Belated Happy New Year

The only reason I'm adding this blog entry is that if you landed on my blog and saw the "December Dates" entry, you might think the Patriots were still headed to the Super Bowl. I wanted to spare you that moment of hopeful confusion. It's January and the Pats are going sledding instead. As a Steelers fan living in New England, I have to admit that this shocking turn of events will make for a less hostile mood in the 'hood next weekend. Phew!

Very brief reminders:

If you have to, under the FACT ACT and the Red Flags Rule, make sure you put in place a Written Identity Theft Program. To my knowledge, the rule is now enforceable. Look for my prior ramblings on this topic if you want some background.

If you do annual disclosures in January, such as sending Privacy Notices and information on SIPC and Broker-Check, remember to send them.  Also remember that SEC offers a form of model privacy notice, in case you want to switch to a format that will meet their approval. Your existing notice may be fine--but you'll have to review Reg. S-P to be sure. Again, look for my earlier blather on this subject.

Remember, pre-notifcation to and review by a supervisor of all new 'other business' or 'outside business activities' of Reps is now required.  Reps can't start doing something new on the side unless this review process has taken place first--and you firms have to document this. And for existing OBA you have until June, as far as I can see, to document your reviews. Start thinking about how you'll do this and getting the documentation in place. If you used a year-end RR questionnaire that solicited this information, use those answers as a basis for requesting and gathering further information on the outside activities.

Don't forget to do a periodic OFAC check of all current customers/accounts. You can define 'periodic.' Put the results in your files.

And remember to encrypt any information you give FINRA on portable storage devices. Notice 10-59 describes this new requirement.

That's it for now. Writing updates to procedures--don't forget to update yours.

December Dates

These kinds of dates are not the fun ones, but they're worth paying attention to:

1. December 10: Due date for notification of change of accountant. If you have appointed a different accountant to do your annual audit, you have to tell SEC and FINRA about it. Please reference my blog entry of last December for specifics--the information is still good and you'll save me time. You're great: thanks!

2. December 13: FINRA renewal payments due. Remember, even if you disagree with what is on your preliminary renewal statement, pay it! You can make amendment filings now that will be reflected on the final statement (Jan. 3): at that point you can get a refund if you overpaid. Here is a link to FINRA's page on payment options.

3. December 15: Effective date of new Rule 3270 requiring reps to pre-notify the firm of their new outside business activities--and requiring the firm to consider those activities in the context of its securities business. I blabbed about this in a recent (yeah, October was recent in my mind) entry. See here.

4. December 23: Deadline for all year-end filings on CRD. Remember, you can post-mark termination filings (like dropping states or dropping reps) to December 31 if you want.

5. December 31: End of your right to use self-congratulatory Privacy Notices. The use of SEC's "model form" is advisable for those who want to be sheltered by the safe harbor. Not sure what I'm talking about? Search my blog for "Privacy Notices" and you'll hear all about it. 

6. December 31: The last day of the year. Oh, and as of the next day, in theory, the FACT ACT is enforceable. Since that effective date changes more often than I do when getting ready for a holiday party, I'm not convinced it will stick. See this blog for details and sarcasm.

Happy December, everyone!

Outside Business Activities: The New Rule

Pull up Notice 10-49 to see FINRA's announcement of some recent Rule Consolidation changes. Within these is the shiny new FINRA Rule 3270 on Outside Business Activities of Registered Persons. It becomes effective December 15 for new notifications of OBA; but for reps with current outside activities, firms must comply with the supplementary material by June 15, 2011.

For what they're worth, here are my comments. Bit lengthy: my apologies.

1. This rule applies to ‘registered persons’ not ‘associated persons.’ (But the selling away rule, 3040, applies to associated persons.) Here a definitions to remind you of the difference for now--def's may change soon:

According to Article I Definitions in NASD By-Laws, "person associated with a member" or "associated person of a member" means: (1) a natural person who is registered or has applied for registration under the Rules of the Corporation; (2) a sole proprietor, partner, officer, director, or branch manager of a member, or other natural person occupying a similar status or performing similar functions, or a natural person engaged in the investment banking or securities business who is directly or indirectly controlling or controlled by a member, whether or not any such person is registered or exempt from registration with the Corporation under these By-Laws or the Rules of the Corporation; and (3) for purposes of Rule 8210, any other person listed in Schedule A of Form BD of a member

For "registered person" I offer the following: From NASD 1031(a): “All persons engaged or to be engaged in the investment banking or securities business of a member who are to function as representatives shall be registered as such with NASD in the category of registration appropriate to the function to be performed as specified in Rule 1032.” And from 1031(b): Persons associated with a member, including assistant officers other than principals, who are engaged in the investment banking or securities business for the member including the functions of supervision, solicitation or conduct of business in securities or who are engaged in the training of persons associated with a member for any of these functions are designated as representatives.

2. The rule applies to persons with a “reasonable expectation of compensation”: this broadens the scope from the prior rule. No more excuses: if the Rep may make money from an outside activity, it counts.

3. The rule newly requires “PRIOR” written notice. It used to be “prompt.” That means Reps can’t start doing outside business activities and then later inform their BD employers. Firms should have a clear pre-notification requirement in their procedures manuals and they should devise a notification mechanism, like an internal form, that prompts information from the RR about the activity. They should include a time frame for the notice that allows enough time for the firm to meet its review obligations under 3270.01 (see next comment).

