In recent years, there have been ongoing occurrences of serious professional misbehavior, ethical lapses and compliance failures at financial institutions. This has resulted in a long list of large fines and penalties, and, to a lesser degree than I would have desired employee dismissals and punishment.

I reject the narrative that the current state of affairs is simply the result of the actions of isolated rogue traders or a few bad actors within these firms. As James OToole and Warren Bennis observed in their Harvard Business Review article about corporate culture: Ethical problems in organizations originate not with a few bad apples but with the barrel makers. That is, the problems originate from the culture of the firms, and this culture is largely shaped by the firms leadership. This means that the solution needs to originate from within the firms, from their leaders.

For the economy to achieve its long-term growth potential, we need a sound and vibrant financial sector. Financial firms exist, in part, to benefit the public, not simply their shareholders, employees and corporate clients. Unless the financial industry can rebuild the public trust, it cannot effectively perform its essential functions. For this reason alone, the industry must do much better.

In conclusion, if those of you here today as stewards of these large financial institutions do not do your part in pushing forcefully for change across the industry, then bad behavior will undoubtedly persist. If that were to occur, the inevitable conclusion will be reached that your firms are too big and complex to manage effectively. In that case, financial stability concerns would dictate that your firms need to be dramatically downsized and simplified so they can be managed effectively.

I want to observe that regulators can unwittingly reinforce what I have termed a mere compliance mentality. I would first note that the detail of many regulations means that attention to narrow issues of compliance is sometimes wholly understandable and, indeed, essential. Banks, like other regulated entities, need to be able to determine how a regulation actually applies to them. Beyond that kind of unavoidable focus on narrow compliance, however, management and line employees are more likely to adopt a mere compliance mentality where regulations appear to them to have been poorly drafted or implemented This is an outcome that regulators can avoid, and something with which the regulated firms themselves can assist by pointing out what they would regard as more sensible methods for achieving stated regulatory purposes.

Compliance-risk management can be more difficult for management to integrate into an organization's regular business processes because it often reflects mandates set out by legislation or regulation that the organization itself does not view as key to its success.

While all banking organizations should have a program in place to effectively manage compliance risk, these programs can vary considerably, depending on the size, complexity, and geographic reach of the banking organization and the inherent risks of its activities...Therefore, our supervisory expectations regarding an organization's risk-management program, and more specifically the scope of an examination, will vary according to the organization's size and complexity.

Federal Reserve examinations for compliance-risk management are not designed to be gotcha games in which examiners look for one-time breaches of specific regulations or laws. Rather, these examinations are designed to assess the adequacy of the structure and processes the institution uses for managing compliance risk. Examiners are expected to look for the bigger picture and to look at the effectiveness of the program (including policies and processes) for managing the organization's compliance risk.

Because compliance failures have touched many businesses, including banking, securities, and insurance firms, it has become clear that companies operating in more than one type of business must have a compliance strategy that is both globally consistent and locally effective. Increasingly, large, complex organizations are taking an enterprise-wide compliance-risk management approach to augment and better coordinate what had been fragmented and duplicative compliance activities.

A successful compliance-risk management program starts at the top of the organization. It is essential that the board of directors take the lead by requiring a top-to-bottom compliance culture that is well-communicated and incorporated into the organization's day-to-day operations by senior management, in order to ensure that all staff members understand their compliance responsibilities and their roles in implementing the enterprise-wide program.