Belated Happy New Year

The only reason I'm adding this blog entry is that if you landed on my blog and saw the "December Dates" entry, you might think the Patriots were still headed to the Super Bowl. I wanted to spare you that moment of hopeful confusion. It's January and the Pats are going sledding instead. As a Steelers fan living in New England, I have to admit that this shocking turn of events will make for a less hostile mood in the 'hood next weekend. Phew!

Very brief reminders:

If you have to, under the FACT ACT and the Red Flags Rule, make sure you put in place a Written Identity Theft Program. To my knowledge, the rule is now enforceable. Look for my prior ramblings on this topic if you want some background.

If you do annual disclosures in January, such as sending Privacy Notices and information on SIPC and Broker-Check, remember to send them.  Also remember that SEC offers a form of model privacy notice, in case you want to switch to a format that will meet their approval. Your existing notice may be fine--but you'll have to review Reg. S-P to be sure. Again, look for my earlier blather on this subject.

Remember, pre-notifcation to and review by a supervisor of all new 'other business' or 'outside business activities' of Reps is now required.  Reps can't start doing something new on the side unless this review process has taken place first--and you firms have to document this. And for existing OBA you have until June, as far as I can see, to document your reviews. Start thinking about how you'll do this and getting the documentation in place. If you used a year-end RR questionnaire that solicited this information, use those answers as a basis for requesting and gathering further information on the outside activities.

Don't forget to do a periodic OFAC check of all current customers/accounts. You can define 'periodic.' Put the results in your files.

And remember to encrypt any information you give FINRA on portable storage devices. Notice 10-59 describes this new requirement.

That's it for now. Writing updates to procedures--don't forget to update yours.

New CCO Reg. Category

Quick note on proposed Rule 1230(a)(4). Reference: Notice 09-70.

The rule makes a stand-alone registration category for Chief Compliance Officers, which will require a new qualification examination. Here are some reminders:

• If you are already on Form BD as CCO when the rule is made effective, you'll be 'grandfathered' and won't have to take the new test. You will be registered as CCO via a U4 amendment.
• This includes any person listed on Form BD, such as co-CCO's and limited principals filling that role.
• If you are added to Form BD after the effective date of the rule, but before the new examination is available, you will likewise be grandfathered, BUT only if you hold a 24. That is, if you are a limited principal and the firm adds you as CCO in this interim period, you will not qualify for the freebie CCO registration--you'll have to take the 24 or wait and take the new CCO exam.
• If you are added to Form BD after the effective date of the rule and after the new examination is available, you will have to pass the exam first before your CCO registration is approved. Even if you have a 24...it won't matter.

So think about this and plan accordingly. I'm not sure when the rule will be approved. See this link for links to Comments about the proposal.

The Difference Between June 1 and June 2: Red Flags Rule Delayed AGAIN

June 1:
>The effective/enforcement date of FTC's Red Flags Rule, whereby you, my broker-dealer friends, had to put in place an Identity Theft Prevention Program.
>The date by which I (against my better judgment/procrastination instincts) worked my buttocks off in an attempt to customize/deliver FTC's neat-o PDF customizable 'low-risk' form.
>The date before which, if a regulatory body were going to announce a delay in enforcement of the Rule, said regulatory body should have announced a delay of said Rule.

June 2:
>The date after which you, my broker-dealer friends, put into effect your IDTPP's, after having struggled to customize either FINRA's template or FTC's 'customizable low-risk form.
>The date after which we all collectively considered this topic done/handled/put to rest and happily forgotten about it.
>The date we got notice from FINRA that the enforcement date of the Rule had been delayed AGAIN...now to Dec. 31, 2010.
>The date, perhaps, you and I both swore under our breath something profane and un-American.


Here is the announcement, in case you missed it:

The FTC has again delayed enforcement of its Fair and Accurate Credit Transactions Act of 2003 (FACT Act) Red Flags Rule, from June 1, 2010, to December 31, 2010. The delay will allow Congress to consider legislation limiting the businesses covered by the rule. If legislation passes with an effective date earlier than December 31, 2010, the FTC will begin enforcement as of that effective date.