4. The rule newly requires the firm to consider the ramifications of the outside activity as follows:

(1) Does it interfere with or compromise the registered person's responsibilities to the firm and/or customers?

(2) Could it be viewed by customers or the public as part of the firm’s business based upon, among other factors, the nature of the proposed activity and the manner in which it will be offered?

(3) Is the OBA really ‘selling away’ under NASD Rule 3040?

The firm should document its review of these things: it would make sense to have the results of the review appear on the notice form. If no conflict is perceived and the business is not ‘selling away,’ the firm can move forward without action (or it can document ‘approval’ of the activity—not technically required, but implicit). But if the answer to questions (1) and/or (2) is ‘yes’ then the firm has to do something about it, like imposing specific conditions or limitations on the registered person's outside business activity or outright prohibiting it. Again, the records should document all requirements/prohibitions, as well as the communications to the registered person describing the firm’s decision. If the answer to number (3) is ‘yes,’ then the firm has to apply its procedures for 3040 compliance and recordkeeping—or prohibit the activity.

5. The rule change was scaled back from the original: FINRA member voices were heard, such that now, firms will not have to supervise the surf lessons Reps are giving on the side. (However, if a firm feels like mutual customers are risking their lives by taking these surf lessons, thus increasing the possibility of losing firm accounts, firms can say CowaSorry to the Rep…no surf lessons to firm customers.)

6. Here’s what I can’t figure out: why didn’t the new rule include reference to, or somehow reflect on, the reporting requirements on U4. U4 calls for disclosure of OBA as follows:

“Enter "yes" or "no" to indicate whether you currently are engaged in any other business, either as a proprietor, partner, officer, director, employee, trustee, agent, or otherwise. Exclude non-investment-related activity that is exclusively charitable, civic, religious or fraternal, and is recognized as tax exempt.”

Better yet, why didn’t the respective Notice reflect on this subject? I have to assume the following: outside ‘business’ activities do not refer to charitable, civic, religious or fraternal organizations/activities. BUT it might be worth addressing, to a limited extent, these categories on the internal notice form. Why? So that any such activities that also include ‘investment-related activities’—for instance, helping to manage the church’s investments—are not overlooked. If these types of activities are not investment-related, then U4 reporting is not required. If they are, then the firm should complete the same review as for other OBA…and make decisions and document them. I wish I could be clear about this strategy, but I’m not. It seems like a firm could, based on the rule language, prohibit a registered person from engaging in charitable work if the firm deemed it a conflict or risk to business. But what do I know? Enough to be curious…

7. Back to the subject of effective dates: firms should notify all registered persons of this new 'prior notice' requirement--and tell them that as of Dec. 15 they must, in effect, seek pre-approval of any new OBA. And the firm must remember to review all existing OBA by next June to determine if limitations, conditions or prohibitions should be imposed.

That's all for now. Why don't you let me know what you think?

Update Your Procedures: Summary of Some Recent Changes

Summary of some changes during the first half of 2010. You'll want to be sure to update your procedures manuals (there were more changes than those listed here...read all your Notices!).

 1. The Red Flags Rule will not be enforced until year-end 2010. If I provided you with an “Identity Theft Protection Program,” you don’t have to worry about documenting your compliance until then.

2. Reminder: all initial U4 filings (not amendments) require ‘wet’ signatures from both the rep and the firm signatory. Make sure you have original, signed U4’s in your files.

3. If you are holding a Variable Annuity application/customer check for up to seven days after the application was complete (as allowed under Rule 2330), the following must be true:

a. It was a recommended purchase or exchange (non-recommended trans. still must happen w/in one day)
b. Staff made reasonable efforts to safeguard the check and deliver the completed application to the supervisor for review
c. The reason for holding the check is to review the application for approval
d. You have procedures in place for this (yes, you do)
e. You keep a record of the date when the principal (OSJ) receives a complete and correct copy of the application package
f. A principal reviews the application as required under the rule
g. You don’t hold the check/application longer than 7 business days
h. You keep a copy of the check and a record of the date it was received from the customer and the date it was transmitted to the ins. co or returned to the customer

See Notice 10-05 for details.

4. I’ve already reminded you a lot about RR’s use of Social Networking Sites. Remember that you have to deal with compliance on this issue if your personnel discuss their services on sites like Facebook.

See Notice 10-06 for details.

5. FINOP’s should review the details of the following Notices:

a. 10-12 on changes to line-item reporting on FOCUS (guidance on FAS 167)
b. 10-15 on new requirements for subordinated loans to BD’s, including new standard forms that can be used (*remember that changes to the terms—even maturity—of outstanding sub loans will be subject to the new rule requirements)
c. 10-21 on consolidated rule 2261: When the Company is party to an open transaction with another FINRA member, or has on deposit cash or securities of another member firm, it has to, if requested by the other firm, deliver the Company’s most recent balance sheet (FOCUS) in either paper or electronic form. (This is not required for non-member customers unless the firm holds customer funds/securities)

6. If you provide consolidated financial reports (that contain information on various holdings, even those away from the firm) to customers, you have to have a review/approval process in place. Sources of information included on the statements should be verified and documented, unless pre-approved exceptions are made. You’ll have to make certain disclosures to customers about the statements; you may want to get a signed acknowledgment form from customers.
See Notice 10-19 for details.

