"i-think" by Imhoff Consulting Project

New Blog Address

2011-02-28T11:35:00.000-05:00

Hi There. I revised my website: it now includes my blog. This means you go to one cyberplace to visit me, not two.

This is the last blog entry I'll make on this account, and I'll leave it here for visitors who are looking for me. Go to my website (http://www.imhoffconsultingproject.com/) and click the 'blog' link to get to my postings. Some of the old entries may have issues with links...forgive me or at very least inform me when you hit such a snag.

Thanks for reading!

Belated Happy New Year

2011-01-17T11:34:00.001-05:00

The only reason I'm adding this blog entry is that if you landed on my blog and saw the "December Dates" entry, you might think the Patriots were still headed to the Super Bowl. I wanted to spare you that moment of hopeful confusion. It's January and the Pats are going sledding instead. As a Steelers fan living in New England, I have to admit that this shocking turn of events will make for a less hostile mood in the 'hood next weekend. Phew!

Very brief reminders:

If you have to, under the FACT ACT and the Red Flags Rule, make sure you put in place a Written Identity Theft Program. To my knowledge, the rule is now enforceable. Look for my prior ramblings on this topic if you want some background.

If you do annual disclosures in January, such as sending Privacy Notices and information on SIPC and Broker-Check, remember to send them. Also remember that SEC offers a form of model privacy notice, in case you want to switch to a format that will meet their approval. Your existing notice may be fine--but you'll have to review Reg. S-P to be sure. Again, look for my earlier blather on this subject.

Remember, pre-notifcation to and review by a supervisor of all new 'other business' or 'outside business activities' of Reps is now required. Reps can't start doing something new on the side unless this review process has taken place first--and you firms have to document this. And for existing OBA you have until June, as far as I can see, to document your reviews. Start thinking about how you'll do this and getting the documentation in place. If you used a year-end RR questionnaire that solicited this information, use those answers as a basis for requesting and gathering further information on the outside activities.

Don't forget to do a periodic OFAC check of all current customers/accounts. You can define 'periodic.' Put the results in your files.

And remember to encrypt any information you give FINRA on portable storage devices. Notice 10-59 describes this new requirement.

That's it for now. Writing updates to procedures--don't forget to update yours.

December Dates

2010-12-03T11:56:00.000-05:00

These kinds of dates are not the fun ones, but they're worth paying attention to:

1. December 10: Due date for notification of change of accountant. If you have appointed a different accountant to do your annual audit, you have to tell SEC and FINRA about it. Please reference my blog entry of last December for specifics--the information is still good and you'll save me time. You're great: thanks!

2. December 13: FINRA renewal payments due. Remember, even if you disagree with what is on your preliminary renewal statement, pay it! You can make amendment filings now that will be reflected on the final statement (Jan. 3): at that point you can get a refund if you overpaid. Here is a link to FINRA's page on payment options.

3. December 15: Effective date of new Rule 3270 requiring reps to pre-notify the firm of their new outside business activities--and requiring the firm to consider those activities in the context of its securities business. I blabbed about this in a recent (yeah, October was recent in my mind) entry. See here.

4. December 23: Deadline for all year-end filings on CRD. Remember, you can post-mark termination filings (like dropping states or dropping reps) to December 31 if you want.

5. December 31: End of your right to use self-congratulatory Privacy Notices. The use of SEC's "model form" is advisable for those who want to be sheltered by the safe harbor. Not sure what I'm talking about? Search my blog for "Privacy Notices" and you'll hear all about it.

6. December 31: The last day of the year. Oh, and as of the next day, in theory, the FACT ACT is enforceable. Since that effective date changes more often than I do when getting ready for a holiday party, I'm not convinced it will stick. See this blog for details and sarcasm.

Happy December, everyone!

Is an Anagram of "Wells Notice" Okay?

2010-11-15T13:23:00.000-05:00

I'm thinking "swell notice" might be somewhere in my manual, or "client lowse"? Colleen's wit"? Or maybe "elite clowns"? Will one of these do?

What I am referring to is this: in last week's FINRA news release and attached Letter of AWC FINRA states that Goldman Sachs failed to include the term “Wells notice” in its procedures manual. As far as I can discern, there is no rule or specific guidance calling for this exact terminology. So I'm wondering if FINRA examiners will accept a substitute...an anagram (ha ha) or perhaps something reasonable (I'm being serious now), like procedures requiring Reps to promptly inform firms of necessary changes to U4, including any new 'yes' answers on U4 disclosure questions. That--the latter--is what most firms probably have in their manuals. But let's assume that is not enough. Uh, given the whopping $650,000 fine imposed on Goldman, I think it's safe to assume that is not enough.

Okay, to be fair, I will note that the fine was also assessed for GS's failure to update its Reps' U4s to disclose the actual on-going SEC investigations that were made known to Reps via, yes, Wells notices. So there is some substance behind the action.

My point here? Check your procedures to see if they include the phrase "Wells notice" and an explicit requirement that registered persons immediately inform you of any investigations they are subjected to. You can then sort out whether or not such an investigation merits reporting on U4 (see Question 14G(2)).

Many thanks to Andy's Anagram Solver for online assistance.

Outside Business Activities: The New Rule

2010-10-18T16:41:00.000-04:00

Pull up Notice 10-49 to see FINRA's announcement of some recent Rule Consolidation changes. Within these is the shiny new FINRA Rule 3270 on Outside Business Activities of Registered Persons. It becomes effective December 15 for new notifications of OBA; but for reps with current outside activities, firms must comply with the supplementary material by June 15, 2011.

For what they're worth, here are my comments. Bit lengthy: my apologies.

1. This rule applies to ‘registered persons’ not ‘associated persons.’ (But the selling away rule, 3040, applies to associated persons.) Here a definitions to remind you of the difference for now--def's may change soon:

According to Article I Definitions in NASD By-Laws, "person associated with a member" or "associated person of a member" means: (1) a natural person who is registered or has applied for registration under the Rules of the Corporation; (2) a sole proprietor, partner, officer, director, or branch manager of a member, or other natural person occupying a similar status or performing similar functions, or a natural person engaged in the investment banking or securities business who is directly or indirectly controlling or controlled by a member, whether or not any such person is registered or exempt from registration with the Corporation under these By-Laws or the Rules of the Corporation; and (3) for purposes of Rule 8210, any other person listed in Schedule A of Form BD of a member

For "registered person" I offer the following: From NASD 1031(a): “All persons engaged or to be engaged in the investment banking or securities business of a member who are to function as representatives shall be registered as such with NASD in the category of registration appropriate to the function to be performed as specified in Rule 1032.” And from 1031(b): Persons associated with a member, including assistant officers other than principals, who are engaged in the investment banking or securities business for the member including the functions of supervision, solicitation or conduct of business in securities or who are engaged in the training of persons associated with a member for any of these functions are designated as representatives.

2. The rule applies to persons with a “reasonable expectation of compensation”: this broadens the scope from the prior rule. No more excuses: if the Rep may make money from an outside activity, it counts.

3. The rule newly requires “PRIOR” written notice. It used to be “prompt.” That means Reps can’t start doing outside business activities and then later inform their BD employers. Firms should have a clear pre-notification requirement in their procedures manuals and they should devise a notification mechanism, like an internal form, that prompts information from the RR about the activity. They should include a time frame for the notice that allows enough time for the firm to meet its review obligations under 3270.01 (see next comment).

4. The rule newly requires the firm to consider the ramifications of the outside activity as follows:

(1) Does it interfere with or compromise the registered person's responsibilities to the firm and/or customers?

(2) Could it be viewed by customers or the public as part of the firm’s business based upon, among other factors, the nature of the proposed activity and the manner in which it will be offered?

(3) Is the OBA really ‘selling away’ under NASD Rule 3040?

The firm should document its review of these things: it would make sense to have the results of the review appear on the notice form. If no conflict is perceived and the business is not ‘selling away,’ the firm can move forward without action (or it can document ‘approval’ of the activity—not technically required, but implicit). But if the answer to questions (1) and/or (2) is ‘yes’ then the firm has to do something about it, like imposing specific conditions or limitations on the registered person's outside business activity or outright prohibiting it. Again, the records should document all requirements/prohibitions, as well as the communications to the registered person describing the firm’s decision. If the answer to number (3) is ‘yes,’ then the firm has to apply its procedures for 3040 compliance and recordkeeping—or prohibit the activity.

5. The rule change was scaled back from the original: FINRA member voices were heard, such that now, firms will not have to supervise the surf lessons Reps are giving on the side. (However, if a firm feels like mutual customers are risking their lives by taking these surf lessons, thus increasing the possibility of losing firm accounts, firms can say CowaSorry to the Rep…no surf lessons to firm customers.)

6. Here’s what I can’t figure out: why didn’t the new rule include reference to, or somehow reflect on, the reporting requirements on U4. U4 calls for disclosure of OBA as follows:

“Enter "yes" or "no" to indicate whether you currently are engaged in any other business, either as a proprietor, partner, officer, director, employee, trustee, agent, or otherwise. Exclude non-investment-related activity that is exclusively charitable, civic, religious or fraternal, and is recognized as tax exempt.”

Better yet, why didn’t the respective Notice reflect on this subject? I have to assume the following: outside ‘business’ activities do not refer to charitable, civic, religious or fraternal organizations/activities. BUT it might be worth addressing, to a limited extent, these categories on the internal notice form. Why? So that any such activities that also include ‘investment-related activities’—for instance, helping to manage the church’s investments—are not overlooked. If these types of activities are not investment-related, then U4 reporting is not required. If they are, then the firm should complete the same review as for other OBA…and make decisions and document them. I wish I could be clear about this strategy, but I’m not. It seems like a firm could, based on the rule language, prohibit a registered person from engaging in charitable work if the firm deemed it a conflict or risk to business. But what do I know? Enough to be curious…

7. Back to the subject of effective dates: firms should notify all registered persons of this new 'prior notice' requirement--and tell them that as of Dec. 15 they must, in effect, seek pre-approval of any new OBA. And the firm must remember to review all existing OBA by next June to determine if limitations, conditions or prohibitions should be imposed.

That's all for now. Why don't you let me know what you think?

More New Rule Numbers: Chapter X

2010-10-18T16:13:00.001-04:00

First off, who doesn't love the letter X? C'mon, it's true. What popped into my head today as I read FinCEN's announcement on simplifying the structure of its rules and regulations? Racer X! No, not the 80's band, but Rex Racer himself! That guy's posture, not to mention his mystique, is something to adore.

Anyway...back to national security...(Racer X is clearly a candidate for SAR filings, non?)...check out the link I just provided you and you will see that, thanks to the motivated bunch over at FinCEN, we will soon be able to use the handy--and if this term doesn't call to mind Sparky's mechanical prowess, you are not on my page--"Chapter X Citation Translator" to figure out the new rule numbers (and to revise your AML written programs). Yes, more new rule numbers. As if we haven't had enough of those lately.

Implementation date: March 1, 2011. So, Speed, push that calendar accelerator button and mark this date (with an X?) as a reminder.

Hedge Fund Marketers: Beware The Dodd-Frank Act!

2010-09-21T12:02:00.000-04:00

Unregistered hedge fund marketers, that is. Important distinction (for now).

Let me explain.

Hedge funds (i.e., IA firms) that use third parties (finders/consultants/solicitors/placement agents) for introductions to potential investors may face a new limitation. In June, SEC adopted the 'pay to play rule' which, among other things, "Prohibits an adviser from paying a third party, such as a solicitor or placement agent, to solicit a government client on behalf of the investment adviser, unless that third party is an SEC-registered investment adviser or broker-dealer subject to similar pay to play restrictions." (See SEC news release.)

What this means is that IA firms/hedge funds cannot pay an unregistered entity for introductions to public pension plans. The entity has to be an SEC-registered investment adviser or a registered broker-dealer. So you FINRA member BD's out there are in a stronger position when competing with unregistered finders (you know who those guys are...the ones not reading this blog). These unregistered types will now have to, under temporary Rule 15Ba2-6T of the Securities Exchange Act of 1934, register as "municipal advisors" by October 1, 2010. See SEC's links about Form MA-T. (And don't ask me why they decided to spell 'advisors' with an 'o' this time...?)

Back to you, the FINRA member firm who offers investments in hedge funds, sometimes to public pension funds: What changes? Nothing yet, as far as I can tell. But be on the lookout for new rules from FINRA about this sales activity. Not sure how much misery they'll inflict on you, but somehow I think it will be mildly annoying at very least. Stay tuned.

SIPA Amended by Dodd-Frank Act. But Not Really.

2010-09-21T11:21:00.001-04:00

On my son's 16th birthday, this announcement was made about changes to the Securities Investor Protection Act (SIPA, enforced by SIPC). One of the changes is described as follows:

Sounds clear to me.

"Dodd-Frank Act Section 929V amends the minimum assessment amount for SIPC member firms. The highest amount that SIPC can impose as a minimum assessment has been changed from $150 per annum to 0.02 percent of the gross revenues from the securities business of the SIPC member. (15 U.S.C. §78ddd(d)(1)(C))."

But. If you dig around in SIPC's member site and go to "News for Members," you'll stumble on this July 23, 2010 Notice about the minimum assessment changes. Here's what SIPC says about the Dodd-Frank amendment cited above:

(I can't figure out this out. .02 percent is smaller than .25 percent, so the D-F Act doesn't conflict with SIPC's current assessment rate, so why did SIPC have to put out the 'disregard' notice? Probably because everyone is still tee-oh'ed that they have to pay this new assessment and SIPC assumed everyone would start paying the new minimum (.02 percent) instead of the published rate (.25 percent). If that's the case, then SIPC thinks people actually read this stuff! In the summer, no less! [Birthday] hats off to SIPC for having that kind of faith in compliance personnel.

Well, anyway, here's a change that might really be a change:

"UNTIL FURTHER NOTICE, FOR MEMBERS WHOSE FISCAL YEAR ENDS ON OR AFTER JULY 31, 2010, PLEASE DISREGARD ANY REFERENCE TO A MINIMUM ASSESSMENT. THE SIPC ASSESSMENT WILL CONTINUE TO BE ONE FOURTH (1/4) OF ONE (1) PERCENT (.0025) PER ANNUM OF NET OPERATING REVENUES FROM THE SECURITIES BUSINESS, WITHOUT REGARD TO ANY MINIMUM ASSESSMENT."

Thus paraphrased by the late, great Gilda Radner as "Never mind."*

'In addition, for your information, the definition under the Securities Investor Protection Act of "gross revenues from the securities business" has been changed. Gross revenues now also includes "... revenues earned by a broker or dealer in connection with a transaction in the portfolio margining account of a customer carried as securities accounts pursuant to a portfolio margining program approved by the [Securities and Exchange] Commission." (15 U.S.C. §78lll(9)).'

*Bonus points to those who remember the character played by Gilda when offering this phrase weekly on SNL.

Miss EMMA Says, "Disclose It!"

2010-09-21T10:35:00.000-04:00

Just a reminder to teach your Reps about disclosing 'material information' to customers (except institutional buyers--sophisticated muni market participants) when selling munis. Even if not recommended. The EMMA portal is the place to find most such information. And here is a link to FINRA's news release on the subject--don't forget to search for "material events" in my blog to be treated to some other useful information...like a reminder that this rule applies to 529 sales.

FINRA provided in the news release a 'checklist' for Reps to use as a means of documenting their notification efforts (necessary! always document!). It's pretty lengthy and for some reason I don't envision Reps reading it. But if they did, they would surely be enlightened: it's full of instructions and explanations and ultimatums and guilt trips (jk). You may want to put your brilliant word processing staffers to work on this in order to create a more user-friendly checklist (send it to me and I'll send you my thanks and maybe chocolates!).

Also, MSRB's Fact Sheet is a very lovely tool for educating your muni customers. I hope they don't mind me passing it along.

Update Your Procedures: Summary of Some Recent Changes

2010-08-05T11:53:00.001-04:00

Summary of some changes during the first half of 2010. You'll want to be sure to update your procedures manuals (there were more changes than those listed here...read all your Notices!).

1. The Red Flags Rule will not be enforced until year-end 2010. If I provided you with an “Identity Theft Protection Program,” you don’t have to worry about documenting your compliance until then.

2. Reminder: all initial U4 filings (not amendments) require ‘wet’ signatures from both the rep and the firm signatory. Make sure you have original, signed U4’s in your files.

3. If you are holding a Variable Annuity application/customer check for up to seven days after the application was complete (as allowed under Rule 2330), the following must be true:

a. It was a recommended purchase or exchange (non-recommended trans. still must happen w/in one day)
b. Staff made reasonable efforts to safeguard the check and deliver the completed application to the supervisor for review
c. The reason for holding the check is to review the application for approval
d. You have procedures in place for this (yes, you do)
e. You keep a record of the date when the principal (OSJ) receives a complete and correct copy of the application package
f. A principal reviews the application as required under the rule
g. You don’t hold the check/application longer than 7 business days
h. You keep a copy of the check and a record of the date it was received from the customer and the date it was transmitted to the ins. co or returned to the customer

See Notice 10-05 for details.

4. I’ve already reminded you a lot about RR’s use of Social Networking Sites. Remember that you have to deal with compliance on this issue if your personnel discuss their services on sites like Facebook.

See Notice 10-06 for details.

5. FINOP’s should review the details of the following Notices:

a. 10-12 on changes to line-item reporting on FOCUS (guidance on FAS 167)
b. 10-15 on new requirements for subordinated loans to BD’s, including new standard forms that can be used (*remember that changes to the terms—even maturity—of outstanding sub loans will be subject to the new rule requirements)
c. 10-21 on consolidated rule 2261: When the Company is party to an open transaction with another FINRA member, or has on deposit cash or securities of another member firm, it has to, if requested by the other firm, deliver the Company’s most recent balance sheet (FOCUS) in either paper or electronic form. (This is not required for non-member customers unless the firm holds customer funds/securities)

6. If you provide consolidated financial reports (that contain information on various holdings, even those away from the firm) to customers, you have to have a review/approval process in place. Sources of information included on the statements should be verified and documented, unless pre-approved exceptions are made. You’ll have to make certain disclosures to customers about the statements; you may want to get a signed acknowledgment form from customers.
See Notice 10-19 for details.

7. Consolidated FINRA Rule 3240 concerns borrowing money from or lending money to customers. In certain instances, such as where the customer is also a member of a Rep’s immediate family, or is in the business of lending money/providing credit/etc., your firm does not have to require notification and pre-approval. Other lending arrangements always require pre-approval. If your procedures aren’t specific on this topic, or prohibit all lending arrangements with customers, you may end up getting in trouble for breaking the rule without understanding why. It’s worth understanding the requirements, since this is a very common FINRA disciplinary action.

8. FINRA has provided specific guidance on due diligence requirements for Reg. D offerings. You already know about these, but it’s worth reviewing revised procedures. Remember that if you contribute to PPM’s, you’ll be held to compliance with the advertising rules. You are also required to fill gaps in due diligence performed by others, if you perceive of them. You’ll want to document everything, including your vetting of outside sources of due diligence. Some of this guidance may apply to hedge fund offerings. Think about creating a stand-alone “Due Diligence Checklist” based on FINRA’s guidance. You may want to use it as a means of ensuring proper documentation.

See Notice 10-22 for details.

9. As of February 14, 2011, asset-backed securities are reportable to TRACE. Mortgage pool numbers may be used as identifiers.

See Notice 10-23 for details.

10. Effective November 1, 2010, OTC equity trades must be reported within 30 seconds of execution. The new reporting time frame also applies to trade cancellations that currently are subject to 90-second reporting, as well as stop stock and prior reference price trades. Firms are also required to report secondary market transactions in non-exchange-listed DPP securities within 30 seconds of execution.

See Notice 10-24 for details.

11. There is a new ODD supplement. You can find it here.

12. FINRA will phase in the REX system, which replaces its existing Reg. T system to collect Reg. T extension of time requests. The first effective date is August 23, 2010. There is a REX tutorial for those who are interested: REX Tutorial.

13. As of June 10, FINRA put into place a temporary program that permits it to halt trading otherwise than on an exchange—the ‘trading pause pilot.” It expires December 10, 2010. Under this pilot, FINRA may halt trading in individual securities where the primary listing market has issued a trading pause in that security due to a move of 10 percent or more from a sale in a preceding five-minute period. Halts apply to all trading, including otherwise than on an exchange.

See Notice 10-30 for details.

14. SEC Rule 15c2-12 regarding material event notices (Muni securities) was amended and the changes are effective as of 12-1-10. The information that must be reported by issuers to MSRB now include new categories, and not all events are characterized as ‘material.’ Also, demand securities (like VRDO’s) are no longer exempt from event notice reporting. Because you have to inform muni customers of events listed on the EMMA portal, revise your procedures to show the new event categories. You may also want to add a list of voluntary event-based disclosures.

See MSRB Notice 10-20 for details.

15. I revised the annual Rep Questionnaire to include the topics of social networking and protection of information on personal devices such as cell phones and computers. You will see that revised form during the Annual Meeting process.

16. As of February 1, 2010, MSRB revised Rule G-37 (and G-38) by adding contributions to bond ballot initiatives/campaigns to the existing list of reportable contributions. The rule parallels the requirements of existing disclosure rules (de minimis exceptions for annual amounts $250 or less), except that there is no ban on municipal securities business as a result of contributions to bond ballot campaigns. Form G-37 was revised and should be used to report contributions when required.

See MSRB Notice 10-01 for details.

17. As of November 10, 2010, Rule 201 of Reg. SHO will be in effect. This is the new Circuit Breaker/Alternative Uptick Rule approved by SEC this year. Firms may not display any short sale order, absent an exception, at a price that is equal to or below the national best bid if the price of that security decreases by 10% or more from the security’s closing price as determined by the listing market for the covered security as of the end of regular trading hours on the prior day “circuit breaker”); likewise, in such circumstances, for the remainder of the day and the following day, short selling is permitted only at a price above the current national best bid. There are exceptions and trades meeting them must be marked ‘short exempt.’ As such, OATS will reinstate its “SX” value in the buy/sell code field.
The rule is found here.

For the Notices cited, go to FINRA Notices or MSRB Notices for specific links.

Work hard! Relax harder!

ESM: Another Provider

2010-08-05T11:29:00.000-04:00

Just wanted to let you know about another provider of electronic storage--for emails and other files: OneSecure Technology. From what I hear, they provide good service at a good price--especially for you small firms out there struggling to keep up the expensive cost of compliance.

Here is an overview of some of the support and compliance help the firm provides: The firm also offers other services aimed at the financial services industry: web site design and hosting, email hosting, email encryption service, social media archiving / controls, data protection and back-up, web filtering (control web access to Facebook, other websites), and network security.

Required attestation lettes: format and access Supervisory Lexicon - monitoring tools for flagging electronic communication containing potential compliance violations; assigns them for further review
Contacts for support, training and system URL’s
Email Set up Documentation
Email Admin Interface Training
New Client Communications
Email Archive Admin Training
Archive End User Training Documentation
Product Documentation for Companies written Policies and Procedures
Mock Audit run through

Don't forget to keep your CRD notifications current: if you switch providers, you have to file a new notification in Forms and Filings/Financial Notifications/Electronic Storage Media and you have to upload new attestation letters.

Wow, this subject has a way of spoiling a good mood. Yikes.

Changes to Broker Check: Update Rep Complaint Filings!

2010-08-05T11:17:00.000-04:00

If you've been reading your Notices (10-34 and Info Notice 8-3) you know that Broker Check will, as of August 23, display complaints that are older than 24 months and that haven’t been settled or adjudicated, or that settled for less than the prior, respective U4 disclosure threshold. There are other changes, too...here's a full summary of the changes, courtesy of FINRA:

The SEC approved amendments to FINRA Rule 8312, which governs the release of informtion through Broker Check. The amendments:
(1) make publicly available in Broker Check all historic customer complaints that became non-reportable after the implementation of Web CRD;
(2) permanently make publicly available in Broker Check information about former associated persons of a member firm, as reported to CRD on a uniform registration form if they were (a) convicted of or pled guilty or no contest to certain crimes; (b) subject to a civil injunction involving investment-related activity or found in a civil court to have been involved in a violation of investment-related statutes or regulations; or (c) named as a respondent or defendant in an arbitration or civil litigation in which they were alleged to have committed a sales practice violation, and which resulted in an award or civil judgment against them;
(3) expand the Broker Check disclosure period for former associated persons of a member firm to 10 years from two years; and
(4) codify FINRA’s current process for disputing the accuracy of (or updating) information disclosed through Broker Check.