Firms subject to this rule—which include most broker-dealers—must have in place by the FTC enforcement date a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

As a reminder, FINRA has developed an optional template that firms may use as a guide when fulfilling their requirements under the FTC's Red Flags Rule. You can find more information about the FACT Act regulations in Regulatory Notice 08-69.

I won't start babbling about how I think this Rule is redundant and how the criteria for determining applicability is being interpreted in a bogus way. You can always search the subject on my blog to read more. But why bother? Let's just forget this all happened. And let's hope the Rule NEVER gets enforced for you BD's who are already, under AML rules, required to act as law enforcement and root out any nefarious attempts to usurp identities (even if they're not terrorists).

What a Difference a Day Makes: No, what a difference two weeks would have made! Now that kind of lead-time would have been appreciated! (Here I am again, Daydream Believer.)

800 Overseas Investors Thank You

Alternate title: Keep those SAR Filings Coming! Terrorist financing down 36%!

Please read FinCEN's 15th Issue of The SAR Activity Review – Trends, Tips & Issues (http://www.fincen.gov/news_room/rp/files/sar_tti_15.pdf). It's a blast.

Seriously, you AML officers out there should read it. It gives you a reason to value all the time you spend worrying about whether or not to file a SAR. You and all your AML brethren are making a difference! The SAR report outlines some cases cracked thanks to your efforts (for instance, a foreign national was busted for leading a scheme involving hedge funds and advisory firms that resulted in $21 million in losses for over 800 foreign investors: that makes you feel good about doing all that AML work, right?). ....(right??)

Here's what examiners want to see from you:

1. Complete written procedures.
2. Implementation of written procedures.
3. Monitoring for susp. activity.
4. Reporting of susp. activity.

Here's what examiners are seeing from you:

1. Failure to document reviews of suspicious activity.
2. Incomplete SAR forms.
3. Crappy SAR's: completed inaccurately; inadequate narrative section (why is it suspicious?); includes supporting docs even though it's not supposed to; filed late.
4. Inadequate due diligence on potentially susp. activity--investigate to determine if you should file!

Recent transactions in the sale of unregistered securities or representing fraud/market manipulation are not being reported as required (such as those involving penny stocks). Read the publication for an example that may be familiar to you.

The report includes sound advice on how to maintain a current and effective SAR program at your firm, for instance, by addressing:

• current events and emerging trends: thanks to our little financial crisis, automated surveillance based on certain profiles and parameters don't work like they should (stock price/volume swings--all that is now normal; and customers with 'top reputations' can't be trusted anymore--those darned institutional short sellers!).
• cyber crime: one-two punch, here--electronic intrusion into online brokerage accounts combined with traditional market manipulation (market-savvy hackers, our worst nightmare).
• trade-based money laundering: no, not that kind of trade, this kind: international trade of goods and services. These Marco-Polo types under- or over-invoice or route invoices through various financial institutions (not just banks), leading to multiple payments for the same goods. Sophistication is growing in the illicit trade finance arena.
• reported suspicious activity: evaluate your firm's reporting history; analyze trends; identify similar schemes, common locales or names, or possible red flags; follow enforcement actions.
• identification and analysis of transaction types: don't just think of securities transactions that involve money: there are far more things to worry about! account transfers, free deliveries and receipts, external withdrawal by transfers and internal journal entry transfers. Your program should be able to detect activity and gaps that occur across the full spectrum of operations--all transactions "by, at or through" your broker dealer.
• identification of detection points: all departments and personnel must be adequately incorporated into escalation workflows. Matters such as ID theft, insiders trading, 314a matches, law enforcement subpoenas, customer tax issues, customer due diligence, credit reviews, back office operations, interaction with other financial institutions, and employee financial crime and prohibited trading... they all should feed into the SAR consideration stream.

(Those aren't my big words, by the way--not all of them. That summary is derived from the aforementioned SAR report.)

If you work for a huge firm with well-staffed internal legal, audit and compliance departments, this improvement to your AML/SAR program should seem reasonable. If you are a micro-firm, with one guy who pretty much wears every supervisory hat, well, my advice is to dedicate your summer in an attempt to achieve this level of AML musculature. Good luck. Take steroids.

