Proprietary Limit Breach and the Unqualified Compliance Certificate
A newly appointed compliance officer at a Karachi-based securities broker has completed a first review of the proprietary trading desk. The broker has 2,300 active clients and Rs 4.1 billion in client assets. Internal policy caps proprietary exposure to any single counterparty at Rs 120 million, but the head trader executed Rs 186 million of exposure for 11 days to fund a settlement gap. The CEO says the breach was temporary, no client lost money, and asks the compliance officer to record it as an 'operational timing issue' and report it only in the quarterly board pack. The compliance officer also finds that the daily limit report has been produced weekly since January and was never reviewed by anyone senior to the trader. The broker is due to submit its next regulatory compliance certificate in 12 days. The CEO wants the certificate signed without qualification.
1. Identify the compliance failures and explain what the compliance officer should do before the certificate is due, including how to handle the CEO's instruction.
Read the worked answer
Failures. There are three layers: (i) the Rs 186m exposure breached a hard internal limit of Rs 120m for 11 days; (ii) the daily limit report was not daily and had no senior review, so both control design and operation failed; (iii) the CEO is asking for a misleading record and an unqualified certificate. The fact that no client lost money affects harm and regulatory materiality, not whether the limit breach occurred.
Immediate steps. Preserve the trade blotters, limit reports, emails and board papers. Recalculate the exposure and identify whether any client-money, market-disclosure or exchange-notification rule was triggered; consult legal or the company secretary on reportability. Escalate to the board audit or risk committee, or the board chair if unavailable, in writing. Do not change the description to 'timing issue'.
Certificate. Sign only if it is accurate. If the breach remains unremediated or unreported where required, issue a qualified report or refuse to sign and document why. The compliance officer can agree a dated remediation plan: restore limits, daily independent reporting, senior sign-off and disciplinary referral. The CEO can direct business decisions but cannot direct the compliance officer to falsify records or certify ineffective controls.
2. How should the compliance officer distinguish between a control weakness and a reportable regulatory breach, and what evidence should be retained?
Read the worked answer
Use a structured test rather than the CEO's characterization. First, identify the legal or regulatory obligation: was the limit only an internal policy, or does the rulebook, client agreement or licensing condition impose a similar exposure or notification requirement? Second, assess materiality and duration: a Rs 66m excess for 11 days is more significant than a minor intraday breach, but both require a documented breach record. Third, consider harm and concealment: no client loss reduces severity, but an instruction to mislabel the event increases conduct risk. Fourth, check whether the firm's own escalation policy requires board or regulator notification.
A control weakness is a defect that creates risk; a reportable breach is a failure against an external requirement that meets the reporting threshold. Retain the source data, limit calculation, exception reports, emails and meeting minutes, the breach log, remediation evidence and the certificate rationale. Record the decision and the person accountable. If uncertain, escalate; do not decide alone. The key is to show that the conclusion was independently reasoned and not manufactured to protect the CEO.