The Difference Between June 1 and June 2: Red Flags Rule Delayed AGAIN

June 1:
>The effective/enforcement date of FTC's Red Flags Rule, whereby you, my broker-dealer friends, had to put in place an Identity Theft Prevention Program.
>The date by which I (against my better judgment/procrastination instincts) worked my buttocks off in an attempt to customize/deliver FTC's neat-o PDF customizable 'low-risk' form.
>The date before which, if a regulatory body were going to announce a delay in enforcement of the Rule, said regulatory body should have announced a delay of said Rule.

June 2:
>The date after which you, my broker-dealer friends, put into effect your IDTPP's, after having struggled to customize either FINRA's template or FTC's 'customizable low-risk form.
>The date after which we all collectively considered this topic done/handled/put to rest and happily forgotten about it.
>The date we got notice from FINRA that the enforcement date of the Rule had been delayed AGAIN...now to Dec. 31, 2010.
>The date, perhaps, you and I both swore under our breath something profane and un-American.


Here is the announcement, in case you missed it:

The FTC has again delayed enforcement of its Fair and Accurate Credit Transactions Act of 2003 (FACT Act) Red Flags Rule, from June 1, 2010, to December 31, 2010. The delay will allow Congress to consider legislation limiting the businesses covered by the rule. If legislation passes with an effective date earlier than December 31, 2010, the FTC will begin enforcement as of that effective date.

Firms subject to this rule—which include most broker-dealers—must have in place by the FTC enforcement date a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

As a reminder, FINRA has developed an optional template that firms may use as a guide when fulfilling their requirements under the FTC's Red Flags Rule. You can find more information about the FACT Act regulations in Regulatory Notice 08-69.

I won't start babbling about how I think this Rule is redundant and how the criteria for determining applicability is being interpreted in a bogus way. You can always search the subject on my blog to read more. But why bother? Let's just forget this all happened. And let's hope the Rule NEVER gets enforced for you BD's who are already, under AML rules, required to act as law enforcement and root out any nefarious attempts to usurp identities (even if they're not terrorists).

What a Difference a Day Makes: No, what a difference two weeks would have made! Now that kind of lead-time would have been appreciated! (Here I am again, Daydream Believer.)

Identity Theft and Privacy Notice

As you know I'm not happy about the ID Theft/Red Flags rules for introducing firms that offer margin accounts through their clearing firms. Doesn't make sense that these firms are considered 'creditors.' But don't get me started on bad rules that require time, money and effort for the sake of token compliance. Yuk. But a trusted informant from another consulting firm told me that FINRA is obsessing about compliance with these new rules--even though they don't take effect until June 1 and even though FINRA does not have authority to enforce the rules (FTC does). So gear up. Read this Notice Red Flags Rule and Template Procedures and customize the template FINRA provides.

On Privacy (wait, why is this separate from ID theft: isn't protecting customer information all under the same umbrella? Ugh. Whatever.): I came across this, about changes to Reg. S-P: eCFR Link to S-P Amendment. The Reg change eliminates the 'sample clauses' that most of you are using in your Privacy Notices right now. After this year, you won't be able to use those clauses to meet the disclosure requirements under Reg. S-P. Rather, there is a new 'model privacy form.' As of 2011, firms must either use the model form or be sure that their custom privacy notices meet all Reg. S-P criteria. You don't have to wait until 2011--the model form may be used now, and will give you the comfort of knowing your notice meets federal requirements (i.e., it is a safe harbor). You may want to begin the process of switching over from your currently-used notice.

There are two versions of the new model form: Notice with Opt-Out and Notice without Opt-Out. You'll want to decide which is right for your firm and then customize it. Remember, Privacy Notices are NOT required for institutional customers; for individuals, you must deliver the Notice at account opening and yearly thereafter.

Now go forth and confidently protect the privacy and identies of your customers. And do it in a well-documented fashion. Or else.

Another Delay of Red Flags Rule Enforcement (and other stuff)

Greetings, surfers!

Topic 1: Red Flags Rule (dedicated to my tipster: Mr. B. Gray)

FTC announced yesterday that they would delay enforcement of the Red Flags Rule--again. Now you have until November 1 to figure out what it all means for your broker-dealer firm. On this note, I tried to create a flow chart to help you decide if you needed an Identity Theft Prevention Program, but I ran out of ink (and brains) in the process. It's complicated--and I disagree with the going interpretation, so I should just stay out of it.

I guess I can be a little helpful by providing some reference links for you:

http://imhoffconsultingproject.blogspot.com/2008/11/update-on-fact-act.html and http://imhoffconsultingproject.blogspot.com/2009/07/useful-information-on-rainy-day.html contain my ranting (I mean, informative content) on the subject.