For instance, if one of your Reps had a customer complaint that was reported on U4 3 years ago, but was never resolved—say it faded away, for instance, because you or the Rep never heard from the complainant again—that complaint currently does NOT show up on Broker-Check. As of August 23, it will show up. It’s status will show ‘pending’ if it remains pending.

It is in your Reps’ best interest to make sure their historic complaint disclosures are accurate. For instance, if a complaint was resolved but the CRD record was never updated to show that, then now is the time to do it.

FINRA is being helpful (and Allison in Disclosure was extremely helpful in explaining all this!) by looking at ALL historic complaint filings to determine which are ‘pending’ and may be subject to updating. For any such complaints identified as pending, they will issue either a disclosure letter for the individual Rep, or they will batch the occurrences in a new category of disclosures letters issued to the firm, itself.

Here’s what is important: make sure you are set up to receive notifications of outstanding disclosure letters...that way, you and your Reps can address the status of prior DRP's in order to make changes, if necessary. Also go into Organization in CRD Main and look for the new ‘disclosure letter’ category. Later this month check that link to see if FINRA has batched 'pending' complaints for your review. NOTE: for right now, they will not send you notification of batched disclosures letters--there's no mechanism for that presently.

Good luck.

Your Voice (My Discretion)

2010-07-17T10:44:00.000-04:00

I finally enabled comments on this little blog o'mine. Don't be shy. Anonymous parties welcome.

(But remember that I have first right of refusal.)

Talk to you soon...

Oops...forgot to add this link: Bill Singer's Opinion

2010-07-16T12:08:00.001-04:00

Here is What Bill Singer Has to Say on the subject of the election and proxy proposals. (Not the $5 minimum stuff...although it's funny reading... rather, Bill's personal message below.) If you generally like Bill's take on things, maybe you'll trust his judgment on the candidates and proposals.

"Too Bad I'm Not a FINOP" or "Higher Compliance Costs for Small Firms"

2010-07-16T11:47:00.002-04:00

Rumor has it--because that's all we have to go on, here, rumors--that FINRA is moving all firms to monthly FOCUS filings. Seems to me they are starting with the smallest firms. The ones that have a $5,000 minimum, keep their net capital well above that, don't hold customer funds or securities, and pose no threat whatsoever to nation's financial security. Yes, those firms that already pay an extremely disproportionate share of their earnings on compliance will now be forced to spend more money and time reporting to FINRA about numbers that make no difference to anyone. Okay, maybe some 'small' firms (150 reps or fewer) should have their books examined monthly. Maybe if they are at risk of going out of business in this terrible economy, some customer, somewhere, would be inconvenienced by having to talk directly to the clearing firm for a few weeks instead of Mr. Little BD. But for micro-firms that don't have 'customers' per se, but only introduce sophisticated investors to private investment opportunities? Or who send applications and checks to investment companies on behalf of their small town clients? Why does FINRA need to see their bank balances every month? Especially those firms that have been in business for many years and that are consistently in net capital compliance? I don't get it.

If I'm missing something, please write me and tell me. In the mean time, I'll keep thinking this is another nail in the coffin for tiny BD's, who will now have to pay their bookkeepers/accountants/FINOP's more money and who will have to spend more time responding to inane requests from coordinators every month. Some say FINRA wants to completely weed out small BD's, that it's not profitable for them to have these firms as members. Well, yes, if they keeping adding to their costs by imposing more needless regulatory scrutiny over these firms, it does become quite cost-ineffective*.

Which brings me to another question: why are they being secretive about this?? As a member of a club, aren't you entitled to know the club rules? Shouldn't all firms right now be made aware of this coming change, rather than be surprised by a sudden announcement from the District, with no specific explanation of the required change? And how about explaining the roll-out strategy: who goes first? and why? C'mon FINRA, be fair about this. Give small firms a chance to prepare their staffing/budgets for the change. And give'em a good reason for doing this (okay, maybe that's too much to ask).

*Have you, too, received correspondence from FINRA staffers written/sent out in the wee hours, including on weekends? Those folks are definitely overworked.

Get Involved
And for those of you who follow and participate, as members, in FINRA's election process, remember (from recent Election Notice): "The Financial Industry Regulatory Authority, Inc. (FINRA) will conduct its annual meeting of firms on Thursday, August 12, 2010, at 10 a.m. in the FINRA Visitors Center, 1735 K Street, NW, in Washington, DC. The purpose of the meeting is to elect individuals to fill the seven Elected Governor seats on the FINRA Board of Governors (FINRA Board) and to vote on proxy proposals submitted by a member firm." The link provided includes information on each candidate.

The proxy proposals are getting a lot of attention, including from the dissident community. Some reading and resources:
The SIPA blog on the proxy proposals
Investment News article about FINRA's recommendation to vote AGAINST the proxy proposals
Site for members to vote on the proxy electronically

Mr. or Ms. Micro Firm, maybe it's time to speak your mind. I mean, really, all this brown-nosing: where has it gotten you?

New Reg. Category for Operations Professionals: Let's Be Clear About This

2010-06-03T13:47:00.001-04:00

Notice 10-25 solicits comments on a new registration category for "Certain Operations Personnel." I only wish they'd have called them "Operations Supervisors" so as to limit the hysteria sure to result when folks hear about this. Okay, maybe I'm the only hysterical person in the room. Consider me a bellwether. (Mais, je prefere "belle-weather.")

Here are two excerpts from the Notice that should calm everyone down:

"Persons subject to the new registration category generally are those persons who are directly responsible for overseeing that tasks within the covered functions are performed correctly in accordance with industry rules, firm protocols, policies and procedures, and who are charged with protecting the functional and control integrity of the covered functions for the firm."

and

"The requirements would not apply to persons who perform a covered function, but whose responsibilities are below these three specified levels, or persons who perform a function ancillary to a covered function or whose function is to serve a role that can be viewed as supportive of, or advisory to, the performance of a covered function, such as internal audit, legal or compliance personnel. Also, the requirements would not apply to persons who are engaged solely in clerical or ministerial activities in any of the covered functions."

It seems to me it's all about supervisors and those with control. I guess after the comments are received and addressed, we'll have convincing clarity on this, as we normally do when a rule is made effective.

[throat clearing sound]

Alright, maybe there is room for worry, in the end...another quote:

Importantly, those persons subject to the new Operations Professional registration category would be considered associated persons of a firm irrespective of their employing entity and would be subject to all FINRA rules applicable to associated persons and/or registered persons.

So, just like outsourced professionals who are doing work requiring registration and qualification, employees of parent companies, affiliates, etc. will be treated as if they work for the BD. Ah, the long arm of the law gives a bear hug to your whole enterprise...

I'm done for now. Three blog entries in one day? Gotta get back to work.

New CCO Reg. Category

2010-06-03T13:27:00.001-04:00

Quick note on proposed Rule 1230(a)(4). Reference: Notice 09-70.

The rule makes a stand-alone registration category for Chief Compliance Officers, which will require a new qualification examination. Here are some reminders:

If you are already on Form BD as CCO when the rule is made effective, you'll be 'grandfathered' and won't have to take the new test. You will be registered as CCO via a U4 amendment.

This includes any person listed on Form BD, such as co-CCO's and limited principals filling that role.

If you are added to Form BD after the effective date of the rule, but before the new examination is available, you will likewise be grandfathered, BUT only if you hold a 24. That is, if you are a limited principal and the firm adds you as CCO in this interim period, you will not qualify for the freebie CCO registration--you'll have to take the 24 or wait and take the new CCO exam.
If you are added to Form BD after the effective date of the rule and after the new examination is available, you will have to pass the exam first before your CCO registration is approved. Even if you have a 24...it won't matter.

So think about this and plan accordingly. I'm not sure when the rule will be approved. See this link for links to Comments about the proposal.

The Difference Between June 1 and June 2: Red Flags Rule Delayed AGAIN

2010-06-03T13:06:00.002-04:00

June 1:
>The effective/enforcement date of FTC's Red Flags Rule, whereby you, my broker-dealer friends, had to put in place an Identity Theft Prevention Program.
>The date by which I (against my better judgment/procrastination instincts) worked my buttocks off in an attempt to customize/deliver FTC's neat-o PDF customizable 'low-risk' form.
>The date before which, if a regulatory body were going to announce a delay in enforcement of the Rule, said regulatory body should have announced a delay of said Rule.

June 2:
>The date after which you, my broker-dealer friends, put into effect your IDTPP's, after having struggled to customize either FINRA's template or FTC's 'customizable low-risk form.
>The date after which we all collectively considered this topic done/handled/put to rest and happily forgotten about it.
>The date we got notice from FINRA that the enforcement date of the Rule had been delayed AGAIN...now to Dec. 31, 2010.
>The date, perhaps, you and I both swore under our breath something profane and un-American.

Here is the announcement, in case you missed it:

The FTC has again delayed enforcement of its Fair and Accurate Credit Transactions Act of 2003 (FACT Act) Red Flags Rule, from June 1, 2010, to December 31, 2010. The delay will allow Congress to consider legislation limiting the businesses covered by the rule. If legislation passes with an effective date earlier than December 31, 2010, the FTC will begin enforcement as of that effective date.

Firms subject to this rule—which include most broker-dealers—must have in place by the FTC enforcement date a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

As a reminder, FINRA has developed an optional template that firms may use as a guide when fulfilling their requirements under the FTC's Red Flags Rule. You can find more information about the FACT Act regulations in Regulatory Notice 08-69.

I won't start babbling about how I think this Rule is redundant and how the criteria for determining applicability is being interpreted in a bogus way. You can always search the subject on my blog to read more. But why bother? Let's just forget this all happened. And let's hope the Rule NEVER gets enforced for you BD's who are already, under AML rules, required to act as law enforcement and root out any nefarious attempts to usurp identities (even if they're not terrorists).

What a Difference a Day Makes: No, what a difference two weeks would have made! Now that kind of lead-time would have been appreciated! (Here I am again, Daydream Believer.)

S(M)ocialware, E(?)-Learning, Report C/Enter, Proposed Rule 20Fuzzy

2010-05-21T11:56:00.000-04:00

Just commenting on some miscellaneous topics. Variety is the spice of life.

S(M)ocialware: The company "Socialware" (which recently partnered with Smarsh) offers compliance tools for social media. If you are brave enough to allow your Reps to use tools like Linked In, Facebook and Twitter to expand their business, then you should check out this vendor's products. As you know, archiving and monitoring those types of communications is required, and, the fact that I am an ITiot, I can't fathom managing that compliance without some sophisticated help. I see on their website that they will be at the May FINRA conference in Baltimore. Check'em out when you're there. (PS: Here's a link to a free, interactive webcast on the topic of advisers using social media sites as business communication tools... June 2 webcast).

E?-Learning: Let me commence by stating unequivocally that the people who work in FINRA's E-Learning department are wonderful---> helpful, dedicated, pleasant. I appreciate them with my entire being. [pause] BUT: oh-em-gee. Having just gone through the process of setting up a firm's reps for participation in E-Learning in order to meet C/E firm element assignments, I have to surmise that the regulatory body formerly known as NASD did not do proper due diligence when choosing a programmer for their newly (?)improved FINRA Education online system. From start to finish, the system is crazily inefficient and cumbersome. To choose "Mandatory" for an assigned course, you can't just type the word, or choose it from a drop down menu--instead, you have to click/search/type/click/etc. before the magic word "Mandatory" appears in the box. Adding courses to a Rep's training plan is equally puzzle-like...instead of a list or drop down menu to choose from, you have to search for specific course names. I have more nit-picks but this is getting boring...take it from me, give yourself mucho time to set up Reps' training plans if you intend to use this system. And don't blame our friends at E-Learning: they really are great.

Report C/Enter: FINRA now offers a 'continuing education regulatory element report' on Report Center. It is a quarterly report that shows how your firm's Reps perform on Reg. Element testing, compared to industry averages. You may want to incorporate this report into your C/E needs analysis process. Check it out on Report Center in Firm Gateway (you won't see a report listed if there were no Reps who took Reg. Element training in the prior quarter).

Proposed Rule 20Fuzzy: --'er, I mean, 2040. See Notice 09-69 for a description of the proposed rule, which concerns payments to unregistered persons. What everyone is always hoping for is crisp rule language on paying people like finders. For now, it's fuzzy, and according to the Notice and thoughtful comment letters, it will remain so. I suggest you read a few of the comment letters, like the one from NASAA and the one from Morgan, Lewis, to understand how this Rule, as proposed, will provide no clarity on this issue. (Wanna pay an unregistered finder? Hire a legal team to prepare an opinion of counsel that, by relying on specific regulatory guidance, no-action letters and interpretations [not rules, mind you!], justifies how your payment will not subject the recipient to SEC registration. ...G'luck with that.)

Gee, I wish I weren't so critical, cynical, analytical and generally bitch-ical. But seriously, can you blame me?? Enjoy your sunshine and your weekend--may it be varied and spicy.

SEC's Model Form Builder: What's Up Doc?

2010-05-13T16:04:00.000-04:00

I'm so happy I started this process seven months in advance. By December, I should know how to properly customize SEC's new "model form" privacy notice (see earlier blog entries). Reminders: here is the link to the site with the links to the model forms--Form Builder Site; and here is the link to instructions for customizing the forms.

The forms are a great idea and would be very useful IF they didn't create substantial frustration when attempting to fill them in. Certain fields don't accept the information you want to include; other fields are too small to accept your chosen disclosures; lines or fields that may be omitted (according to the instructions) can't be; and, well, I generally fear that small firms not well-versed in Reg. S-P and the Fact Act will not be able to customize the form correctly. On the "Reasons" table, is the answer Yes? or No?...situations where your affiliate IA markets to your BD customers using information you shared with it will necessitate considerations like, "Is the BD subject to the Fact Act?", "Is the IA subject to the Fact Act?" and "Does the affiliate use personal information in a manner that requires an opt out?" Will micro firms know the answers? Will they even know the questions? Probably not. It's complicated stuff. And despite what the SEC thinks--that firms are supposed to be familiar with these rules (that's a paraphrase from my convo this morning)--you and I both know only the firms with the big-budget legal teams can feel good about what's in the fine print.

The form, quite simply, is not a user-friendly, prompt-driven tool for small BD's without legal departments or idle word processors. I wish it were, it would save me time, too. But instead, I just spent all day creating Word documents with input fields (big enough fields!) and comments (explaining the choices) so that I can help my clients adopt and complete the form without seriously profane outbursts (a friendly, grateful shout out to KN, whose "bite me!" did indeed fit into an SEC input field with no problem).

If anyone wants my Word forms, write me. I may accept modest remuneration for my efforts.

Oh, and perhaps you should think about using your old Privacy Notice, instead. My next research project is to understand completely what changed in Reg. S-P and how much effort it would take to simply revise my clients' existing forms. The dangling 'safe harbor' carrot presented by the Model Form may not be enough, in the end. Warn Bugs if you see him.

Back to the Subject of Real Regulation

2010-04-28T09:42:00.000-04:00

Now that I'm no longer watching C-SPAN 3's version of The Good, The Bad and The Ugly, here are a few reminders about real regulatory matters that are not being debated anywhere on TV:

INVESTMENT BANKERS: Remember: if you are an investment banker you can opt-in to the new IB exam by filing a U4 amendment instead of taking the Series 79 exam. But you only have until May 3 to do it! See my July 30, 2009, entry for the details.

PRIVATE PLACEMENTS: For those of you doing private placements, check out Notice 10-22. The Notice, in my opinion, does not go as far as it should in clarifying expectations. It remains vague and incomplete. A few comments: they lay the responsibility for the PP Memorandum on the firm that prepared it or assisted in its preparation, but expect you to fill in any holes if you perceive them; if you didn’t prepare the PPM, you still have responsibility for any sales literature you distribute, whether or not you prepared it; and you may rely on counsel or syndicate managers to prepare the PPM and do due diligence, as long as you have confidence in that third party (and have documented your vetting process). Oh, and yes, you have to determine suitability of your investors—even if they are accredited. You already knew that, but now it’s official.
The Notice includes a list of due diligence topics. For those of you putting together offerings and charged with this responsibility, it would be behoove you to review the list to make sure you are currently addressing these areas of investigation.

PRIVACY NOTICES: As I noted in my January 28, 2010, entry, SEC has put out a 'model form' to use as your privacy notice. There are difference versions, depending on opt-out options. Here is a link to SEC’s newly released Privacy Form Builder. This site provides links to the different model forms. If you do not use the model form, which assures safe harbor if customized correctly, then you must make sure your privacy notice conforms to Reg. S-P changes by year-end.

Drunk on Goldman Lemonade

2010-04-27T15:39:00.001-04:00

...and havin' a blast! Yes, I'm spending my day watching the Goldman hearing. I didn't plan to do this, it just happened. But I'm sure glad it worked out this way. I vacillate between hating the senators and hating the GS kids. And between loving the senators and loving the boys. Sometimes the conversation looks like my 17-year-old son trying to explain the difference between the music of Lil Wayne and P. Diddy to an 85-year-old Belarusian who speaks no English. The knowledge divide is immense! But there's plenty of CYA and political rhetoric to go around, that's for sure. I respect Mr. Sparks' attempts to explain the complexities of the market to his elders; I like Mr. Tourre's willingness to not rest on legalese; I get a huge kick out the predictability of Mr. Birnbaum's CYA-speak (he wins in this event); and the exasperated brevity of Mr. "Um"'s (forgot his name) responses. There's nothing new about this showdown and it was very easy to explain it to my teenage boys (who watched with me for quite a while, much to my surprise): I mean, c'mon, politicians expressing disbelief and anger at these apparently unethical, greedy players versus slick, coached, extremely experienced and smart professionals defending their daily grind and covering for their employers?...not hard to explain. They could be speaking Farsi and we'd all still get it.

My problem is, I see both sides. I respect the skill of Wall Street bartenders, but I, like many, have suffered thanks to their concoctions. They made great lemonade, as Mr. Sparks said, but it was folks like me and my neighbors that were left to suck the lemon rinds.

And yet, can I trust our DC reps to sort this out and come up with the best answer? I'm not that drunk..

Our Top Five Unsuspicious States

2010-03-11T13:52:00.002-05:00

Or is it our bottom five suspicious states?

FinCEN's "By The Numbers" report from January shows SAR-SF reporting summary totals from 2003 through June 2009. SAR-SF's are forms filed by securities brokerage firms and other non-depository institutions (non-banks). Here are the states with our nation's most trusting brokers (or most honest investors, depending on how you look at it), in order of fewest SAR-SF's filed since 2003:

Alaska (!! How can they be that unsuspicious? Is there no check fraud, mail fraud, insider trading, or at very least, forgery, taking place up there? I'm suspicious...)
Wyoming (1 SAR-SF filed since 2003 for check fraud. I hope it was against Cheney.)
Hawaii (5 total: 1 for embezzlement and the others for other... you can't trust surfers...or maybe you can...)
Rhode Island (twice the population of Wyoming living on 1/100 the land mass and only 4 more SAR-SFs? Obviously the most trusting lot on the East Coast. We should all move there.)
South Dakota (Hmmm. How can they have filed 10 SAR-SF's to date more than Alaska, a state full of corrupt politicians and crazed hunters with helicopters? I'm still suspicious...)

I skipped non-states in my list, such as District of Columbia. DC beat SD with fewer SAR-SFs. WHAT?? Wait, DC has 600,000 people living there, most of them working for the government (okay, that might not be technically true), and these numbers make it look like Mayberry RFD. What do these numbers mean: are there no BD's, CPO's, CTA's, FCM's, IA's or other such financial institutions in DC, resulting in the dearth of filings? Or is everyone in DC really, really honest, their activities arousing no suspicions? (Uh, did I just say that?) Or does everyone in DC have each other's backs?--oh wait, I may have stumbled onto something. Hmmm. Again, I'm suspicious.

Oh, in case you're wondering, NY has the highest number of SAR-SF's filed to date. Ho hum.

And once again, the type of suspicious activity near the bottom (ranked 20 out of 21) is--yes, that's right--Terrorist Financing! The reason you're all in this mess called AML compliance represents less than 1% of all SAR-SF's filed to date--206, to be exact. The SAR Activity Review offers a lot of information on the growth of mortgage loan fraud as a reported event, but nothing on how all these SAR's are fighting terrorism. But then again, we now know that it's not about that anymore.

________________________

As for bankers and their customers: completely different story. Alaska redeems itself in that race, with the second highest number of SAR's filed from 1996 through June 2009. Now that's what I'm talkin' about! Wyoming is still pretty unsuspicious, ranking 48th out of the 50 states (but that doesn't absolve Cheney of my personal suspicion); and surfers, believe it or not, turn out to not be so trustworthy (Hawaii ranks 30th). South Dakota (23rd) has thousands more SAR filings by banks, but still looks good compared to Alaska; and lastly, I still think it's a good idea to move to Rhode Island...38th of the 50 states.

The good news for New Yorkers is that California outdid them in the SAR's-filed-by-banks competition: CA has more than double NY's filings.

And yes, Terrorist Financing ranks equally low in these filings, just like with SAR-SF's: second to last with less than 1% of all filings. Sigh.

_________________________

Here are the links to my resources. I suggest you take a look, so you can glean useful information (as opposed to useless information like the kind I presented above). The last link is especially valuable for you AML Compliance Officers and auditors.

FinCEN's News Release on the Jan. 2010 By The Numbers Report

FinCEN's SAR Activity Review--By The Numbers Jan. 2010

FinCEN's SAR Activity Review, October 2009

Reminders, My Friend, Are Blowin' In The Wind

2010-03-03T15:09:00.004-05:00

Having survived a wind storm and a semi-annual procedures update process that nearly killed me (the update, not the wind storm), I am resurfacing to provide a few reminders:

1. R.I.P. Webcasts: After March 31 you will no longer be able to view Webcasts on FINRA's website. All of the prior content is included in other offerings, such as Video E-Learning or plain-old E-Learning courses. But, well, you have to pay for those. Webcasts were free. All's fair in love, war, and a crappy economy.

2. TRACE: Agency Debt Securities became TRACE eligible on March 1, as did certain primary market transactions (those that qualify as list or fixed price offering or takedown transactions). See Notice 09-57.

3. New Capital Compliance Rule: As of February 8, the new financial responsibility rules became effective (FINRA Rules 4110, etc.). Many of the restrictive rules apply to "carrying or clearing firms"--but look at the footnote in the rule and you'll see that they also apply to firms with "k2i" accounts--you know, the account you have set up so you can receive checks from customers for mutual fund and other purchases? This new rule requires, for instance, that your firm must obtain prior written approval before withdrawing any capital that exceeds10 percent of the firm’s excess net capital in any rolling 35-calendar-day period. This includes withdrawals of profits, routine dividends and similar distributions. Wow. For small business owners who take profits this way, this rule seems extremely onerous. See Notice 09-71.
As for the answers to these extremely logical questions: 1) "To whom do firms request approval?" and 2) "How long does FINRA have to grant approval?", well, the answers were not easy to find... in summary: 1) Eventually there will be an electronic request process on Gateway, but for now fax or email your District Office, and 2) In your communication to the District, inform them that you will be making the distribution in x days in the absence of a response from them. In the published Response to Comments on these rules, it states,"[...] requests for withdrawals can be handled in a routine manner and that decisions typically would be issued in approximately three business days": how's that for clarity?!
[Allow me for a moment to express frustration with FINRA for making a Rule effective without having a mechanism in place for allowing firms to comply with the Rule--and for not providing this basic, administrative information to all firms in an easily accessible, publicly-available place (like the Notice??), rather than burying (half of) it in filing documents not regularly visited by most compliance staff. And what-up with making pleasant, good-intentioned, helpful folks like moi feel wrong for asking presumably easy questions and expecting to get answers? What's wrong with regulators saying, "I don't know" or "We're still working on that" or "Three days, but sorry, we didn't put that in the Notice"? ... ugh. P.S. I'm thankful to Estee Dorfman Foster (CPA/outsourced FINOP) for her assistance in finding answers.]

