Where these actions come from
Compliance actions can come from federal agencies, state regulators such as the New York Department of Financial Services, state attorneys general, or self-regulatory bodies like FINRA. They often start with an examination, a customer complaint, a data incident, or a referral, and they may escalate from informal requests to subpoenas, formal investigations, and enforcement proceedings. Resolutions range from closing the matter without action to consent orders with penalties and remediation plans, and sometimes an independent monitor or consultant. The questions under review usually concern whether controls were designed and followed, whether problems were identified and escalated, and how the company responded once it learned of them.
Records and preservation
Once an inquiry begins, issue a legal hold covering emails, chats, policies, testing records, and system data relevant to the subject. Collect the policies that were in effect at the relevant time, not only the current versions, along with audit reports, board and committee materials, and remediation records. Communications with the regulator should run through a single coordinated channel, since statements made in early meetings can shape the whole matter. Employees who are interviewed should understand whom counsel represents. Do not alter or backdate documents to make the record look better; that can create a separate and more serious problem.
Strategy before the first meeting
Early decisions include whether to conduct an internal review, whether to self-report related issues, how to approach remediation, and how to communicate with the board, auditors, and, for public companies, investors. Regulators often publish guidance describing what they credit, such as cooperation and timely remediation, and that guidance changes over time. We begin by understanding which agency is involved, what it has asked for, and what the company already knows. From there we plan a response that addresses the regulator's concerns while protecting privilege where it applies. If the agency proposes settlement terms, the wording of any admissions and the scope of required remediation deserve as much attention as the penalty.