You know what I think? That small firms should have an AML clearing house that performs their AML responsibilities for them, collectively. I mean, c'mon, it's crazy to imagine small firms being able to implement the goals expressed above. The whole cybercrime topic makes me scream louder than Danny Gokey: it's hard enough to get Outlook to work correctly, let alone defeat intergalactic cyberfiends. Wouldn't it be cool if the several thousand tiny FINRA BD's could outsource their AML stuff to one place? That place would be super-good at their job: they'd use unemployed MBA's and IT jocks to mastermind the most sophisticated and effective AML tools available on our planet, and they'd give the small firms the comfort of knowing that none of their clients was a foreign national perpetrating fraud on a global basis. They'd manage CIP, OFAC, 314a lists, 314b filings, account monitoring, suspicious activity investigations and reporting--and just think! AML audits would be a thing of the past! Instead, SEC or FINRA could do one big audit of the clearing house (let's call it AML, Inc. (tm) for now) to ensure compliance for the thousands of firms. The tiny firms could go back to doing what they do: helping their clients make money in the markets. Ahhhhh. (Un cafe, s'il vous plait...I think I was just dreaming.)

Anyway, 53,022 SAR's filed by the securities and futures industry through 2008. And exactly 6 cases solved. (Okay, I made that second number up.) Keep at it, folks! Some day a SAR you file will be profiled in a FinCEN report, and you'll be able to share your pride with your grandkids.

Oh, wait, no, you won't.

Sharing SAR's: Some Proposed Changes

FinCEN has announced proposed changes to BSA's regulations on SAR sharing and confidentiality rules. Since they're now just proposals subject to comment, I won't detail every change, but here's my summary:

The guidance on sharing with parent entities will remain intact--it will be built into the regulation so as to be all the more official. Here is the original guidance from January 2006: http://www.fincen.gov/statutes_regs/guidance/html/sarsharingguidance01202006.html You remember that it allowed BD's to share a SAR or the existence of a SAR with a holding or parent company, but not with affiliates. The guidance required that a confidentiality agreement be place with the holding co/parent entity.

BD's will now be allowed to share a SAR or the existence of a SAR with affiliate entities--that is, only if those entities are subject to SAR rules (i.e., banks, BD's, mutual funds, thrifts, insurance co's, casinos, money service business--not IA's or unregistered investment companies). BD's can only share this stuff if they filed the SAR and the affiliates can't go on to share the information with others (it's not like Facebook: 'friends of friends' don't get to see stuff...). Like with parent entities, confidentiality agreements should be in place when sharing with affiliates.

Other changes clarify some things that you might have otherwise assumed, like: the sharing prohibition applies to all employees, directors, agents, etc. (not just the firm); BD's can share SAR's or the existence of SAR's with their examining authorities; and BD's and their employees can share the information, facts, and documents underlying a SAR a) with financial institutions for the sake of filing a joint SAR and b) in connection with certain employment references or termination notices.

I would think FINRA would provide an announcement when these changes go into effect, so look for a Notice in the coming months. For the proposals and guidance, go to: http://www.fincen.gov/statutes_regs/frn/pdf/frnSAR_Confidentiality.pdf and http://www.fincen.gov/statutes_regs/frn/pdf/frnSF_SAR_Sharing.pdf .

FACT Act for BD's? Maybe.

A very helpful member of FINRA's Office of General Counsel looked into the whole FACT Act/ID Theft/Red Flags Rules subject. A big shout out to that person--thanks again!

I had asked him about 2 weeks ago about how these new rules might apply to registered B-D’s. He let me know that it is, specifically, FTC Rule 681, implemented under the FACT Act, that may apply. This rule goes into effect November 1. I guess FINRA is considering publishing either a reminder or guidance on the topic. Since it’s not an SEC Rule, SEC won’t be enforcing this; whether or not FINRA adds it to their examination protocols, we won’t know yet. A parallel example of FINRA enforcing an FTC rule is in the area of telemarketing restrictions. As you know, FINRA/NASD ‘adopted’ them and enforces cold calling rules.