4. Variable Annuity Rules: As of February 8, the formerly-delayed parts of FINRA Rule 2330 became effective. Principals now have 7 days to review recommended v/a purchases and exchanges. There are changes to customer funds rules, too--because if you held a customer's check during that 7 days, you would have otherwise broken SEC customer funds rules. Check out Notice 10-05 for fresh guidance on these changes.

5. AML Madness: FINRA released its updated AML Small Firms Template in January... it is full of wonderfully--wait, not wonderfully, but rather, dreadfully--legalistic text changes that would drive any technical writer crazy. I'm proud to say my template is still better than theirs. You should look at your AML program and FINRA's updated template to assess the time it will take to make corresponding changes; then you should drown your sorrows in a stiff drink (or call me!). See here for a link to the template in Word format. Oh and remember that as of January 1, you may no longer have someone in your small firm conduct annual independent testing if that person has a conflict of interest (you used to be able to rely on a loophole--it is gone). For this rule change, see Notice 09-60.

6. 3012/3130--Testing & Verification: For most of you, it's that time of year again--in fact, this is the 5th time you have to follow these rules since inception! This should be easy by now...You have to test and verify your supervisory system. And write a report. And write another report about the process of writing the report. And sign a certification. And put the whole shebang in a file drawer and hope no-one ever asks for it (...but they will). Remember, your reports and certifications are due w/in 12 months of last year's. It's not a calendar year requirement--it's every 12 months by the anniversary. Here is a link to regulatory information on supervisory controls.

7. Short Sales Rule Change: Mary over at SEC approved a change to Reg. SHO, affectionately called the "alternative uptick rule" that restricts short selling in stocks that have dropped 10% in price in one day. Effective Date: May 10, 2010; Compliance Date: November 10, 2010. See link to Reg SHO change for 334 pages of bedtime reading. I'm getting sleepy just thinking about it.

8. TARP Warrants: How do we describe these nouvelles choses? Warrants (that's what they're called)? Options (they're priced like options)? Corporate securities (they're issued by corp's)? Government securities (they were issued to Uncle Sam--is he backing them in the secondary market)? Ask 4 people and you'll get 4 different answers (ask me and you'll get a frustrated shrug of confusion and disgust). Stay tuned for the answer.

FINRA has released its March 1 examination priorities. Review it and weep. You have work to do.

Your Moment of Optimism: 17 days till Spring!

Social Networking Compliance: A Resource

2010-02-01T10:46:00.000-05:00

I'd post this on my Wall, but none of my FB friends would understand it!

Got a follow-up email to my last post on this subject from a reader--a firm in Austin, Texas that may have just the tool you need to keep up with FINRA's demands. Check out Socialware's "Risk Manager" product. On the surface, Socialware seems to have developed something useful and, importantly, something designed specifically to meet regulatory guidance.

To allow Reps to use social networking sites as tools to build business might be the best idea of the 21st century--but it carries with it a commitment of both money and time (even an affordable automated surveillance program will require concerted attention by a Principal). The way you balance the need for online networking and the need to budget time and money will determine whether you take this leap.

Some due diligence considerations: Socialware's product is brand new with a limited number of users; the loyal following may consist more of non-FINRA-regulated firms (that is, IA's and others) and therefore may not have been tested yet by examiners; and I'm told the per user charge is small but I don't know about set-up/installation/training charges.

I think it's worth checking out. Tell'em I sent you, K? And please report back with feedback. I'd love to think this is the answer BD's are looking for.

Identity Theft and Privacy Notice

2010-01-28T10:46:00.000-05:00

As you know I'm not happy about the ID Theft/Red Flags rules for introducing firms that offer margin accounts through their clearing firms. Doesn't make sense that these firms are considered 'creditors.' But don't get me started on bad rules that require time, money and effort for the sake of token compliance. Yuk. But a trusted informant from another consulting firm told me that FINRA is obsessing about compliance with these new rules--even though they don't take effect until June 1 and even though FINRA does not have authority to enforce the rules (FTC does). So gear up. Read this Notice Red Flags Rule and Template Procedures and customize the template FINRA provides.

On Privacy (wait, why is this separate from ID theft: isn't protecting customer information all under the same umbrella? Ugh. Whatever.): I came across this, about changes to Reg. S-P: eCFR Link to S-P Amendment. The Reg change eliminates the 'sample clauses' that most of you are using in your Privacy Notices right now. After this year, you won't be able to use those clauses to meet the disclosure requirements under Reg. S-P. Rather, there is a new 'model privacy form.' As of 2011, firms must either use the model form or be sure that their custom privacy notices meet all Reg. S-P criteria. You don't have to wait until 2011--the model form may be used now, and will give you the comfort of knowing your notice meets federal requirements (i.e., it is a safe harbor). You may want to begin the process of switching over from your currently-used notice.

There are two versions of the new model form: Notice with Opt-Out and Notice without Opt-Out. You'll want to decide which is right for your firm and then customize it. Remember, Privacy Notices are NOT required for institutional customers; for individuals, you must deliver the Notice at account opening and yearly thereafter.

Now go forth and confidently protect the privacy and identies of your customers. And do it in a well-documented fashion. Or else.

Social Networking Sites: Word to the Wise

2010-01-28T10:27:00.000-05:00

FINRA has put out guidance on the topic of social networking sites (SNS). The explosion of electronic communications in many forms has made it difficult for BD’s to know how to follow SEC books & records rules. It used to be straightforward, but with tools like Facebook & Twitter, it’s tough to decide what constitutes categories like advertising, public appearance, correspondence and recommendations. I suggest you read Notice 10-06 (it’s not long!) so you are aware of FINRA’s concerns.

What FINRA wants is this: if your Reps or the Firm itself use SNS’s for business purposes, then you have to be able to supervise all postings, whether they are ‘static’ (like profiles or wall posts) or ‘interactive’ (like chats or interactive posts with third parties), and you have to be able to store all that content under SEC books and records rules (17a-3/a-4). Pre-approval of anything considered an ‘advertisement’ (the static content) is required; pre-approval is not required for interactive content, but all other requirements apply to that material.

Sound like a big job? It is! Word has it the bigger e-mail storage vendors are working on products that firms can use to meet these requirements (automatically saving the online content and providing an automated review tool for monitoring it), but I can imagine those products will not be cheap. And it’s harder to imagine small firms being able to adequately meet the supervision/r-k requirements on their own.

So, if you are going to allow Reps to participate in SNS’s, you HAVE to implement procedures to meet FINRA’s guidance. And you HAVE to follow those procedures.

If you would rather avoid this administrative challenge & expense (and the related liability of allowing the activity), you will have to be clear about your expectations of firm personnel. Make sure your procedures include a prohibition of this activity; it would also be smart to send an e-mail reminder to everyone at your firm. I suggest:

Our firm strictly prohibits you from engaging in business communications in a social media site (such as Twitter, Facebook and Linked-In, among others). Your participation in such sites must be for purely personal reasons. You may not present yourself on such sites as a representative or agent of the firm: to do so is considered “advertising” and requires pre-approval by our compliance staff. Likewise, on such sites you may not recommend securities or engage in discussions about securities or the firm’s business. Lastly, you may not: link to third party material relating to securities; assist third party site participants in preparing such material; or comment on/endorse third party posts on such material. Our firm may from time to time request access to your social networking sites in order to spot check them for compliance with this prohibition. Perceived violations will be met with disciplinary action.

No matter how you word it, the message should be clear--personnel may not use these sites for business purposes: to do so immediately puts your firm at risk.

AML: P.O. Boxes for Address Confidentiality Program Participants

2010-01-14T12:11:00.001-05:00

I just read about FinCEN's position on the subject of customers who are participants in Address Confidentiality Programs (ACP) and how firms can comply with CIP 'street address' rules for these customers.

To back up: right now, if you're meeting CIP requirements for a new customer, you are gathering a residential or business street address for that person; if the person gives you a P.O. Box, you kindly ask for a street address for the records, but promise to use the P.O. Box for mailing and other business purposes. That's great.

But what if your customer informs you that s/he is participating in an ACP in order to protect his/her confidentiality? These programs are State-run and help to protect victims of domestic violence, sexual assault or stalking. The customer gives you only a P.O. Box address, in keeping with ACP standards. What do you do? You have to comply with CIP rules and your firm's internal procedures, but you want to honor your customer's right to self-protection.

Well, your answer comes in FinCEN Ruling FIN-2009-R003. In this Ruling, FinCEN explains that CIP rules allow customers who do not have street addresses to provide a "residential or business street address of next of kin or of another contact individual." In this case, however, the customer does have a street address, but s/he is keeping it a secret on purpose. What FinCEN has done is made an exception to the CIP rule in this instance. They will treat the ACP participant as not having a street address. In our example above, you would record the P.O. Box of the customer and also collect the street address of the ACP sponsoring agency (such as the Secretary of State or other state agency administering the ACP). That street address will meet the CIP requirement. In essence, the entity administering the ACP will serve as the agent of the customer for CIP purposes.

Obviously, you are required to reasonably believe that you know the true identity of your new customer: if the person gives you an ACP address, risk-based thinking will compel you to check on that address, just in case. Not all states offer these programs--I found this table, which has updated information through Jan. 2009: States with ACP's .

**********

One more thing: I have seen examiners looking for OFAC checks on new associated persons. I haven't researched the rule calling for this, but it may be a good idea to incorporate this procedure in your hiring/registration practices. Run the check, put the results in the personnel file.

We Have a Winner! (clarification on subject of k2i a/c and fin. resp. rules)

2010-01-06T16:54:00.001-05:00

And the Snuggie goes to: a kind gentleman at FINRA who called me back TODAY and pointed to what I should have reviewed in the first place: response to comments and amendment 2 as they relate to the original rule filing.

In summary, even if your firm is a subscription-based mutual fund retailer--not a clearing firm and not a carrying firm--you still fit into the category of ''carrying/clearing members' if you have an account for the exclusive benefit of customers as described in paragraph (k)(2)(i) of SEA 15c3-3. That is, if you receive and deposit customer checks in an account you control, you're in this category for the sake of rule compliance. It's a customer protection thing, so they say.

So review Notice 09-71 again, and remember that all of these rules might apply to you, even if you think they don't (or shouldn't).

Going home now to put on my own Snuggie. Brrrr.

Happy Oh-10: Financial Responsibilty Rules and New CCO Exam Proposal

2010-01-06T08:41:00.000-05:00

Was just reading some Notices and had a few comments:

1. Financial Responsibility Rules (see Notice 09-71): I'm a little confused about whether non-clearing/non-carrying firms with "k2i" accounts are or are not included in the category of clearing/carrying members for many of the new rules... footnotes in the Rules, the Notice and the Rule Filing all say: "Members Operating Pursuant to the Exemptive Provisions of SEA Rule 15c3-3(k)(2)(i). For purposes of this Rule, all requirements that apply to a member that clears or carries customer accounts shall also apply to any member that, operating pursuant to the exemptive provisions of SEA Rule 15c3-3(k)(2)(i), either clears customer transactions pursuant to such exemptive provisions or holds customer funds in a bank account established thereunder."

But the Rule Filing explains, in a Pg 36 footnote: “For clarification, introducing firms and firms with limited business models (for example, firms that engage exclusively in subscription-basis mutual fund transactions, direct participation programs, or mergers and acquisitions activities) are not deemed carrying or clearing members and therefore would not be subject to Proposed FINRA Rule 4110(a), or for that matter any of the other provisions of the proposed rules that would apply only to carrying or clearing members.”

But what if a mutual fund application-way firm has a k2i account established to receive customer funds? I sent an email to one of the Notice authors: I'll let you know what I hear. Or if you can shed light on this apparent contradiction, please write me and I'll enter your name into a drawing for a free Snuggie.

2. Proposed Changes in Registration/Qualification Requirements (see Notice 09-70): One of the changes creates a new category for Chief Compliance Officers--they'd have to pass a specific exam to hold that title. Those with a 24 and who are listed on Form BD prior to the rule taking effect would be grandfathered (no new exam nec.), but those assuming the role after that, even if they have their 24, would have to take the test. I was thinking that some of you principals might want to take advantage of the "multiple CCO" mechanism before they make this rule effective. That way, you will be on the Form BD as CCO in time, and won't have to take the exam. For instance, if you're a small shop with a just a few senior managers, and you originally flipped a coin to see who would serve as CCO, what happens if your existing CCO moves to Jamaica, leaving you with an obligation to pass a new test just to step into Mr. Sun-n-Surf's shoes? Or, perhaps you have a new employee who got his 24, but hasn't yet assumed the role of CCO that you're anxiously looking forward to handing over...you could appoint him co-CCO (dividing up responsibilities, of course, and outlining all this in your WSP) and therefore he won't have to pass the new test later.

Other reminders: Look at your final renewal statements and pay what you owe or request a refund (see excerpted FINRA help, below); do your FCS check by Jan. 27; and don't forget to do quarterly complaint filing by the 15th. And send thank-you notes to all those nice people who gave you xmas gifts!! Emails don't count!

Your compliance compadre,
Sharon

RENEWALS:
If your statement shows an ‘Amount Due’ (i.e., positive amount or debit balance), then your firm needs to pay the balance to FINRA by February 5, 2010.
 Print the statement. A copy of the statement’s first page should be included if your firm is paying with a check.
 See the "How to Submit Renewal Payment" section of this Bulletin or visit the Renewal Program Payment Options page on the FINRA Web site.

If your Final Renewal Statement displays ‘Paid In Full’:
 If your Final Renewal Statement’s ‘Paid In Full’ amount is equal to the amount owed for your Preliminary Renewal Statement then the balance is $0 and no additional payment is required.
 If your Final Renewal Statement’s ‘Paid In Full’ amount is less than the amount your firm paid for its Preliminary Renewal Statement then your overpayment has been systematically transferred to your firm’s Daily Account. Any refunds should be requested from that account. You may request a refund check from FINRA or leave the funds in your Daily Account for future registration-related fees.

To request a refund check, have an appropriate signatory sign the first page of the Final Renewal Statement and mail it to FINRA for receipt by February 5, 2010. Send your refund request to:

FINRA Registration Management-CRD Accounting
9509 Key West Avenue
Rockville, MD 20850

(301) 869-6699

Prepare Your Job Application

2009-12-07T14:23:00.000-05:00

I just read this: Investment News Article about Well-Paid FINRA Execs .

Does it explain this: Notice 09-68 about Fee Changes (and Renewal Increases) ?

and this: Notice 09-67 about Reg Element Fee Increases ?

Wow.

Change of Accountant?

2009-12-04T14:06:00.000-05:00

Hey, if you hired a new accountant to do your year-end audit, remember that you have to tell SEC about it. You can find the Designation of Accountant form at this link:

http://www.finra.org/web/groups/industry/@ip/@comp/@regis/documents/industry/p009841.pdf

Here is the delivery information I have:

Constance Jackson
SECURITIES AND EXCHANGE COMMISSION
mailstop - 6628
100 F Street, NE
Washington, DC 20549
fax # 202 772 9273
phone # 202 551 5526

My notes say this is due by December 10. So if you haven't done this yet, hurry.

Rule Reference: SEC 17a-5(f)(2)

SIPC Supplemental Report: Last Helpful Tip

2009-11-12T09:18:00.000-05:00

I'm getting bored with this subject, I have to admit... but I looked into something and thought I'd pass along what I learned.

The "e-4 report," or "supplemental report" required under SEA 17a-5(e)(4), is a newly-unearthed requirement for SIPC members (read my two earlier blogs on this if you're confused right now: Sept. 24 and Nov. 10). FINRA sent out a little blurb that stated, "If your firm is a SIPC member and has net operating revenues of more than $500,000, your firm's auditor must complete the SIPC Supplemental Report..."

A helpful reader (I have readers! and some of them are helpful!!) was looking for the source of that $500,000 threshold. I, being busy, promised to look for it, but he, being helpful, found it himself and forwarded me FINRA's 89-25 NtM...here is the link to that: http://finra.complinet.com/en/display/display_main.html?rbid=2403&element_id=1400

This old Notice includes an SEC no-action letter that describes the $500,000 threshold. But SEC uses the term "total revenues" and FINRA, in said Notice, uses the term "gross annual revenue." Both of these terms contradict FINRA's newest descriptor, "net operating revenues."

So I called a woman at SIPC who is smart and kind and--again, this word--helpful! She explained that yes, it is indeed "total revenue"--that is, before deductions--and that the SEC no-action letter is the only reference to that exclusion/threshold. You won't find it anywhere else. She also surmised that this new assessment equation will be in place for a while--so get used to it, folks!

If you work for FINRA and you are reading this, a) why are you reading my blog? and b) to be helpful (pay it forward), tell someone at your shop about this discrepancy/miscommunication, so that firms may do what is required without being confused.

Thanks to Mr. A.C., who inspired today's blog entry.

Procrastination Pays Off Again: Red Flags Rule Enforcement Delayed

2009-11-11T09:30:00.000-05:00

How did I miss this last week?? Received November 4...

"At the request of Members of Congress, the Federal Trade Commission (FTC) has delayed until June 1, 2010, its enforcement of the new Red Flags Rule. The rule requires most broker-dealers to have in place a written program to identity, detect and respond to patterns, practices or specific activities that could indicate identity theft ("red flags"). Enforcement of the Red Flags Rule, which implements a section of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), was previously scheduled to begin on November 1, 2009."

I wonder which "Members of Congress" we have to thank for this? Well, anyway, most small firms aren't pulling credit reports and don't have proprietary online account access systems that would be vulnerable to attack. So if you didn't put an Identity Theft Prevention Program in place by now, I understand why. And you know how I feel about introducing firms that open margin accounts being characterized as 'creditors' for the sake of this rule, right? Baloney. Let's hope with this third? fourth? delay, the enforcers-that-be will come to their senses on that topic.

SIPC Supplemental Report--Some More Help

2009-11-10T11:24:00.000-05:00

On that SIPC supplemental report I discussed back in September... got this (see below) from FINRA the other day. Two things to note:

1. The $500,000 threshold -- I had not noted this in my earlier blog. Probably because I didn't know about it. This will spare some of you very small firms from having to procure this report from your auditor.
2. The AICPA site includes guidance on the 'e-4 report'--check out the link, below.

From FINRA:

SIPC Supplemental Report Requirement This year, SIPC raised its member's assessment to .0025 of each member's securities business net operating revenues. If your firm is a SIPC member and has net operating revenues of more than $500,000, your firm's auditor must complete the SIPC Supplemental Report under SEA Rule 17a-5(e)(4) for fiscal years ending April 30, 2009, through December 31, 2009. Auditors must complete and submit the Report, together with the Annual Audit, or the Audit will be deemed deficient. For guidance on what to include in the Report, see the American Institute for Certified Public Accountants Web site--http://www.aicpa.org/download/acctstd/AppendixG_V3_ff.pdf .

AML Non-Compliance Back in the Day

2009-10-26T14:41:00.000-04:00

I just read FINRA’s release on the Scottrade fine, the one that alleges failure to establish and implement an adequate AML program to detect and trigger reporting of suspicious transactions.

Yikes!

The period of most egregious failure was from April 2003 to January 2005. Geez, back then, NASD’s testing of AML compliance consisted of seeing if firms knew what A-M-L stood for. It’s only in the past couple of years that FINRA’s examination program has raised its expectations…that is, instead of being satisfied that a firm had a program in place, they actually look at the components and consider their reasonableness. To look back at a period in which AML rules were brand new seems a bit unfair (I know—the Rule came out in April 2002--but CIP didn’t come out until October 2004, and this whole emphasis on REPORT! REPORT! REPORT! didn’t take shape until about two years ago). If their expectations were low back then, why is it okay to apply the heightened standard retroactively?

I don’t have any information on this case, so I’m reacting to the summary provided by FINRA. So I might not be fair, either.

But reading the summary leads to me a few other hysterical reactions—er, I mean, thoughtful considerations: Why was it unreasonable, in the early days of AML regulation, to assume that monitoring movement of money was a good means of detecting suspicious activity? Why was it unreasonable to let designated personnel like branch (front-line), cashiering (appropriate, non?) and margin employees refer suspicions to compliance? Why was is a bad thing that Scottrade got progressively more attuned to the challenge of AML monitoring and thus hired a risk management analyst to review its system and later developed a proprietary, automated monitoring system? Why is Scottrade being criticized, in this context, for not preventing ID theft and account intrusions back before 2007, when those hot topics were only in the early stage of regulatory focus (Nov. 1, 2009 is the effective date for compliance with the ITPP requirements under the FACT Act and to my knowledge, Reg. S-P amendments have yet to be made effective—email me if I’m wrong on this)? And Scottrade’s volume report being used back in 2006 to detect pump-and-dump schemes and unauthorized trading activity, but not to detect suspicious activity by bona fide account holders?... if NASD required this back then, why didn’t they tell them? I’m sure they were in there reviewing general and AML compliance every year.

I’m wondering, how much of this longed-for monitoring would have led to SAR reporting that would have resulted in actual cases proving terrorist financing? Was that factored into the findings? (Oops, there I go again, forgetting that BD’s are law enforcement agencies charged with uncovering fraud and tax evasion, too.) Or is this finding just a hypothetical exercise in retroactive nit-picking for the sake of making an example out of the ‘failure’ or – I’m not really a cynic – to make money?

I have to admit: I see small firms being examined on the bare basics of AML and I find that FINRA continues to be gentle with these small firms. It’s almost like ‘principle-based’ compliance, but not really. It’s more like, “Okay, you’ve met the minimum requirements under 3011, but don’t forget to get exception reports” and all ends well. Personally, I’m okay with this, especially in the context of very small firms with a limited business whose clientele is local and very familiar. To expect anything more than token AML compliance is wrong in those cases. For bigger firms, yeah, sure, take it to the next level—but don’t mix subject areas and don’t retroactively apply developing standards to a time when AML was new and little understood. Even for the big firms that’s not fair. They are slow-moving beasts and should have been afforded a learning curve.

I think I’m too tolerant. That’s my problem. The world might very well be a charred sinkhole had it been under my watch until now. Never elect me President*.

(*Attorney General, maybe. I promise I’ll follow in Holder’s footsteps. --here I go again, with that tolerance thang.)

Internal Testing of AML: Loophole Closed

2009-10-15T12:21:00.000-04:00

Just yesterday I was blathering about the loophole in NASD IM-3011-1, which allows firms to have internal staff do annual testing of their AML programs. This rule lets firms have someone in the AML chain of command do the testing. The way it was written was always a bit curious: as if meant to strictly limit firms, but with a nice rabbit hole to jump into to safely avoid the limitation. Don't get me wrong: I've been a fan of the loophole, since I tend to sympathize with really small firms that have to meet onerous, big-firm requirements....and that's who would have relied on the loophole until now: very small firms with no staff remote enough from the AML staff and supervisor (usually the same person) to be considered independent. Well, thanks to FinCEN, these small firms will henceforth have no choice but to pay up for their annual independent AML testing.

You see, in Notice 09-60 FINRA announced its recent slate of rule consolidation changes. One of those is new FINRA Rule 3310, replacing NASD Rule 3011 and its IM's. The rule essentially stays the same except for the removal of the independence carve-out.

Firms can still appoint an internal staff member to conduct the testing, but that person must absolutely meet the following requirements:

1. The person must not perform the functions being tested,
2. The person may not be the designated AML compliance person, and
3. The person may not report to either anyone performing AML functions or the designated AML compliance person.

So if your firm is big enough such that you have senior staff who do not get involved at all in AML stuff, and you have employees who are well-versed in BSA/other AML requirements who do not do any AML work, you should be able to continue to rely on in-house AML testing.

The reason for the change? FINRA blames it on FinCEN, which stated that "the independent testing provision of the BSA precludes AML program testing by personnel with an interest in the outcome of the testing..." Seems reasonable--if you believe that our current AML rules, regulations and applied guidance have proven useful in fighting terrorism and if you believe that it is the role of the broker and the brokerage firm to police its clientele. Might seem unreasonable if you closely run a very small firm with a local, familiar clientele and have seen the cost of compliance sky-rocket right along with the increase in regulatory expectations, and you now have to pay a third-party to come in and verify the obvious: you're trying hard to follow the rules.

(Oops. I let myself go for a second, there... back to the subject at hand...)

The rule change is effective Jan. 1, 2010. You tiny firms out there will have to find someone to do your independent testing next year. (This is not a sales pitch, by the way--could you tell?)

