Safety Norms: Investment Banking and Capital Markets

1Purpose, Scope, and Safety Principles

These norms protect firm capital, clients, counterparties, markets, colleagues, and professional reputations during investment banking and capital markets work. Serious harm in this field is usually financial, legal, or informational rather than physical, although travel fatigue and overnight deal closings also need planning. The scope covers advisory and mandate work, underwriting, debt and equity issuance, mergers and acquisitions, sales and trading, market making, securities financing, and the operations that confirm, settle, and report transactions. A control is a documented step that prevents, detects, or corrects an error or misconduct. A restricted list is a register of securities that staff may not trade without clearance.

Three principles apply throughout. Controls exist so that no single individual can cause loss or misconduct alone. Information is shared only on a need-to-know basis. Any doubt is escalated rather than resolved informally.

• Mandatory: no person may bypass a documented control to meet a client deadline, a market window, or a leadership request.
• Mandatory: where a business instruction conflicts with written policy, the policy applies until compliance gives written approval.
• Recommendation: treat unexplained urgency, secrecy, or pressure to skip a step as a warning sign requiring escalation.

2Roles, Competence, and Accountability

Front office bankers originate mandates and lead execution. Traders and sales staff price, quote, and transact. Operations, finance, and risk teams book, confirm, settle, value, and report. Compliance and legal teams set policy, advise, and monitor. Internal audit tests controls independently. Senior management owns the overall control framework and must name an accountable owner for every control, with a backup owner for absence cover.

Competence means more than seniority. A person should perform a task only after training, documented authorization, and, where licensing applies, confirmation of the required registration. Licensing and registration rules are jurisdiction-dependent, so confirm current requirements with the relevant regulator or qualified counsel.

• Mandatory: system access, approval limits, trading limits, and payment authorities must be granted in writing and recorded in an authority matrix maintained by the control owner.
• Mandatory: staff must not execute client orders, sign offering documents, release payments, or approve vendor bank details unless their authority is current and recorded.
• Mandatory: managers must remove access promptly when a person changes role, goes on extended leave, or leaves the firm.
• Recommendation: managers should review authority matrices periodically and after any organizational change.

3Course-Specific Hazards and Risk Assessment

Realistic activities include building valuation models, preparing pitch books and offering memoranda, handling material non-public information, placing orders, booking trades, generating confirmations, updating settlement instructions, and approving fee invoices. Typical people include bankers, research analysts, traders, sales staff, operations clerks, outside lawyers, auditors, and clients. Common tools include spreadsheets, order management systems, trading platforms, data rooms, payment systems, email, and chat applications. Environments range from trading floors and deal rooms to client sites, airports, and home offices.

Risk is rated by likelihood and impact before controls are applied. High risks require named controls and regular testing. Medium risks require documented controls and periodic review. Low risks require awareness and standard practice.

• High: business email compromise, where a fraudster impersonates a client or colleague to change payment instructions. Control: verify every change by calling a contact from firm records, never the number in the request.
• High: leakage of material non-public information through informal conversations, shared files, or chat. Control: wall crossing, restricted lists, and access logs.
• High: market abuse such as spoofing, layering, or front running. Control: surveillance alerts reviewed by an independent team and pre-clearance for personal trading.
• High: valuation or fee errors caused by unreviewed spreadsheet formulas. Control: independent model validation and version control.
• Medium: trades outside approved limits or mandates. Control: hard pre-trade limits and daily limit reports.
• Medium: misbooked or unconfirmed trades. Control: same-day booking checks and counterparty confirmation matching.
• Low to medium: fatigue during overnight closings and long model sessions. Control: staffing rotas, handover notes, and scheduled breaks.

4Preventive Controls and Safe Work Practices

Financial control safety depends on layered controls. Preventive controls stop errors before they occur, detective controls identify exceptions, and corrective controls limit damage and fix root causes. No single control is sufficient. A payment release, for example, should involve an authorized initiator, an independent approver, a call-back verification, and a reconciliation on the next business day.

Segregation of duties is the central safeguard. The same person must not initiate and approve a transaction, create and approve a counterparty or vendor record, or book and confirm the same trade. Where staff are too few to separate duties, the control owner must add compensating review and record the exception.

• Mandatory: initiators and approvers of payments, journals, and trades must be different people with different system roles.
• Mandatory: payment instructions and changes to beneficiary bank details must be verified through an independently sourced contact before release.
• Mandatory: trades must be booked in approved systems on the day of execution, with confirmations matched by a team independent of the trader.
• Mandatory: fee invoices must be checked against the signed engagement letter before payment.
• Mandatory: staff must not trade personal or household accounts in restricted securities without pre-clearance, and must not use off-system channels for client orders.
• Mandatory: quotes and price commitments must come from authorized desks and be recorded with time stamps.
• Mandatory: no staff member may share material non-public information outside the approved deal team or restricted group.
• Recommendation: confirm unusual orders by a second person or a recorded call before release, especially in thinly traded markets.