Here is the link to the Federal Register announcing the FTC’s (and other agencies’) implementation of the FACT Act: http://frwebgate1.access.gpo.gov/cgi-bin/PDFgate.cgi?WAISdocID=080421251418+19+1+0&WAISaction=retrieve.

The operative terms within the rule are “financial institution,” “creditor” and “covered account.” I have a sense that M&A/private placement firms and straight up check & app firms (no brokerage accounts) will be able to exempt themselves; OGC seems to think introducing firms whose clients have brokerage accounts will not be exempt. But let’s wait and see…my opinion is, it’s only fair that FINRA provide some help on this complicated subject. Because let's face it: your compliance staff is working hard these days on many other issues. They're not pro-actively reading the Federal Register on weekends in an attempt to find new, unannounced rules to follow. (If they are, give them a raise or ask them to call me for a job.)

So be on the lookout for something from FINRA. In the mean time, think about clicking that link above and searching "681." You'll be way ahead of the game. (Unlike the Sox.) (Go Sox.)

Fact-ish: The FACT Act and Reg. S-P Amendments

I'm writing this to let you know I'm looking into something--that is, this is preliminary and I'll follow up later. So, put this information in the category of 'truthiness.'

I saw on FINRA's weekly e-mail the announcement of its online workshop on the subject of customer data protection issues (see: http://www.finra.org/Industry/Education/OnlineLearning/OnlineWorkshops/P117068 ). Within the workshop description the “new FACT Act” is mentioned.

This mention made me look into the FACT Act; I'd certainly seen references to new 'ID theft' compliance in other documents and online sources, but I was not familiar with the Act, nor its applicability to broker-dealers. Sometimes I'm lazy (no, not lazy: overworked!), and I rely on FINRA's Notices to announce important new requirements that will effect my clients.

Note that the FACT Act was referenced in NtM 05-49, but only in the footnotes and in reference to preventing identity theft by destruction of consumer reports.

The FACT Act is a banking regulation: the Fair and Accurate Credit Transactions Act of 2003. Financial institutions, under the Act, have a mandatory deadline of November 1, 2008, to comply with three new parts, called the Red Flag Rules (in sections 114 and 315 of the Act). New requirements include:

• Creating an identity theft prevention program
• Implementing change of address safeguards when issuing credit/debit cards
• Verifying identity upon notice of address discrepancy from a consumer reporting agency

As you can see, this stuff doesn't really seem to relate to your brokerage business. Well, my read of the FACT Act is that it doesn’t apply to broker-dealers. Here's an excerpt from the Act proposal that appears to exempt BD’s from complying with the red flag rules, including having an ID theft program:

334.90 Duties regarding the detection, prevention, and mitigation of
identity theft.
(a) Purpose and scope. This section implements section 114 of the Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681m, which amends section 615 of the Fair Credit Reporting Act (FCRA). It applies to financial institutions and creditors that are insured state nonmember banks, insured state licensed branches of foreign banks, or subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

But, within the Act, “account” and "transaction" as defined may include certain types of brokerage accounts that allow for check writing, debit transactions,etc., that would then throw the requirements into a BD's realm. Since you, the small BD offering mutual fund investments on an application way basis, doing private placements or hedge funds offerings, or running an institutional trade desk, do not allow check writing on customer accounts, this stuff seems inapplicable and worthy of ignoring.

But.... why the mention in the online workshop announcement? The mention, itself, is a red flag for me: ooh-oh, is this something I missed? Maybe the workshop will confirm just what I surmise: the FACT Act doesn't apply to you; no worries. I would have liked it better had FINRA released guidance first, though, so that the message was way more broadly-distributed (most firms don't listen to the online workshops). I've asked FINRA if guidance is forthcoming. I'll keep you posted.

We're not done yet.

Reg. S-P is subject to pending amendments that cross reference the FACT Act. So, this may be a good thing for you or a bad thing. That is, if S-P will definitively require all BD’s to comply with the red flag rules under the Fact Act, then you'll have to waste time building procedures or justifications for not having procedures to comply. Perhaps the amendments--and FINRA's expectations of compliance—will be nuanced, such that you won't have to waste time on this. We will see.