SIPC Assessments: Something You Might Not Know

2009-09-24T11:48:00.000-04:00

...but which your accountant should know.

Okay, so you know by now that SIPC assessments went from a coins-under-the-couch-cushions-amount ($150) to a revenue-based number (.0025 of annual net operating revenues). This change happened as of April 1 and there are new assessment reporting forms that apply: see http://www.sipc.org/members/members.cfm for links to the new forms: Form 7T (interim reporting) and Form 6 (general form used for semi-annual reporting/payment). Depending on your fiscal year end, SIPC will mail you the correct forms to complete. You will be given credit for the $150 you might have paid earlier this year. But be prepared to pay a bunch more: firms making millions in revenue will pay tens of thousands.

The last time SIPC imposed a revenue-based assessment was 14 years ago. When the SIPC Fund balance gets low (under $1 billion), they invoke their right to raise money this way. If you're feeling sorry for yourself, maybe because your investors are institutions or otherwise won't be relying on SIPC coverage anytime soon, here's the theory behind this universal assessment: your business is dependent on a robust market; that market consists of individuals—they drive the market by virtue of their investments. Without them you wouldn’t do the business you do. You therefore benefit from the retail market in the end. And you want those investors to have confidence, some of which is provided by SIPC coverage. So you pay for SIPC, along with every other broker, regardless of your niche.

Onto the meaningful part of this message...

When your auditor does your annual audit, he/she has to remember to do an 'e-4 report.' That refers to paragraph (e)(4) of SEC Rule 17a-5: 'Reports to be made by certain brokers and dealers.' Your accountant knows to what to provide to FINRA and SEC, based on years of service in this industry. But now that the SIPC assessment is based on revenues, he/she has to provide this new item, too--and he/she may not know about it. It's basically a 'negative assurance letter' and will include either a schedule of payments to SIPC or copies of the assessment forms that were filed for the period. The bummer is, SIPC does NOT address this on its members site....they say it's an SEC Rule, not theirs, and that's why...but hey, give a BD a break! It would be nice if they provided clear guidance on this. I guess that's why I'm writing this entry--to introduce the subject and suggest that you talk to your auditor to make sure he/she is prepared to comply.

Here's the text from the SEC Rule that applies (from http://edocket.access.gpo.gov/cfr_2002/aprqtr/17cfr240.17a-5.htm):

(4) The broker or dealer shall file with the report a supplemental report which shall be covered by an opinion of the independent public accountant on the status of the membership of the broker or dealer in the Securities Investor Protection Corporation (``SIPC'') if, pursuant to paragraph (e)(1) of this section, a report of the broker or dealer is required to be covered by an opinion of a certified public accountant or a public accountant who is in fact independent. The supplemental report shall cover the SIPC annual general assessment reconciliation or exclusion from membership forms not previously reported on under this paragraph (e)(4) which were required to be filed on or prior to the date of the report required by paragraph (d) of this section: Provided, That the broker or dealer need not file the supplemental report on the SIPC annual general assessment reconciliation or exclusion from membership form for any period during which the SIPC assessment is a minimum assessment as provided for in section 4(d)(1)(c) of the Securities Investor Protection Act of 1970, as amended.

The supplemental report, an original of which shall be submitted to the regional or district office of the Commission for the region or district in which the broker or dealer has its principal place of business, the Commission's principal office in Washington, the principal office of the designated examining authority for such broker or dealer and the office of SIPC, shall be bound separately, be dated and be signed manually, and shall include the following:

(i) A schedule of assessment payments also showing any overpayments applied and overpayments carried forward including: payment dates, amounts, and name of SIPC collection agent to whom mailed, or

(ii) If exclusion from membership was claimed, a statement that the broker or dealer qualified for exclusion from membership under the Securities Investor Protection Act of 1970, and the date and name of the SIPC collection agent with whom a Certification of Exclusion from Membership (Form SIPC-3) was filed, and

(iii) An accountant's report which shall state that in the accountant's opinion either the assessments were determined fairly in accordance with applicable instructions and forms, or that a claim for exclusion from membership was consistent with income reported. If exceptions are noted, the accountant shall state any corrective action taken or proposed.

The accountant's review on which his report is based shall include as a minimum the following procedures:

(A) Comparison of listed assessment payments with respective cash disbursements record entries;

(B) For all or any portion of a fiscal year ending in 1976 and each fiscal year thereafter, comparison of amounts reflected in the annual report as required by paragraph (d) of this section, with amounts reported in the Annual General Assessment Reconciliation (Form SIPC-7);

(C) Comparison of adjustments reported in Form SIPC-7 with supporting schedules and working papers supporting adjustments;

(D) Proof of arithmetical accuracy of the calculations reflected in Form SIPC-7 and in the schedules and working papers supporting adjustments; and

(E) Comparison of the amount of any overpayment applied with the Form SIPC-7 on which it was computed; or

(F) If exclusion from membership is claimed, the accountant shall review the annual report required by paragraph (d) of this section for all or any portion of a fiscal year ending in 1976 and each fiscal year thereafter to ascertain that the Certification of Exclusion from Membership (Form SIPC-7) was consistent with the income reported.

[Some of this is outdated due to changes in form names, but you get the idea.]

OH--and this 'e-4 report' has to go to SIPC, too. So include it in your filings with FINRA and SEC, and also send it (alone, not with the annual audited f/s) to SIPC.

Talk to your accountant; make sure this is clear. And chat it up over drinks, too. You'll impress your peers by being up on this subject way ahead of the crowd. Ah, the joys of compliance.

Another Delay of Red Flags Rule Enforcement (and other stuff)

2009-07-30T15:52:00.001-04:00

Greetings, surfers!

Topic 1: Red Flags Rule (dedicated to my tipster: Mr. B. Gray)

FTC announced yesterday that they would delay enforcement of the Red Flags Rule--again. Now you have until November 1 to figure out what it all means for your broker-dealer firm. On this note, I tried to create a flow chart to help you decide if you needed an Identity Theft Prevention Program, but I ran out of ink (and brains) in the process. It's complicated--and I disagree with the going interpretation, so I should just stay out of it.

I guess I can be a little helpful by providing some reference links for you:

http://imhoffconsultingproject.blogspot.com/2008/11/update-on-fact-act.html and http://imhoffconsultingproject.blogspot.com/2009/07/useful-information-on-rainy-day.html contain my ranting (I mean, informative content) on the subject.

FINRA's ITPP template: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119093.pdf

FINRA's page that has all kinds of references to guidance and stuff: http://www.finra.org/Industry/Issues/CustomerInformationProtection/p118480

FTC site on the Rule: http://www.ftc.gov/redflagsrule

FTC site on ID Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

+++++++++++++++

Topic 2: Investment Banking Registration Category

Wow! At last, for investment bankers, a test of their own! I'm impressed. If you are an investment banker, now you have your very own registration category: the Series 79. (Monty Python's Life of Brian came out this year--but that's off topic.)

Notice 09-41 does a terrific job explaining this new test and registration requirement. Here is a summary:

If you're currently doing only private placements (not of munis, govt's or DPP's) you only need the Series 82 so don't worry about this.
If you're currently doing investment banking activities--such as originating offerings, underwriting, marketing, structuring, syndication, or doing M&A deals like advising on restructurings, asset sales, corporate reorganizations, writing fairness opinions, etc., then YES, you need the Series 79.
If you're doing this business, and you're not registered--better get that way.
If you're doing this business and you have your Series 7, you have to 'opt-in' between November 2, 2009 and May 3, 2010. During that 6-month period, make sure a U4 amendment is filed for you, adding the Series 79 registration. That's all you need to do.
If you miss the opt-in period, you have to pass the Series 79 to keep doing your investment banking business.
If you're a Series 7 and you just kinda want the Series 79, well, that's not okay. You can't opt-in, because, technically, you have to be engaged in investment banking business to earn the opt-in registration.
If you're new to the business and were going to get your 7 so that you could work as an investment banker, you can still take your 7 during the six-month period before May 3, 2010...after you pass the 7, do the U4 amendment to add the 79 and voila! It's yours!
If you're an intern like I was, guess what? You don't have to get the 79 (see the Notice for details on this one--some qualifying factors).
If you also do general securities business or other business like muni structurings or DPP's or whatever, you need the 7 in addition to the 79.
If you are a Series 24 who supervises investment banking activities, you now need the Series 79. You can opt-in (see above) by May 3, 2010.
If you're thinking of being a supervisor of investment banking activities, but aren't yet licenced, the Series 79 will qualify as a prerequisite to the 24. Take both and supervise away! But wait: if you supervise any other securities activities, like trading or retail sales, you'll need the 7, too.
You know how you can take the Series 66 instead of the 65 and 63 to register as agent and IA in states? Well, the Series 7 is a pre-requisite for the 66...you can't rely on the 79 to do that job. The 79 is, however, a pre-requisite for the 63.

Okay, that's enough of that topic. One little thing...did you see the words "asset sales" above? That's kinda scary for unregistered M&A shops out there who always thought that arranging asset sales didn't require registration. Well, then again, those folks aren't reading this, so why waste my words.

++++++++++++++

Topic 3: U4 Disclosure Questions: no 'wet' signatures

New FINRA Rule 1010 allows firms to amend the U4 disclosure answers without having the rep manually sign the U4 amendment. Instead, you have to: provide the rep with a copy of the amended disclosure information prior to filing and get the rep's written acknowledgement (like an email or signature on internal form) prior to filing that shows the rep received and reviewed the changes. Keep records of this for examiner review.

(Note: My firms had reps answer the new disclosure questions on an internal form, sign the form and return it. To me, this satisfies the new Rule.)

If reps are on military duty, otherwise unavailable or refuse to acknowledge the disclosure information, you should note that in the rep's electronic signature field.

The effective date is July 27, 2009. Notice 09-40 explains that this new rule helps out with the new disclosure questions that have to be answered by November 14....but it doesn't explicitly say that if your firm was conscientious enough to have made all those U4 amendment filings already--that is, before 7-27--then you don't need 'wet' signatures under the new rule. Hmmm. Let's assume you don't, and that your documentation of rep approval of the new disclosure answers will suffice. Wouldn't seem fair otherwise.

Back to the beach. Surf's up!

YES--Material Event Disclosures for 529 Plans

2009-07-15T11:52:00.000-04:00

So I should trust my FINRA sources more, that is my conclusion. I've taken my skeptical hat off for now.

Spoke to a very helpful, very pleasant gentleman at MSRB today. He very clearly conveyed this reality: SEC has determined that Rule 15c2-12 applies to municipal fund securities. I'm talking about material event disclosure requirements--G-17 (see blog entry below)--in the context of 529 plans. To the extent municipal issuers file notices on MSRB's new EMMA portal, firms that offer/sell 529 plans MUST review those notices and provide the material event information to their customers prior to the sale. As a practical matter, you won't see many such notices relating to 529 plans.

So here's what you do: build into your procedures this requirement; train your reps on how to use EMMA; supervise 529 sales to make sure disclosures are being made when required.

The EMMA site is easy to use. Go to http://emma.msrb.org/. Click on the '529 Plan Search' box with the graduation cap icon; accept the site terms; in the orange box, select a state and hit the arrow; then look for the plan you are about to sell to a customer. Click on that plan and you'll see links to the disclosure statements and, IF there are material event notices, you'll see a link to those. That is what you'll review and discuss with your customer... ta da!

So, while this is one more thing you have to worry about (and document), it's pretty easy to implement.

It's not a bad idea to inform your customers about the EMMA portal--knowledge is power. That way, you'll be educating your customers as you should.

One more helpful link for you, courtesy of the nice man at MSRB: http://www.msrb.org/msrb1/mfs/mfs7.asp This is the 'securities regulation' page explaining which regs apply to 529 plan sales.

Hmm. Wonder how long it will take before I put that hat back on? Stay tuned.

Update: It's Sunny (and a note on MSRB Rule G-17)

2009-07-13T13:34:00.000-04:00

One of my favorite clients just reprimanded me for not updating my blog to correctly identify our NH weather as SUNNY. Which it is. Thanks so much, Mr. Get Back to Work...

Oh, and I just talked to a gentleman at FINRA who was happy I wasn't a reporter when I asked about a rule interp. ?? Are they bombarded these days by the Geraldos of the world who aren't busily churning M.J. rumors? Guess so.

His answer to my question was that, yes, BD's who do nothing but 529 plans--that is, they sell municipal FUND securities, not municipal securities--are required to comply with interpretive material on G-17 about material event disclosures. See Notice 09-35 at http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119067.pdf .

This means that before having your customer sign onto that 529 plan, make sure you visit MSRB's new EMMA site at http://emma.msrb.org/ to gather and convey important disclosures about the issuer. Document that you did this; and you supervisors: check the records to make sure it's being done. Oh, and update your procedures for this new one.

I dunno. I'm a bit skeptical. I have a call into MSRB. I hope they call back before it starts raining again...

Useful Information on a Rainy Day

2009-07-02T09:16:00.000-04:00

I walked to my NEW office this morning without drowning in a puddle. High of 61 today with downpours. Feel sorry for us, here in coastal NH. We deserve your pity.

Few things:

1. Remember the FTC Red Flags Rule? FINRA released its brand new written ID Theft Prevention Program template!--and it has an acronym: ITPP! This is great. Thank-you, FINRA. Now all you small firms that have no idea what this rule is all about, and believe that it is completely duplicative with AML and unnecessary, given that you are a tiny shop that does not use credit reports, does not provide debit cards or checkwriting, and does not extend credit (but wait, you have a clearing firm and your clients may open margin accounts through your firm), can create an ITPP without much effort. And the better news is, if FINRA examines for compliance with this rule like it did with AML, you will have years before your written program actually has to be fully customized and implemented. FTC enforcement of the Red Flags Rule begins August 1, 2009. So get going. Here is the link to the template, courtesy of FINRA:
www.finra.org/customerprotection/redflags.

2. As of August 17 you have to provide a new disclosure to customers. New FINRA Rule 2267 is based on old NASD Rule 2280 (Investor Education and Protection). The old rule applied only to firms carrying customer accounts. Now it applies to everyone. BUT: if your firm has an clearing firm that will make the disclosures for you, you're all set (confirm this with them, ok?). If you have other (or only) customers that aren't serviced by a clearing firm and that don't, for instance, receive statements or confirms, then your firm will have to make the disclosures. An example would be an 'application-way' shop that processes MF/VA applications and does not have brokerage accounts. I'm guessing PP/M&A firms are in this category, too, but let's not expect FINRA to be clear on that (you know how I feel about this subject, right?).

So, if all your customers are receiving statements, etc. from the clearing firm, make sure they'll include the disclosures annually to your customers.

Otherwise, you have to provide the disclosures (annually if you carry accounts). If you don't carry accounts, as I desdcribed above, or have some customers not receiving statements, you have to provide the disclosures at or prior to the time of the customer’s initial purchase, in lieu of once every calendar year.

Disclosures may be provided electronically (yahoo).

Here is what you have to disclose:

1. FINRA Broker Check Hotline Number -- (800) 289-9999;
2. FINRA Web site address -- www.finra.org; and
3. A statement as to the availability to the customer of an investor brochure that includes information describing FINRA Broker Check. ...Harder than it sounds. Here's what I recommend: "You may find information about Broker Check online by visiting this link http://www.finra.org/web/groups/industry/@inv/@tools/documents/industry/p009888.pdf or by calling the Hotline number and requesting a hard copy via mail."

Here's what FINRA says about the due date: "Any firm subject to NASD Rule 2280 that complies with its annual (calendar year) mailing requirement on or after January 1, 2009 but prior to the August 17, 2009 effective date of FINRA Rule 2267 will be deemed to have complied with FINRA Rule 2267 for the 2009 calendar year."

So check with your clearing firm to see it they will have complied with old 2280 by 8-17; if not, you're not in compliance. For other firms (see above), start making the disclosures for new accounts. And what the heck, if you send out an annual disclosure notice with other things, like privacy policy and SIPC info, why not include this one, too?

3. Rule 2821 on Variable Annuities--they FINALLY finalized the rule. And the great news is, they took out that requirement to consider ALL deferred V/A purchases and exchanges as 'recommended.' The rule changes also clarify the 7-day review/approval process and funds transfers in that 7-day period. It's good, and the Notice is written well. Look it up: Notice 09-32 is at http://www.finra.org/Industry/Regulation/Notices/2009/P118955. BUT DON'T start enforcing the rule yet. It's effective 2-8-10. I have a call into FINRA about whether optional compliance before then is okay, but I haven't heard back yet :( . In the mean time, you have the usual 24 hour turnaround period to move funds out and approve the business.

Looking out my window: still raining.

Beat It, Bernie Madoff

2009-06-29T13:48:00.000-04:00

"I'm Starting With The Man In The Mirror.
I'm Asking Him To Change His Ways
And No Message Could HaveBeen Any Clearer
If You Wanna Make The World A Better Place
(If You Wanna Make The World A Better Place)
Take A Look At Yourself, And Then Make A Change
(Take A Look At Yourself, And Then Make A Change)
(Na Na Na, Na Na Na, Na Na,Na Nah)"

There you go, the chorus from one of Michael's soul-searching songs. (I did the moonwalk in honor of our beloved--demented--King of Pop...did you? Did you join any Michael Jackson Flashmobs?) This song, Man in the Mirror, did Bernie ever listen to it? Did he, himself, look in the mirror while in the midst of defrauding thousands out of their billions? If he did, his own eyes believed his lies.

Michael's gone and doesn't know the world really did love him; Bernie's gone and finally knows how much the world despises him. Will both men meet soon on one of Dante's circles? I have to believe Bernie will be closer to the chewy center.

Bye for good, Bernie. "They're Out To Get You, Better Leave While You Can.... So Beat It. Just Beat It."

The Rumor Was True!

2009-06-01T12:09:00.000-04:00

That is, the one about FINRA revising its proposed rule on circulation of rumors. This is good! The new language is more focused and will allow industry professionals to discuss amongst themselves and with clients the nature of circulating rumors (without triggering a regulatory reporting obligation). That is, firms can talk about rumors: they just can't spread them with the intention of moving markets... that makes sense, right? If those folks on TV are all blabbing about a rumor, why shouldn't a broker be allowed to speak to the subject with his/her client? to help things, rather than hurt them?

Specifically, the amendments:

Narrow the prohibition to apply to rumors that are 'likely to influence' the market price of a security;
Retain the reporting obligation, but narrow it to report only those instances of origination/circulation when the offender did it 'for the purpose of improperly influencing' the market price of the security;
Include supplementary material: defining 'rumor,' allowing certain exceptions (permissible communications), reminding firms that such rumor origination/circulation could violate lots of other rules, not just this new one, and requiring firms to have WSP's and training programs (the usual).

The revised rule is out for comment through July 16. Go to http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p118807.pdf to read the notice on this topic.

Pssst: It's okay if you pass this on--not a violation, I promise.

Privacy Clauses in Contracts

2009-05-26T13:42:00.000-04:00

Another reminder for you. (This was discussed at the April conference, too.)

Your contracts with third parties, such as payroll services, clearing firms and, of course, ESM (electronic storage media) providers, should have some language about safeguarding customer information. FINRA seems to be enforcing this in anticipation of final approval/effectiveness of amendments to Regulation S-P. Here’s a summary of the related change in that SEC rule:

Currently, Section 30(a) of Regulation S-P requires institutions to adopt written policies and procedures that address administrative, technical and physical safeguards to protect customer records and information.

Amendments to Reg. S-P would require firms to develop “information security programs” that would require firms to, among other things:

“oversee service providers by taking reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for the personal information at issue, and require service providers by contract to implement and maintain appropriate safeguards (and document such oversight in writing).”

The term “service provider” would mean any person or entity that receives, maintains, processes, or otherwise is permitted access to personal information through its provision of services directly to a person subject to the rule.

Reasonable steps to evaluate the information safeguards of service providers could include the use of third-party review of those safeguards such as a Statement of Auditing Standards No. 70 (“SAS 70”) report, a SysTrust report or a WebTrust report. (This is straight from the SEC release—it seems geared towards large firms; small firms will have to determine which ‘reasonable steps’ are practical, affordable and effective.)

See http://www.sec.gov/rules/proposed/2008/34-57427.pdf for the SEC’s proposed amendment from last year.

The Adam Lambert Memorial Exam Findings Tips and other Reminders

2009-05-21T08:44:00.000-04:00

Well, now we know: southern, culturally-conservative (i.e., anti-guyliner) voters favoring the underdog. That's who crowned Kris last night. But do we care? No. FINRA suits are walking through the door soon, armed with lists of practically irrelevant exam priorities. And you, my friend, have no-one calling 1-800-I Comply! to vote for you. (No-one except me: I'm here to help.)

btw: Not enough of you requested free conference notes. That means: a) you don't care, b) you're afraid to write to me, knowing I'll write back and talk too much, or c) you're not even reading this. You're over on that other, better blog: http://thereformedbroker.com/ But is that guy giving you practical information you can use immediately to improve your compliance grade (Randy Jackson wants to give you an "A+")? No, he's giving you insightful analysis of current economic and political events, all in a well-written and sometimes hilarious fashion. What good is that?*

*Real good. Check him out.

Oh, back to my exam findings tips, in honor of my favorite second-place, soon-to-be superstar, Glambert. Recent findings:

BCP summary disclosure not on website -- 3510(e);
CCO not disclosed on Schedule A of Form BD -- 3130(a);
AML testing not done by independent person or firm didn't comply with exemption provisions when using in-house, non-independent person -- 3011(c) and IM-301101;
Supervisory Control Procedures don't address electronically notifying FINRA of the reliance on the limited size and resources exception -- 3012(a)(2)(A)(iii);
Don't have procedures for monitoring new rules proposed under Section 311 of the USA Patriot Act -- 3011(b);
[The age-old] failed to notify of electronic storage media and provide required representations on format/storage and third party access -- SEC 17a-4(f)(2) and (f)(3)(vii);
Don't a have a third party to access electronic records to meet SRO requests -- SEC 17a-4(f)(3)(vii).

Comments on the above:

BCP: If you have a website, it has to be there. Remember, post just your summary, not the whole plan. Just do it.
CCO on Sked A: the thing is, no CRD deficiency is generated if it's not there. This rule came out in 2004--FIVE American Idol seasons ago!--and it's hard to believe that this violation can still exist. But it does. I think, like for FCS and other nec. disclososures, that the system should alert the firm on Gateway if no CCO is listed on Sked A.
AML Indep. Tester: for very small firms, this is frustrating. Yes, they may rely on an in-house person who isn't independent, but they have to provide justification for doing so and have written procedures about non-retaliation, etc.... look at http://finra.complinet.com/en/display/display_viewall.html?rbid=2403&element_id=3719&record_id=4397 for the requirements under IM-3011-1. Just do it. The obvious alternative is to hire an outside party (cha-ching).
Procedure to notify of LS&R exemption: Uh, this is easy to comply with. Put in your supervisory control procedures that you will make a filing in CRD, notifying FINRA of your reliance on this exception if you appoint someone not 'senior' to do branch examinations. Just do it.
311 procedures: Guidance came out in 2007. If your firm doesn't have foreign accounts, just mention in your procedures that you don't have to include due diligence procedures for 'specified banks' under FinCEN's 'special measures' rules--from Section 311 of the USA Patriot Act. You can promise you'll add such procedures when deemed relevant to your business. Add a link to FinCEN’s Special Measures page http://www.fincen.gov/reg_section311.html for fast reference to changes.
ESM notification: Oh, don't get me started. Well, at least FINRA is showing some patience on this issue. For goodness sakes, by now firms should know what they have to do! Look at my many, verbose postings on this subject for more information. If you haven't notified FINRA on CRD of your use of acceptable ESM, just do it (it's under 'financial notifications' on the forms and filings tab on the Gateway).
Access: See my earlier postings on this topic. You have to have a third party to assert that they will provide access to your e-records in case you can't/won't produce them upon request. This party does not have to maintain your records--they just have to be able to access/produce them. There is a firm called Securities Industry Records Services in Utah that provides this access letter for a an annual fee...check them out at SIRSCO.com. (I don't endorse these guys...haven't yet had personal experience with them--but it might be worth talking to them if you want to store your own records.)

Some areas of exam focus:

Reg. SHO: aggregation units, controls in place to prevent illegal short sales, affirmative determination records.
Scrutiny of lack of SAR filings: why none?

