The Commodity Futures Trading Commission updated its enforcement manual last week for the first time in 26 years, with a heap of attention paid to the importance of corporate compliance programs when firms are looking to reduce potential monetary penalties.
The update, published as a four-page memo from the CFTC Enforcement Division on May 20, says enforcement staff “will take into account… the gravity of the violation, any mitigating and aggravating circumstances, and other considerations.”
Two of those mitigating factors: efforts to improve the corporate compliance program after a violation of CFTC regulations; and the existence and effectiveness of the company’s compliance program before any violations occurred.
“Transparency in our procedures, and in particular how we think about penalties, promotes fairness and enhances respect for the rule of law,” CFTC enforcement chief James McDonald said in a statement released along with the update. “Ultimately, we want our enforcement program to change behavior in a positive way. Explaining how and why we punish is a significant part of that effort.”
This enforcement update shouldn’t be a surprise. CFTC chairman Heath Tarbert promised last December that the agency would take measures to be more transparent about how and why it does what it does, and last week’s update is the latest step along those lines.
Plus, the policy itself is the same sort of move we’ve seen from the Justice Department, the Securities and Exchange Commission, and other corporate conduct regulators during the Trump Administration: a shift toward more leniency for companies that have an effective compliance program by the time an enforcement matter is resolved, and even better treatment for companies that had a compliance program in place before a specific incident of trouble happened. The only thing unique about the CFTC’s update is the actual law it’s enforcing: the Commodity Exchange Act.
All the CFTC Factors
The CFTC listed eight factors that might count as aggravating or mitigating factors when deciding penalties. They’re worth considering in full:
- Mitigating conduct, such as attempts to cure, return of victim funds, or efforts to improve a compliance program
- Aggravating conduct, such as concealment or obstruction of an ongoing investigation
- Whether the company self-reported the misconduct, as well as the extent of cooperation and remediation, as detailed in the Division’s Enforcement Advisories
- Timeliness of remediation
- Existence and effectiveness of the company’s pre-existing compliance program
- Prior misconduct, such as whether the company is a recidivist
- Pervasiveness of misconduct within the company, including responsibility of management
- Nature of any disciplinary action taken by the company with respect to the individuals engaged in misconduct
Take them altogether, and it’s clear that a company really needs — cliché alert! — a culture of compliance, complete with sufficient resources and corporate will to achieve compliance program objectives.
For example, you can have a compliance program that looks great on paper, replete with well-crafted policies and whiz-bang internal reporting systems. But if the company is a repeat compliance offender, or senior executives are involved, or the firm waits for the CFTC to order restitution to victims — that’s not a commitment to compliance. That’s a commitment to doing the bare minimum.
Conversely, when we look at factors like timeliness of remediation, decisions to self-report misconduct, or efforts to understand compliance failures and fix those weaknesses — you can’t take positive steps like that unless the company wants to practice what the compliance program preaches on paper. You can’t take those steps without senior executives who support what “culture of compliance” really means.
That’s a point worth emphasizing when speaking with senior executives or the board about compliance program resources. (Especially in the commodities world, where lots of firms are on the smaller side and have, shall we say, immature compliance effectiveness.) What does the CFTC want to see from its regulated firms, if they want to avoid harsh penalties? It wants to see that those firms take compliance seriously, in word and deed.