7. Consolidated FINRA Rule 3240 concerns borrowing money from or lending money to customers. In certain instances, such as where the customer is also a member of a Rep’s immediate family, or is in the business of lending money/providing credit/etc., your firm does not have to require notification and pre-approval. Other lending arrangements always require pre-approval. If your procedures aren’t specific on this topic, or prohibit all lending arrangements with customers, you may end up getting in trouble for breaking the rule without understanding why. It’s worth understanding the requirements, since this is a very common FINRA disciplinary action.

8. FINRA has provided specific guidance on due diligence requirements for Reg. D offerings. You already know about these, but it’s worth reviewing revised procedures. Remember that if you contribute to PPM’s, you’ll be held to compliance with the advertising rules. You are also required to fill gaps in due diligence performed by others, if you perceive of them. You’ll want to document everything, including your vetting of outside sources of due diligence. Some of this guidance may apply to hedge fund offerings. Think about creating a stand-alone “Due Diligence Checklist” based on FINRA’s guidance. You may want to use it as a means of ensuring proper documentation.

See Notice 10-22 for details.

9. As of February 14, 2011, asset-backed securities are reportable to TRACE. Mortgage pool numbers may be used as identifiers.

See Notice 10-23 for details.

10. Effective November 1, 2010, OTC equity trades must be reported within 30 seconds of execution. The new reporting time frame also applies to trade cancellations that currently are subject to 90-second reporting, as well as stop stock and prior reference price trades. Firms are also required to report secondary market transactions in non-exchange-listed DPP securities within 30 seconds of execution.

See Notice 10-24 for details.

11. There is a new ODD supplement. You can find it here.

12. FINRA will phase in the REX system, which replaces its existing Reg. T system to collect Reg. T extension of time requests. The first effective date is August 23, 2010. There is a REX tutorial for those who are interested: REX Tutorial.

 13. As of June 10, FINRA put into place a temporary program that permits it to halt trading otherwise than on an exchange—the ‘trading pause pilot.” It expires December 10, 2010. Under this pilot, FINRA may halt trading in individual securities where the primary listing market has issued a trading pause in that security due to a move of 10 percent or more from a sale in a preceding five-minute period. Halts apply to all trading, including otherwise than on an exchange.

See Notice 10-30 for details.

14. SEC Rule 15c2-12 regarding material event notices (Muni securities) was amended and the changes are effective as of 12-1-10. The information that must be reported by issuers to MSRB now include new categories, and not all events are characterized as ‘material.’ Also, demand securities (like VRDO’s) are no longer exempt from event notice reporting. Because you have to inform muni customers of events listed on the EMMA portal, revise your procedures to show the new event categories. You may also want to add a list of voluntary event-based disclosures.

See MSRB Notice 10-20 for details.

15. I revised the annual Rep Questionnaire to include the topics of social networking and protection of information on personal devices such as cell phones and computers. You will see that revised form during the Annual Meeting process.

16. As of February 1, 2010, MSRB revised Rule G-37 (and G-38) by adding contributions to bond ballot initiatives/campaigns to the existing list of reportable contributions. The rule parallels the requirements of existing disclosure rules (de minimis exceptions for annual amounts $250 or less), except that there is no ban on municipal securities business as a result of contributions to bond ballot campaigns. Form G-37 was revised and should be used to report contributions when required.

See MSRB Notice 10-01 for details.

17. As of November 10, 2010, Rule 201 of Reg. SHO will be in effect. This is the new Circuit Breaker/Alternative Uptick Rule approved by SEC this year. Firms may not display any short sale order, absent an exception, at a price that is equal to or below the national best bid if the price of that security decreases by 10% or more from the security’s closing price as determined by the listing market for the covered security as of the end of regular trading hours on the prior day “circuit breaker”); likewise, in such circumstances, for the remainder of the day and the following day, short selling is permitted only at a price above the current national best bid. There are exceptions and trades meeting them must be marked ‘short exempt.’ As such, OATS will reinstate its “SX” value in the buy/sell code field.
 The rule is found here.


For the Notices cited, go to FINRA Notices or MSRB Notices for specific links.

Work hard! Relax harder!

Changes to Broker Check: Update Rep Complaint Filings!

If you've been reading your Notices (10-34 and Info Notice 8-3) you know that Broker Check will, as of August 23, display complaints that are older than 24 months and that haven’t been settled or adjudicated, or that settled for less than the prior, respective U4 disclosure threshold. There are other changes, too...here's a full summary of the changes, courtesy of FINRA:

The SEC approved amendments to FINRA Rule 8312, which governs the release of informtion through Broker Check. The amendments:

(1) make publicly available in Broker Check all historic customer complaints that became non-reportable after the implementation of Web CRD;
(2) permanently make publicly available in Broker Check information about former associated persons of a member firm, as reported to CRD on a uniform registration form if they were (a) convicted of or pled guilty or no contest to certain crimes; (b) subject to a civil injunction involving investment-related activity or found in a civil court to have been involved in a violation of investment-related statutes or regulations; or (c) named as a respondent or defendant in an arbitration or civil litigation in which they were alleged to have committed a sales practice violation, and which resulted in an award or civil judgment against them;
(3) expand the Broker Check disclosure period for former associated persons of a member firm to 10 years from two years; and
(4) codify FINRA’s current process for disputing the accuracy of (or updating) information disclosed through Broker Check.