A few reminders for those of you who didn't read my notes:

1. Get a PCAOB-registered accounting firm before December--for your next audit. Remember that, for non-public BD's, this registration doesn't change the accounting standards or protocols; for now, the auditor just has to pay a fee to register. Don't be lured into paying higher fees for your audit.

2. Don't expect 30 days advance notice of your next exam--even though Robert Errico in his February 2007 letter to members stated the following:

Advance Notice of Examinations. For the vast majority of firms, NASD is doubling the amount of notice in advance of a routine examination. Specifically, we are moving the notice period from 14 days to 30 days. This change will provide member firms with adequate time to respond to the WebIR and to gather the records and other information requested prior to the on-site portion of the examination. Similarly, it will provide our examiners with more time to review materials, leading to a more efficient examination.

I rarely see 30 days notice being given. The staff at the April conference said, 'Oh, it's up to 30 days.' I guess they didn't know about Mr. Errico's kind promise. Oh, and don't kid yourself into thinking you're on a set exam schedule--they'll use BORAM (clearly, Spock language) every year to decide when your next exam will be.

3. Establish a policy for protecting customer information when Reps leave your firm. If you let them take Outlook contacts information or other data that contains non-public info, you have to disclose this in your privacy policy (and give customers an opt-out choice).

4. Remember that the ID Theft Program requirement has been delayed until Aug. 1--and remain on the lookout for FTC's promised "template to help entities with a low risk of identity theft to comply with the rule" (but then again, we know how promises work...you promised you'd vote for Adam and you didn't).

Thanks for reading. And remember to amend your Reps' U4's for the new disclosure questions. But you've got time...first go out and enjoy the fine weather.

800 Overseas Investors Thank You

2009-05-13T13:53:00.000-04:00

Alternate title: Keep those SAR Filings Coming! Terrorist financing down 36%!

Please read FinCEN's 15th Issue of The SAR Activity Review – Trends, Tips & Issues (http://www.fincen.gov/news_room/rp/files/sar_tti_15.pdf). It's a blast.

Seriously, you AML officers out there should read it. It gives you a reason to value all the time you spend worrying about whether or not to file a SAR. You and all your AML brethren are making a difference! The SAR report outlines some cases cracked thanks to your efforts (for instance, a foreign national was busted for leading a scheme involving hedge funds and advisory firms that resulted in $21 million in losses for over 800 foreign investors: that makes you feel good about doing all that AML work, right?). ....(right??)

Here's what examiners want to see from you:

Complete written procedures.
Implementation of written procedures.
Monitoring for susp. activity.
Reporting of susp. activity.

Here's what examiners are seeing from you:

Failure to document reviews of suspicious activity.
Incomplete SAR forms.
Crappy SAR's: completed inaccurately; inadequate narrative section (why is it suspicious?); includes supporting docs even though it's not supposed to; filed late.
Inadequate due diligence on potentially susp. activity--investigate to determine if you should file!

Recent transactions in the sale of unregistered securities or representing fraud/market manipulation are not being reported as required (such as those involving penny stocks). Read the publication for an example that may be familiar to you.

The report includes sound advice on how to maintain a current and effective SAR program at your firm, for instance, by addressing:

current events and emerging trends: thanks to our little financial crisis, automated surveillance based on certain profiles and parameters don't work like they should (stock price/volume swings--all that is now normal; and customers with 'top reputations' can't be trusted anymore--those darned institutional short sellers!).
cyber crime: one-two punch, here--electronic intrusion into online brokerage accounts combined with traditional market manipulation (market-savvy hackers, our worst nightmare).
trade-based money laundering: no, not that kind of trade, this kind: international trade of goods and services. These Marco-Polo types under- or over-invoice or route invoices through various financial institutions (not just banks), leading to multiple payments for the same goods. Sophistication is growing in the illicit trade finance arena.
reported suspicious activity: evaluate your firm's reporting history; analyze trends; identify similar schemes, common locales or names, or possible red flags; follow enforcement actions.
identification and analysis of transaction types: don't just think of securities transactions that involve money: there are far more things to worry about! account transfers, free deliveries and receipts, external withdrawal by transfers and internal journal entry transfers. Your program should be able to detect activity and gaps that occur across the full spectrum of operations--all transactions "by, at or through" your broker dealer.
identification of detection points: all departments and personnel must be adequately incorporated into escalation workflows. Matters such as ID theft, insiders trading, 314a matches, law enforcement subpoenas, customer tax issues, customer due diligence, credit reviews, back office operations, interaction with other financial institutions, and employee financial crime and prohibited trading... they all should feed into the SAR consideration stream.

(Those aren't my big words, by the way--not all of them. That summary is derived from the aforementioned SAR report.)

If you work for a huge firm with well-staffed internal legal, audit and compliance departments, this improvement to your AML/SAR program should seem reasonable. If you are a micro-firm, with one guy who pretty much wears every supervisory hat, well, my advice is to dedicate your summer in an attempt to achieve this level of AML musculature. Good luck. Take steroids.

You know what I think? That small firms should have an AML clearing house that performs their AML responsibilities for them, collectively. I mean, c'mon, it's crazy to imagine small firms being able to implement the goals expressed above. The whole cybercrime topic makes me scream louder than Danny Gokey: it's hard enough to get Outlook to work correctly, let alone defeat intergalactic cyberfiends. Wouldn't it be cool if the several thousand tiny FINRA BD's could outsource their AML stuff to one place? That place would be super-good at their job: they'd use unemployed MBA's and IT jocks to mastermind the most sophisticated and effective AML tools available on our planet, and they'd give the small firms the comfort of knowing that none of their clients was a foreign national perpetrating fraud on a global basis. They'd manage CIP, OFAC, 314a lists, 314b filings, account monitoring, suspicious activity investigations and reporting--and just think! AML audits would be a thing of the past! Instead, SEC or FINRA could do one big audit of the clearing house (let's call it AML, Inc. (tm) for now) to ensure compliance for the thousands of firms. The tiny firms could go back to doing what they do: helping their clients make money in the markets. Ahhhhh. (Un cafe, s'il vous plait...I think I was just dreaming.)

Anyway, 53,022 SAR's filed by the securities and futures industry through 2008. And exactly 6 cases solved. (Okay, I made that second number up.) Keep at it, folks! Some day a SAR you file will be profiled in a FinCEN report, and you'll be able to share your pride with your grandkids.

Oh, wait, no, you won't.

Conference Notes: For Less Than the Cost of a Snuggie!

2009-05-07T16:20:00.000-04:00

I attended the Small Firms Conference that FINRA presented on April 7 in NYC--and guess what? I took notes! I apologize for the delay in putting my notes into digital format. Thanks to Gokey voters (see below), I have now finished this process. Rather than post the document here (it's 12 pages long), I will be happy to email it to you upon request.

Please hit this link and send me a request for the notes. I'll send them over without even asking why you care so much, what with the economy in the tank, the Taliban gaining power, and an AI top 3 without Allison. Your priorities are your own business. mailto:inquiry@imhoffconsultingproject.com

Here are some topics sure to lure you:

BORAM;
Broadened supervisory authority over outside business activities;
Required reporting of internal violations;
Circulation of rumors (and rumors of rumors);
Principles-based research rules;
Customer data protection--when your reps leave;
PCAOB compliance; and
Unanswered questions (are you surprised?).

I'll be standing by. No credit card required.

The Allison Iraheta Memorial Promise and Red Flags Reprieve

2009-05-07T13:18:00.000-04:00

In reaction to last night's travesty on American Idol, I now swear to you that by day's end I will have posted a message about my April conference notes. I have hunkered down and worked diligently on typing my notes--and translating my hand-scrawled gibberish. The wretched AmIdol results led me to this confinement: I am eschewing contact with the public today in hopes of snubbing those who cast votes for Danny. You Gokeyites who read my blog are henceforth required to either a) pay me money for the pleasure or b) promise you'll vote 30 million times for Adam next week.

In the mean time, I hope you've heard that (cut and pasted from FINRA's e-mail, emphasis added):

"FTC Delays Enforcement of FACT Act Red Flags Rule Until August 1
The Federal Trade Commission (FTC) has delayed until August 1 its enforcement of the new Red Flags Rule, which requires most broker-dealers to have in place a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft ("red flags"). In addition, the FTC will soon release a template to help entities with a low risk of identity theft to comply with the rule. Enforcement of the Red Flags Rule, which implements a section of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), was previously scheduled to begin on May 1."

God Bless the FTC. (I give all the credit to Obama.)

Be back soon.

Conference: Small Firms, Big Rules

2009-04-09T12:56:00.000-04:00

This is just a tease...I'm not ready yet to give you my comments on the Small Firms Conference I attended Tuesday in NYC. There's plenty of information to send your way, all under the general heading, "Oh my!" So be patient please.

Summary thoughts:

What I liked (besides the coffee): the overview of recent Rule filings, their status and their significance. This was an excellent means of scaring everyone to death. And I liked John Komoroske's pun-laden wit. It felt good to laugh once in a while.

What I didn't like: the fact that my questions, e-mailed in advance at their request, were not answered or even read aloud...this means only Moi will benefit from the answers (which they promised to deliver), not the attendees. Also, I didn't like that "facts-specific" questions were dismissed as unworthy of discussion. To me, these sessions are valuable for that reason: to talk in a big group of peers about specific compliance problems. Everyone benefits from that exposure to details.

I plan to share my notes with you, so check back in a while ("while" shall remain undefined for now).

Be well!

She Audits Me, She Audits Me Not

2009-03-23T08:49:00.000-04:00

Ah, Spring. A time of contrasts, for sure. To add to the already long list of flip-flops you'll encounter this printemps, here's a summary of my recent attempt to clarify something I thought I'd been quite clear on.

Back in February 2006, NASD put out two IM's on Rule 3011, the AML rule for BD's. One of these IM's finally spelled out the independent testing expectations under the Rule. Prior to that, we all made the assumption that testing had to be annual, although it wasn't required in writing at the time. IM-3011-1 explained what 'independent' meant and that testing for most firms was an every-calendar-year requirement. "Most firms" excluded those that didn't execute transactions, hold customer accounts or introduce customers to a clearing firm (act as introducing broker). Well, if you're a prop trading firm with no customers, that's Clariton-clear. If you're a private placement/M&A shop, it's not.

After the Notice came out in 2006, I called and spoke with its author at NASD. My question related to these types of firms--the ones that didn't seem to fit into either category--the poor PP firms that always seem to be denied the benefit of succinct rule interpretation. He explained that PP firms would indeed fall into the 'every year' category. I took him on his word and went ahead and spread that word. My PP clients lived according to this guidance and I saw repeated evidence of District examiners living by this interp, too, since they tested firms for compliance with an annual testing requirement. In conferences, when the subject came up, panelists confirmed it: PP firms were expected to have annual AML testing.

Last week a thick layer of Northeastern pollen settled on this issue. It seems there's dissension in the ranks, that certain examiners are of the opinion that a registered broker-dealer who offers investments in, say, hedge funds, should not be held to the annual testing requirement. General terms, like 'no retail customers,' and 'no brokerage accounts' are being tossed about like old, wet leaves. The well-worn "every firm is different" flag is brought out of winter storage and the conversation is over. My attempt to get into specifics fails. Specifics like: what, exactly, does "execute transactions" mean in this context? What about the apparent contradiction of requiring PP firms to do CIP work while putting them in the category of two-year cycle firms like prop traders, who don't have to do CIP work? How about the fact that FinCEN recently withdrew its proposed AML rules for both IA's and unregistered investment companies? Why? Partly because the financial transactions conducted with these firms have to go through registered BD's--and are thus subject to existing BSA AML requirements. (Doesn't this imply that BD's offering investments in HF's--unregistered investment firms--are presumed to be the front line of AML defense and can be considered to 'execute transactions'?) And lastly, what about the fact that 'corporate' has, seemingly, been clear this subject (Office of General Counsel verbally confirmed last week the continued validity of the annual testing requirement for PP firms). Last week on one call, there was some mention of my profit motive: you know, I stand to make a fortune if my PP firm clients have to have annual instead of bi-annual AML audits. ...aha! now you (and I) know: my passion for regulatory consistency is simply a thinly-veiled construct known as greed. (Note to self: stop spending so much time on this blog entry and get back to the business of manipulating your clients' understanding of their responsibilities.)

Other industry consultants are hip to this muddy subject, too. NRS years ago attempted to have NASD spell it out (they didn't). A savvy consultant in lower Manhattan feels strongly that PP firms don't have to have annual reviews, but suggests that they do, given the ambiguity on the subject. Without specific written guidance on this--or better yet, specific Rule language--different firms will live by different opinions. It seems to me that what is expected is this: you, the small PP/HF offeror firm, have to call your Coordinator and ask him or her which AML exam cycle applies to your particular firm. You may not rely on a generally-accepted, age-old definition of your business activities in order to make a determination using IM-3011-1. Nope. Assume ambiguity and call your District. Without a bright line drawn for all firms, we'll have to find out what FINRA wants, one firm at a time. I, for one, would prefer a different approach.

Yesterday snow flurries blew about the crocus buds. Nature is full of beautiful contradictions. Should securities regulation be so? I'll leave that to the Chauncey Gardeners of the world to contemplate.

[Very important explanatory babble: I really appreciate the dialogue I have with certain FINRA representatives and I don't want that dialogue to end. I believe in their motives and I hope they believe in mine. When I write entries like this, my goal is to assist firms understand misunderstood things and also to promote change to the extent possible. I do not write simply for the sake of complaining or criticizing: for me, it's about making things better. Thanks to those at FINRA who help me do that. --shi]

Sharing SAR's: Some Proposed Changes

2009-03-06T13:49:00.000-05:00

FinCEN has announced proposed changes to BSA's regulations on SAR sharing and confidentiality rules. Since they're now just proposals subject to comment, I won't detail every change, but here's my summary:

The guidance on sharing with parent entities will remain intact--it will be built into the regulation so as to be all the more official. Here is the original guidance from January 2006: http://www.fincen.gov/statutes_regs/guidance/html/sarsharingguidance01202006.html You remember that it allowed BD's to share a SAR or the existence of a SAR with a holding or parent company, but not with affiliates. The guidance required that a confidentiality agreement be place with the holding co/parent entity.

BD's will now be allowed to share a SAR or the existence of a SAR with affiliate entities--that is, only if those entities are subject to SAR rules (i.e., banks, BD's, mutual funds, thrifts, insurance co's, casinos, money service business--not IA's or unregistered investment companies). BD's can only share this stuff if they filed the SAR and the affiliates can't go on to share the information with others (it's not like Facebook: 'friends of friends' don't get to see stuff...). Like with parent entities, confidentiality agreements should be in place when sharing with affiliates.

Other changes clarify some things that you might have otherwise assumed, like: the sharing prohibition applies to all employees, directors, agents, etc. (not just the firm); BD's can share SAR's or the existence of SAR's with their examining authorities; and BD's and their employees can share the information, facts, and documents underlying a SAR a) with financial institutions for the sake of filing a joint SAR and b) in connection with certain employment references or termination notices.

I would think FINRA would provide an announcement when these changes go into effect, so look for a Notice in the coming months. For the proposals and guidance, go to: http://www.fincen.gov/statutes_regs/frn/pdf/frnSAR_Confidentiality.pdf and http://www.fincen.gov/statutes_regs/frn/pdf/frnSF_SAR_Sharing.pdf .

Odds and Ends and Others

2009-02-20T08:24:00.000-05:00

A few notes to share.

ODD: I have heard that FINRA is issuing deficiency letters to firms that have outside FINOPs if the FINOP is listed as a ‘control person’ on Form BD and if the Form BD doesn’t list every other client firm of that outside FINOP as an affiliate of the firm. So if you're using an outside FINOP, check your Form BD. If he or she is listed as a 'control person' on Schedule A, then under this interpretation, all of his or her other BD clients for whom he or she acts as FINOP must be disclosed as affiliates on Question 10A.

The reasoning (if there is any) would be that all of the entities are under common control by virtue of the outsourced FINOP being a control person of those entities. Obviously, this would unnecessarily and confusingly link completely unrelated firms.

So, the best thing to do is to file a BD amendment, removing your outsourced FINOP as a control person from Schedule A. (Of course, if that person meets the other criteria for being listed on Schedule A--through ownership, for instance--then you'll have to keep him/her listed...but that doesn't seem likely for truly outsourced FINOPs.)

END: The exemption for non-public B-D's from using a PCAOB-registered accounting firm for annual audits is now gone. It expired December 31, 2008. Your 2008 financial statements may be audited by your non-PCAOB firm, but next year is a different matter. You'll have to replace your accounting firm or make sure it got its PCAOB registration before committing to use them for next year's audit. FINRA says it's talking directly to those few firms who have January or February fiscal year-ends.

You may want to work on this before the months evaporate and you find yourself without a registered accounting firm next year. Remember that if you change your accountant you must notify SEC by December 10. Put this on you calendar!

OTHER: FINRA Notice 09-10 describes a change in their treatment of "market letters," which are now a subset of "correspondence" instead of "sales literature." As sales literature, they required pre-approval by a qualified principal--even if sent to institutional investors. Now they are treated like other correspondence and institutional sales material, and their approval requirements will depend on whom they're being sent to and how many are sent within 30 days. You should look to your existing procedures on correspondence and institutional sales material to know which approval processes to follow.

I like this distinction, because it clearly defines those communications not meeting the definition of "research report" that might have otherwise been confused with research reports. For instance, market letters are communications that discuss broad-based indices, include commentaries on economic, political or market conditions, include technical analyses of sectors, indices, or industries, statistical summaries of multiple companies' financial data, including listings of current ratings, present recommendations for increasing or decreasing holdings in particular industries or sectors, or include notices of ratings or price target changes (with certain disclosures).

OTHER: I hear that FINRA will be requiring all firms to update Forms U4 for all representatives, in order to provide answers on some new DRP questions. This will be quite a job for big firms. Stay tuned on this, as no doubt we'll all see a public announcement of the requirement. I'll be helping my clients to manage this process--you will want to make sure you appoint someone to handle it, so you that you avoid reporting deficiencies.

That's it for now. Peace out.

Shame on Who?

2009-02-02T12:19:00.000-05:00

I have a "Yes We Can Opener" to commemorate Obama's presidency. I got it at Stupid.com. I'm not ashamed to share that with you (or it with you--c'mon over!). But Mr. Obama is ashamed: of you!

Yes, he's a little upset about the Wall Street bonuses paid for 2008. Well, even though this topic is of no value to you and will not broaden your understanding of current and changing compliance obligations, I feel like talking about it. It's my blog: I'll cry if I want to.

Is the car factory worker to blame for the auto industry's failure? Is the farmhand at fault for the effect of subsidies on our crop market inefficiencies? No. Then why are our brokers blamed for this big financial crisis we're in? Every work day last year these folks got to work by 7:30 or 8:00 a.m. , dressed quite well, by the way, and worked until an hour or two after market closing. They did what was expected of them from on-high: they bought, sold and bartered their way through the day so as to make their bosses happy. They invented or used flashy software tools, trading algorithms and order management systems in order to efficiently get the job done. They did it with skill and enthusiasm...not because they wanted to take down the free market system, but because they wanted to get paid. In their (your) world, they get paid at year-end. They all know it's coming, so they live accordingly. I would do the same. But now comes the end of the world as we know it, and some of us decide to blame the baby in addition to the bath water. What were these legions of Wall Street workers supposed to do? Fall on their superiors' swords? Not expect to get paid for a year's worth of toil and trauma? I don't think so. Yes, they can now all adjust their expectations for 2009: the gig's up. And yes, senior management--the guys/ladies who made the decisions that directly fed our slots-like odds of failure--they should go without their '08 bonuses. They can put their gold in pre-paid envelopes and walk to the post office. Responsibility for this mess falls on those at the top.

Wait, if you're conjuring WWII images, don't. Soldiers know slaughter is wrong; most brokers don't have the tools or knowledge necessary to morally object to their crimes. Or didn't. Now they do. This transition to less fun, less money and great social responsibility will be tough for brokers. I wish you well. And I wish Obama a stronger will to avoid rhetoric.

If you stop by to use my Yes We Can opener, we'll be drinking Iron City. (The Steelers six pack is in the house.)

Update on FACT Act

2008-11-28T14:40:00.000-05:00

First, let me share my appreciation for FINRA's effort to explain the applicability of the FACT Act's Red Flag and other rules to member firms. The folks in OGC said they were working on it, and they did. Here's the link to Notice 08-69: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p117448.pdf

Now, let me express my dismay at the extreme lack of distinct clarity on this topic--not necessarily from FINRA, but embedded in the Act's definitions. Your firm may be subject to the regulation, or not--just read and re-read the definitions of 'financial institution,' 'transaction account, 'creditor' and 'covered account.' It's a little like solving a Rubik's cube. If all like colors end up on the same side, then yes, your firm has to implement Red Flag Rules under the Fact Act. But good luck getting there.

In reading the definitions provided in FINRA's notice, my first reaction is, "If they wanted broker-dealers to be covered, why didn't they just say so?" For instance, the term“financial institution” is specifically defined as “a State or National bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account . . . belonging to a consumer.” And a “transaction account” is specifically defined as “a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third persons or others. Such term includes demand deposits, negotiable order of withdrawal accounts, savings deposits subject to automatic transfers, and share draft accounts.” See what I mean? If they wanted B-D's to be subject to the regs, why not just include "SEC registered broker-dealers" or "brokerage accounts" or some such other simple identifiers in the definitions? That would have made it real easy... but instead, these definitions overtly exclude the whole subject of brokerage accounts and broker-dealers. And then your favorite SRO puts the onus on firms to twist and retwist the cube in order to solve the puzzle by themselves. Frankly, for most of the 5100 registered B-D's, I think this is like trying to force a square cube through a round hole: I don't think these rules should apply.

Also, while I'm ranting, this whole thing is crazy!! B-D's already have CIP rules to follow. And remember that AML rules are not just about preventing money laundering. We all know that most AML-triggered investigations end up focusing on fraud, including mail fraud and credit/debit card fraud. So firms are already obligated to attempt to identify and report fraud....why do they have to now be subject to seemingly duplicative rules? And at what cost? ...read the Notice... do you really have time to create a "Written Identity Theft Prevention Program"? One that will confuse your already confused Reps about the account opening process? This reminds me of redundant local ordinances--instead of having one rule that requires safe and responsible behavior on sidewalks, they have in place six different rules, pertaining to different possible ways to conduct unsafe and irresponsible behavior on sidewalks: skateboarding, bicycling, rollerblading, dog walking, etc.... get my point? I guess I just feel sorry for firms whose business has nothing at all to do with credit cards, withdrawals, payment transfers, etc. To think that they will have to adopt lengthy and complicated procedures on top of what they already have in place (which are already hardly deemed necessary and applicable): what a waste of resources.

But who am I ranting at, here? The Federal Trade Commission? That's a big target for a little person like me. And I don't want to trash FINRA--they did something cool by addressing the subject. I guess I would like if FINRA would go a bit farther out on the limb by actually giving its opinion on how application way firms, M&A/PP shops, and introducing firms who do not actually extend margin to clients fit into this definitional puzzle. I know they state up front that they're not the rulemakers or interpreters on this subject, but c'mon, since they go on to say that NOT complying would be a violation of just and equitable principles of trade, can't they show a little more mercy?

Another topic within this one: check out Part C of the Notice. It's about policies you have to have in place re: use of consumer reports. If your firm requests a consumer report about a new or existing customer and receives a notice of address discrepancy from a CRA, you'll have to be able to form a reasonable belief that the consumer report actually relates to the customer in question. FINRA did a nice job of laying out these responsibilities. I'm assuming the effective date of these requirements is the same delayed date as for Red Flag Rules: May 1, 2009 (although I could be wrong.)

Lastly, FINRA mentions in the Notice that FTC has indicated a willingness to work with them to "resolve on a consistent and industry-wide basis, interpretive questions that arise under these rules as applied to broker-dealers. " I love that! My advice to you and all your B-D friends: call OGC at (202)728-8071 to ask about this. Perhaps that kind of dialogue will result in 'interpretive challenges' being met head on with concrete directives from FINRA. Then you can throw that darned Rubik's cube out the window. Puzzle solved.

Networking Rocks!

