Leading Practices in Treasury: Compliance and Leveraging Networks

Speaker A: Hello and a warm welcome to the open Treasury Podcast. Your go to source for the latest news and analysis in corporate cash and treasury management. This show is brought to you by ctmfile.com and the Treasury News Network where Treasury professionals learn and share the information that matters most. You are listening to the fifth episode of the six part Leading Practices in Treasury Podcast series. This series draws from the second ebook in the professional development series produced by Strategic Treasurer, a well known treasury consulting firm and CTM File, a trusted source of corporate treasury news. The ebook, also titled Leading Practices in Treasury, offers actionable insights and guidance in into some of the most vital areas of the treasury function. We invite you to download the ebook or uh, listen to the audiobook by visiting strategictreasurer.com this podcast series highlights key themes from the ebook. In this fifth episode we focus on two topics, compliance and leveraging networks. I'm Pushpendra Mehta, your host. Joining me today is Paul Galloway, Senior Director of Advisory Services at Strategic Treasurer. Paul, it's a pleasure to have you back. We appreciate you taking the time to offer your valuable insights.

Speaker B: I uh, always love doing this push.

Speaker A: Thank you Paul. Paul treasury is expected to wade through a continual stream of regulations that brings with it compliance risks and challenges. To start us off, is compliance really important to Treasury?

Speaker B: Absolutely it is. Regulations are put in place to mitigate systemic risks. Systemic risks are impacts to financial systems. This may be an interruption or a, uh, total failure. So it could be either of them. When it comes to systemic risk, these tend to be things that can be mitigated. There are some things that can't be. So the focus needs to be on these risks that you have control over, not the risks that you don't have the ability to control. And regulations typically are in place to help manage those particular risks. So treasurers are often focused on security of their organization. As the superintendent of payments, they set the standards for payment security. As part of managing these risks, treasurers need to maintain compliance to void regulatory fines. So some examples of what those would be like would be I'm just going to throw out one FBAR filings, foreign bank and financial accounts. If you fail to file, there are penalties associated with that. So you want to make sure that you're following what the regulations are saying or put in place. They're put there for a reason. You don't have to like them, you just need to make sure that you comply with them and you do what's stated within the regulation that will help you mitigate some of these risks. That you do have control over. You know, as a treasurer of an organization, I like sleep insurance and I think of regulations in many ways are a way to provide sleep insurance to treasurers.

Speaker A: That's a very useful explanation Paul. It helps set the stage for a deeper look into how compliance plays out in day to day treasury operations. What are the key compliance areas treasurers are most concerned with?