For instance, if one of your Reps had a customer complaint that was reported on U4 3 years ago, but was never resolved—say it faded away, for instance, because you or the Rep never heard from the complainant again—that complaint currently does NOT show up on Broker-Check. As of August 23, it will show up. It’s status will show ‘pending’ if it remains pending.

It is in your Reps’ best interest to make sure their historic complaint disclosures are accurate. For instance, if a complaint was resolved but the CRD record was never updated to show that, then now is the time to do it.

FINRA is being helpful (and Allison in Disclosure was extremely helpful in explaining all this!) by looking at ALL historic complaint filings to determine which are ‘pending’ and may be subject to updating. For any such complaints identified as pending, they will issue either a disclosure letter for the individual Rep, or they will batch the occurrences in a new category of disclosures letters issued to the firm, itself.

Here’s what is important:  make sure you are set up to receive notifications of outstanding disclosure letters...that way, you and your Reps can address the status of prior DRP's in order to make changes, if necessary.  Also go into Organization in CRD Main and look for the new ‘disclosure letter’ category. Later this month check that link to see if FINRA has batched 'pending' complaints for your review. NOTE: for right now, they will not send you notification of batched disclosures letters--there's no mechanism for that presently.


Good luck.

New Reg. Category for Operations Professionals: Let's Be Clear About This

Notice 10-25 solicits comments on a new registration category for "Certain Operations Personnel." I only wish they'd have called them "Operations Supervisors" so as to limit the hysteria sure to result when folks hear about this. Okay, maybe I'm the only hysterical person in the room. Consider me a bellwether. (Mais, je prefere "belle-weather.")

Here are two excerpts from the Notice that should calm everyone down:

"Persons subject to the new registration category generally are those persons who are directly responsible for overseeing that tasks within the covered functions are performed correctly in accordance with industry rules, firm protocols, policies and procedures, and who are charged with protecting the functional and control integrity of the covered functions for the firm."

and

"The requirements would not apply to persons who perform a covered function, but whose responsibilities are below these three specified levels, or persons who perform a function ancillary to a covered function or whose function is to serve a role that can be viewed as supportive of, or advisory to, the performance of a covered function, such as internal audit, legal or compliance personnel. Also, the requirements would not apply to persons who are engaged solely in clerical or ministerial activities in any of the covered functions."

It seems to me it's all about supervisors and those with control.  I guess after the comments are received and addressed, we'll have convincing clarity on this, as we normally do when a rule is made effective.

[throat clearing sound]

Alright, maybe there is room for worry, in the end...another quote:

Importantly, those persons subject to the new Operations Professional registration category would be considered associated persons of a firm irrespective of their employing entity and would be subject to all FINRA rules applicable to associated persons and/or registered persons.

So, just like outsourced professionals who are doing work requiring registration and qualification, employees of parent companies, affiliates, etc. will be treated as if they work for the BD. Ah, the long arm of the law gives a bear hug to your whole enterprise...

I'm done for now. Three blog entries in one day? Gotta get back to work.

Reminders, My Friend, Are Blowin' In The Wind

Having survived a wind storm and a semi-annual procedures update process that nearly killed me (the update, not the wind storm), I am resurfacing to provide a few reminders:


1. R.I.P. Webcasts: After March 31 you will no longer be able to view Webcasts on FINRA's website. All of the prior content is included in other offerings, such as Video E-Learning or plain-old E-Learning courses. But, well, you have to pay for those. Webcasts were free. All's fair in love, war, and a crappy economy.


2. TRACE: Agency Debt Securities became TRACE eligible on March 1, as did certain primary market transactions (those that qualify as list or fixed price offering or takedown transactions). See Notice 09-57.


3. New Capital Compliance Rule: As of February 8, the new financial responsibility rules became effective (FINRA Rules 4110, etc.). Many of the restrictive rules apply to "carrying or clearing firms"--but look at the footnote in the rule and you'll see that they also apply to firms with "k2i" accounts--you know, the account you have set up so you can receive checks from customers for mutual fund and other purchases? This new rule requires, for instance, that your firm must obtain prior written approval before withdrawing any capital that exceeds10 percent of the firm’s excess net capital in any rolling 35-calendar-day period. This includes withdrawals of profits, routine dividends and similar distributions. Wow. For small business owners who take profits this way, this rule seems extremely onerous. See Notice 09-71.
       As for the answers to these extremely logical questions: 1) "To whom do firms request approval?" and 2) "How long does FINRA have to grant approval?", well, the answers were not easy to find... in summary: 1) Eventually there will be an electronic request process on Gateway, but for now fax or email your District Office, and 2) In your communication to the District, inform them that you will be making the distribution in x days in the absence of a response from them. In the published Response to Comments on these rules, it states,"[...] requests for withdrawals can be handled in a routine manner and that decisions typically would be issued in approximately three business days": how's that for clarity?! 
     [Allow me for a moment to express frustration with FINRA for making a Rule effective without having a mechanism in place for allowing firms to comply with the Rule--and for not providing this basic, administrative information to all firms in an easily accessible, publicly-available place (like the Notice??), rather than burying (half of) it in filing documents not regularly visited by most compliance staff. And what-up with making pleasant, good-intentioned, helpful folks like moi feel wrong for asking presumably easy questions and expecting to get answers? What's wrong with regulators saying, "I don't know" or "We're still working on that" or "Three days, but sorry, we didn't put that in the Notice"? ... ugh. P.S. I'm thankful to Estee Dorfman Foster (CPA/outsourced FINOP) for her assistance in finding answers.]