2008-11-21T10:17:00.000-05:00

Big shout out to Christine at IMS. Prompt, thorough assistance on a compliance issue. Gracias, Amiga!

r-e-s-p-e-c-t

2008-11-21T09:34:00.000-05:00

...that's what binds both you and me.

I made that rhyme for your auditory pleasure. Say it out loud, go ahead.

I want my clients to know that, not only do I like you, I respect you--that is, I think the work you are doing is hard and you should be praised for that. Many in the media are trashing investment bankers, brokers and bankers, alike, as if they alone are to blame for the market turmoil. We know that's not true. You, my clients, are creative individuals who choose to make a living by making other people money. That ain't no crime. And the more creativity, energy and motivation you have, most likely, the more money your clients will make. (That came out a bit like Yoda-speak.)

Oh, and what I really want to say is thank-you for likewise respecting me and my work. It's an honor to help you out and I benefit everyday from your appreciation for what I do.

Oh my gosh, this touchy feely stuff is hard to take, non? Okay, back to my Rule Conversion/WSP update work...

Just a few notes on AML

2008-11-21T09:21:00.000-05:00

Hey there, busy over here. Year-end always comes too quickly. I wish you all well in the markets and in your securities business. Hang in there.

Kinda recently, FinCEN published their newest SAR Activity review… here is the link: FinCEN Publishes SAR Activity Review- By the Numbers – Issue 11

Here is their summary analysis regarding SAR filing increases in the first 6 months of 2008:

Suspicious Activity Reports characterizing the suspicious activity type as Credit/Debit Card Fraud increased 58%, compared to the corresponding six month period in 2007.

In 2008, Suspicious Activity Reports characterizing the suspicious activity type as Mail Fraud increased 49%, compared to reports filed during the same period in 2007.

The total suspicious activity reporting volume in the first six months of 2008 increased 18%, compared to the same period in 2007.

Suspicious Activity Reports characterizing the suspicious activity type as Money Laundering/Structuring increased 15%, compared to the corresponding six month period in 2007.

And, this came out last month… as you know, investment advisers are not currently required to have AML programs in place, although most these days are adopting programs to meet the expectations of investors and broker-dealers. The announcement (see below) informs us that the proposed rule to require IA’s (SEC-registered IA’s and unregistered IA’s with $30mm under management) to have AML programs has been dropped. They say that if IA’s in the future are to be subject to FinCEN AML program requirements, a new rule will have to be proposed and adopted.

What that means for you, maybe: if you as a BD had hoped your unregistered IA friends would have their own darned AML rules to follow, so that you could rely on them to do it for you when they introduce investors to you, well, forget it. The currently-effective SEC no-action letter (effective 1-12-08) allows you to rely on federally-regulated IA's to do that--not unregulated IA's. I have that letter in my files; if you want me to email it to you, just ask.

Here is FinCEN's announcement, pulling the proposed IA rule proposal:
From: http://www.fincen.gov/news_room/nr/html/20081030.html
October 30, 2008

FinCEN Withdraws Dated AML Rule Proposals for Unregistered Investment Companies, Commodity Trading Advisors, and Investment Advisers

VIENNA, Va. – As part of its overall effort to increase its efficiency and effectiveness in administering the Bank Secrecy Act (BSA), the Financial Crimes Enforcement Network (FinCEN) has withdrawn its proposed anti-money laundering (AML) program rules for unregistered investment companies, commodity trading advisors and investment advisers. The withdrawals of the proposed program rules have been submitted for publication in the Federal Register.

Given the passage of time since these rules were first proposed in 2002 and 2003, FinCEN has determined that it will not proceed with BSA requirements for these entities without publishing new proposals and allowing for industry comments. FinCEN will continue to consider whether and to what extent it should impose requirements under the BSA on these entities.
Since the proposed rules were first published, FinCEN has concluded rulemakings for banks, broker-dealers and futures commission merchants. The financial transactions of unregistered investment companies, investment advisers, and commodity trading advisors and their clients must be conducted through, and their assets carried by, other financial institutions that are subject to BSA requirements. Thus, as FinCEN continues to consider the extent to which BSA requirements should be imposed on these entities, their activity is not entirely outside the current BSA regulatory regime.

In an effort to make its rulemaking processes more transparent, FinCEN today also established a section of its website entitled "Pending Rules" where those rules that are still awaiting comments or finalization will be made easily available.

I'm Going as a Conversion Chart for Halloween

2008-10-30T09:18:00.000-04:00

Reason? It's the scariest thing I can think of.

Remember when NASD Reg. merged with NYSE reg.? And they said they'd be consolidating the rulebooks? Well, the first set of Rule Conversions was released by FINRA on October 16. For 34 pages of fright, see Notice 08-47 at: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p117255.pdf

This shows the changes that are effective in 60 days. Many changes are simply adopting current NASD Rules and incorporating old NYSE Rules into brand new FINRA Rules—with no substantive changes. But the quantity of information is scary: 564 items in the handy “Conversion Chart.”
http://www.finra.org/Industry/Regulation/FINRARules/p085560 . This chart shows the old NASD Rule number and the new, corresponding FINRA Rule number (I'm not addressing NYSE Rule changes here, since that's not my area of expertise). That’s helpful, but not as great as it could be. I mean, each of these conversion listings has links to the old and new Rules, the Federal Register with the Rule Filings and approval orders, and any amendments to Rule Filings. The chart doesn’t comment on the nature of the changes represented: minor, technical or substantive. You have to cross reference the Notice (above) for any mention of that. Or open up the Rule Filing and start reading… a lengthy process, for sure.

I've added two columns to the chart: "Summary of Changes" and "In WSP? Changes Necessary?" This way, I'll record the results of my painstaking investigation into each and every cited change. Process: open up 'filing number' link on chart; read summary; open up 'text of proposed rule change' and any amendment links, read 'til I'm cross-eyed, then summarize changes on the table. Next, go to WSP, look for old Rule citations, change them, and add any text necessary to incorporate substantive Rule changes. That's it! I only have 547 items to go. I'm on a roll.

Seriously though, many of these changes relate to things like arbitration claims procedures and other administrative Rules that are generally not included in a firm's WSP. So, maybe in the end only a handful of these announced conversions will result in real written procedural changes. (Wait, this reminds me of the difference between the 'real America' and the, well, not-so-real America and that silly Congresswoman's call for Congressional hearings to route out the fakers... oops, wrong scary blog site...) Anyway, I'm not one to make assumptions and will therefore poke through every item on this chart. I'm praying to the Great Pumpkin and Santa Claus that the next released Conversion Chart will be waaaaaay less lengthy/frightening.

I encourage you to take the time to look at the recent Notice and to open up subsequent bi-monthly Notices. Scroll down through the list of Rule changes for those that are relevant to your business. It certainly won't pay to put off attention to this. Face these demons now: 'tis the season.

Have a sweet Halloween.

FACT Act for BD's? Maybe.

2008-10-15T12:35:00.000-04:00

A very helpful member of FINRA's Office of General Counsel looked into the whole FACT Act/ID Theft/Red Flags Rules subject. A big shout out to that person--thanks again!

I had asked him about 2 weeks ago about how these new rules might apply to registered B-D’s. He let me know that it is, specifically, FTC Rule 681, implemented under the FACT Act, that may apply. This rule goes into effect November 1. I guess FINRA is considering publishing either a reminder or guidance on the topic. Since it’s not an SEC Rule, SEC won’t be enforcing this; whether or not FINRA adds it to their examination protocols, we won’t know yet. A parallel example of FINRA enforcing an FTC rule is in the area of telemarketing restrictions. As you know, FINRA/NASD ‘adopted’ them and enforces cold calling rules.

Here is the link to the Federal Register announcing the FTC’s (and other agencies’) implementation of the FACT Act: http://frwebgate1.access.gpo.gov/cgi-bin/PDFgate.cgi?WAISdocID=080421251418+19+1+0&WAISaction=retrieve.

The operative terms within the rule are “financial institution,” “creditor” and “covered account.” I have a sense that M&A/private placement firms and straight up check & app firms (no brokerage accounts) will be able to exempt themselves; OGC seems to think introducing firms whose clients have brokerage accounts will not be exempt. But let’s wait and see…my opinion is, it’s only fair that FINRA provide some help on this complicated subject. Because let's face it: your compliance staff is working hard these days on many other issues. They're not pro-actively reading the Federal Register on weekends in an attempt to find new, unannounced rules to follow. (If they are, give them a raise or ask them to call me for a job.)

So be on the lookout for something from FINRA. In the mean time, think about clicking that link above and searching "681." You'll be way ahead of the game. (Unlike the Sox.) (Go Sox.)

Fact-ish: The FACT Act and Reg. S-P Amendments

2008-10-03T11:52:00.000-04:00

I'm writing this to let you know I'm looking into something--that is, this is preliminary and I'll follow up later. So, put this information in the category of 'truthiness.'

I saw on FINRA's weekly e-mail the announcement of its online workshop on the subject of customer data protection issues (see: http://www.finra.org/Industry/Education/OnlineLearning/OnlineWorkshops/P117068 ). Within the workshop description the “new FACT Act” is mentioned.

This mention made me look into the FACT Act; I'd certainly seen references to new 'ID theft' compliance in other documents and online sources, but I was not familiar with the Act, nor its applicability to broker-dealers. Sometimes I'm lazy (no, not lazy: overworked!), and I rely on FINRA's Notices to announce important new requirements that will effect my clients.

Note that the FACT Act was referenced in NtM 05-49, but only in the footnotes and in reference to preventing identity theft by destruction of consumer reports.

The FACT Act is a banking regulation: the Fair and Accurate Credit Transactions Act of 2003. Financial institutions, under the Act, have a mandatory deadline of November 1, 2008, to comply with three new parts, called the Red Flag Rules (in sections 114 and 315 of the Act). New requirements include:

Creating an identity theft prevention program
Implementing change of address safeguards when issuing credit/debit cards
Verifying identity upon notice of address discrepancy from a consumer reporting agency

As you can see, this stuff doesn't really seem to relate to your brokerage business. Well, my read of the FACT Act is that it doesn’t apply to broker-dealers. Here's an excerpt from the Act proposal that appears to exempt BD’s from complying with the red flag rules, including having an ID theft program:

334.90 Duties regarding the detection, prevention, and mitigation of
identity theft.
(a) Purpose and scope. This section implements section 114 of the Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681m, which amends section 615 of the Fair Credit Reporting Act (FCRA). It applies to financial institutions and creditors that are insured state nonmember banks, insured state licensed branches of foreign banks, or subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

But, within the Act, “account” and "transaction" as defined may include certain types of brokerage accounts that allow for check writing, debit transactions,etc., that would then throw the requirements into a BD's realm. Since you, the small BD offering mutual fund investments on an application way basis, doing private placements or hedge funds offerings, or running an institutional trade desk, do not allow check writing on customer accounts, this stuff seems inapplicable and worthy of ignoring.

But.... why the mention in the online workshop announcement? The mention, itself, is a red flag for me: ooh-oh, is this something I missed? Maybe the workshop will confirm just what I surmise: the FACT Act doesn't apply to you; no worries. I would have liked it better had FINRA released guidance first, though, so that the message was way more broadly-distributed (most firms don't listen to the online workshops). I've asked FINRA if guidance is forthcoming. I'll keep you posted.

We're not done yet.

Reg. S-P is subject to pending amendments that cross reference the FACT Act. So, this may be a good thing for you or a bad thing. That is, if S-P will definitively require all BD’s to comply with the red flag rules under the Fact Act, then you'll have to waste time building procedures or justifications for not having procedures to comply. Perhaps the amendments--and FINRA's expectations of compliance—will be nuanced, such that you won't have to waste time on this. We will see.

Now remember, my knowledge base is minimal on this subject. No facts expressed here, only factish information. My goal is let you know that you don't have to react with alarm if you hear about firms complying with the Fact Act. Most likely it does not concern you. But stay tuned, because the Reg. S-P changes might.

If only politics were this straightforward. ... oh wait, they are.

Outside In

2008-09-22T08:50:00.000-04:00

What does Heidi Klum say? "You are either in or you are out." It's one or the other, and the other goes home.

In years past this distinction for me has been clear: as an "outside consultant" to securities firms, I've always been treated that way by regulators--as an unwelcome outsider. I remember a few years ago, standing at a gas station in Some City, USA, on business travel. I was on my cell with a District liaison, fighting to get information from her about a rule interpretation or some such other clarification. My purpose was to assist my BD client--not to waste the liaison's time to build my personal knowledge base. I was speaking to the subject without divulging the client's name--that would have defeated my client's purpose at the time. Anyway, this experience was similar to many I've had over the past 8 years as a consultant: I act as a go-between in order to help my BD clients better meet Finra's Rules, and I'm shut down in the process by Finra staff due to a procedure they put in place that requires, without exception, the caller to identify the member firm's name when making inquiries.

I'm happy to say that my recent interaction with some Finra staff members has strayed from this model. I've been treated to assistance by folks in various offices--such as District offices and the Office of General Counsel--without the bias I was used to confronting. A great guy in Advertising has been helpful on several occasions. A kind examiner in NYC has been generous with his time. I haven't been made to feel like a spy or a cheater when engaging in intelligent dialogue. I'm hoping this trend continues. While I understand the old mantra, 'firms can call us for information without raising red flags or risking retribution...,' I also understand that many small firms simply prefer to avoid that direct contact. They'd rather have someone like me act as an information gatherer and interpreter. In my opinion, the result is the same (and mutually desirable): BD's are well-informed and better able to meet their responsibilities. The means to that end should not be restricted. It is in the investing public's best interest to let information/guidance/interpretation flow to BD's and their consultants.

I also want to thank some Finra staff members for their good-natured, prompt and extremely helpful assistance to me in months past...I won't name them, but the folks in the online learning and waiver departments are good at what they do and pleasant to work with. Thanks to all of you!

So, Heidi, am I in or am I out? I think for the time being, I'm a little of both. And on this particular reality show, that means I'm a winner.

The Law of Opposites

2008-09-18T13:48:00.000-04:00

I haven't written for a while. Too much going on. I've been busy watching my son balance speed with caution at the age of 16, marvelling at my other son as he defies gravity on his unicycle, questioning the sanity of our polarized political system, and witnessing the end of the beginning of the end. These directional changes are making me nauseous. At least I have my work to keep me facing forward... I think.

A few thoughts for the day:

Finra has redesigned its website, just when I became adept at navigating the old site. Oh well, it's not about me. Anyway, it looks nice. www.finra.org

FinCEN's most recent report on suspicious activity reporting--SAR by the Numbers--includes totals for 2007. It's here: http://www.fincen.gov/news_room/rp/files/sar_by_numb_10_sec4.xls

From 2006 to 2007, there was a 58% increase in the number of SAR's filed by the securities and futures industry. One of the fastest areas of growth was in identity thefts. I imagine we'll see high growth again this year, since it's one of SEC's and Finra's priorities to make sure firms are filing SAR's, even in the face of 'potential' suspicious activity. (On that subject, please read Bill Singer's 'Cases of Note' comment on the James I. Black & Company and Jess Gove Tucker III case, August 2008 at: http://www.rrbdlaw.com/RegulatoryLinks/CASESOFNOTE/NASD/2008.htm .) Oh, and if you look closely at the report, you'll see only one state where, since 2003, there has never been a SAR filed. Where? The State of Alaska. Does that mean Sarah Palin supports money laundering by terrorists? Probably not, but I bet someone on cable TV would make that connection.

Back in May, Finra released a series of Notices related to the Rule Consolidation project. Notice 08-24 requested comment on revisions to supervision and supervisory controls rules. This is what we've been waiting for, right? The big Rule Consolidation Re-Write... the one that will bring us closer to an intelligent, principles-based regulatory structure that allows for flexibility depending on firm size and business niche?

Not so fast.

First, they're going to rewrite the rules so that there is less clarity, more cause for misinterpretation, broader authority leading to even more onerous procedural changes, and... oops, I didn't mean to be critical. I admit it must be a very difficult job: to take a HUGE rulebook governing many different business models, full of cross-references, overlapping definitions and nuanced contradictions, and attempt to improve it with a little tweaking. My take is, it's not gonna happen with edits--it will only happen with a complete re-write.

In the end, firms should be required to simply do the right thing and a well-managed regulatory body should be capable of discerning when those firms are not doing the right thing. The more minutia- and legalese-laden, arbitrary and seemingly non-applicable rules, the more likely firms are to treat compliance like a chess match: outwit the opponent by seizing on his lack of peripheral vision. That's not the way it should work.

Anyway, what IS interesting are the comment letters--go here, and choose some to read. http://www.finra.org/Industry/Regulation/Notices/2008/P038502 It's encouraging that firms are voicing opposition to things like: broadened supervisory requirements on outside business activities; requiring principals be assigned to supervise business areas of firms that do not require BD registration; duplicative supervisory sign-off on investment banking transactions; closer oversight of one-person OSJ's; and transaction review of reps' family member accounts, among others. I especially enjoyed reading the letter from ING Advisors Network, June 30. The author's comments are clear and rational. See: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/noticecomments/p038858.pdf

Now, back to the end of the beginning of the end... Did I really just say that firms should have simple, principles-based rules to follow in the way they see fit, and our regulators should be smart, motivated, united and reasonable in enforcing these new 'just do it' rules? I said that, in this market environment? What, am I nuts? Every day on the news shows all I hear is 'more regulation, more regulation, more regulation,' even from those who oppose it. I pity the team of Finra authors even more: if their mission was challenging before, it's now darned-near impossible. Whose advice do they take? Alan Greenspan said leave the short sellers alone--they're necessary and smart. Other talking heads say the short sellers are greedy and irresponsible. I hear Cox is a genius, then I hear he's an idiot. I'm not savvy enough to make up my own mind. But as a compliance consult, I do know one thing: there will be more rule changes and more rules and much, much more work to do on the part of my small BD firm clients who ALWAYS do the right thing.

In the name of opposites, I'll close quoting someone else, whose name I don't know (he was on Fresh Air): "In our country we privatize profits and socialize losses." Isn't that perfect? -er, I mean, not perfect? ....there I go again.

FinCEN's Better Website

2008-08-04T09:27:00.000-04:00

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.

Another Cover-Up

2008-07-19T11:47:00.000-04:00

Remember when John Ashcroft, serving as Attorney General under President Bush 2001-2005, required that the statues in his press room be made, well, less revealing? In an effort to protect the public, expensive fabric was draped over the age-worn marble of both Spirit of Justice and Majesty of Justice--well, at least over the more love-worn parts. The language of art was muted to satisfy our government's assumptions about our well-being. The thought art provokes, the questions it raises, and the beauty it portrays were denied an audience (what audience? ...not sure anyone was watching Ashcroft, anyway).

Mr. Ashcroft opposed nudity in art. Last week, the SEC decided it would oppose nudity in short selling. In an emergency order released July 15 (see: http://www.sec.gov/news/press/2008/2008-143.htm) SEC announced that for 19 publicly-traded financial company stocks (such as Lehman Bros., B of A, Citigroup, and of course, Freddie Mac and Fannie Mae), short sellers have to pre-borrow the subject securities, as opposed to the standard pre-locate practice. Trading firms everywhere are scurrying to devise procedures to meet this order. Some are saying 'forget it'--we just won't trade in those stocks for 8 days. And maybe that's what the SEC is hoping for: shrouding the market in a blanket heavy enough to silence the critics.

The SEC's mission was to "protect investors, maintain orderly markets, and promote capital formation." Is it possible that what the SEC is really doing is denying the rightful power of the free market to self-adjust? I mean, by shielding these firms from what the market wants to do--short the hell out of them in expectation of falling prices--isn't the federal government, with its artificial drapery, silencing the thinkers? ignoring the questions? rejecting the beauty of a sophisticated investment community? Why not let things progress as they otherwise might--let these financial houses of cards fall? Let the investors suffer for their bad choices? As they say in sports, no pain, no gain. The gain we sacrifice here is badly needed. Corporate bail-outs, no matter what form they take, don't help us progress. They just delay the pain.

On a practical note, by now you should have talked to your clearing firm about rules engines or other means of ensuring this temporary rule is enforced. And you should have informed your traders of the specific requirements. Be sure to notate your short sales as having complied with the 'pre-borrow' ethic. Keep the records; have a supervisor review the records. As for keeping your clothes on, well, that depends on how hot it gets...and your definition of 'art.' ;)

I won't call it a reversal

2008-06-26T16:07:00.000-04:00

...but it seems like one.

Oh, I'm talking about electronic storage rules again. When I die, will someone please make sure my tombstone says something about my dedication to this cause? ...says something...not necessarily flattering.

Okay, so in the last two days I've run into situations where it appeared that 3rd party electronic storage vendors would not provide the representation letters generally expected under 17a-4(f)(2)(i)--you know the letter--the one that says the media will do the things listed under (f)(2)(ii), as follows:

(A) Preserve the records exclusively in a non-rewriteable, non-erasable format;

(B) Verify automatically the quality and accuracy of the storage media recording process;

(C) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media; and

(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member.

Since way back, when this subject was just a shadow across compliance officers' desks, the expectation--and instructions from then-NASD, I might add--was that, if the firm used a 3rd party vendor to store its electronic records, it was the 3rd party vendor who was required to make those representations in writing, on their letterhead, to the regulators. The firm would engage the vendor to store information (such as e-mails), would request the letter, would get the letter, and would mail it to Susan DeMando's office. Later, firms had to submit it to FINRA online.

Firms storing their own records electronically would make the representations themselves, in writing to FINRA.

What I just learned from a helpful and trusted FINRA staff member is this: the format representations letter does NOT have to come from the 3rd party vendor. Quoting (f)(2)(i) of the Rule: "...the member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2)." The staff member said that the BD would make the representations 'unless they don't have the knowledge' to make them.

My opinion is this: most firms are hiring out because they don't have that knowledge or anything close to it. But hey, I've been wrong--or at least misled--before.

Most 3rd party vendors, in my experience, give those letters to their clients for delivery to FINRA. I would expect it if I were you. If the vendor wants to charge you for the letter, save your money and write the letter yourself.

Here's the thing , though: make sure you, the BD, get solid, written clarity from your 3rd party vendor before writing and submitting your letter to FINRA. You have to be sure the media meets the criteria. You're hiring the vendor because you can't or don't want to store the records yourself... you'll need to rest assured that the records meet the regulator's expectations, right? Otherwise, why pay their prices??

Oh, and remember: you always have to submit an 'access letter' to FINRA-complying with 17a-4(f)(3)(vii)--and that letter has to come from an independent third party (any old third party will do--as long as they know what they're talking about and they're not an affiliate or relative). Your third party storage vendor will write that letter for you--if they don't, fire them.

Thanks to Davis for his inspiration... he knows that nothing gets me going like ESM.

Little more input on audit function under electronic r/k rule

2008-06-20T11:30:00.000-04:00

Quick--I promise--update on the 'audit function' under 17a-4(f)(3)(v). This week a FINRA examiner provided verbal guidance in response to a firm's written request for such. The guidance was not specific; it was based only common sense, not formal guidance from SEC or FINRA higher-ups. It consisted of recommending a periodic review of stored records to confirm that they are intact.

Okay then.

Obviously more on this subject is necessary for firms to fully understand their responsibilities.

AND...I came across another outside vendor for e-mail archiving: Global Relay Communications. I haven't gotten permission to link to them--please google them and check out their broker-dealer services. They seem quite thorough in their comprehension of FINRA members' regulatory burdens. Their materials plainly address all requirements and describe how their systems meet them... nice to see. Here's an excerpt from their presentation on the audit function (okay, I didn't get permission to copy this--but I'm hopeful the G.R. folks will appreciate the plug):

"All messages stored in the Message Archiver are forwarded directly from the Member firm’s email server, with no User intervention. During the lifecycle of a message, all actions (viewing, replying, forwarding, downloading, flagging, notation, review) by any User, Reviewer, Super Reviewer, Administrator or the system itself associated with the message are logged. The Message Archiver’s detailed logs provide a full audit trail verifying the integrity of the message. These logs automatically appended to the messages and are viewable and made available to authorized administrative Users.

As detailed directly above, Message Archiver immediately provides a full audit trail accessible to any authorized administrative User. A side benefit of the system, is that a firm also builds an audit trail for the auditors actions in the archive during an online audit.