Now remember, my knowledge base is minimal on this subject. No facts expressed here, only factish information. My goal is let you know that you don't have to react with alarm if you hear about firms complying with the Fact Act. Most likely it does not concern you. But stay tuned, because the Reg. S-P changes might.

If only politics were this straightforward. ... oh wait, they are.

FinCEN's Better Website

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.

I won't call it a reversal

...but it seems like one.

Oh, I'm talking about electronic storage rules again. When I die, will someone please make sure my tombstone says something about my dedication to this cause? ...says something...not necessarily flattering.

Okay, so in the last two days I've run into situations where it appeared that 3rd party electronic storage vendors would not provide the representation letters generally expected under 17a-4(f)(2)(i)--you know the letter--the one that says the media will do the things listed under (f)(2)(ii), as follows:

(A) Preserve the records exclusively in a non-rewriteable, non-erasable format;

(B) Verify automatically the quality and accuracy of the storage media recording process;

(C) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media; and

(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member.

Since way back, when this subject was just a shadow across compliance officers' desks, the expectation--and instructions from then-NASD, I might add--was that, if the firm used a 3rd party vendor to store its electronic records, it was the 3rd party vendor who was required to make those representations in writing, on their letterhead, to the regulators. The firm would engage the vendor to store information (such as e-mails), would request the letter, would get the letter, and would mail it to Susan DeMando's office. Later, firms had to submit it to FINRA online.

Firms storing their own records electronically would make the representations themselves, in writing to FINRA.

What I just learned from a helpful and trusted FINRA staff member is this: the format representations letter does NOT have to come from the 3rd party vendor. Quoting (f)(2)(i) of the Rule: "...the member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2)." The staff member said that the BD would make the representations 'unless they don't have the knowledge' to make them.

My opinion is this: most firms are hiring out because they don't have that knowledge or anything close to it. But hey, I've been wrong--or at least misled--before.

Most 3rd party vendors, in my experience, give those letters to their clients for delivery to FINRA. I would expect it if I were you. If the vendor wants to charge you for the letter, save your money and write the letter yourself.

Here's the thing , though: make sure you, the BD, get solid, written clarity from your 3rd party vendor before writing and submitting your letter to FINRA. You have to be sure the media meets the criteria. You're hiring the vendor because you can't or don't want to store the records yourself... you'll need to rest assured that the records meet the regulator's expectations, right? Otherwise, why pay their prices??

Oh, and remember: you always have to submit an 'access letter' to FINRA-complying with 17a-4(f)(3)(vii)--and that letter has to come from an independent third party (any old third party will do--as long as they know what they're talking about and they're not an affiliate or relative). Your third party storage vendor will write that letter for you--if they don't, fire them.

Thanks to Davis for his inspiration... he knows that nothing gets me going like ESM.

>

Little more input on audit function under electronic r/k rule

Quick--I promise--update on the 'audit function' under 17a-4(f)(3)(v). This week a FINRA examiner provided verbal guidance in response to a firm's written request for such. The guidance was not specific; it was based only common sense, not formal guidance from SEC or FINRA higher-ups. It consisted of recommending a periodic review of stored records to confirm that they are intact.

Okay then.

Obviously more on this subject is necessary for firms to fully understand their responsibilities.

AND...I came across another outside vendor for e-mail archiving: Global Relay Communications. I haven't gotten permission to link to them--please google them and check out their broker-dealer services. They seem quite thorough in their comprehension of FINRA members' regulatory burdens. Their materials plainly address all requirements and describe how their systems meet them... nice to see. Here's an excerpt from their presentation on the audit function (okay, I didn't get permission to copy this--but I'm hopeful the G.R. folks will appreciate the plug):

"All messages stored in the Message Archiver are forwarded directly from the Member firm’s email server, with no User intervention. During the lifecycle of a message, all actions (viewing, replying, forwarding, downloading, flagging, notation, review) by any User, Reviewer, Super Reviewer, Administrator or the system itself associated with the message are logged. The Message Archiver’s detailed logs provide a full audit trail verifying the integrity of the message. These logs automatically appended to the messages and are viewable and made available to authorized administrative Users.

