Introduction to Compliance

What this chapter covers

This chapter carries about 4 per cent of the III-C examination.

LEARNING OBJECTIVES: After studying this chapter, you should know about:

• Appointment of compliance officer by stock brokers.
• Role and Reporting structure of Compliance officer.
• Appointment of compliance officer.
• Responsibilities of compliance officers towards stakeholders.
• Compliance requirements under the SEBI (Certification of Associated Persons in Securities Markets) Regulations, 2007.

3.1.1 What compliance means

In general, compliance means conforming to a rule, such as a specification, policy, standard or law.

That general sense is the first review question — compliance primarily involves conforming to a rule, policy, standard or law. Record keeping, reporting and fraud prevention are how it is done, not what it is.

In the securities market it is more specific. The workbook puts it this way:

Four sources of obligation — SEBI, the exchanges, the depositories, and the firm's own board.

And the actions themselves: the set of actions include maintenance of records, adoption of policies and procedures, preparation of reports, taking actions and making submissions to the competent authorities.

3.1.2 The compliance officer

In short, the CO has two jobs. He monitors compliance, and he sees that investor grievances are redressed.

And the reach goes beyond SEBI: the compliance officer is also required to monitor the compliance of the rules, regulations and bye-laws of the concerned stock exchanges, or the Registrar of Companies, where applicable.

The phrase to remember: in other words, the compliance officer is the first line regulator and all regulations require the appointment of COs.

First line regulator — the regulator inside the firm, before SEBI ever arrives.

The international definition. In 2005, the International Organisation of Securities Commission (IOSCO) issued a discussion paper on 'Compliance function at Market Intermediaries'. It defined the compliance function as follows:

Five verbs in that definition — identifies, assesses, advises on, monitors and reports on — plus a sixth idea: checking whether there are appropriate supervisory procedures in place.

And note "on an on-going basis." Compliance is not an annual event.

3.1.3 Appointment

Under the SEBI (Stock Brokers) Regulations, 1992, a Compliance Officer is mandatorily required to be appointed.

Regulation 18A:

(1) Every stockbroker shall appoint a CO who shall be responsible for monitoring the compliance of the Act, rules and regulations, notifications, guidelines, instructions and so on, issued by SEBI or the Central Government and for redressal of investors' grievances.

(2) The Compliance Officer shall immediately and independently report to SEBI any non-compliance observed by him.

And under the SEBI (Intermediaries) Regulations, 2008 dated 26th May 2008, Regulation 14:

Which is the second review question — True, the Intermediaries Regulations do mandate the appointment.

Note the one exemption — an intermediary may not appoint a compliance officer if it is not carrying on the activity of the intermediary. A dormant registration needs no officer.

And the two reporting lines differ. Under 18A(2) the officer reports immediately and independently to SEBI; under Regulation 14(2) he reports to the intermediary or its BoD, in writing, any material non-compliance.

Both apply — the compliance officer may be appointed under other regulations also, apart from the Securities and Exchange Board of India (Stock Brokers) Regulations, 1992.

3.1.4 Scope and role

The CO shall be responsible for monitoring the compliance by the concerned intermediary with:

• The SEBI Act, 1992.
• The rules and regulations, notifications, guidelines, orders passed and instructions issued by SEBI or the Central Government.
• The rules, regulations and bye-laws of the concerned stock exchanges, or the Self-Regulatory Organization (SROs), where applicable.

The responsibility of the CO also extends to ensure redressal of investors' grievances.

Why the function matters: compliance looks into the different aspects of the culture and ethics of a market intermediary and is an important tool in managing the risk of legal or regulatory sanctions, financial loss, or loss to reputation resulting from the violation of regulatory requirements.

Three risks named — legal or regulatory sanctions, financial loss, or loss to reputation.

And a duty that looks outward as well as inward: the CO is responsible for monitoring the internal standards and policies put in place by the intermediary that also involves protecting the firm from any liability arising from false claims/abuses committed by its customers.

