcement actions against compliance personnel:[15]

• where compliance personnel affirmatively participated in misconduct unrelated to the compliance function;
• where they misled regulators; and
• where there was a wholesale failure by them to carry out their compliance responsibilities.

The first category is easy: being a member of the compliance function is not a “get-out-of-jail” card, so when compliance officers violate the securities laws in ways that have nothing to do with exercising their compliance responsibilities, they are held accountable just like anyone else.

Here is one example. In June, the SEC charged the chief compliance officer of an international payment processing company with insider trading, alleging that he traded based on material nonpublic information that he surreptitiously obtained from his girlfriend’s laptop about upcoming mergers and acquisitions in which her employer was involved.[16] He then allegedly traded on that information and tipped it to his friends, who also traded.

The second category involves cases where a compliance officer obstructs or misleads the Commission’s staff or provides false information to regulators.

For example, the SEC charged a CCO with aiding and abetting and causing a firm’s books and records violation when she provided backdated and factually inaccurate compliance review memos to the SEC, falsely claiming that she created the memos contemporaneously with the reviews.[17]

In a similar case, the SEC charged a CCO with aiding and abetting a firm’s policies and procedures violations when she provided SEC staff compliance reports that she had falsified to give the misleading appearance that she had timely prepared the reports, when she, in fact, had not.[18]

These cases do not involve the SEC second-guessing good faith judgment calls; they involve deliberate conduct by the CCO intended to thwart the SEC’s ability to exercise effective oversight of the compliance function.

The third category involves wholesale failures by compliance personnel to fulfill their obligations.

Last month, for example, the Commission charged a partner at Marcum LLP, a public accounting firm, with failing to sufficiently address and timely remediate numerous deficiencies in Marcum’s quality control system.[19]

While not a CCO, the partner oversaw the firm’s quality control policies and procedures, and supervised all personnel working within Marcum’s quality control function.

According to the SEC’s order, for several years, the partner knew that the PCAOB had identified various deficiencies in that function and that Marcum’s own inspections had also revealed several deficiencies. Yet, he failed to address them, leading to various compliance failures in the firm. The partner agreed to pay a $75,000 civil penalty to resolve the case and was ordered to have no leadership role at an accounting firm for three years.

In another example from this past fiscal year, the Commission charged the CCO of a registered investment adviser who was responsible for implementing and adopting the firm’s compliance policies and procedures.^[20]

For at least 10 years, instead of adopting policies and procedures that actually related to the firm’s business or even the federal securities laws, the firm adopted a handbook published by a professional trade organization containing standards of practice for candidates preparing for that organization’s examinations. The firm did not tailor the handbook to its actual business. In fact, the handbook did not even mention the applicable federal securities laws. On top of that, the firm also did not conduct any compliance training or annual reviews of its program.

In simple terms, in these cases, there was no education, no engagement and no execution. Rather, there were wholesale failures to carry out compliance responsibilities and to conduct even basic inquiry and analysis.

But cases like these are rare. The Commission has filed well over 1,000 standalone cases since I became Enforcement Director and only a handful have involved charges against compliance officers.

As I have said, we have no interest in pursuing enforcement actions against compliance personnel who undertake their responsibilities in good faith and based on reasonable inquiry and analysis.

We fully recognize that this is challenging work, but there is a way to meet those challenges and it requires, as I have detailed: education, engagement and execution.

Thank you again to the New York City Bar Association for the invitation to address you today.

I look forward to working with each of you towards our shared goal of fostering a culture of proactive compliance, so we can, together, enhance public trust and confidence in our markets and institutions.

And thank you all again for your efforts.