Global Relay’s Message Archiver employs retention schedules for all audit results. Audit results are retained for the lifecycle of the message. The SEC three and six year retention requirement for records set out in paragraph (a) and (b) of this Rule 17a-4 can be applied to the audits within Message Archiver."

Happy Summer!

Bill Singer, Put Your Holster Back On

2008-05-22T12:28:00.000-04:00

"When I decide whether to ride out of town into the sunset or slap the iron back on and walk the streets, you'll know -- I'll post that decision here."

That is a quote from Bill Singer's blog entry of May 16. The good news is, he wrote a subsequent entry--"The Dead-Animal Man"--yesterday, on May 21. The bad news is, he didn't reveal his decision. I'm reluctant to assume he's back in the saddle again, since this latest, delightfully-dreary, entry did not address our favorite subject (the one that so wears on Mr. Singer that he is forced to consider retiring to the comforting chaos of his Pandora's box): securities regulation and its many splendid forms. Is Bill back? Or still in the barn? I, for one, am waiting with great hope that he'll darken FINRA's doorway again soon.

Bill's blog: http://www.rrbdlaw.com/brokeandbroker/index.php

Exam Priorities

2008-05-22T12:18:00.000-04:00

FINRA just put out its annual notice on exam priorities. Below I've listed the areas they prioritize (many), along with summaries and few comments. Far below, I note some recent findings I've seen on exams. This isn't overly original or interesting, but I thought I'd throw it in my blog, since I've been way too busy lately to write anything else... :)

Senior Investors – hot topics include misleading advertising, shameless, fear-inducing sales pitches and of course, suitability. Advice: don’t let your reps claim to be qualified
‘senior investing’ specialists and make sure each transaction is well documented to establish suitability.
Deferred Variable Annuities – new Rule 2821 went into effect, sort of, on May 5. Reps have to document their reasonable basis for recommending a Def. V/A purchase or switch; principals in the future will also be required to ensure reasonableness. Training is in Def. V/A rules and products is required. Here is the link to the April Phone-In Workshop on the subject - phone-in workshop; also reference my notes on this in an earlier blog entry.
Anti-Money Laundering (AML) – final rule 312 of Patriot Act went into effect in Feb; most small firms are not effected since they don’t have foreign banking relationships. Examiners are looking for suspicious activity monitoring and SAR filings; also making sure firms are having independent testing as required. Remember, follow-up on testing recommendations and keep records of your follow-up action taken.
Protection of Customer Information – issues include online account hacking (not relevant for most small firms) and protecting information stored electronically (on hard drives, portable drives, laptops and PDA’s). Exam deficiencies include failure to provide privacy notices (and keep records of providing them), failure to have procedures addressing disposal of consumer report information, failure to obtain required confidentiality agreements from third parties; failure to insure that outsourcing entities maintained the confidentiality of customer information; and failure to include a required “opt out” clause in their privacy policies. While firm procedures may address safeguarding their information, it’s a good idea to have a separate “IT” type document detailing the administrative, technical and physical safeguards used to secure data.
Supervision and Supervisory Controls – I guess a lot of firms are still struggling with the difference between supervisory procedures under 3010 and control procedures under 3012/3013. Exams focus on separate control procedures, review of producing manager, heightened supervision of high-risk brokers, annual testing and verification and CEO certifications.
Sales of New or Non-Conventional Products – firms have to have procedures for approving of new products; examiners are also focusing on recommendations in new and non-conventional products, such as hedge funds, CMOs/CDOs, REITS, auction rate securities and other structured products. Guidance references MSRB notices for firms doing muni business.
Transaction Reporting – accuracy of reported transaction information is the firm’s responsibility, no matter how it’s reported. Trade Reporting Facility participants must transmit certain information regarding last sale reports of transactions in designated securities. Examiners are also finding firms to have incorrectly reported riskless principal transactions, incorrectly reported transactions with the long/short-sale indicator and not properly submitted OATS data with accurate order information, terms and conditions, and/or special handling codes.
Business Continuity Planning (BCP) – the exam priorities publication states that firms should periodically test their plan to ensure all of its components work as envisioned…but this is not required by the Rule itself or in FINRA’s 2006 NTM 06-74 on the subject. Firms should decide if periodic testing is necessary, given their size and customer services.
Data Integrity – exams will look at CRD filings, complaint reporting and clearing firm reporting to ensure accuracy and timeliness. Firms face steep fines for late filings.
Bank Sweep Programs – for broker-dealers sweeping customer credit balances into deposits at banks. All sorts of issues, here, including: protection of funds, net capital requirements, written agreements, reconciliations, books and records, SIPC/FDIC coverage, and account statements. Call district contact to discuss before setting up such a program.
Agency Lending Disclosure – for firms that operate an agency securities lending business. Exam findings show firms not performing principal counterparty credit risk monitoring or reconciliations and not resolving contract differences nor computing securities borrow deficit capital charges at the principal counterparty level. Ref: 05-45.
Inventory Valuations – firms should have controls to independently validate the pricing of inventory positions.
Outsourcing – outsourcing is not a substitute for internal controls and compliance monitoring; outsourcing should be monitored and overseen. Outsourcing to foreign entities may result in risks and should be closely monitored.
Order Audit Trail System (OATS) – as of February 4, 2008, OATS reporting requirements include OTC equity securities such as orders for OTC equity securities traded on the OTCBB, Pink Sheets or otherwise, as well as orders for certain foreign equity securities and other securities meeting the definition of OTC equity security in NASD Rule 6951. Best to visit the OATS web site (OATS) and FAQs to understand the complexities of OATS reporting.
Regulation NMS -- SEC Rules 610 (the Access Rule) and 611 (the Order Protection Rule) were fully implemented for all NMS stocks as of October 8, 2007. Initial FINRA exams show that some firms mistakenly may believe that Reg NMS does not apply to them, either because they make markets in a limited number of NMS stocks or because they infrequently execute orders internally. Note that Reg NMS does not include any exception to the definition of “trading center” based on de minimis activity. Firms are reminded that the requirements for ISOs apply to “any broker or dealer” that uses ISOs, and are not limited solely to broker-dealers that operate as trading centers. Refer to online resources for clarity on this: Spotlight On Regulation and Frequently Asked Questions on Rules 610 and 611.

Additional areas of exam findings:

Changes in Account Name or Designation – changes in account name or designation, including error accounts, must be approved by a designated principal and there must be records to show that s/he was personally made aware of the essential facts concerning the change. Approval must be noted on the order or another record.
Time and Price Discretion – when relying on a verbal, one-day time and price discretion exception to Rule 2510 (discretionary accounts), firms must note the reliance on tickets and must not extend the discretion beyond the close of business that day. (Doesn’t apply to institutional accounts in ‘good-til-cancelled’ transactions on a ‘not held’ basis.)
Net Capital – violations include inaccurate inventory valuations of prop. positions and mark-to-markets performed by traders; and improper treatment of ‘cash-like’ investments offered by banks (non-allowable).
Customer Protection – 15c3-3 violations include: inaccurate treatment of stock record allocation positions; non-bona fide reserve bank deposits; and creation of segregation deficits by deliveries, securities loaned and securities borrowed returns.
Back-Office Transaction Processing – inaccurate trade processing and reconciling. Conversions of processing systems often leads to a lot of trade breaks and unreconciled items, creating inaccuracies in books and records, charges against net capital and increased customer reserve requirements.

What I have seen lately in exam results:

Audit of Electronic Storage Input -- failure to have procedures for/comply with the ‘audit’ function under the SEC electronic books and records rule (17a-4(f)(3)(v). I have requested guidance from four FINRA staff members; three clients have directly requested guidance, verbally and/or in writing, from their examiners and/or liaisons, but NONE has been provided. At very least, perhaps firms should ‘check to see that the records are there’—paraphrased advice from one FINRA staff member.
Notify Outside Brokerage Firms of Employee Accounts – Rule 3050. If reps opened accounts prior to being associated persons of the firm, they will not have informed the outside brokerage firm of their status as RR. Firm should send letter to outside brokerage firm with request to provide duplicate statements/confirms.
Provide Copy of U5 to Term’d Rep – copies of U5’s must be provided to terminated reps within 30 days of termination; keep a record to show that the U5 was indeed provided.
Maintain Updated Contacts on FCS – be sure when updating contact information that you hit “save” or the changes will be lost. Changes of most CRD information should be made within 30 days of the change or of knowing of the change.
Provide BCP Disclosure Summary – required for all firms, including those with institutional customers. Provide at account opening and when the information changes (not an annual disclosure requirements, but a good idea to include in annual disclosures).
Register Personnel with Access to B/R – back office or administrative staff who have access to customer records or the firm’s financial b/r should be registered on CRD as “NRF” employees. Fingerprint cards and certain personal data are filed.
Obtain AML Information (CIP) -- new account forms or other such forms should include all required CIP information—name, physical address, TIN and DOB if individual. Verification must be in evidence and customers must be informed of firm’s CIP verification efforts—keep records of all compliance with this rule.

Deferred Variable Annuities--The New Rule

2008-04-22T13:29:00.000-04:00

Hi. And Happy Earth Day. While you're in your backyard digging holes and planting things, perhaps include this information (-'er, I don't mean bury it--I mean, plant it in your mind so that it may bloom and grow).

Rule 2821 is effective May 5. But not the whole thing: paragraphs (c) and (d) have been put on hold indefinitely, pending SEC's response to FINRA's forthcoming amendments (that's some kinda vague, isn't it?). What this means is: your Reps have to perform and document a suitability analysis for def. v/a purchases and exchanges, but you as Principal don't have to follow the new approval rules--you don't have to make a suitability determination, too. At least not yet. You still have to approve the business like you've always done. The other part of the Rule that will be effective May 5 is the training part: you have to train your reps on the new Rule and on def. variable annuities in general, along with the specific products they offer. I have a feeling you're doing this already for C/E purposes. But be sure to train, by May 5, the reps on the specifics of their new obligations under the Rule; also train them on any new forms you've devised to help them document their suitability analysis. Lastly, interestingly, your firm has to comply with these effective parts of the Rule, but you don't have to have written procedures in place describing the compliance elements you're adopting. That paragraph (d) has been delayed. If you're in the process of updating your WSP manual, or will be soon, it wouldn't hurt to go ahead and include new procedures: you can revise them later, if necessary.

I listened in on the Def. V/A Phone-In Workshop last Friday. Here are the notes I typed up. My apologies for the tone of brevity. FYI: I didn't learn a lot on this phone call and found that the "cya" and "not our job" messages were loud and clear, as usual.

Notes on Rule 2821: Deferred Variable Annuities Phone-In Workshop
April 18, 2008

Presenters: Larry Kosciulek and Andy Favret

1400 participants signed up for call
Questions submitted in advance; no live questions from listeners
(cya introduction: FINRA doesn’t endorse any compliance practice)

Link to materials: http://www.finra.org/EducationPrograms/Materials/p038332

1. UPDATE:
Paragraphs (c) and (d) –effectiveness delayed indefinitely. See rule filing notice sent April 17 by Finra: http://www.finra.org/RulesRegulation/RuleFilings/2008RuleFilings/P038354

2. APPLICABLE TO:
Rule applies to stand-alone purchase of def. v/a and exchange of one for another. Includes purchases in IRA accounts, not transaction in employer-sponsored plans. Does not apply to re-allocation in sub-accounts or to subsequent investments in sub-accounts. Does not apply to recommendations to SELL v/a’s (but other, general rules such as Communications with the Public--Rule 2210--apply to these transactions). Rule would apply to specific recommendations made to individual plan members of an employer-sponsored plan.

Rule applies to recommended transactions (not all communications constitute recommendations)—but the text of Paragraph (c) (that may be amended and is not now effective) states that a principal must treat “all transactions as if they have
been recommended for purposes of this principal review” and must make a suitability determination… FINRA is considered truly making the Rule apply ONLY to recommendations.

3. SCOPE:
Rule pertains to:
Reps who recommend these transactions
Principal who approve them
WSP’s
Training

4. REPS:
When recommending purchase or exchange, must get info and review existing assets. Effective date: May 5

Q: What does “liquidity needs” mean? What info is required?
A: See 2821(b)(2). Liquidity needs is not defined, but age, income, net worth, dependents, short term cash needs for homes, education, etc. are factors to consider.
IRA funds are not liquid assets—because they require a penalty/fee to tap.

Information must be captured so it can be reviewed: no special form is required under the Rule.

Q: Document and sign determinations: what form to use? Is the intent: to provide rationale for transaction or to give disclosure to client?
A: Form should be firm’s choice as appropriate. This is not about disclosure to customer; it’s about suitability.

Remember, investment time horizon—these securities are long term investments. Access to funds before end of surrender or waiting period is costly.

Rep must determine suitability based on factors listed in rule. Must document and sign some record to show this.

Exchanges: primary purpose cannot be RR’s profit. Consider:
Triggers surrender charge?
Lose benefits, increase in fees/charges?
Compare fees/etc. of both
Does customer benefit?Has customer done exchange w/in last 36 months?

Q: The 36-month exchange reference—does it refer to the particular customer’s account?
A: No, in any account w/in 36 months.

Q: Does customer have to sign acknowledgement of disclosures?
A: No but firm may decide to require this.

Remember: ‘Intended use’—important to suitability consideration. Need for cash---not a good reason to buy v/a.

Q: Is an exchange within 36 mos. a call to action?
A: No, an exchange with a customer having done an exchange w/in the last 36 months may not necessarily be prohibited. This information is just part of the necessary background information used to make suitability determination. A yes answer may end up triggering more supervision or a closer look at the proposed transaction.

5. PRINCIPAL:

Paragraph (c) of Rule—Principal must review before sending to insurance co/vendor for processing. This paragraph is not in effect; delayed effective date.

Discussing it anyway….

Q: If customer sends $ directly to vendor how can Principal review transaction before sending for processing?
A: Doesn’t apply to non-recommended transactions or to reinvestments.

Rule is in state of flux for now. Par. (c) will be amended and FINRA will provide guidance.

A: What about in the interim? Bet. May 5 and ultimate effective date of (c) and (d)?

No interim requirement. Keep doing what you’re doing re: Principal review… firms can adopt new procedures now if they want.

Principal doesn’t need insurance license to approve this business. 26, 24 or 9-10 license is okay.

Rule now states that Principal must approve within 7 business days of the customer signing the application. The workshop presenters said it was 7 days from the date the OSJ received the completed application. Assumption: clarification is forthcoming with Rule change.

Application must be sent by next business day after Principal approval (noon on Day 8 at latest)

Firms can hold customer checks pending Principal review—relief from net capital reserve and n/c rules. “Promptly transmit” is waived if 2821 is met.:
Copy check, record date rec’d and date transmitted to vendor or returned to customer. (i.e., on checks rec’d forwarded blotter)
$ must be sent by noon next day after approval.

Possible Rule change about use of suspension a/c’s at ins. companies. This would allow funds to be send pending Principal approval.

6. WSP:

Although this part of the Rule has been delayed, it (paragraph (d)) will not change. Firm will be required to have written procedures.

Automated systems to review/approve v/a business is NOT permitted.

7. TRAINING:

Training program must be in effect by May 5.

Training required on more than just general characteristics--on specific products offered by firm.

Rely on 3rd parties, such as wholesalers, ins. co’s? Okay, but firm ultimately responsible.
Train all reps on 2821 by May 5.
Can put in c/e firm element, but some training should be provided by May 5.

Use webcasts and e-learning to provide training.

For wholesalers who promote v/a products to firms—training req. does not apply (no recs to customers)

8. MISC:

Q: Offshore V/A’s—included?
A: Rule focuses on whether it’s a registered product, not if it’s offshore (no explicit answer to question)

FINRA “Relies on firms to set their own parameters for suitability”—FINRA doesn’t set.

Q: What is reasonable for procedures/disclosures?
A: Firm decides. For instance, could require customer sign-off on purchase/exchange.

Q: Does FINRA have any plans for an online tool like the Mutual Fund expense analyzer to use with V/A analysis?
A: They are exploring this.

Q: Will FINRA be providing other tools, like disclosure forms? Replacement forms?
A: No, they’re not working on this.

Workshop time estimated: 75 minutes; actual time: 50 minutes.

If I Were a Golfer I'd Follow This Guy's Advice

2008-04-01T09:43:00.000-04:00

Personally, I hate golf. But my relatives are pretty darned good at it--including a 2nd(?) cousin on my father's side named Tommy Weiskopf. Now that I've established credibility, read on...

For you compliance professionals who like the game of golf but hate the way it makes you want to throw your clubs in the nearest water hazard, I recommend this book: Peace and Par, Enjoying Golf in the Now. My most enlightened friend, Mike Shingleton, wrote it and he did the golfing world a favor by introducing ancient breathing techniques to this too-often stress-inducing game. Read this book, practice the technique, and you'll be: a) happier and b) a better golfer. Oh, and you'll laugh along the way: Mike is a very funny guy.

Maybe his next work will help compliance folks breath easier during routine exams. I'll keep you posted. (But seriously, Mike Shingleton, a former institutional bond broker, leads in-office stress management sessions that are remarkably effective in reducing workplace anxiety. Even if you don't golf, Mr. Shingleton may be able to help you and your company.)

Here is the link to Mike's website: http://www.thenowsound.net/
And here is how you buy his book: http://www.amazon.com/Peace-Par-Enjoying-Golf-Now/dp/1419681419/ref=sr_1_1?ie=UTF8&s=books&qid=1207058765&sr=8-1

“In like a lion…”: no kidding! I can’t wait for the lamb.

2008-03-28T14:13:00.000-04:00

Plenty of action going on at FINRA these days. I count 24 announcements made in the first 20 business days of March. That’s 1.2 announcements per day! I’ve pulled out a few items to share, in case you haven’t been reading.

In FINRA’s March 24 exam priorities letter we heard about…
1. a change in examination protocol. Firms will no longer reply to their exit conference memo…from now on, they’ll wait to receive an “Examination Report” and they’ll have 30 days to respond. The final document from FINRA after an exam will now be called the “Examination Disposition Letter,” which will enumerate exceptions/deficiencies classified as: No Further Action, Cautionary Action, Compliance Conference, or Referral to Enforcement for Review and Final Disposition. Obviously, we’ll need new acronyms… goodbye, LOC.

2. a new name for your helpful FINRA contact person: “Coordinator.” They say that for most of you, the Coordinator is the same person you used to call “Liaison.” Of course this person could be different from your Core Examiner and Finance Coordinator. In any case, perhaps this new title will last longer than the last one did.

3. advance notice of examinations. The new timeframe is “up to 30 days”…but not necessarily 30 days… that will depend on the risk perceived. In some cases, firms will get up to 60 days, for instance those firms with lots of retail branches where beaucoup information requests will have to be met. Side note: for those of you who have not gotten Web IR entitlements, I suggest you do that now. That way, when you get your exam notice, you’ll be able to login to the Web Information Request site and get started—you’ll have more time to prepare for the exam, this way.

4. paying careful attention to senior customers. If only FINRA had beaten the sub-prime horse to death, as it does with this issue…maybe my portfolio would be in better shape (etc., etc., etc….it’s not all about me, I know that). Not that this issue isn’t important, but, well, if this is the first you’re hearing about your obligations to ensure suitability when dealing with senior citizens, I bet you’re dizzy right now from your recent space travel.

5. the new deferred variable annuities rule—2821. Partly effective May 5, 2008, so look it up. You may find that your firm is already complying because you generally adhere to a best practices ethic. A few parts of the rule that concern supervisory approval have been delayed until August at the earliest. Check out NtM 07-53 to know what’s in store for you—or listen to the phone-in workshop on April 18.

6. data protection and how important it is to have your IT staff/vendor set you up right. Protect customer records! OK, easier said than done. I mean really, hackers are better than most IT staff and vendors. But that’s no excuse to do nothing. CD’s, thumb drives, laptops, i-pods all have to be protected somehow.

7. new MSRB rules that parallel FINRA’s supervisory rules… if this applies to you, see MSRB Notices 2008-06, 2007-32 and 2007-16.

8. other things like new product sales, fee-based accounts, transaction reporting, information barriers, inventory valuations, and the ever-present OATS, among others. Please see the link below for FINRA’s emphasis on these topics.

I won’t copy all of FINRA’s links to references for these items; rather, here is the link to their exam priorities letter, which contains many helpful links. http://www.finra.org/web/groups/corp_comm/documents/home_page/p038169.pdf

Also in March:

In Notice 08-12 we learned about an exception to the principal approval requirements for certain filed sales material—in Rule 2210. This is good for you firms out there that use mutual fund or variable annuity sales literature produced by the sponsor…now your designated principal doesn’t have to re-approve this material if it has already been submitted to and granted approval by FINRA. As they say really, really fast on the radio, “Certain conditions apply.” So read the Notice before giving up your advertising review processes.

In a podcast released Mach 25 that followed an information notice published March 12, we were informed that the big rulebook consolidation process is in the works. Meaning, NASD Rules and NYSE Rules will be harmonized into one new “Consolidated” rulebook. Key points made:
·Eliminating duplicative NASD/NYSE rules;
·Looking at both sets of rules to determine if one set can ‘inform’ the
other—meaning, turn two bad rules into one good rule;
·Considering different approaches to the application of rules, such as a
principles-based or tiered approach according to firm size, business model and customer type (retail or institutional). (Did I just write this or am I dreaming? Let’s all keep our fingers crossed on this one!)
·The process will be lengthy (my word, not theirs): the SEC will have to approve all rule changes. Some changes will be put out for comment first (don’t be shy);others will go directly to the SEC. Importantly for small firms, the newly-elected Small Firms Advisory Board will have a say in the changes.

In a March 6 news release we heard about some State Farm RR’s being busted for not taking their firm element online training; rather, they had someone else do it for them. Read my entry below about the $5,000/hour C/E course for a Word to the Wise.

A March 10 podcast reminds us of an earlier announcement about not having to keep copies—paper or electronic—of certain CRD filings. Yahoo! Filings that don’t require a Rep’s signature will now be officially maintained on your behalf by CRD. This applies to U4 and U5 amendments (but not DRP’s or any such filing that requires the rep to sign it) and BR filings. See the information notice from February 21 to read all about it.

We learned on March 17 that certain webcasts had been converted to a new format: the “video tutorial.” The VT is more like an E-Learning Course; it has a mastery test so you can use it as a C/E firm element training tool that will test your reps’ comprehension. The bad news it, now these lessons cost money, whereas before they were free. There are still many free webcasts online, but I’m wondering if eventually they’ll all go the way of VT? I don’t have the scoop on this. (Anyway, at the bargain annual subscription rate of $45 for unlimited E-Learning and VT courses, who’s complaining?)

On March 24, FINRA put out a Q&A on electronic filing requirements under Rule 3170. I can’t say I learned anything, but maybe if you’ve never dealt with the system this info piece will be useful. I was hoping for a bright, shining light on ESM rules (see my numerous, proof-I’m-obsessed-with-this-issue entries, below)…for instance what does ‘audit system’ mean, anyway?...but no such luck.

Lastly, on March 28 FINRA announced changes to the New Membership Application process...again. Form NMA has been restructured to be more logical and to prompt more detailed input; fewer items are sent hardcopy; funding of the application fees is done right up front; and applications are no longer filed with the district office--now they go to FINRA's HQ ("the Department"). These changes are effective June 26, 2008. Before then, follow the old process. These changes seem good to me; see Notice 08-14 for the details.

I did not comment on all recent announcements; if you want to see the full list go to http://www.finra.org/Resources/RecentAnnouncements/index.htm .

One last thing, not from FINRA: Investment News wrote on March 24 about the SEC’s expected proposal (by summer) that would cap 12(b)-1 fees charged to investors in Class C mutual fund shares. Here is the link to their article: http://www.investmentnews.com/apps/pbcs.dll/article?AID=2008468162776.

Thanks for reading. Now let’s hope that lamb shows up.

Optional Comments on Your DRP: some are not an option

2008-03-25T13:27:00.000-04:00

In Bill Singer's recent blog entry ("Regulatory Double Standard: Dissing your Settlement," 24 Mar 2008), he exposes FINRA's double standard in its enforcement practices. Mr. Singer tells the story of an industry heavyweight not being sanctioned or otherwise formally punished for remarks it made that violated the terms of its settlement agreement (it had agreed to not deny FINRA's allegations but then appeared to do just that). The story continues to show the flip side of enforcement...a registered rep was fined and suspended for doing the same thing, but in a different manner. On his U4, he denied the allegations named in his AWC (Acceptance, Waiver and Consent agreement). He did this in the "Comment (Optional)" question on the DRP. You should click this link and read Bill Singer's entry: it is interesting and provides a cautionary tale. http://www.rrbdlaw.com/brokeandbroker/index.php?a=blog&id=38

I'd just like to reiterate the lesson to be learned here.

