In the Circular of 31 January, 2024, the RBI has advised Supervised Entities (SE’s) to conduct a comprehensive review of their internal compliance tracking systems and to implement any necessary updates or new systems by June 30, 2024. The following is an analysis of the requirements in the notification and how Complius® from Quant LegalTech provides a comprehensive solution to the RBI challenge.

Requirements cited in this notification:

1) There is a need to implement comprehensive, integrated, enterprise-wide and workflow-based solutions/tools to enhance the effectiveness of this [compliance] function.

The Complius platform not only enables SEs with legislative mapping, tracking and recording, but critically, it builds-in the capacity to track, policies, processes and SOPs so that the internal procedures that enable compliance are integrated and tracked together with the regulatory compliance. This is illustrated below by mapping the requirements of RBI/2023-24/117 (referred to herein as, RBI Circular or Circular).

Requirements of the RBI Circular

The Circular calls for a workflow-based solution to be implemented and breaks it down further into the following steps;

• Carry out a Comprehensive Review of your existing internal compliance system (per Para 1)
• Implement a series of intermediate steps (per Para’s 2 to 5)
• Acknowledge Receipt of the Circular (per Para 5).

For illustrative purposes, we will now show how these Tasks can be executed and tracked in Complius, including samples of the internal process that may be adopted by any SE seeking to comply with the Circular. This is explained in detail with screen images in pages 2- 6 below, and then we return to a further explanation of the Circular.

The first stage is to import the Tasks into Complius and we start below with the high-level requirements which are simply line items.

Setting & Executing Tasks in Complius

The first Task (highlighted) has been mandated in the RBI Circular itself and is an important opening step that must be executed and tracked.  This starts by the Task being routed to the Owner for execution, which can be carried out in one of two ways, either by clicking the link in the platform (as viewed above), or directly from an email notification which is sent in parallel, thus making it possible to execute a Task without even logging into the system.

An approval is then executed by the Manager who opens and reviews the Task and can mark it “Complied” or can send it back for further action.  In the example below, the Manager has added a note in the Comments field that the acknowledgement must be sent to General Counsel, Compliance and the Board (thus, putting all on notice that the RB-mandated review process has been kicked off).

Configuring Workflows in Complius

Not all compliance tasks can be completed as easily and many will require department staff to meet and submit documentation. Given the RBI’s concern about internal compliances, SE’s are encouraged to use technology to track their internal processes as well, so the Company may elect to import into Complius their internal approval procedure so that they have a full record of how the Task was handled.  In the example below, an SE has created 5 steps to implement and track the RBI review.

With a few clicks, these steps may then be imported into Complius and each phase of the review carefully tracked. The administrator of the process (usually a Senior Manager) can then assign “owners” to each step and, set the schedule of meetings and add any internal processes, policies and SOPs that are applicable.

In this example, the administrator has set monthly meetings with a Final Report-out to Management on 17 June, 2024, two weeks prior to RBI’s deadline for implementing new systems. In so doing, any number of internal policies may be uploaded so that when a User clicks on a Task that has been assigned, any relevant policy or procedure document is available from the links provided (see below).

This ensures that all team members have the necessary documents to actively participate in the review process.

Sub-Tasks

Inevitably, the review meetings will produce action items and decisions will be made about how the process can be improved and new processes documented.  These may also be tracked on the platform and further “Sub-Task” adopted.  This is easily done by a Manager-level User by clicking the Sub-Task button (shown below) and entering the Sub-Task directly into the field.

The Example below shows that a Sub-Task has been added requiring external legal counsel to give an opinion on the soundness of the compliance process and adherence to the RBI Circular.  Once this Sub-Task has been created, the parent task (in this case the second review meeting), cannot be completed until the Sub-Task (i.e counsel’s opinion) has been obtained.

In this way, the system is flexible enough to accommodate changes in the workflow while being self-reinforcing, as important new Tasks can be made conditions precedent to the next phase of the review.