The reporting structure. The CO is appointed by an entity or its Board of Directors (BoD) to comply with the SEBI Act and regulations, rules and so on. As such, the CO is required to report to the BoD of the Intermediary. However, where there is a non-compliance of the provisions of the SEBI Act or the allied regulations and rules, the CO is required to report to SEBI immediately and independently any non-compliance of the intermediary.

Ordinarily to the board; on a breach, to SEBI as well, immediately and independently.

3.1.5 Independence

The gap between regulatory intent and compliance shall be minimal if there is a professional cadre of compliance officers in each organization of intermediaries. This is the rationale for the independent functioning of the CO, in any intermediary organization.

And the officer belongs in the room where policy is made: CO shall participate in the preparation of policies and procedures so that the internal affairs of the intermediary are aligned with the regulatory objective rather than business expediency in case of conflict between the two.

Regulatory objective over business expediency — the sentence that defines the role.

Which is why the reporting line is short. This necessitates the level of reporting by the CO to the BoD/owners and SEBI and other competent authorities. It frees the CO from elaborate internal reporting procedures and protocol with the delays and inadequate attention to compliance matters.

The banking parallel. RBI in September 2020 issued guidelines to Banks to set up an independent corporate compliance function headed by a designated chief compliance officer (CCO) selected through a suitable process with an appropriate 'fit and proper' selection criteria to effectively manage compliance risk.

Three protections in that guidance. The CCO should be appointed for a minimum fixed period of three years in the rank of a general manager or not below two levels of the rank of CEO. And a CCO "may be transferred/ removed before completion of the tenure only in exceptional circumstances with the explicit prior approval of the board after following a well-defined and transparent internal administrative procedure".

A fixed tenure, a senior rank, and protection from removal — the three things that make independence real rather than nominal.

3.1.6 Reporting responsibility

It is the duty of the CO to immediately and independently report any non-compliance observed to the BoD of the intermediary and SEBI.

Two kinds of reporting:

Mandatory reporting: Periodic submission of reports as per provisions of regulations.

Critical Reporting: CO must immediately and independently report to SEBI and BoD any non-compliance observed.

The distinction is the third review question. Routine submissions — books of account, the sauda book — are mandatory reporting, made because a regulation says so on a calendar. Money laundering activity is critical reporting, made at once because something has gone wrong.

And a third duty sits alongside: Coordination with the Regulators - The Compliance Officer is responsible for all the compliances under various laws. The coordination with the regulators under each law applicable to the entity is an important role of the Compliance Officer.

The four duties under Regulation 12

As given under Regulation 12 of the SEBI (Intermediaries) Regulations 2008, the intermediary is required to:

(1) Provide SEBI with a certificate of its compliance officer on the 1st April of each year certifying:

a) the compliance by the intermediary with all the obligations, responsibilities and the fulfilment of the eligibility criteria on a continuous basis under these regulations and the relevant regulations;

b) that all disclosures made in Form A and under the relevant regulations are true and complete.

(2) Prominently display a photocopy of the certificate at all its offices including branch offices.

(3) Prominently display the name and contact details of the compliance officer to whom a complaint may be made in the event of any investor grievance.

(4) Maintain books, accounts and records as specified in the relevant regulations.

1st April each year for the certificate — and note that limb (a) certifies compliance on a continuous basis, not merely on the day.

Duty (3) is the investor-facing one — the officer's name and contact details must be on display, so an investor knows whom to complain to.

3.2 The CAPSM Regulations, 2007

The SEBI (Certification of Associated Persons in Securities Markets) (CAPSM) Regulations, 2007, Regulations 7 and 8, delegates the following powers and functions to the National Institute of Securities Markets (NISM):

(a) The functions of NISM in respect of certification for associated persons in the securities market shall include putting in place and implementing the certification process, procedure and policies.

(b) NISM in consultation with SEBI may lay down standards. These standards may do two things:

Note limb (ii) — non-compliance disqualifies a person from being employed or engaged or continued to be employed or engaged. Certification is a condition of the job, not a credential to collect.

3.2.1 The obligation

Regulation 3... provides that SEBI may by notification in the official gazette require such categories of associated persons to obtain the requisite certificate for engagement or employment with such classes of intermediaries and within such time as may be specified.