As detailed directly above, Message Archiver immediately provides a full audit trail accessible to any authorized administrative User. A side benefit of the system, is that a firm also builds an audit trail for the auditors actions in the archive during an online audit.

Global Relay’s Message Archiver employs retention schedules for all audit results. Audit results are retained for the lifecycle of the message. The SEC three and six year retention requirement for records set out in paragraph (a) and (b) of this Rule 17a-4 can be applied to the audits within Message Archiver."

Happy Summer!

Exam Priorities

FINRA just put out its annual notice on exam priorities. Below I've listed the areas they prioritize (many), along with summaries and few comments. Far below, I note some recent findings I've seen on exams. This isn't overly original or interesting, but I thought I'd throw it in my blog, since I've been way too busy lately to write anything else... :)

Senior Investors – hot topics include misleading advertising, shameless, fear-inducing sales pitches and of course, suitability. Advice: don’t let your reps claim to be qualified
‘senior investing’ specialists and make sure each transaction is well documented to establish suitability.
Deferred Variable Annuities – new Rule 2821 went into effect, sort of, on May 5. Reps have to document their reasonable basis for recommending a Def. V/A purchase or switch; principals in the future will also be required to ensure reasonableness. Training is in Def. V/A rules and products is required. Here is the link to the April Phone-In Workshop on the subject - phone-in workshop; also reference my notes on this in an earlier blog entry.
Anti-Money Laundering (AML) – final rule 312 of Patriot Act went into effect in Feb; most small firms are not effected since they don’t have foreign banking relationships. Examiners are looking for suspicious activity monitoring and SAR filings; also making sure firms are having independent testing as required. Remember, follow-up on testing recommendations and keep records of your follow-up action taken.
Protection of Customer Information – issues include online account hacking (not relevant for most small firms) and protecting information stored electronically (on hard drives, portable drives, laptops and PDA’s). Exam deficiencies include failure to provide privacy notices (and keep records of providing them), failure to have procedures addressing disposal of consumer report information, failure to obtain required confidentiality agreements from third parties; failure to insure that outsourcing entities maintained the confidentiality of customer information; and failure to include a required “opt out” clause in their privacy policies. While firm procedures may address safeguarding their information, it’s a good idea to have a separate “IT” type document detailing the administrative, technical and physical safeguards used to secure data.
Supervision and Supervisory Controls – I guess a lot of firms are still struggling with the difference between supervisory procedures under 3010 and control procedures under 3012/3013. Exams focus on separate control procedures, review of producing manager, heightened supervision of high-risk brokers, annual testing and verification and CEO certifications.
Sales of New or Non-Conventional Products – firms have to have procedures for approving of new products; examiners are also focusing on recommendations in new and non-conventional products, such as hedge funds, CMOs/CDOs, REITS, auction rate securities and other structured products. Guidance references MSRB notices for firms doing muni business.
Transaction Reporting – accuracy of reported transaction information is the firm’s responsibility, no matter how it’s reported. Trade Reporting Facility participants must transmit certain information regarding last sale reports of transactions in designated securities. Examiners are also finding firms to have incorrectly reported riskless principal transactions, incorrectly reported transactions with the long/short-sale indicator and not properly submitted OATS data with accurate order information, terms and conditions, and/or special handling codes.
Business Continuity Planning (BCP) – the exam priorities publication states that firms should periodically test their plan to ensure all of its components work as envisioned…but this is not required by the Rule itself or in FINRA’s 2006 NTM 06-74 on the subject. Firms should decide if periodic testing is necessary, given their size and customer services.
Data Integrity – exams will look at CRD filings, complaint reporting and clearing firm reporting to ensure accuracy and timeliness. Firms face steep fines for late filings.
Bank Sweep Programs – for broker-dealers sweeping customer credit balances into deposits at banks. All sorts of issues, here, including: protection of funds, net capital requirements, written agreements, reconciliations, books and records, SIPC/FDIC coverage, and account statements. Call district contact to discuss before setting up such a program.
Agency Lending Disclosure – for firms that operate an agency securities lending business. Exam findings show firms not performing principal counterparty credit risk monitoring or reconciliations and not resolving contract differences nor computing securities borrow deficit capital charges at the principal counterparty level. Ref: 05-45.
Inventory Valuations – firms should have controls to independently validate the pricing of inventory positions.
Outsourcing – outsourcing is not a substitute for internal controls and compliance monitoring; outsourcing should be monitored and overseen. Outsourcing to foreign entities may result in risks and should be closely monitored.
Order Audit Trail System (OATS) – as of February 4, 2008, OATS reporting requirements include OTC equity securities such as orders for OTC equity securities traded on the OTCBB, Pink Sheets or otherwise, as well as orders for certain foreign equity securities and other securities meeting the definition of OTC equity security in NASD Rule 6951. Best to visit the OATS web site (OATS) and FAQs to understand the complexities of OATS reporting.
Regulation NMS -- SEC Rules 610 (the Access Rule) and 611 (the Order Protection Rule) were fully implemented for all NMS stocks as of October 8, 2007. Initial FINRA exams show that some firms mistakenly may believe that Reg NMS does not apply to them, either because they make markets in a limited number of NMS stocks or because they infrequently execute orders internally. Note that Reg NMS does not include any exception to the definition of “trading center” based on de minimis activity. Firms are reminded that the requirements for ISOs apply to “any broker or dealer” that uses ISOs, and are not limited solely to broker-dealers that operate as trading centers. Refer to online resources for clarity on this: Spotlight On Regulation and Frequently Asked Questions on Rules 610 and 611.