The effect of the Sub-Task is to embed a new internal workflow into the approval process so that any attempt to execute the Parent Task will be met by a reminder to execute the Sub-Task first. This ensures that important procedural steps are not missed. In this example, Senior Management have required that the compliance process be reviewed by external counsel. This Task can only be closed by uploading counsel’s opinion into Complius. Any attempt to proceed with the workflow without completing the Sub-Task will be rejected and a reminder posted so that the User is reminded to execute the Sub-Task first.

Status Updates

The Complius platform is continually updating as Tasks are met and dates trigger new activities to be completed.  The Screen below shows the status of Tasks due over the next month.

Similarly, when a User logs on to Complius, the opening screen shows a snapshot of all Tasks due that month. (Example below).

[Returning to the Circular]

2) Requirement: Effective communication and collaboration among all the stakeholders (by bringing business, compliance and IT teams, Senior Management, etc. on one platform)

Comments:

• As we have illustrated above, Complius is a collaboration platform where multiple stakeholders including principal compliance owners, managers, approvers and auditors are granted “role-based access” determined by their function. In addition, various “view-only” rights may be added to enhance oversight by external lawyers, consultants or otherwise as you may determine
• It allows all stakeholders to update and track the status of their Tasks, which are accessible to senior management for real-time monitoring and reporting.
• The system incorporates an email-based workflow that issues reminders and follows up with users, including sending escalations for non-compliance post, their due date.
• As illustrated above, the Comments feature allows stakeholders to post questions or provide additional information to other users, thus facilitating communication and collaboration called for in the Circular.

3) Requirement: Have processes for identifying, assessing, monitoring and managing compliance requirements

Comments:

• Complius implements a proprietary attributes framework which maps the universe  of potential compliance Tasks to the company’s corporate footprint and then validates the dataset with your legal and compliance teams.
• Complius facilitates monitoring and management of compliance obligations by allocating responsibilities to the appropriate stakeholders.
• Legal updates and changes in business scope, are constantly updated to ensure that the compliance dataset remains accurate. (The whole process is illustrated in the following workflow).

IMPACT analysis workflow

4) Requirement: Escalate issues of non-compliance, if any

Comments:

• As further support to the series of reminders generated prior to each due date, Complius sends escalation reminders to users after the due date.

• In addition, on the 25th of each month, a notification with a list of all overdue Tasks are sent to either CXOs or Senior Managers.

5) Requirement: Require recording approval of competent authority for deviations/ delay in compliance submission.

Comments:

Complius enables Task owners to select options for deviations, delays and even a complete failure to comply. However, they are all subject to a 2^nd Line of Defence review by the next level of decision maker.

Custom Reporting options are also available so that particularly sensitive compliance Tasks (and exceptions) can be tracked and reported to management monthly

As featured earlier in this memo, Complius allows Managers to create Sub-Tasks for any compliance activity, thus adding an additional layer of approval for mission-critical Tasks to ensure that nothing gets missed.

The Supporting Documents function allows exceptions to be recorded with any number of proofs, which can range from correspondence with the regulator to email approval from immediate management.

The Comments function can be used to enable real-time dialogue with the management chain explaining the exception.

6) Requirement: Unified dashboard view to Senior Management on compliance position of the Regulated Entity

Comments:

Complius includes a unified Dashboard feature which is available to designated roles, typically for the Senior Managers, providing a comprehensive overview of the compliance status of the Regulated Entity on a real-time basis. This is featured on Page 6 above and a different variation below.

Concluding Comment

The RBI Circular calls for a comprehensive, integrated, enterprise wide and workflow-based solutions tools to enhance the effectiveness of the (compliance) function.

As we have explained in detail in this memo, Complius has been architected for exactly this function and includes a feature-set which enables SE’s to meet all of the requirements of the Circular.  The Workflow feature in particular, ensures that your internal processes are mapped with and integrated as part of the regulatory compliance dataset and although each SE will have different internal processes, Quant LegalTech is able to provide a series of default workflows to get you started today!