Amid tightening regulatory pressure, good data governance is key

For Sumanda Basu, head of data quality and data domain lead at Societe Generale Americas, the 2008 global financial crisis was the “initial mandate” for banks to reassess their data governance. Fifteen years and several landmark regulations later, banks are actively managing their strategies and policies to stay compliant and on top of their data.

Post-crisis regulations in the US and EU like Dodd–Frank and Mifid II helped banks navigate and put into practice the management of investor confidence, consumer privacy and market integrity. Dodd–Frank stipulates that all information related to an executed trade must be retained for up to five years in secure storage, while Mifid II requires records be kept and made easily accessible for up to seven years at the request of regulators.

When it comes to building the foundation of a data governance program, Basu, who spoke at the North American Financial Information Summit in New York on May 16, stressed the importance of setting a purpose. “In 2008, the purpose was very clear,” he said. “Everyone had a clear idea of where they wanted to be.”

Now, with those regulatory drivers well embedded, firms still need to maintain an up-to-date view of their internal data and analytics ecosystems. Frameworks like the Data Management Capability Assessment Model (DCAM) from the EDM Council are available for that kind of work and from there, firms can do gap assessments to understand what’s lacking. “It can tell you what processes you need to focus on, what skill sets you need to have, and what capabilities you need,” Basu said.

Following that, it takes three to five years or more to establish the data program. “After almost six years into the journey in the Americas, we’ve made significant progress,” Basu said of SG Americas’ data program. But he also stressed the importance of “pulse checks” to make sure there has been focused progress.

Meanwhile, Mayank Goel, vice president and compliance manager at MUFG Bank, who also spoke at Nafis, said that when defining data controls, it’s important to look at where the data is being used.

As an example, requirements for the compliance program will differ from the finance program. Under the Bank Secrecy Act/Anti-Money Laundering (BSA/AML), banks are required to create specific compliance programs that have specific recordkeeping requirements. Goel said those requirements mean the bank cannot alter data and must maintain its integrity. “In that case, the controls that you need are more continuity,” he said.

Another consideration is ownership, especially when it comes to legacy data. Unlike new data that has been captured with ownership determined at its creation, legacy data has no clear ownership. Basu said he looks at data domain to determine ownership.

“Whether it’s customer data or financial reporting, each of these areas deals with a specific set of data that’s related to each other,” he said. “Once we identify the executive owner in each of the domains, it becomes imperative for the owner to ensure that data is captured irrespective of where it is in their organization.”