4. Variable Annuity Rules: As of February 8, the formerly-delayed parts of FINRA Rule 2330 became effective. Principals now have 7 days to review recommended v/a purchases and exchanges. There are changes to customer funds rules, too--because if you held a customer's check during that 7 days, you would have otherwise broken SEC customer funds rules. Check out Notice 10-05 for fresh guidance on these changes.


5. AML Madness: FINRA released its updated AML Small Firms Template in January... it is full of wonderfully--wait, not wonderfully, but rather, dreadfully--legalistic text changes that would drive any technical writer crazy. I'm proud to say my template is still better than theirs. You should look at your AML program and FINRA's updated template to assess the time it will take to make corresponding changes; then you should drown your sorrows in a stiff drink (or call me!).  See here for a link to the template in Word format. Oh and remember that as of January 1, you may no longer have someone in your small firm conduct annual independent testing if that person has a conflict of interest (you used to be able to rely on a loophole--it is gone). For this rule change, see Notice 09-60.


6. 3012/3130--Testing & Verification:  For most of you, it's that time of year again--in fact, this is the 5th time you have to follow these rules since inception! This should be easy by now...You have to test and verify your supervisory system. And write a report. And write another report about the process of writing the report. And sign a certification. And put the whole shebang in a file drawer and hope no-one ever asks for it (...but they will). Remember, your reports and certifications are due w/in 12 months of last year's. It's not a calendar year requirement--it's every 12 months by the anniversary. Here is a link to regulatory information on supervisory controls.

7. Short Sales Rule Change: Mary over at SEC approved a change to Reg. SHO, affectionately called the "alternative uptick rule" that restricts short selling in stocks that have dropped 10% in price in one day. Effective Date: May 10, 2010; Compliance Date: November 10, 2010. See link to Reg SHO change for 334 pages of bedtime reading. I'm getting sleepy just thinking about it.


8. TARP Warrants: How do we describe these nouvelles choses? Warrants (that's what they're called)? Options (they're priced like options)? Corporate securities (they're issued by corp's)? Government securities (they were issued to Uncle Sam--is he backing them in the secondary market)? Ask 4 people and you'll get 4 different answers (ask me and you'll get a frustrated shrug of confusion and disgust). Stay tuned for the answer.

FINRA has released its March 1 examination priorities. Review it and weep. You have work to do.


Your Moment of Optimism: 17 days till Spring!

Social Networking Compliance: A Resource

I'd post this on my Wall, but none of my FB friends would understand it!

Got a follow-up email to my last post on this subject from a reader--a firm in Austin, Texas that may have just the tool you need to keep up with FINRA's demands. Check out Socialware's "Risk Manager" product. On the surface, Socialware seems to have developed something useful and, importantly, something designed specifically to meet regulatory guidance.

To allow Reps to use social networking sites as tools to build business might be the best idea of the 21st century--but it carries with it a commitment of both money and time (even an affordable automated surveillance program will require concerted attention by a Principal). The way you balance the need for online networking and the need to budget time and money will determine whether you take this leap.

Some due diligence considerations: Socialware's product is brand new with a limited number of users; the loyal following may consist more of non-FINRA-regulated firms (that is, IA's and others) and therefore may not have been tested yet by examiners; and I'm told the per user charge is small but I don't know about set-up/installation/training charges.

I think it's worth checking out. Tell'em I sent you, K? And please report back with feedback. I'd love to think this is the answer BD's are looking for.

Identity Theft and Privacy Notice

As you know I'm not happy about the ID Theft/Red Flags rules for introducing firms that offer margin accounts through their clearing firms. Doesn't make sense that these firms are considered 'creditors.' But don't get me started on bad rules that require time, money and effort for the sake of token compliance. Yuk. But a trusted informant from another consulting firm told me that FINRA is obsessing about compliance with these new rules--even though they don't take effect until June 1 and even though FINRA does not have authority to enforce the rules (FTC does). So gear up. Read this Notice Red Flags Rule and Template Procedures and customize the template FINRA provides.

On Privacy (wait, why is this separate from ID theft: isn't protecting customer information all under the same umbrella? Ugh. Whatever.): I came across this, about changes to Reg. S-P: eCFR Link to S-P Amendment. The Reg change eliminates the 'sample clauses' that most of you are using in your Privacy Notices right now. After this year, you won't be able to use those clauses to meet the disclosure requirements under Reg. S-P. Rather, there is a new 'model privacy form.' As of 2011, firms must either use the model form or be sure that their custom privacy notices meet all Reg. S-P criteria. You don't have to wait until 2011--the model form may be used now, and will give you the comfort of knowing your notice meets federal requirements (i.e., it is a safe harbor). You may want to begin the process of switching over from your currently-used notice.