FINRA's ITPP template: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119093.pdf

FINRA's page that has all kinds of references to guidance and stuff: http://www.finra.org/Industry/Issues/CustomerInformationProtection/p118480

FTC site on the Rule: http://www.ftc.gov/redflagsrule

FTC site on ID Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

+++++++++++++++

Topic 2: Investment Banking Registration Category

Wow! At last, for investment bankers, a test of their own! I'm impressed. If you are an investment banker, now you have your very own registration category: the Series 79. (Monty Python's Life of Brian came out this year--but that's off topic.)

Notice 09-41 does a terrific job explaining this new test and registration requirement. Here is a summary:

• If you're currently doing only private placements (not of munis, govt's or DPP's) you only need the Series 82 so don't worry about this.
• If you're currently doing investment banking activities--such as originating offerings, underwriting, marketing, structuring, syndication, or doing M&A deals like advising on restructurings, asset sales, corporate reorganizations, writing fairness opinions, etc., then YES, you need the Series 79.
• If you're doing this business, and you're not registered--better get that way.
• If you're doing this business and you have your Series 7, you have to 'opt-in' between November 2, 2009 and May 3, 2010. During that 6-month period, make sure a U4 amendment is filed for you, adding the Series 79 registration. That's all you need to do.
• If you miss the opt-in period, you have to pass the Series 79 to keep doing your investment banking business.
• If you're a Series 7 and you just kinda want the Series 79, well, that's not okay. You can't opt-in, because, technically, you have to be engaged in investment banking business to earn the opt-in registration.
• If you're new to the business and were going to get your 7 so that you could work as an investment banker, you can still take your 7 during the six-month period before May 3, 2010...after you pass the 7, do the U4 amendment to add the 79 and voila! It's yours!
• If you're an intern like I was, guess what? You don't have to get the 79 (see the Notice for details on this one--some qualifying factors).
• If you also do general securities business or other business like muni structurings or DPP's or whatever, you need the 7 in addition to the 79.
• If you are a Series 24 who supervises investment banking activities, you now need the Series 79. You can opt-in (see above) by May 3, 2010.
• If you're thinking of being a supervisor of investment banking activities, but aren't yet licenced, the Series 79 will qualify as a prerequisite to the 24. Take both and supervise away! But wait: if you supervise any other securities activities, like trading or retail sales, you'll need the 7, too.
• You know how you can take the Series 66 instead of the 65 and 63 to register as agent and IA in states? Well, the Series 7 is a pre-requisite for the 66...you can't rely on the 79 to do that job. The 79 is, however, a pre-requisite for the 63.

Okay, that's enough of that topic. One little thing...did you see the words "asset sales" above? That's kinda scary for unregistered M&A shops out there who always thought that arranging asset sales didn't require registration. Well, then again, those folks aren't reading this, so why waste my words.

++++++++++++++

Topic 3: U4 Disclosure Questions: no 'wet' signatures

New FINRA Rule 1010 allows firms to amend the U4 disclosure answers without having the rep manually sign the U4 amendment. Instead, you have to: provide the rep with a copy of the amended disclosure information prior to filing and get the rep's written acknowledgement (like an email or signature on internal form) prior to filing that shows the rep received and reviewed the changes. Keep records of this for examiner review.

(Note: My firms had reps answer the new disclosure questions on an internal form, sign the form and return it. To me, this satisfies the new Rule.)

If reps are on military duty, otherwise unavailable or refuse to acknowledge the disclosure information, you should note that in the rep's electronic signature field.

The effective date is July 27, 2009. Notice 09-40 explains that this new rule helps out with the new disclosure questions that have to be answered by November 14....but it doesn't explicitly say that if your firm was conscientious enough to have made all those U4 amendment filings already--that is, before 7-27--then you don't need 'wet' signatures under the new rule. Hmmm. Let's assume you don't, and that your documentation of rep approval of the new disclosure answers will suffice. Wouldn't seem fair otherwise.

Back to the beach. Surf's up!

Useful Information on a Rainy Day

I walked to my NEW office this morning without drowning in a puddle. High of 61 today with downpours. Feel sorry for us, here in coastal NH. We deserve your pity.