Speaker B: Yeah, so I kind of threw out an example. I'm going to go through in detail different areas. EPBAR is one of them. I'm going to start with know your customer. Anybody that deals with banks deals with kyc. Sometimes it's painful. The information that banks ask for is not consistent necessarily. Some banks ask for a lot more than others. There is a minimum standard that they have to comply with. For know your customer. Every one of them is going to ask for generally the same items. The things that they have to. Sometimes they may ask for more, maybe they're just a little more risk averse than others. But typical areas for KYC are formation documents of an organization, key stakeholder information, typically like C suite executives or anybody that has control of or influenced on a payment process where they're approvers. Then maybe they own a certain percentage of the business that gives them some level of control that needs to be known. That type of information needs to be provided to your bank that's requesting kyc. Corporate resolutions often requested as well, proof of business address where the business is legally established. It may be in some instances a uh, different location than where you actually are working for that company. And then sometimes they ask for financial documents. And so these are typical things that they ask for. For kyc. There could be additional items that are requested by your bank, but you need to comply with the KYC requirements. One of the other areas is foreign bank and financial accounts. Fbar, uh, talked about this earlier. If you have foreign bank accounts, you're required to complete annual filings reporting for any of these foreign bank accounts that holds $10,000 or more at a given time within a year. And so what they're required to provide typically are the account holdings, the account signers, the names of people, Social Security numbers, tax identification numbers and the address of all the account holders. Sometimes people don't like that. But, but this is what the requirement is. You have to provide it, you have to comply. Non compliance can lead to fines. So you want to make sure you do what they're asking. A newer one that uh, has come out recently is the beneficial ownership information or boy. Boy was supposed to be enacted towards the End of last year there was a delay, but I think right now it's in a voluntary status. But it will be something that is going to be a requirement for organizations. It requires them to provide data, not only data, but data and file paperwork for the organization and individuals that financially benefit from ownership in the company. Who owns it, who controls it. It typically focuses on creating more transparency. Reporting is managed by FinCEN or Financial Crimes Enforcement Network. It requires the organization to provide beneficial ownership in terms of one the company, what the legal traded name is, the address, the tax identification number, the jurisdiction in which the company resides. And then for the owner side it requires the legal name of the person, the date of birth, the address and ballot identification number. And so boy is something that's relatively new and something that organizations need to be aware of because it's new and you need to comply with this particular regulation. Another area I wanted to talk about was payment screening. And a lot of organizations are familiar with OFAC and sanctioning your banks do this quite often for you. Treasury aggregators can do this. So there are third parties that can help you with the screening. There are services that can also help you with screening. But what it's designed to do is to ensure that payments aren't going to criminals or terrorists. That's the real reason behind the OFAC and sanctions checks. Historically there have been companies that have been heavily fined for not complying or just being negligent in terms of these checks. The screening part. So you want to make sure that you're in compliance here. You don't want to be fined, you don't want to be a headline news, hey, my organization just got dinged for not doing OFAC sanctions checks and we have funds that went to criminals and terrorists. Nobody wants that. So you need to make sure you're doing your payment screening, utilize your banks, utilize third party services as a need be. If you have a Treasury aggregator, like I said, oftentimes they also can do that for you. Another area is security and controls. So payment networks help reduce the risk of fraud because it requires everybody that participates in the network to meet certain security requirements. An example of that is the Swift Code Customer Security program or csp. Swift has a program that requires participants in the Swift network to comply with these specific security payment security requirements. So that is one area. Another area that companies often touch would be around card payments. So PCI DSS tied to credit cards and the retention of customer information by an organization. So it requires security measures that the company needs to comply with. There is an Annual compliance check that an organization has to do. There's different levels depending on whether the information is stored on your company's server, where other information is stored, or if that's completely separate and segregated from anything else and is not tied to an outside network of any kind, meaning it can't be accessed by the Internet or anything else. Oftentimes you find companies that will have just like a, uh, dedicated server that that's all it does, or they hire third party services to manage that for them so that they don't have to worry about it. The burden of PCI DSS can be quite substantial if you're saving customer data and information on a server that's utilized by other areas within the company. So this is something you really want to keep an eye on.

Speaker A: Well, Paul, thank you for breaking that down so well. In order to effectively carry out compliance activities and stay updated on changes in the regulatory environment, it's important to assign clear responsibilities. Paul, what does compliance responsibility look like in practice?

Speaker B: Yeah, so think about it from the individual perspective. Your people within the organization that are tied to the payment process and need to understand what their duties are. They need to comply with any existing regulatory requirements in how you effectuate transactions, save information, document what is being done and that you're complying with the regulations. You're doing what regulations require you to do. They also need to be able to track new and potential regulatory changes. It's constantly changing over time. New regulations are introduced, older regulations are abandoned or enhanced. So you need to be up to date on, um, what is going on from a regulatory standpoint. You need to monitor whether the company is meeting the requirements by the regulatory body. Do they have existing policies, controls, risks, processes and standards that help them comply? Your people need to understand what those are and they don't have them. They should have them in place. There are some organizations that don't have existing policies and we find this from time to time doing assessments for clients where, you know, there's lacking that guiding document, that policy that helps set the tone for what they should be doing. We help organizations write those policies so that they have what's in place, what's needed to stay in compliance and to help mitigate risks within the organization. Those controllable risks we talked about earlier. Also, you need to make sure that you report on any violations that's documented, if violation happens, that's communicated to everyone that's tied to the payment process, and that you work with your person or people within the company that have fallen short from a regulatory Compliance standpoint, help educate them, get them up to speed so it doesn't happen again. You also want to prevent duplications. You don't want to do the same thing more than once. It's inefficient to do that. If it's being done in one place, it shouldn't be done somewhere else. Oftentimes what happens within organizations, if they're not speaking to each other, they tend to be doing something in one spot and the same thing in another. Neither one of them is aware that the other is doing it and the whole time they're in compliance, but they're two different areas that are doing it and they may be doing it differently. And so you want to make sure that you're not duplicating and that you have one area that's handling that. Going through this process to establish clear responsibilities not only prevents that duplication, but also enables separation of risk ownership so that the risks are residing with the right party within the organization to effectively manage it.