Question 13 on the Regulatory Action DRP states, "Comment (Optional). You may use this field to provide a brief summary of the circumstances leading to the action as well as the current status or disposition and/or finding(s). Your information must fit within the space provided." After going through the lengthy and emotionally draining settlement process, some of you who stalwartly maintain your innocence may be tempted to include an optional comment such as, "I deny the allegations" or some similar, perhaps more veiled denial. Based on the disciplinary action described in Bill Singer's blog entry and his follow-up explanation of the implicit bargain struck in every AWC, this type of optional comment is NOT AN OPTION. (btw: Mr. Singer provided that explanation in response to my rant about reps having a right to free speech--I'm not an attorney and can sometimes get lost standing on a soap box).

So, following a final settlement with FINRA, make sure you live by the terms of that settlement, including not going around denying the allegations--especially on your U4. As Mr. Singer so eloquently put it, "It's a minor thing to ask someone to just keep their mouth shut and get on with their life."

Many thanks to Bill Singer for this lesson.

Understanding Eliot: Thank Goodness for Rule 3011!

2008-03-18T10:36:00.000-04:00

...otherwise, you may not have understood how Eliot Spitzer got caught.

Hmmm, what am I talking about? I'll explain. FINRA (NASD) Rule 3011 is the rule that broker-dealers follow when ensuring anti-money laundering compliance. You BD's set up written programs, supervisory structures, recordkeeping procedures, risk assessment strategies, reporting requirements and red flag escalation practices so that you meet Rule 3011 and the various requirements under even more various rules, regulations, acts and official guidance (such as the Bank Secrecy Act, the Money Laundering Control Act, The Travel Rule and of course, the USA Patriot Act, to name a few). By virtue of this compliance, you're familiar with terms like 'structuring,' 'politically-exposed persons,' and ' suspicious activity reports.' These terms have now migrated all the way from the Federal Register to NY tabloid publications--who'd a thought? But only readers like you, who have been subjected to the recent, rather annoyingly, non-stop attention to the AML subject, can really visualize how Eliot's bust materialized. The going story: he structured payments by wiring funds under the $10,000 reporting threshold; the bank didn't have complete information on the recipient of the third party wires; and Eliot was subjected to heightened scrutiny as a politically-exposed person. Voila. Sounds familiar and justified, non? Not in my understanding...

First of all, structuring to avoid reporting: the BSA's requirement to file reports on transactions exceeding $10,000 refers to currency, not wire transfers. A Currency Transaction Report would not be required for wires over $10,000. It's the Travel Rule that dictates records requirements for wires over $3,000...which brings me to the second point: the bank investigating the recipient of his wire transfers. The Travel Rule requires only that the initiating institution identify the recipient of the wire if it's a third party wire (not going to the sender's other account): the rule doesn't require due diligence on the recipient. If, instead, the institution were receiving a wire for a non-customer (for whom the institution had never done its CIP work), then yes, the institution would have to perform CIP on the recipient to verify his/its identity. This wasn't the case. So Eliot's bank (from what I've read) looked deeper into the receiving party which is what led, ultimately, to the suspicion. Lastly, Eliot's bank applied a higher level of scrutiny than normal, due to his status as a politically-exposed person. The problem here: Section 312 of the Patriot Act requires enhanced scrutiny of senior foreign political figures. The rule says nothing about US political figures. Eliot's bank obviously had its own heightened scrutiny procedures, and they're allowed to do so--all financial institutions may adopt and implement custom, risk-based AML procedures.

So, the escalation of poor Eliot's financial transactions to the level of suspicious activity reporting was based--in part, and according only to my reading of media reports--on bank employees' mistaken or overzealous compliance with AML rules. He didn't avoid CTA reporting under BSA rules; his wire recipients did not require CIP due diligence under the Travel Rule or Section 326 of the Patriot Act; and he as Governor did not require heightened scrutiny under Section 312 of the Patriot Act. And he still got busted.

The questions this fly-smashed-in-the-typewriter trail of events raises are these: Is Spitzer's case indicative of the purpose of federal AML rules and regulations? Does the public think it is acceptable to rely on these anti-fraud/theft/money laundering mechanisms to interfere with someone's private (if pathetic) life? Should banks and broker-dealers really take to heart the current "we're all in law enforcement now" ethic? Is it too much to ask of you, the broker-dealer, to devote time and resources to this type of non-financial crime investigation? Lastly, and importantly for your AML staff: do you understand your true obligations under Rule 3011, the BSA, the Patriot Act and other guiding FinCEN/OFAC rules? If not, my advice is to brush up.

Now if only the federal government had enacted a one-word violation called "hypocrisy." Eliot is clearly guilty of that.

No CIP for clearing firms...but not vice versa

2008-03-04T13:13:00.000-05:00

I remember the moment in Miss Anita's 5th grade class when she taught us the definition of vice versa...she used the example, "Jimmy has a crush on Sharon and vice versa." The color I turned!...a lovely shade of bright red. Well here's an announcement that will tickle clearing firms pink.

Fresh off the press: FinCEN has released a no-action position relating to CIP requirements of clearing firms. In summary, if the clearing firm has a written agreement with its introducing firm, and that agreement exclusively allocates to the introducing firm the functions of opening and approving customer accounts and directly receiving and accepting orders from introduced customers, then ONLY the introducing firm must comply with the CIP requirements for BD's. FinCEN has stated in this release that it will not take action against clearing firms in this situation. Of course, the written agreement must be clear in its allocation of duties.

Small introducing firms oftentimes express frustration with CIP rules and state their belief that, since the clearing firm has to ultimately accept the account and since it is the clearing firm that maintains the customer's securities accounts, why does it have to meet CIP rules--why not the clearing firm instead? I think it's interesting that this FinCEN release does not include a vice versa clause...that is, it doesn't offer no-action to introducing firms if the clearing agreement allocates exclusive final account approval to the clearing firm, instead. This clearly codifies the practical understanding of CIP rules: it's the front line that matters. The process of opening accounts and taking orders for transactions is an important first step to AML awareness and compliance. While the clearing firm has credit risk and handles the funds, it's the Rep-Customer relationship that counts when detecting and deterring illegal activities. I'm not saying clearing firms don't have AML obligations in this instance--they do, any many of them, as reiterated in FinCEN's release--but CIP, the cornerstone of a broker-dealer's AML compliance practices, is squarely in the hands of the introducing firms.

I have to be thorough by noting one point: an introducing firm may, indeed, be relieved of some or all of its CIP duties, but only if this arrangement is reasonable, in writing and renewed annually, and the CIP duties are performed by a federally-regulated entity subject to AML regulations. So the clearing firm can, in the end, perform CIP for its introducing firms, but that arrangement must be subject to an iron-clad agreement and is not something that can be inferred based on loose allocation language in a clearing agreement. Most clearing firms do not include CIP agreements in their clearing agreements. Other note: if your firm wants to rely on an SEC-registered IA firm to do CIP for you, it can under a 2004 SEC no-action letter that has been extended to be effective through January 12, 2010. But again, reliance is subject to strict conditions. See: SEC's no-action relief January 2008 .

Here's the link to FinCEN's no-action release: FinCEN's CIP no-action position .

And for the record, Miss Anita was right.

Few Reminders: Outside Brokerage Accounts and Cycle Exams

2008-02-21T12:11:00.001-05:00

Happy almost-end-of-February. Wasn't that lunar eclipse the coolest--'er, as the youth say, sick?! The shrouded moon should be a reminder to BD firms of the long shadow cast by FINRA. And thus...

A few reminders: your RR's MUST tell you about their 'outside brokerage accounts,' that is, their accounts at other firms in which they can buy/sell securities (futures, too). And they have to dislcose any such accounts in which they have a beneficial interest...like their kids' or spouse's accounts. Besides this notification requirement, the outside brokerage firms must be notified that the RR is registered with your firm. Usually this is done at account opening, right on the application, but if the account is existing when the Rep joins your firm, the outside brokerage firm may not be advised.... so when your Rep notifies you, send a notification letter to the outside brokerage firm. Oh, and if your firm doesn't allow Reps to maintain accounts at other firms, and a Rep defies this prohibition, well, talk to Bill Singer about that one. FINRA is coming down hard on Reps for this defiance. (Bill's "Cases of Note" on his RRBDLAW.com website is a valuable means of learning about violations and penalties.) Compliance tip: ask your reps at least once a year if they have opened any new accounts and take it from there.

Second thought for the day: FINRA's cycle exams may not be as far apart as you'd thought, based on your recent 4-year experience. They're using a risk-based system to test and may conduct a review of, say, financial books and records every 2 years, and a sales practice exam every 4 years. The unfortunate thing is, they won't tell you what cycle you're on. And the cycle may change without warning based on prior exam findings or things like errors on FOCUS filings. So don't get too comfortable or lazy: stay in compliance 24/7 and you'll be okay...oh, and a call to your liaison to ask about your exam cycle may shed some light on the subject. Or maybe a shadow--let's hope not.

Link to Sources for Going Paperless

2008-02-20T12:58:00.000-05:00

Investment News delivers stories and information useful to investment advisors. They started a newsletter about technologoy developments called IN: Tech and Davis Janowski posted an article on February 19 about going paperless. The article references vendors providing applications and other solutions that may be of interest to you, the broker-dealer struggling to keep up with record keeping demands.

I got pemission to provide the link to the article... go to: A Paperless Office Can Boost Your ROI and see what you think.

Remember to read my other entries on electronic record keeping if you want to test your ability to see cross-eyed. :)

See Jan. 22 Post on ESM: Audit System

2008-02-12T10:14:00.000-05:00

Hi. I'm still new at this blogging thing. I posted a new entry today--February 12, 2008--but it showed up as posted on Jan. 22. That's when I started writing it and saved it as a 'draft.' Please see that entry, below, for a tedious but possibly interesting discussion of a requirement under the SEC electronic storage rules you may not know about.

Thanks.

Protecting Infants

2008-02-12T09:21:00.000-05:00

FINRA has deluged us recently with guidance and reminders about protecting seniors: let's not limit our focus to the elderly. You've all seen that commercial featuring a baby making stock trades: it's time to think about how your firm will protect these valuable--and vulnerable--customers from potential deception by registered representatives. Next time a baby calls your firm to set up an account, ask these important questions in order to determine suitability:
Can you talk yet?
Can you walk yet?
Do you have a state- or federally-issued document verifying your identity?

That should be enough to get the ball rolling. And don't forget to discuss investment preferences. Formula and plastic rattles are not all these savvy little guys care about...

(In jest. Couldn't help it.)

ESM: Outsourced or In-House?

2008-01-28T10:55:00.000-05:00

If you keep any primary records exclusively in electronic format you know you have to meet all those tedious requirements under SEC 17a-4(f) (see other blog entries, below). ESM=Electronic Storage Media.

You have a choice to make: do you attempt to meet the requirements using an in-house system or by hiring a third-party vendor? Or both? Some firms use third parties to archive and monitor their e-mails, IM’s and external message systems like Bloomberg; and they use an internal system to store and backup their other—non-communications—records. The goal in either case is to ensure proper archiving, back-up and recovery, and content management.

Quick apology: I have no expertise in this area—the tech side, that is. The vocabulary is foreign to me and therefore I use layman terms when speaking to the issues. But consider this: I’m not very different from small B-D business owners who are struggling to understand the rules and implement a compliant system. Regulators should—and I’ve seen evidence that they do—cut firms some slack in this area.

Your choices of third parties are many: Seccas, Smarsh, Iron Mountain Digital, Amicus and AdvisorMail, to name a few. As time goes by these services become more conversant in SEC-speak and more able to meet your regulatory compliance needs without resistance or ignorance. They meet the storage, serializing, indexing and backup requirements, they provide back-up copies on disk when requested, they issue representation letters as required, and they provide nice software tools for searching data and completing lexicon-based compliance reviews. And their pricing is pretty good: a one-time set up fee plus a small fee per month, per user/mailbox. This is a nice way for very small firms to meet ESM rules because you are leaving the technical stuff and the hardware expense to folks in the know. [That said, remember that member firms have been cited with violating the rules because their vendors didn’t meet the rules…that is, compliance is ultimately your responsibility, not the vendor’s.]

In-house systems for very small firms tend to be, well, non-compliant. Many firms keep records on their hard drives, then periodically download them to disk or tape. Their records are rewritable and erasable for a period of time prior to being stored in WORM (write once, read many) format. That gap of time is technically not okay under the rule. Also, they generally do not have indexing or auditing capabilities. Lastly, they may not make back-up copies of the archives that, too, are serialized, indexable and subject to an audit system. And, while these firms may have notified FINRA/SEC of their use of electronic storage, a) their representations may not be true; and b) they may not understand or meet the obligation under 17a-4(f)(3)(vii) to have a non-affiliated third party issue an ‘access letter’—a statement that the third party can get to and provide records requested by regulatory authorities. Firms that meet every letter of the ESM rules most likely have an expensive system or full IT staff in place. One such system is put out by EMC. Their software and hardware products are, as far as I can tell, state of the art and—important for you—completely compliant. And at least one third party vendor I know uses the EMC system in providing services to firms like yours. The problem here, depending on the firm’s size, is cost. EMC’s policy engines, ‘E-Mail Xtender’ and “Disk Xtender,” may be affordable choices for establishing records storage, indexing and destruction parameters, but in both cases you’ll still need a hardware storage system to hold those records and enforce the established policies (such as EMC’s “Centera” product). That’s where it gets expensive. Then again, if you’re spending a lot of time and money storing your records and updating your servers, breakeven may be just a few years away.

How far to go in attempting to meet every aspect of the ESM rules?—that is the question. Is a good faith, less-than-absolutely-compliant approach acceptable? It is if you say it is, but you may be forced to defend your choices. The more resolute and sincere your defense, the more apt you are to win your own principle-based vs. rule-based battle. Not the war, though: that rages on.

Footnote: Another consideration… the cost of discovery. If your system feels good enough, but doesn’t meet every requirement, and if your firm is subject to a regulatory investigation, you will spend huge bucks to recover and produce requested records. This possibility should be built into any cost benefit analysis.

Links (without permission but with luck, permitted):
EMC: http://www.emc.com/solutions/business-need/compliance-ediscovery/index.htm
Smarsh: http://www.smarsh.com/prinsite/my/default.asp
Seccas: http://www.seccas.com/
Amicus: https://www.amicus.com/solutions/EMM/
Iron Mountain Digital: http://www.ironmountain.com/digital/
AdvisorMail: http://www.advisormail.net/emailcompliance/index.asp

Stay tuned; another--maybe my last?--entry on the audit aspect of ESM rules is forthcoming.

What Do the Numbers 3012 and 3013 Mean to You?

2008-01-24T09:50:00.000-05:00

For those into numerology, perhaps those numbers portend happiness, prosperity, or love. For you in the securities compliance business, you know otherwise. They mean WORK.

This is a reminder for those of you who first complied in about February or March 2006--and again last Feb. or March--with the 'testing and verification' requirement under FINRA Rule 3012 . You are required to test and verify every 12 months; that is, by the anniversary of your last test date. Since the testing and verification process takes longer than 5 minutes, or even a few hours, you may want to start the process now, or least prepare your strategy.

Remember your goal:
To verify that your firm has in place processes to:
(a) establish, maintain and review policies and procedures reasonably designed to achieve compliance with applicable NASD/FINRA rules, MSRB rules and federal securities laws and regulations;
(b) modify such policies and procedures as business, regulatory and legislative changes and events dictate; and
(c) test the effectiveness of such policies and procedures on a periodic basis, the timing and extent of which is reasonably designed to ensure continuing compliance with NASD/FINRArules, MSRB rules and federal securities laws and regulations .

Here is an example of the steps you might take to meet that goal:
1. Take an inventory of the securities rules and regulations that are relevant to the firm’s business, including identification of new or changed requirements applicable to existing or new lines of business;
2. Review the firm’s supervisory procedures and control system procedures that are designed to address the rules and regulations, as well as additional, internal policies;
3. Perform testing of adherence to the firm’s compliance, supervisory, and supervisory controls procedures using a risk-based approach;
4. Identify and detail the gaps perceived in meeting required procedures.
5. Devise a reasonable plan for addressing the perceived gaps.

Note the term 'risk-based'--it's important. You don't have to test every single procedure every year. You can prioritize and stagger your reviews according to product risks, customer profiles, new business areas and perceived weaknesses (i.e., from earlier office inspection or FINRA exam results).

You'll want to put the results your process in writing and present it to the top business officer of your firm. This meeting between you (CCO) and the top dog (CEO, for instance) is required. If you and the top officer are one and the same, may I suggest a mirror to aid in the communication?

Your top business officer will sign the 3013 Certification after reading the report and judging for him/herself that your firm does indeed have the necessary processes in place. S/He doesn't have to like the state of compliance, but s/he does have to acknowledge the existence of the firm's processes.

And remember, you don't submit the 3012 report or the 3013 certification to FINRA or SEC. You put them in labelled files and hope the examiner is happy with them in your next cycle exam. He or she probably will be: word has it examiners are not being overly fussy about compliance in small firms, but they do want to see good faith efforts.

The $5,000/hr Online C/E Course

2008-01-24T09:28:00.000-05:00

Well, it may seem like something you could get away with: having your assistant do that annoying RegEd or E-Learning online course for you. Why not, right? You know all that stuff anyway... so your assistant logs in as you, takes the course, logs off and you get credit. Saved you some time, which, in your business is valuable.

But if you don't make $5,000/hour, it may be worth taking the assigned course yourself. Just ask Karen Curtis, who was fined $5,000 and suspended for 60 days for trying this new method of meeting firm element requirements. Or ask Rebecca Sappington, who will never be allowed to work as a FINRA principal again because she directed people to take the courses for RR's. (She also paid $10,000 and is suspended for 6 months.)

To verify that I didn't make this up, and to see other unsmart ideas for getting around the rules, check out January's disciplinary actions at http://www.finra.org/web/groups/enforcement/documents/monthly_disciplinary_actions/p037831.pdf .

Electronic Storage Media: Audit System?

2008-01-22T16:39:00.000-05:00

Warning: you will need energy to get through this... if there's a power source nearby, plug in and read on.

This blog entry addresses a specific instance of what many have experienced: differing expectations from FINRA on meeting SEC rules. With regard to electronic storage, this is typical. On the one hand, we are informed that there are no interpretations: the rule is the rule and must be followed. On the other hand, we're expected to accept different degrees of testing during exams and differing exam findings--some tolerant and seemingly 'principle-based' and some strictly by the book. FINRA staff do not apologize for this. Exam methodologies are 'risk-based' and therefore can vary greatly--even for firms with identical business niches. While that seems reasonable, it also seems unfair.

17a-4(f) rules relating to electronic storage are hard to live by. Most small firms do not meet those standards. But then again, most small firms are forgiven by FINRA examiners (not officially, of course) who witness the firms making good faith efforts towards compliance. A firm that backs up its server daily and takes the tapes home is generally not penalized for not having WORM compliant media and not evidencing instantaneous compliance with the rules (that is, there is a gap between record creation and compliant-format storage). And that's good.

But how to plan for this sort of non-uniform enforcement? I mean, a compliance consultant like moi can't just say, "Awe, don't worry about it--your system is close enough!" Our job--I should say my job--is to help firms understand what is expected of them (i.e., rules) and help them put in place procedures that meet those expectations (i.e., compliance). It's not up to me to exempt firms from certain aspects of certain rules, where there is no official regulatory exemption. I have to promote compliance to the highest degree. But in cases like electronic storage, my job is hard.

Here is an example: SEC 240.17a-4(f)(3)(v) says, "The member, broker, or dealer, must have in place an audit system providing for accountability regarding inputting of records required to be maintained and preserved pursuant to Rules 17a-3 and 17a-4 to electronic storage media and inputting of any changes made to every original and duplicate record maintained and preserved thereby."

This little (v) is down deep in the electronic storage rules and not typically seen in exam findings. In fact, many compliance personnel and FINRA staff don't even know about this rule. Lately some firms were written up in exit conferences for lack of compliance. I did some research and had some conversations in an attempt to understand what, exactly, is expected under this rule. Here's what I can report:

There is no published guidance on this specific paragraph under 17a-4(f)--the audit system; that is, there is no Notice or other such wonderful distillation of FINRA or SEC expectations for compliance.
There is no conspiracy, in my judgment, by FINRA examiners to suddenly pick on small firms in examinations; no master plan to increase awareness of this subject by including it in every LOC henceforth. There is however--dare I say the word--inconsistency among Districts and examiners, so that you may or may not be tested for compliance with this little paragraph (v).
'Audit system' appears to imply a system that keeps records of every record saved on the firm's ESM (electronic storage media). The records show the creation time and date of each record created, as well as every change made to those records. The system also must keep information on every duplicate record created/changed. This might be easy for some IT folks to understand and implement; it may be insanely impossible for non-IT minded small firms attempting to understand and implement.
The only thing close to an explanation of SEC's expectations for an audit system are included in their release of the final rule from 1997 (SEC Release No. 34-38245--http://sec.gov/rules/final/34-38245.txt ). Here's the paragraph:

'The Proposing Release would have required a broker-dealer to "have in place an audit system providing for accountability regarding all access to records maintained and preserved using optical storage technology and any changes made to every original and duplicate optical disk." Commenters sought clarification as to whether this provision requires maintenance of a log of all persons who have the capability or authority to access optical disks, or maintenance of a log indicating each instance where data is added to a disk. The rule adopted by the Commission today requires an audit system to be utilized only when records required to be maintained under Rule 17a-4 are being entered or when any additions to existing records are made. Therefore, an audit record is not required when a record is accessed but cannot be altered by the reader.'
So this can be interpreted--or can it?--to mean firms that have their records in truly WORM compliant format do not have to have an audit system for tracking changes to the records--duh, they can't be changed. But they do have to have a system that tracks inputting of records; some way to track at what date and time a record was created in the WORM format. And of course, the duplicate records also have to have such a tracking system.
But here's a possible contradiction... in FINRA's release of amendments to the SEC Rule, they state this: "Audit Systems: Requires the implementation and use of an audit system where required records pursuant to Rule 17a-4 are being entered or when any additions to existing records are made. No audit records will be required for records that can be accessed but not altered by the reader." That would imply that firms do not have to have audit records at all if their data is non-rewriteable. Perhaps firms should think about quoting this in their next exam, if tested. Here's the link to this text: http://www.finra.org/RulesRegulation/NoticestoMembers/1997NoticestoMembers/P004673

Explanations from two District staff members treat the subject this way: audit system means firms have to periodically check to see that their electronically stored records are indeed still there; that is, they should access their records once in a while to see if the records are intact. That seems simplistic to me and not in-line with the SEC's language, above. But then again, if the District staff will examine for compliance under this interpretation, it's not a difficult standard to meet.
On the subject of third-party ESM providers... who knows? The rule itself speaks to the member having an audit system in place: does that mean the third party provided can't run the audit system? My helpful FINRA contacts did not have an answer for this. The question must be directed to the SEC.
In talking to EMC squared, their systems are most likely to include such a tool, but it's not necessarily called that, which makes the subject hard to sort out.
On the broader topic of ESM, here's some good news (old news, but still good): SIFMA has requested that SEC amend 17a-4(f) to create a reasonableness standard for ESM compliance. Ahhhh, wouldn't that be nice? It is also pursuing changes to 17a-4(b)(4)--retention of communications. See http://www.sifma.org/regulatory/erecords/index.html for reading on the subject.

All that may not sound helpful in the way I like to be. This is not black and white: it's a lovely shade of grey. If you are unsure about whether your firm meets this 'audit system' requirement, may want to ask your IT people or third party vendor, then decide if it's worth worrying about. You may want to also call your liaison to ask what your District expects to see. To meet the rule may mean you're exceeding the expectations of your District. Or not--you may be charged with non-compliance in your next exam. The good news is, you'll be prepared to discuss the topic. Knowledge is power.

More power to you.