Few things:

1. Remember the FTC Red Flags Rule? FINRA released its brand new written ID Theft Prevention Program template!--and it has an acronym: ITPP! This is great. Thank-you, FINRA. Now all you small firms that have no idea what this rule is all about, and believe that it is completely duplicative with AML and unnecessary, given that you are a tiny shop that does not use credit reports, does not provide debit cards or checkwriting, and does not extend credit (but wait, you have a clearing firm and your clients may open margin accounts through your firm), can create an ITPP without much effort. And the better news is, if FINRA examines for compliance with this rule like it did with AML, you will have years before your written program actually has to be fully customized and implemented. FTC enforcement of the Red Flags Rule begins August 1, 2009. So get going. Here is the link to the template, courtesy of FINRA:
www.finra.org/customerprotection/redflags.

2. As of August 17 you have to provide a new disclosure to customers. New FINRA Rule 2267 is based on old NASD Rule 2280 (Investor Education and Protection). The old rule applied only to firms carrying customer accounts. Now it applies to everyone. BUT: if your firm has an clearing firm that will make the disclosures for you, you're all set (confirm this with them, ok?). If you have other (or only) customers that aren't serviced by a clearing firm and that don't, for instance, receive statements or confirms, then your firm will have to make the disclosures. An example would be an 'application-way' shop that processes MF/VA applications and does not have brokerage accounts. I'm guessing PP/M&A firms are in this category, too, but let's not expect FINRA to be clear on that (you know how I feel about this subject, right?).

So, if all your customers are receiving statements, etc. from the clearing firm, make sure they'll include the disclosures annually to your customers.

Otherwise, you have to provide the disclosures (annually if you carry accounts). If you don't carry accounts, as I desdcribed above, or have some customers not receiving statements, you have to provide the disclosures at or prior to the time of the customer’s initial purchase, in lieu of once every calendar year.

Disclosures may be provided electronically (yahoo).

Here is what you have to disclose:

1. FINRA Broker Check Hotline Number -- (800) 289-9999;
2. FINRA Web site address -- www.finra.org; and
3. A statement as to the availability to the customer of an investor brochure that includes information describing FINRA Broker Check. ...Harder than it sounds. Here's what I recommend: "You may find information about Broker Check online by visiting this link http://www.finra.org/web/groups/industry/@inv/@tools/documents/industry/p009888.pdf or by calling the Hotline number and requesting a hard copy via mail."

Here's what FINRA says about the due date: "Any firm subject to NASD Rule 2280 that complies with its annual (calendar year) mailing requirement on or after January 1, 2009 but prior to the August 17, 2009 effective date of FINRA Rule 2267 will be deemed to have complied with FINRA Rule 2267 for the 2009 calendar year."

So check with your clearing firm to see it they will have complied with old 2280 by 8-17; if not, you're not in compliance. For other firms (see above), start making the disclosures for new accounts. And what the heck, if you send out an annual disclosure notice with other things, like privacy policy and SIPC info, why not include this one, too?

3. Rule 2821 on Variable Annuities--they FINALLY finalized the rule. And the great news is, they took out that requirement to consider ALL deferred V/A purchases and exchanges as 'recommended.' The rule changes also clarify the 7-day review/approval process and funds transfers in that 7-day period. It's good, and the Notice is written well. Look it up: Notice 09-32 is at http://www.finra.org/Industry/Regulation/Notices/2009/P118955. BUT DON'T start enforcing the rule yet. It's effective 2-8-10. I have a call into FINRA about whether optional compliance before then is okay, but I haven't heard back yet :( . In the mean time, you have the usual 24 hour turnaround period to move funds out and approve the business.

Looking out my window: still raining.

The Allison Iraheta Memorial Promise and Red Flags Reprieve

In reaction to last night's travesty on American Idol, I now swear to you that by day's end I will have posted a message about my April conference notes. I have hunkered down and worked diligently on typing my notes--and translating my hand-scrawled gibberish. The wretched AmIdol results led me to this confinement: I am eschewing contact with the public today in hopes of snubbing those who cast votes for Danny. You Gokeyites who read my blog are henceforth required to either a) pay me money for the pleasure or b) promise you'll vote 30 million times for Adam next week.

In the mean time, I hope you've heard that (cut and pasted from FINRA's e-mail, emphasis added):

"FTC Delays Enforcement of FACT Act Red Flags Rule Until August 1
The Federal Trade Commission (FTC) has delayed until August 1 its enforcement of the new Red Flags Rule, which requires most broker-dealers to have in place a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft ("red flags"). In addition, the FTC will soon release a template to help entities with a low risk of identity theft to comply with the rule. Enforcement of the Red Flags Rule, which implements a section of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), was previously scheduled to begin on May 1."

God Bless the FTC. (I give all the credit to Obama.)

Be back soon.