5Equipment, Environment, Information, and Protective Safeguards

Information is the main asset to protect. Client data, deal terms, pricing models, and personal data are confidential, and handling rules may be set by privacy, securities, and banking laws that are jurisdiction-dependent. Equipment includes firm-approved laptops, mobile devices, order systems, and data rooms. Protective safeguards include access controls, multi-factor authentication, encryption, logging, and secure disposal. Trading floors, client meeting rooms, and travel create exposure through overheard conversations and lost devices.

Ergonomic and hygiene measures here include properly adjusted workstations, scheduled breaks during long screen sessions, and rest rules for overnight closings. These are recommendations unless local occupational health rules say otherwise.

• Mandatory: use only firm-approved channels for client and deal communication, and retain records as required by policy.
• Mandatory: enable multi-factor authentication on all remote and privileged access, and never share credentials or leave sessions unlocked.
• Mandatory: store restricted deal material only in controlled data rooms with access logging and expiry settings defined by the deal lead.
• Mandatory: shred or securely dispose of printed confidential material; never place it in general waste.
• Mandatory: report lost or stolen devices immediately to information security.
• Recommendation: use privacy screens and avoid discussing deals in public areas or on speakerphone.
• Recommendation: take a screen break at least hourly during prolonged model review.

6Incident Reporting, Emergency Response, and Escalation

Incidents include suspected fraud, misdirected payments, data breaches, lost devices, erroneous trades, booking errors, and near misses. Near misses must be reported because they reveal weaknesses before losses occur. Report as soon as a concern is identified, not after it is investigated. Do not confront the suspected person, alter records, or attempt recovery of funds or trades alone. Preserve evidence such as emails, system logs, and call records.

Physical emergencies, medical events, threats, and evacuations require contacting local emergency services first, then the site manager. Financial incidents, such as a misdirected wire, require immediate notification of the control owner, operations, and compliance so that recall and notification steps can start. Regulatory notifications and suspicious activity reporting decisions are made only by authorized compliance personnel under applicable law, which is jurisdiction-dependent.

• Mandatory: report suspected fraud, misconduct, or market abuse to compliance or the designated escalation contact without discussing it with the subject.
• Mandatory: report a misdirected payment immediately so the bank can be contacted for recall while funds may still be traceable.
• Mandatory: escalate trade errors to the desk head, operations, and compliance before attempting any correction in the market.
• Mandatory: staff must not file regulatory reports independently; compliance decides and documents such filings.
• Mandatory: report a suspected data breach to information security at once, naming the device or system involved.
• Recommendation: use the confidential whistleblower channel when a normal reporting route feels unsafe; protections depend on jurisdiction and firm policy.

7Records, Training, Inspection, and Review

Accurate records are a safety control. Books, records, audit trails, and approvals must show who did what and when. Retention periods and format rules are set by law and regulator guidance, which vary by jurisdiction, so the records team must confirm them. Training must cover onboarding, role-specific controls, conduct, information barriers, fraud awareness, and escalation, and must be refreshed after material changes to policy or systems.

Inspection means reconciliations, exception reports, and control testing. Daily reconciliation of positions, cash, and confirmations should be performed by someone who does not run the activity being reconciled.

• Mandatory: no record may be backdated, altered, or deleted; corrections are made by documented amendment showing the reason and approver.
• Mandatory: staff must complete required training before accessing restricted deal information or executing client work.
• Mandatory: reconciliation exceptions must be investigated, documented, and aged; unresolved items escalate to the control owner.
• Recommendation: maintain a control register listing each control, its owner, frequency, evidence, and last test result.

8Monitoring, Review, and Continuous Improvement

Monitoring shows whether these norms work in practice. Useful indicators include late approvals, override requests, surveillance alerts, unreconciled items, access exceptions, near-miss reports, and training completion. Trends matter more than single events. A rising number of overrides in one team signals a need to review workload, authority limits, and culture.

Each significant breach requires root cause analysis, corrective action, and follow-up testing. Norms must be reviewed when laws, regulator guidance, firm structure, systems, or deal types change. These norms are a starting point; local procedures must be approved by competent management and checked against current legal and regulatory requirements.

• Mandatory: each control breach must have a documented root cause, corrective action, owner, and due timeframe.
• Mandatory: compliance must approve material changes to these norms before implementation.
• Recommendation: review key indicators with senior management periodically and include them in risk committee reporting.

Implementation checklist

• Confirm your authority in the authority matrix before executing any trade, payment, or approval.
• Verify every payment instruction change using an independently sourced contact.
• Never approve a transaction you initiated or booked yourself.
• Keep material non-public information within the approved deal team and restricted group.
• Use only firm-approved systems and channels for client and deal communication.
• Pre-clear personal trades and check restricted lists before dealing.
• Escalate red flags at once to compliance or the designated contact without tipping off the subject.
• Report misdirected payments, trade errors, lost devices, and near misses immediately.
• Never backdate, alter, or delete records; document corrections as amendments.
• Complete required training and confirm current jurisdiction-specific rules with compliance or counsel.