A transitional rule protects existing staff: an associated person employed or engaged by an intermediary prior to the date specified by SEBI may continue to be employed or engaged by the intermediary if he obtains the certificate within two years from the said date.

Two years for those already in post.

And no duplication: an associated person, who as on the date specified by SEBI, holds a certificate for a category as recognised by SEBI shall not be required to obtain a fresh certificate for the same category during the validity of such certificate.

Six factors decide who needs certification. SEBI considers:

(a) whether the associated person, as part of his work or operation, deals or interacts with the investors, issuers, or clients of intermediaries;

(b) whether the associated person deals with assets or funds of investor or clients;

(c) whether the associated person handles redressal of investor grievances;

(d) whether the associated person is responsible for internal control or risk management;

(e) whether the associated person is responsible for compliance of any rules or regulations;

(f) whether the associated person is engaged in activities that have a bearing on operational risk of the intermediary.

The thread running through all six is contact with investors' money, information or protection — client interface, client assets, grievances, controls, compliance and operational risk.

And limb (e) is why the compliance officer is himself a certified person.

3.2.2 How the certificate is obtained

Three classes of person, with three different routes.

A Principal may obtain the certificate in any of the following methods:

• (a) Passing the relevant certification examination, as may be specified by NISM.
• (b) Successfully completing a related CPE Program, as may be specified by NISM.
• (c) Delivering at least four sessions in a specific CPE program, as may be specified by NISM.

A Principal is a person who is actively engaged in the management of the intermediary's securities business including supervision, solicitation, conduct of business. A principal includes: a) Sole Proprietors, b) Managing Partners and c) Whole Time Directors.

A person other than a principal, who has attained 50 years of age or who has 10 years of experience, may obtain the certificate by any of the following methods: (a) Passing the relevant certification examination... (b) Successfully completing a related CPE Program.

All other persons may obtain the certificate by the following method: (a) Passing the relevant certification examination, as may be specified by NISM.

So the ladder narrows. A principal has three routes; a senior or experienced person has two; everyone else has one — the examination.

And note the teaching route is open only to a principal — delivering at least four sessions in a specific CPE program.

3.2.3 Validity

The certificate given under regulation 3... is valid for 3 years from the date of the grant of the certificate or revalidation as the case may be.

Three years — the fourth review question.

Renewal: upon the expiry of the validity of the certificate possessed by the associated person, the certificate shall be revalidated for 3 years provided the associated person successfully completes a programme of continuing professional education as specified by NISM.

And the consequence of lapse is a bar on working: no associated person engaged in any of the activities mentioned in clauses (a) to (f) of sub-regulation (4) of regulation 3 shall continue to be so engaged unless such a person holds a valid certificate as specified by the Board.

3.2.4 Continuing professional education

Upon expiry of the validity of the certificate possessed by an associated person, the certificate may get revalidated. The associated person must complete one of two routes:

Two routes, and both must be completed before expiry — the CPE programme within the 12 months preceding expiry, or the examination before the expiry of the existing certificate.

**And: the certificate will be revalidated for three years from the date of expiry of the existing certificate.

From expiry, not from the date of the programme — so early completion does not shorten the new term.

The revalidation routes mirror the original ones, with one change.

A Principal may get his/her certificate revalidated by passing the examination, completing a CPE programme, or delivering at least four sessions in specific CPE program.

A person other than a principal, who has attained 50 years of age or who has 10 years of experience, may do so by passing the examination or completing a CPE programme.

All other persons may get their certificate revalidated by any of the following methods: (a) Passing the relevant certification examination... (b) Successfully completing a related CPE Program.

Note the difference. For a first certificate, everyone outside the two privileged classes must pass the examination. For revalidation, they too may use a CPE Program.

And the annexure lists the details: Annexure 1 at the end of the workbook details the various SEBI mandated NISM certifications and the associated persons they are mandated for.

The chapter's review questions confirm four answers. Compliance primarily involves conforming to a rule, policy, standard or law. It is True that the SEBI (Intermediaries) Regulations, 2008 mandate the appointment of a compliance officer. Money laundering activities fall under critical reporting. And a CAPSM certificate is valid for 3 years.