Speaker A: So Paul, once responsibilities are defined, maintaining alignment and oversight becomes crucial. In this context, are regular, uh, compliance meetings important? If so, what should be addressed?

Speaker B: Yeah, regular compliance meetings are important. So they should hold them at least quarterly or no less than semiannually. Individuals within an organization have compliance responsibilities, have to report on them. They need to establish what their progress is, need to share new information or concerns that come up. These meetings serve as a platform so you can address any compliance issues. Make sure that people clearly understand what needs to be done, why it needs to be done, and what the ramifications of not doing it are, because it does have an impact to the company. And if you help them understand why it, uh, needs to be done, you'll get better buy in. This platform also allows you to increase the understanding. You can also gather feedback from people. You can find a way perhaps to monitor, manage some of the compliance of these regulations through feedback with the people, people in your organization, they might be able to say, hey, I think I know a way that we can do this where it's not all manual, that some of this is automated. You can probably have some parts are automated, some are going to have to be manual checks. It's just part of compliance. It's the way it works. You have documentation to complete and fill out it's manual, at least typically it is. Some things can be online, but a lot of times there's forms that you're completing. It also gets your leadership to feel comfortable and to commit to what needs to be done within the organization to Be compliant. So going through these regular meetings I think is a crucial part or aspect to ensuring that the company is meeting what regulatory or governing bodies are saying you should be doing and keeping the company in compliance, avoiding fines and mitigating risks.

Speaker A: Paul, you made some great points. Uh, compliance is an increasingly complex and diverse area of business activity and it should be intentionally managed. Treasury is advised to remember that compliance can even be a driver of sustainable corporate growth and long term competitive advantage. Let's now shift our discussion from compliance to leveraging networks. Treasurers use networks to access their domestic, regional or global cash balance information in a centralized, reliable and secure manner. They also access networks for investment, debt and hedge related information. Paul, what factors impact the benefit of a network?

Speaker B: Well, typically they think of it in terms of reach and functionality. In uh, terms of impacts, leveraging networks can bring significant benefits to an organization. Two factors that typically impact the benefits are reach, which you can think of in terms of the number and type of participants on the network, and functionality. What participants can use the network for, what it does. Both are needed and need to be considered when assessing the value of a network and what it brings to your organization. So understanding reach functionality needs helps you understand and evaluate and ensure that you're getting the best for your company.

Speaker A: Ensuring that you get the best for your company. That's well articulated, Paul. I completely agree. Understanding these factors is key to fully leveraging the strategic value need networks can bring to treasury operations. Paul, networks are an essential requirement for corporate treasurers to achieve visibility and resiliency of their financial processes and information. Why is resilience important for networks?

