OR 14 – Investor Protection and Compliance Risks in Investment Activities

Investor protection is the body of law and regulation whose purpose is to make sure that people putting money into financial products understand what they are buying at the moment they transact. Both the European Union and the United States run comprehensive regimes of this kind, and a firm active in either region needs risk assessments and controls strong enough to keep breaches rare. The stakes are high, because several of the largest settlements and penalties ever paid by banks and investment firms trace back to failures in this area.

The protection reaches further than disclosure. It shields investors from misrepresentation by intermediaries and institutions, creates accountability when fraud or insider trading occurs, and gives regulators and law enforcement in different jurisdictions a basis for working together on suspected fraud. Firms must also run strict know-your-customer (KYC) checks so that money entering their products does not come from a doubtful source, which is why investor protection rules and anti-money laundering (AML) legislation are closely linked.

Where it sits in the Basel taxonomy

A failure to comply with financial laws and regulations is usually recorded under the fourth Basel event type, Clients, Products and Business Practices (CPBP), and investor protection breaches normally land in one of two of its subcategories.

The Markets in Financial Instruments Directive (MiFID, Directive 2004/39/EC) was adopted by the EU in 2004, took effect across the Union in November 2007, and became one of the central pieces of EU law for market activity, built around a high level of protection for investors. It set conduct of business and organisational requirements for investment firms, laid down how regulated markets are authorised, imposed regulatory reporting and trade transparency obligations aimed at preventing market abuse, and governed which instruments could be admitted to public trading. MiFID applied from 2007 to 2018.

Why MiFID was revised

The 2008 financial crisis showed that investors needed firmer protection and that the rules had to keep pace with new trading venues and activities. So, in June 2014, the European Commission approved a replacement package in two parts: a revised directive, MiFID II, and a regulation, the Markets in Financial Instruments Regulation (MiFIR). Besides tightening investor protection, the package required firms to publish more trading data and to report transaction data to regulators and supervisors.

The split matters because an EU regulation applies directly in every member state, whereas a directive must first be written into each country’s national law, and each country may make its version stricter, but never weaker.

What the MiFID II package tightened

The revised framework reaches into how firms pay their staff and how they sell. It covers trader and advisor remuneration and conflicts of interest, fair and non-misleading communication with customers, the definition and independence of investment advice, product governance and the sales process, best execution of client trades, and dealings with eligible counterparties.

The US counterpart is the Investor Protection Act, one component of the wider Dodd-Frank Wall Street Reform and Consumer Protection Act. The bill was introduced in Congress in 2009 and signed into law in July 2010 as a response to the 2007 financial crisis, with the aim of preventing a repeat.

The act created a committee to advise the Securities and Exchange Commission (SEC) on regulatory priorities for new products, fee structures and trading strategies, and it strengthened protection for whistleblowers. It also reaches over the counter (OTC) derivatives: oversight of that trading is split between the SEC and the Commodity Futures Trading Commission (CFTC), and firms dealing in derivatives must now use clearinghouses. Other parts target system stability, adding federal oversight, a Financial Stability Oversight Council and a reorganised regulatory structure.

A compliance breach committed on purpose is an unauthorised activity and therefore a form of internal fraud, so most internal fraud controls also work against deliberate breaches. Breaches that are not deliberate usually come from human error or flawed policies. Because intent is the only real difference between an error and a fraud, most anti-fraud controls catch errors too. Deterrent controls are the exception, since the threat of punishment cannot discourage a mistake nobody meant to make.

The general drivers of compliance breaches and market abuse largely match those of internal fraud: weak staff engagement, dissatisfied or stressed employees, business units given too few resources, and a weak ethical culture. Market activity adds three drivers of its own.

• Information asymmetry. Retail investors usually know far less about a product than the bank or asset manager selling it.
• Conflicts of interest. A trader dealing both for client books and for the firm’s proprietary book can favour the firm at the client’s expense.
• Economic conditions. A volatility spike raises transaction volumes, so errors become more frequent and abnormal trades or insider dealing are easier to bury.

Effective controls include supervising and monitoring both staff and trades, robust middle-office and back-office functions, sound policies and procedures, staff training, and an ethical culture, which holds only if onboarding, screening and training of employees and third parties are applied consistently.

US records show that investor protection violations produced nearly $82 billion in fines and penalties between 2000 and 2022, spread over 6,612 penalty records (data from Violation Tracker). The largest single penalty, $11.15 billion, fell on UBS in July 2008. Settling litigation brought by several states, UBS had to repurchase $11 billion of securities and pay $150 million in penalties for selling auction rate securities as safe, cash-like products while their liquidity risk was rising.

Spoofing: JP Morgan

Spoofing means placing orders and cancelling them quickly to fake demand, so that prices move in the trader’s favour, and it breaches investor protection law. The largest spoofing fine is the $920 million the CFTC imposed on JP Morgan in September 2020 for spoofing in precious metals and US Treasury markets. The order, covering JPMorgan Chase & Company and two subsidiaries, found manipulative and deceptive conduct lasting at least eight years with hundreds of thousands of spoof orders. Such practices were once treated as normal, which shows how far expectations have moved.

Best execution: Deutsche Bank Securities

FINRA, the Financial Industry Regulatory Authority, is an SEC-overseen body that regulates US brokerage firms in the interest of investors and market integrity. Its Rule 5310 requires firms to seek the most favourable terms reasonably available for a customer order, judged on criteria including price improvement and speed of execution.

From 2014 to 2018, unless customers opted out, Deutsche Bank Securities sent orders through an extra step in its smart order router, the SuperX ping, before any part reached an exchange. The detour delayed market orders and lowered fill rates, leaving more orders partly filled or unfilled. The firm knew this yet neither changed the arrangement nor checked whether direct routing would give customers better prices. Its reports mentioned trading rebates only vaguely, with no amount per share or per order, and nothing showed rebates reaching the customers entitled to them. FINRA fined the firm $2 million, settled without admitting or denying the findings.

Where a firm keeps a non-compliant practice running apparently for profit, regulators tend to set a punitive fine that more than wipes out the gain. The fine deters repetition and signals to peer firms that they should review their own processes and monitoring.