Update on FACT Act

First, let me share my appreciation for FINRA's effort to explain the applicability of the FACT Act's Red Flag and other rules to member firms. The folks in OGC said they were working on it, and they did. Here's the link to Notice 08-69: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p117448.pdf

Now, let me express my dismay at the extreme lack of distinct clarity on this topic--not necessarily from FINRA, but embedded in the Act's definitions. Your firm may be subject to the regulation, or not--just read and re-read the definitions of 'financial institution,' 'transaction account, 'creditor' and 'covered account.' It's a little like solving a Rubik's cube. If all like colors end up on the same side, then yes, your firm has to implement Red Flag Rules under the Fact Act. But good luck getting there.

In reading the definitions provided in FINRA's notice, my first reaction is, "If they wanted broker-dealers to be covered, why didn't they just say so?" For instance, the term“financial institution” is specifically defined as “a State or National bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account . . . belonging to a consumer.” And a “transaction account” is specifically defined as “a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third persons or others. Such term includes demand deposits, negotiable order of withdrawal accounts, savings deposits subject to automatic transfers, and share draft accounts.” See what I mean? If they wanted B-D's to be subject to the regs, why not just include "SEC registered broker-dealers" or "brokerage accounts" or some such other simple identifiers in the definitions? That would have made it real easy... but instead, these definitions overtly exclude the whole subject of brokerage accounts and broker-dealers. And then your favorite SRO puts the onus on firms to twist and retwist the cube in order to solve the puzzle by themselves. Frankly, for most of the 5100 registered B-D's, I think this is like trying to force a square cube through a round hole: I don't think these rules should apply.

Also, while I'm ranting, this whole thing is crazy!! B-D's already have CIP rules to follow. And remember that AML rules are not just about preventing money laundering. We all know that most AML-triggered investigations end up focusing on fraud, including mail fraud and credit/debit card fraud. So firms are already obligated to attempt to identify and report fraud....why do they have to now be subject to seemingly duplicative rules? And at what cost? ...read the Notice... do you really have time to create a "Written Identity Theft Prevention Program"? One that will confuse your already confused Reps about the account opening process? This reminds me of redundant local ordinances--instead of having one rule that requires safe and responsible behavior on sidewalks, they have in place six different rules, pertaining to different possible ways to conduct unsafe and irresponsible behavior on sidewalks: skateboarding, bicycling, rollerblading, dog walking, etc.... get my point? I guess I just feel sorry for firms whose business has nothing at all to do with credit cards, withdrawals, payment transfers, etc. To think that they will have to adopt lengthy and complicated procedures on top of what they already have in place (which are already hardly deemed necessary and applicable): what a waste of resources.

But who am I ranting at, here? The Federal Trade Commission? That's a big target for a little person like me. And I don't want to trash FINRA--they did something cool by addressing the subject. I guess I would like if FINRA would go a bit farther out on the limb by actually giving its opinion on how application way firms, M&A/PP shops, and introducing firms who do not actually extend margin to clients fit into this definitional puzzle. I know they state up front that they're not the rulemakers or interpreters on this subject, but c'mon, since they go on to say that NOT complying would be a violation of just and equitable principles of trade, can't they show a little more mercy?

Another topic within this one: check out Part C of the Notice. It's about policies you have to have in place re: use of consumer reports. If your firm requests a consumer report about a new or existing customer and receives a notice of address discrepancy from a CRA, you'll have to be able to form a reasonable belief that the consumer report actually relates to the customer in question. FINRA did a nice job of laying out these responsibilities. I'm assuming the effective date of these requirements is the same delayed date as for Red Flag Rules: May 1, 2009 (although I could be wrong.)

Lastly, FINRA mentions in the Notice that FTC has indicated a willingness to work with them to "resolve on a consistent and industry-wide basis, interpretive questions that arise under these rules as applied to broker-dealers. " I love that! My advice to you and all your B-D friends: call OGC at (202)728-8071 to ask about this. Perhaps that kind of dialogue will result in 'interpretive challenges' being met head on with concrete directives from FINRA. Then you can throw that darned Rubik's cube out the window. Puzzle solved.

FACT Act for BD's? Maybe.

A very helpful member of FINRA's Office of General Counsel looked into the whole FACT Act/ID Theft/Red Flags Rules subject. A big shout out to that person--thanks again!

I had asked him about 2 weeks ago about how these new rules might apply to registered B-D’s. He let me know that it is, specifically, FTC Rule 681, implemented under the FACT Act, that may apply. This rule goes into effect November 1. I guess FINRA is considering publishing either a reminder or guidance on the topic. Since it’s not an SEC Rule, SEC won’t be enforcing this; whether or not FINRA adds it to their examination protocols, we won’t know yet. A parallel example of FINRA enforcing an FTC rule is in the area of telemarketing restrictions. As you know, FINRA/NASD ‘adopted’ them and enforces cold calling rules.