Speaker B: When we think about it in terms of treasury, uh, tie it back to payments and sometimes you have to have payments are done in a very timely manner. It could be that they're mission critical to the organization to get payments out. If networks are down and systems aren't working, you may not have the ability to effectuate a transaction as you need to. Now this could be the internal systems, it could be your treasury systems that you have, it could be bank portals. You have to have redundancy. So we think of that in terms of financial networks. Carry your payment data and other confidential information. There should be a high standard held to how it's handled and how you effectuate these transactions. So you want to make sure you have strong payment security measures in place. A, uh, network is only going to be as secure as your participants. So the participants have to be in compliance with the payment security factors, not going outside of what the payment processes are. The procedures that are in place, not have the ability to maintain segregation of duties, dual controls. You need to have these things in place so that participants are engaged in the right activities. A, uh, network may have security requirements. We talked about Swift earlier in the CSP program. You need to be in compliance with those requirements. If not, you can be kicked off the network. That could be a huge problem for a company that does a lot of payments through a Swift platform or relies on it for information reporting, which helps them with cash positioning and monitoring fraud perhaps. So it's really important that you comply with these security programs across the network. Your network needs to have high uptime measures. So you need to understand what the SLA is saying. What does your service agreement say? You know, is the downtime, they're down for no more than 60 minutes, down for no more than two hours, guarantee back up within X number of hours, four hours, six hours, I don't know what that is, but you know, downtime and understand what that is and what their service level agreement is saying that they are adhering to or going to comply to. It's really important to an organization, especially one that is effectuating lots of transactions or perhaps high value transactions across the network. So as a treasurer you want to have multiple levels of redundancy and failover. So if one thing fails, you have another option, another tool, another pathway to effectuate the transactions, execute on, on them while still maintaining payment security controls. So you need to ensure not only redundancy but also that the integrity or payment security process is maintained. This may mean that the redundancy or fail safe or high uptime measures may mean that, you know, it sits in a secure or separate network rather than on your mainstream Internet. So it's something that gets carved off. It's separate, it's housed or secured or protected from everything else that's out there.

Speaker A: Thanks Paul. That gives our, uh, listeners a great understanding of why resilience plays a central role in financial messaging networks. Paul, while resilience is vital, does uptime of a network matter?

Speaker B: Yeah, short answer is yes. We talked about the, you know, downtime, mitigating that risk before. You know, understanding what downtime is is really important. Having uh, redundancy is really important, but uptime is also really important. So when is it up? When is it down? Sometimes there's maintenance that needs to be completed. It could be that there's something that's going on with the network and they've got to make an update in the middle of the day. How is that communication coming through? Is Everyone aware of when downtime might be. You have transactions that need to go out the door within a timely manner. Understand that uptime is really important. So treasury, you know, overall is responsible for gathering accurate, timely and complete information. Can't do that if you don't know what the uptime is or your uptime is. I'm m doing this from this time to this time every day. This is when it needs to be up. Is it going to be up during that time? So it needs to be clear, it needs to be consistent. The data needs to be flowing within the appropriate times. It can make it really challenging for treasury teams to make decisions around cash positioning. If data is not coming in, that can really frustrate a Treasury team that's sitting there waiting to make decisions. But data is not coming in. Something wrong with the network, something wrong with the bank portal, something wrong with the treasury aggregator or the tms. All these different factors that come into play, it could be your own networks are down. It has nothing to do with accessing bank portals or tms or an aggregator or payment hub. The network is down, it's out of your control. The whole company's down. What do you do then? So uptime really matters to a Treasury team. Automation of generating that level of visibility requires the connections to the systems, to the banks, to the payment networks. Any one of those fail, then the payment flow fails. So you gotta understand all the connections from front end to back end. What we talked about in our prior podcast, we talked about that whole picture, that mindset of understanding front end to back end that comes into play here when you're considering or thinking about uptime of a network. Another thing to consider is also recovery of data, especially data that's critical to the organization or critical to an end to end process. It could have an impact on your company's cash flow, your ability to do the business that you do every day. So uptime, uh, matters quite a bit.

Speaker A: Well, Paul, to my mind, your insightful takeaway is extremely important and I think resilience and uptime need to work together to support Treasury's operational efficiency. We've reached the end of this episode. Paul, heartfelt thanks for your expert input to our audience. Thank you for tuning in. If you found value in today's discussion, be sure to subscribe and share this episode with your colleagues. We'll be back soon with more treasury focused conversations. Until then, keep growing and moving forward. Thank you and have a wonderful week. This podcast is provided for information purposes only and statements made by CTM file or guests on this podcast are not intended as legal, business or consulting advice. For more information, visit ctmfile.com.