Home > News & Insights > Insights & Publications

1/15/19 - The Evolving Role of the First Line of Defense in Managing Conduct Risk in Wholesale-Markets Businesses

In recent years, the wholesale-markets and banking divisions of financial institutions have faced myriad conduct violations that, with more effective internal supervisory programs, could have been detected earlier or avoided altogether. Examples include the manipulation of benchmarks in interest-rate and foreign-exchange markets, insider trading and other forms of market abuse, and the mis-selling of a variety of structured products. As a result, regulators are increasingly focusing on the ability of senior management to manage conduct risk within their businesses, which requires the development and maintenance of processes to supervise business activities and employee conduct. The senior-managers regime in the U.K., the managers-in-charge regime in Hong Kong, the recently introduced banking-executive accountability regime in Australia, and the rules promulgated by U.S. self-regulatory organizations provide the regulatory basis for supervision and give regulators significant authority to take action against firms or individuals who fall short of their expectations.

To meet regulatory expectations, firms are increasingly emphasizing the responsibility of business units — the first line of defense1 — for managing conduct risk. While the traditional second-line risk and compliance units must retain their oversight and design roles for the risk management framework, firms recognize the benefit of positioning the execution of key controls for specialized activities as close to the source of risks as possible. The unique features of wholesale businesses require control staff to have a deep understanding of trading, sales, and portfolio-management activities. Employing such staff in control execution, under a well-designed supervisory framework and with appropriate oversight from second-line functions, can significantly increase the effectiveness of conduct risk management programs.

Some of the largest investment banks have been the vanguard of this risk management trend, establishing formal first-line control units headed by a chief controls officer or equivalent. However, this approach is a more recent development among asset managers and other buy-side institutions. For example, as a response to the introduction of the senior-managers regime in the U.K., asset managers are in the early stages of establishing first-line supervision. Globally, however, asset managers and other buy-side institutions remain far behind in designing and implementing formal first-line control units. 

Clearly Defined Roles and Responsibilities 

Clearly defining roles and responsibilities in first-line control units, particularly in relation to those of the second line, represent the biggest hurdle to effective implementation. The responsibilities of first-line control units differ widely from firm to firm, and there is a wide variation in the particular risks and control processes such units oversee. 

As noted above, establishing a first-line control unit does not preempt the need for robust and independent second-line functions. However, the first-line control unit may undertake control activities traditionally executed in whole or in part by the second line. For example, given the relative volume or complexity of certain transactions, some aspects of trade surveillance, such as order-book monitoring, may be more effectively undertaken by a first-line control unit. Similarly, a first-line control unit may be better placed to review front-office communications. Although second-line monitoring of these activities is still required, an effective first-line control unit allows a firm to leverage the specialized knowledge and skillsets that already exist within the institution.  

Reallocating these control activities can pose organizational and change-management challenges. Poor process design and a lack of coordination across first- and second-line control units may result in duplication or gaps in the monitoring and oversight process. For that reason, firms implementing or enhancing first-line control units will benefit from clearly defining and communicating expectations for first- and second-line control activities. Clearly delineated roles and responsibilities may also help firms identify cost and process efficiencies. 

Tools, Technology, and Management Information

The Fixed Income, Currencies, and Commodities Markets Standards Board, through its periodic statements of good practices, recommends that “firms should provide their supervisors with sufficient tools and information to enable them to carry out their supervisory duties and supervisors should satisfy themselves that they have the right tools and data to discharge their duties.”2 In light of surging transaction volumes, large amounts of available data, and an array of new communication channels, manual first-line control processes are insufficient for most large financial institutions. As regulatory expectations and industry practices evolve toward more real-time surveillance, the first-line control unit must be able to process large quantities of data — including unstructured communications data — quickly. Unfortunately, many of the tools that support front-office supervision are limited and require manual intervention. 