Here is the link to the Federal Register announcing the FTC’s (and other agencies’) implementation of the FACT Act: http://frwebgate1.access.gpo.gov/cgi-bin/PDFgate.cgi?WAISdocID=080421251418+19+1+0&WAISaction=retrieve.

The operative terms within the rule are “financial institution,” “creditor” and “covered account.” I have a sense that M&A/private placement firms and straight up check & app firms (no brokerage accounts) will be able to exempt themselves; OGC seems to think introducing firms whose clients have brokerage accounts will not be exempt. But let’s wait and see…my opinion is, it’s only fair that FINRA provide some help on this complicated subject. Because let's face it: your compliance staff is working hard these days on many other issues. They're not pro-actively reading the Federal Register on weekends in an attempt to find new, unannounced rules to follow. (If they are, give them a raise or ask them to call me for a job.)

So be on the lookout for something from FINRA. In the mean time, think about clicking that link above and searching "681." You'll be way ahead of the game. (Unlike the Sox.) (Go Sox.)

Fact-ish: The FACT Act and Reg. S-P Amendments

I'm writing this to let you know I'm looking into something--that is, this is preliminary and I'll follow up later. So, put this information in the category of 'truthiness.'

I saw on FINRA's weekly e-mail the announcement of its online workshop on the subject of customer data protection issues (see: http://www.finra.org/Industry/Education/OnlineLearning/OnlineWorkshops/P117068 ). Within the workshop description the “new FACT Act” is mentioned.

This mention made me look into the FACT Act; I'd certainly seen references to new 'ID theft' compliance in other documents and online sources, but I was not familiar with the Act, nor its applicability to broker-dealers. Sometimes I'm lazy (no, not lazy: overworked!), and I rely on FINRA's Notices to announce important new requirements that will effect my clients.

Note that the FACT Act was referenced in NtM 05-49, but only in the footnotes and in reference to preventing identity theft by destruction of consumer reports.

The FACT Act is a banking regulation: the Fair and Accurate Credit Transactions Act of 2003. Financial institutions, under the Act, have a mandatory deadline of November 1, 2008, to comply with three new parts, called the Red Flag Rules (in sections 114 and 315 of the Act). New requirements include:

• Creating an identity theft prevention program
• Implementing change of address safeguards when issuing credit/debit cards
• Verifying identity upon notice of address discrepancy from a consumer reporting agency

As you can see, this stuff doesn't really seem to relate to your brokerage business. Well, my read of the FACT Act is that it doesn’t apply to broker-dealers. Here's an excerpt from the Act proposal that appears to exempt BD’s from complying with the red flag rules, including having an ID theft program:

334.90 Duties regarding the detection, prevention, and mitigation of
identity theft.
(a) Purpose and scope. This section implements section 114 of the Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681m, which amends section 615 of the Fair Credit Reporting Act (FCRA). It applies to financial institutions and creditors that are insured state nonmember banks, insured state licensed branches of foreign banks, or subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

But, within the Act, “account” and "transaction" as defined may include certain types of brokerage accounts that allow for check writing, debit transactions,etc., that would then throw the requirements into a BD's realm. Since you, the small BD offering mutual fund investments on an application way basis, doing private placements or hedge funds offerings, or running an institutional trade desk, do not allow check writing on customer accounts, this stuff seems inapplicable and worthy of ignoring.

But.... why the mention in the online workshop announcement? The mention, itself, is a red flag for me: ooh-oh, is this something I missed? Maybe the workshop will confirm just what I surmise: the FACT Act doesn't apply to you; no worries. I would have liked it better had FINRA released guidance first, though, so that the message was way more broadly-distributed (most firms don't listen to the online workshops). I've asked FINRA if guidance is forthcoming. I'll keep you posted.

We're not done yet.

Reg. S-P is subject to pending amendments that cross reference the FACT Act. So, this may be a good thing for you or a bad thing. That is, if S-P will definitively require all BD’s to comply with the red flag rules under the Fact Act, then you'll have to waste time building procedures or justifications for not having procedures to comply. Perhaps the amendments--and FINRA's expectations of compliance—will be nuanced, such that you won't have to waste time on this. We will see.

Now remember, my knowledge base is minimal on this subject. No facts expressed here, only factish information. My goal is let you know that you don't have to react with alarm if you hear about firms complying with the Fact Act. Most likely it does not concern you. But stay tuned, because the Reg. S-P changes might.

If only politics were this straightforward. ... oh wait, they are.