There are two versions of the new model form: Notice with Opt-Out and Notice without Opt-Out. You'll want to decide which is right for your firm and then customize it. Remember, Privacy Notices are NOT required for institutional customers; for individuals, you must deliver the Notice at account opening and yearly thereafter.

Now go forth and confidently protect the privacy and identies of your customers. And do it in a well-documented fashion. Or else.

Social Networking Sites: Word to the Wise

FINRA has put out guidance on the topic of social networking sites (SNS). The explosion of electronic communications in many forms has made it difficult for BD’s to know how to follow SEC books & records rules. It used to be straightforward, but with tools like Facebook & Twitter, it’s tough to decide what constitutes categories like advertising, public appearance, correspondence and recommendations. I suggest you read Notice 10-06 (it’s not long!) so you are aware of FINRA’s concerns.

What FINRA wants is this: if your Reps or the Firm itself use SNS’s for business purposes, then you have to be able to supervise all postings, whether they are ‘static’ (like profiles or wall posts) or ‘interactive’ (like chats or interactive posts with third parties), and you have to be able to store all that content under SEC books and records rules (17a-3/a-4). Pre-approval of anything considered an ‘advertisement’ (the static content) is required; pre-approval is not required for interactive content, but all other requirements apply to that material.

Sound like a big job? It is! Word has it the bigger e-mail storage vendors are working on products that firms can use to meet these requirements (automatically saving the online content and providing an automated review tool for monitoring it), but I can imagine those products will not be cheap. And it’s harder to imagine small firms being able to adequately meet the supervision/r-k requirements on their own.

So, if you are going to allow Reps to participate in SNS’s, you HAVE to implement procedures to meet FINRA’s guidance. And you HAVE to follow those procedures.

If you would rather avoid this administrative challenge & expense (and the related liability of allowing the activity), you will have to be clear about your expectations of firm personnel. Make sure your procedures include a prohibition of this activity; it would also be smart to send an e-mail reminder to everyone at your firm. I suggest:

Our firm strictly prohibits you from engaging in business communications in a social media site (such as Twitter, Facebook and Linked-In, among others). Your participation in such sites must be for purely personal reasons. You may not present yourself on such sites as a representative or agent of the firm: to do so is considered “advertising” and requires pre-approval by our compliance staff. Likewise, on such sites you may not recommend securities or engage in discussions about securities or the firm’s business. Lastly, you may not: link to third party material relating to securities; assist third party site participants in preparing such material; or comment on/endorse third party posts on such material. Our firm may from time to time request access to your social networking sites in order to spot check them for compliance with this prohibition. Perceived violations will be met with disciplinary action.

No matter how you word it, the message should be clear--personnel may not use these sites for business purposes: to do so immediately puts your firm at risk.

Useful Information on a Rainy Day

I walked to my NEW office this morning without drowning in a puddle. High of 61 today with downpours. Feel sorry for us, here in coastal NH. We deserve your pity.

Few things:

1. Remember the FTC Red Flags Rule? FINRA released its brand new written ID Theft Prevention Program template!--and it has an acronym: ITPP! This is great. Thank-you, FINRA. Now all you small firms that have no idea what this rule is all about, and believe that it is completely duplicative with AML and unnecessary, given that you are a tiny shop that does not use credit reports, does not provide debit cards or checkwriting, and does not extend credit (but wait, you have a clearing firm and your clients may open margin accounts through your firm), can create an ITPP without much effort. And the better news is, if FINRA examines for compliance with this rule like it did with AML, you will have years before your written program actually has to be fully customized and implemented. FTC enforcement of the Red Flags Rule begins August 1, 2009. So get going. Here is the link to the template, courtesy of FINRA:
www.finra.org/customerprotection/redflags.

2. As of August 17 you have to provide a new disclosure to customers. New FINRA Rule 2267 is based on old NASD Rule 2280 (Investor Education and Protection). The old rule applied only to firms carrying customer accounts. Now it applies to everyone. BUT: if your firm has an clearing firm that will make the disclosures for you, you're all set (confirm this with them, ok?). If you have other (or only) customers that aren't serviced by a clearing firm and that don't, for instance, receive statements or confirms, then your firm will have to make the disclosures. An example would be an 'application-way' shop that processes MF/VA applications and does not have brokerage accounts. I'm guessing PP/M&A firms are in this category, too, but let's not expect FINRA to be clear on that (you know how I feel about this subject, right?).

So, if all your customers are receiving statements, etc. from the clearing firm, make sure they'll include the disclosures annually to your customers.

Otherwise, you have to provide the disclosures (annually if you carry accounts). If you don't carry accounts, as I desdcribed above, or have some customers not receiving statements, you have to provide the disclosures at or prior to the time of the customer’s initial purchase, in lieu of once every calendar year.

Disclosures may be provided electronically (yahoo).