Additional areas of exam findings:

Changes in Account Name or Designation – changes in account name or designation, including error accounts, must be approved by a designated principal and there must be records to show that s/he was personally made aware of the essential facts concerning the change. Approval must be noted on the order or another record.
Time and Price Discretion – when relying on a verbal, one-day time and price discretion exception to Rule 2510 (discretionary accounts), firms must note the reliance on tickets and must not extend the discretion beyond the close of business that day. (Doesn’t apply to institutional accounts in ‘good-til-cancelled’ transactions on a ‘not held’ basis.)
Net Capital – violations include inaccurate inventory valuations of prop. positions and mark-to-markets performed by traders; and improper treatment of ‘cash-like’ investments offered by banks (non-allowable).
Customer Protection – 15c3-3 violations include: inaccurate treatment of stock record allocation positions; non-bona fide reserve bank deposits; and creation of segregation deficits by deliveries, securities loaned and securities borrowed returns.
Back-Office Transaction Processing – inaccurate trade processing and reconciling. Conversions of processing systems often leads to a lot of trade breaks and unreconciled items, creating inaccuracies in books and records, charges against net capital and increased customer reserve requirements.

What I have seen lately in exam results:

Audit of Electronic Storage Input -- failure to have procedures for/comply with the ‘audit’ function under the SEC electronic books and records rule (17a-4(f)(3)(v). I have requested guidance from four FINRA staff members; three clients have directly requested guidance, verbally and/or in writing, from their examiners and/or liaisons, but NONE has been provided. At very least, perhaps firms should ‘check to see that the records are there’—paraphrased advice from one FINRA staff member.
Notify Outside Brokerage Firms of Employee Accounts – Rule 3050. If reps opened accounts prior to being associated persons of the firm, they will not have informed the outside brokerage firm of their status as RR. Firm should send letter to outside brokerage firm with request to provide duplicate statements/confirms.
Provide Copy of U5 to Term’d Rep – copies of U5’s must be provided to terminated reps within 30 days of termination; keep a record to show that the U5 was indeed provided.
Maintain Updated Contacts on FCS – be sure when updating contact information that you hit “save” or the changes will be lost. Changes of most CRD information should be made within 30 days of the change or of knowing of the change.
Provide BCP Disclosure Summary – required for all firms, including those with institutional customers. Provide at account opening and when the information changes (not an annual disclosure requirements, but a good idea to include in annual disclosures).
Register Personnel with Access to B/R – back office or administrative staff who have access to customer records or the firm’s financial b/r should be registered on CRD as “NRF” employees. Fingerprint cards and certain personal data are filed.
Obtain AML Information (CIP) -- new account forms or other such forms should include all required CIP information—name, physical address, TIN and DOB if individual. Verification must be in evidence and customers must be informed of firm’s CIP verification efforts—keep records of all compliance with this rule.