The scale and complexity of a firm's wholesale businesses are key drivers of the tools — such as e-communications and voice surveillance — and management information needed to support internal supervisory programs. The initial selection and ongoing enhancement of these supervisory tools, especially those used for surveillance, are common challenges for firms. Existing surveillance technology is generally inefficient. For example, despite some advances in the application of artificial intelligence to communications surveillance, many firms remain dependent on lexicon-based searches, which produce a high volume of false-positive alerts. In addition, these alerts represent only one input to the supervisory picture. Firms also seek to incorporate trade surveillance, voice records, and deviations from unique or identifiable patterns of behavior in front-office personnel when evaluating whether pointers to potential conduct violations should be further investigated. 

In some cases, the first-line control unit may be able to leverage existing systems; however, firms should also assess whether the first-line control unit needs additional tools. For instance, first-line control units often directly oversee the tracking and remediation of issues. For the unit to perform this duty effectively, a firm may need to provide it with access to enterprise governance, risk management, and compliance systems — access that will allow the unit to efficiently leverage existing management information and repurpose certain data elements to support supervision (e.g., sales data).

In addition, effective first-line control units seek to develop bespoke management information, such as historical trading volumes or communication patterns for individual traders, that may assist with ongoing oversight of businesses. Management information should be designed to enable senior management to identify issues on a timely basis, understand any wider trends across the business that may cause concern, and identify business areas that may require additional attention. 

Appropriate Skills and Resources

In addition to the challenge of determining the number of personnel required in first-line control units, firms can struggle to identify the appropriate array of skills for staffing the function.

Required skills will vary, depending on the unique characteristics of a firm’s businesses. Effective first-line control units require skills commonly found among employees with front- and middle-office backgrounds, i.e., staff that have experience with business activities. In some cases, firms may be able to reallocate current front- and middle-office resources to the first-line control unit. However, reallocated employees (especially reallocated front-office employees) may have different expectations for compensation packages than those generally provided by financial institutions to employees in control units. As necessary, firms may want to engage human resources to determine an appropriate compensation package to encourage certain employees to move to the first-line control unit. 

Firms must also determine whether they have individuals who understand the operation and output of surveillance tools. A skill gap in this area may result in a failure to identify key issues on a timely basis, or to investigate an issue. Regulators have also become interested in firms’ supervisory skillsets. For example, the U.K. Financial Conduct Authority is working with multiple firms to assess the effectiveness of buy-side trade surveillance and compliance with the European Union’s Market Abuse Regulation, which calls on firms to focus significant resources on the implementation and use of surveillance tools.

Even firms with skilled first-line control units are facing personnel constraints. Using offshore or nearshore resources to support surveillance, monitoring, and the reporting of management information can help reduce costs, as the manual nature of these processes requires significant headcount. Some firms choose to leverage offshore or nearshore resources to perform cost-effective first-level alert reviews. However, placing such activities in remote locations risks losing the benefits of business proximity and knowledge that are among the key drivers of establishing control units in business lines in the first place.  

Enhancing an existing supervisory framework and developing a first-line control unit are not easy exercises. As regulatory scrutiny of internal supervisory programs and board expectations for supervision increase, firms should assess the effectiveness of their first-line control units and consider whether enhancements are necessary.

How Promontory Can Help

Promontory Financial Group, an IBM Company, helps financial institutions develop and enhance their first-line control units, ensuring that their mandates address particular activities and risks. We also advise clients on the design and implementation of appropriate supervisory controls — including effective surveillance and the appropriate use of systems and technology — and we help firms establish and maintain frameworks for supervising employee activities and ensuring compliance with applicable laws and regulations.

Contact Us

Munib Ali
Managing Director
+44 203 900 9803

Anthony Murphy
Managing Director
+1 212 542 6713

Michael Sullivan
Managing Director
+1 202 370 0507 


  1. The first line of defense includes the functions that own and manage risks, such as the front office. 
  2. Front Office Supervision,” FICC Markets Standards Board (September 2017).