Here is what you have to disclose:

1. FINRA Broker Check Hotline Number -- (800) 289-9999;
2. FINRA Web site address -- www.finra.org; and
3. A statement as to the availability to the customer of an investor brochure that includes information describing FINRA Broker Check. ...Harder than it sounds. Here's what I recommend: "You may find information about Broker Check online by visiting this link http://www.finra.org/web/groups/industry/@inv/@tools/documents/industry/p009888.pdf or by calling the Hotline number and requesting a hard copy via mail."

Here's what FINRA says about the due date: "Any firm subject to NASD Rule 2280 that complies with its annual (calendar year) mailing requirement on or after January 1, 2009 but prior to the August 17, 2009 effective date of FINRA Rule 2267 will be deemed to have complied with FINRA Rule 2267 for the 2009 calendar year."

So check with your clearing firm to see it they will have complied with old 2280 by 8-17; if not, you're not in compliance. For other firms (see above), start making the disclosures for new accounts. And what the heck, if you send out an annual disclosure notice with other things, like privacy policy and SIPC info, why not include this one, too?

3. Rule 2821 on Variable Annuities--they FINALLY finalized the rule. And the great news is, they took out that requirement to consider ALL deferred V/A purchases and exchanges as 'recommended.' The rule changes also clarify the 7-day review/approval process and funds transfers in that 7-day period. It's good, and the Notice is written well. Look it up: Notice 09-32 is at http://www.finra.org/Industry/Regulation/Notices/2009/P118955. BUT DON'T start enforcing the rule yet. It's effective 2-8-10. I have a call into FINRA about whether optional compliance before then is okay, but I haven't heard back yet :( . In the mean time, you have the usual 24 hour turnaround period to move funds out and approve the business.

Looking out my window: still raining.

The Adam Lambert Memorial Exam Findings Tips and other Reminders

Well, now we know: southern, culturally-conservative (i.e., anti-guyliner) voters favoring the underdog. That's who crowned Kris last night. But do we care? No. FINRA suits are walking through the door soon, armed with lists of practically irrelevant exam priorities. And you, my friend, have no-one calling 1-800-I Comply! to vote for you. (No-one except me: I'm here to help.)

btw: Not enough of you requested free conference notes. That means: a) you don't care, b) you're afraid to write to me, knowing I'll write back and talk too much, or c) you're not even reading this. You're over on that other, better blog: http://thereformedbroker.com/ But is that guy giving you practical information you can use immediately to improve your compliance grade (Randy Jackson wants to give you an "A+")? No, he's giving you insightful analysis of current economic and political events, all in a well-written and sometimes hilarious fashion. What good is that?*

*Real good. Check him out.

Oh, back to my exam findings tips, in honor of my favorite second-place, soon-to-be superstar, Glambert. Recent findings:

1. BCP summary disclosure not on website -- 3510(e);
2. CCO not disclosed on Schedule A of Form BD -- 3130(a);
3. AML testing not done by independent person or firm didn't comply with exemption provisions when using in-house, non-independent person -- 3011(c) and IM-301101;
4. Supervisory Control Procedures don't address electronically notifying FINRA of the reliance on the limited size and resources exception -- 3012(a)(2)(A)(iii);
5. Don't have procedures for monitoring new rules proposed under Section 311 of the USA Patriot Act -- 3011(b);
6. [The age-old] failed to notify of electronic storage media and provide required representations on format/storage and third party access -- SEC 17a-4(f)(2) and (f)(3)(vii);
7. Don't a have a third party to access electronic records to meet SRO requests -- SEC 17a-4(f)(3)(vii).

Comments on the above:

1. BCP: If you have a website, it has to be there. Remember, post just your summary, not the whole plan. Just do it.
2. CCO on Sked A: the thing is, no CRD deficiency is generated if it's not there. This rule came out in 2004--FIVE American Idol seasons ago!--and it's hard to believe that this violation can still exist. But it does. I think, like for FCS and other nec. disclososures, that the system should alert the firm on Gateway if no CCO is listed on Sked A.
3. AML Indep. Tester: for very small firms, this is frustrating. Yes, they may rely on an in-house person who isn't independent, but they have to provide justification for doing so and have written procedures about non-retaliation, etc.... look at http://finra.complinet.com/en/display/display_viewall.html?rbid=2403&element_id=3719&record_id=4397 for the requirements under IM-3011-1. Just do it. The obvious alternative is to hire an outside party (cha-ching).
4. Procedure to notify of LS&R exemption: Uh, this is easy to comply with. Put in your supervisory control procedures that you will make a filing in CRD, notifying FINRA of your reliance on this exception if you appoint someone not 'senior' to do branch examinations. Just do it.
5. 311 procedures: Guidance came out in 2007. If your firm doesn't have foreign accounts, just mention in your procedures that you don't have to include due diligence procedures for 'specified banks' under FinCEN's 'special measures' rules--from Section 311 of the USA Patriot Act. You can promise you'll add such procedures when deemed relevant to your business. Add a link to FinCEN’s Special Measures page http://www.fincen.gov/reg_section311.html for fast reference to changes.
6. ESM notification: Oh, don't get me started. Well, at least FINRA is showing some patience on this issue. For goodness sakes, by now firms should know what they have to do! Look at my many, verbose postings on this subject for more information. If you haven't notified FINRA on CRD of your use of acceptable ESM, just do it (it's under 'financial notifications' on the forms and filings tab on the Gateway).
7. Access: See my earlier postings on this topic. You have to have a third party to assert that they will provide access to your e-records in case you can't/won't produce them upon request. This party does not have to maintain your records--they just have to be able to access/produce them. There is a firm called Securities Industry Records Services in Utah that provides this access letter for a an annual fee...check them out at SIRSCO.com. (I don't endorse these guys...haven't yet had personal experience with them--but it might be worth talking to them if you want to store your own records.)

Some areas of exam focus:

• Reg. SHO: aggregation units, controls in place to prevent illegal short sales, affirmative determination records.
• Scrutiny of lack of SAR filings: why none?

A few reminders for those of you who didn't read my notes:

1. Get a PCAOB-registered accounting firm before December--for your next audit. Remember that, for non-public BD's, this registration doesn't change the accounting standards or protocols; for now, the auditor just has to pay a fee to register. Don't be lured into paying higher fees for your audit.

2. Don't expect 30 days advance notice of your next exam--even though Robert Errico in his February 2007 letter to members stated the following:

Advance Notice of Examinations. For the vast majority of firms, NASD is doubling the amount of notice in advance of a routine examination. Specifically, we are moving the notice period from 14 days to 30 days. This change will provide member firms with adequate time to respond to the WebIR and to gather the records and other information requested prior to the on-site portion of the examination. Similarly, it will provide our examiners with more time to review materials, leading to a more efficient examination.

I rarely see 30 days notice being given. The staff at the April conference said, 'Oh, it's up to 30 days.' I guess they didn't know about Mr. Errico's kind promise. Oh, and don't kid yourself into thinking you're on a set exam schedule--they'll use BORAM (clearly, Spock language) every year to decide when your next exam will be.

3. Establish a policy for protecting customer information when Reps leave your firm. If you let them take Outlook contacts information or other data that contains non-public info, you have to disclose this in your privacy policy (and give customers an opt-out choice).

4. Remember that the ID Theft Program requirement has been delayed until Aug. 1--and remain on the lookout for FTC's promised "template to help entities with a low risk of identity theft to comply with the rule" (but then again, we know how promises work...you promised you'd vote for Adam and you didn't).

Thanks for reading. And remember to amend your Reps' U4's for the new disclosure questions. But you've got time...first go out and enjoy the fine weather.

Conference Notes: For Less Than the Cost of a Snuggie!

I attended the Small Firms Conference that FINRA presented on April 7 in NYC--and guess what? I took notes! I apologize for the delay in putting my notes into digital format. Thanks to Gokey voters (see below), I have now finished this process. Rather than post the document here (it's 12 pages long), I will be happy to email it to you upon request.

Please hit this link and send me a request for the notes. I'll send them over without even asking why you care so much, what with the economy in the tank, the Taliban gaining power, and an AI top 3 without Allison. Your priorities are your own business. mailto:inquiry@imhoffconsultingproject.com

Here are some topics sure to lure you:

• BORAM;
• Broadened supervisory authority over outside business activities;
• Required reporting of internal violations;
• Circulation of rumors (and rumors of rumors);
• Principles-based research rules;
• Customer data protection--when your reps leave;
• PCAOB compliance; and
• Unanswered questions (are you surprised?).

I'll be standing by. No credit card required.

Outside In

What does Heidi Klum say? "You are either in or you are out." It's one or the other, and the other goes home.

In years past this distinction for me has been clear: as an "outside consultant" to securities firms, I've always been treated that way by regulators--as an unwelcome outsider. I remember a few years ago, standing at a gas station in Some City, USA, on business travel. I was on my cell with a District liaison, fighting to get information from her about a rule interpretation or some such other clarification. My purpose was to assist my BD client--not to waste the liaison's time to build my personal knowledge base. I was speaking to the subject without divulging the client's name--that would have defeated my client's purpose at the time. Anyway, this experience was similar to many I've had over the past 8 years as a consultant: I act as a go-between in order to help my BD clients better meet Finra's Rules, and I'm shut down in the process by Finra staff due to a procedure they put in place that requires, without exception, the caller to identify the member firm's name when making inquiries.

I'm happy to say that my recent interaction with some Finra staff members has strayed from this model. I've been treated to assistance by folks in various offices--such as District offices and the Office of General Counsel--without the bias I was used to confronting. A great guy in Advertising has been helpful on several occasions. A kind examiner in NYC has been generous with his time. I haven't been made to feel like a spy or a cheater when engaging in intelligent dialogue. I'm hoping this trend continues. While I understand the old mantra, 'firms can call us for information without raising red flags or risking retribution...,' I also understand that many small firms simply prefer to avoid that direct contact. They'd rather have someone like me act as an information gatherer and interpreter. In my opinion, the result is the same (and mutually desirable): BD's are well-informed and better able to meet their responsibilities. The means to that end should not be restricted. It is in the investing public's best interest to let information/guidance/interpretation flow to BD's and their consultants.

I also want to thank some Finra staff members for their good-natured, prompt and extremely helpful assistance to me in months past...I won't name them, but the folks in the online learning and waiver departments are good at what they do and pleasant to work with. Thanks to all of you!

So, Heidi, am I in or am I out? I think for the time being, I'm a little of both. And on this particular reality show, that means I'm a winner.