“In like a lion…”: no kidding! I can’t wait for the lamb.

Plenty of action going on at FINRA these days. I count 24 announcements made in the first 20 business days of March. That’s 1.2 announcements per day! I’ve pulled out a few items to share, in case you haven’t been reading.

In FINRA’s March 24 exam priorities letter we heard about…
1. a change in examination protocol. Firms will no longer reply to their exit conference memo…from now on, they’ll wait to receive an “Examination Report” and they’ll have 30 days to respond. The final document from FINRA after an exam will now be called the “Examination Disposition Letter,” which will enumerate exceptions/deficiencies classified as: No Further Action, Cautionary Action, Compliance Conference, or Referral to Enforcement for Review and Final Disposition. Obviously, we’ll need new acronyms… goodbye, LOC.

2. a new name for your helpful FINRA contact person: “Coordinator.” They say that for most of you, the Coordinator is the same person you used to call “Liaison.” Of course this person could be different from your Core Examiner and Finance Coordinator. In any case, perhaps this new title will last longer than the last one did.

3. advance notice of examinations. The new timeframe is “up to 30 days”…but not necessarily 30 days… that will depend on the risk perceived. In some cases, firms will get up to 60 days, for instance those firms with lots of retail branches where beaucoup information requests will have to be met. Side note: for those of you who have not gotten Web IR entitlements, I suggest you do that now. That way, when you get your exam notice, you’ll be able to login to the Web Information Request site and get started—you’ll have more time to prepare for the exam, this way.

4. paying careful attention to senior customers. If only FINRA had beaten the sub-prime horse to death, as it does with this issue…maybe my portfolio would be in better shape (etc., etc., etc….it’s not all about me, I know that). Not that this issue isn’t important, but, well, if this is the first you’re hearing about your obligations to ensure suitability when dealing with senior citizens, I bet you’re dizzy right now from your recent space travel.

5. the new deferred variable annuities rule—2821. Partly effective May 5, 2008, so look it up. You may find that your firm is already complying because you generally adhere to a best practices ethic. A few parts of the rule that concern supervisory approval have been delayed until August at the earliest. Check out NtM 07-53 to know what’s in store for you—or listen to the phone-in workshop on April 18.

6. data protection and how important it is to have your IT staff/vendor set you up right. Protect customer records! OK, easier said than done. I mean really, hackers are better than most IT staff and vendors. But that’s no excuse to do nothing. CD’s, thumb drives, laptops, i-pods all have to be protected somehow.

7. new MSRB rules that parallel FINRA’s supervisory rules… if this applies to you, see MSRB Notices 2008-06, 2007-32 and 2007-16.

8. other things like new product sales, fee-based accounts, transaction reporting, information barriers, inventory valuations, and the ever-present OATS, among others. Please see the link below for FINRA’s emphasis on these topics.

I won’t copy all of FINRA’s links to references for these items; rather, here is the link to their exam priorities letter, which contains many helpful links. http://www.finra.org/web/groups/corp_comm/documents/home_page/p038169.pdf

Also in March:

In Notice 08-12 we learned about an exception to the principal approval requirements for certain filed sales material—in Rule 2210. This is good for you firms out there that use mutual fund or variable annuity sales literature produced by the sponsor…now your designated principal doesn’t have to re-approve this material if it has already been submitted to and granted approval by FINRA. As they say really, really fast on the radio, “Certain conditions apply.” So read the Notice before giving up your advertising review processes.

In a podcast released Mach 25 that followed an information notice published March 12, we were informed that the big rulebook consolidation process is in the works. Meaning, NASD Rules and NYSE Rules will be harmonized into one new “Consolidated” rulebook. Key points made:
·Eliminating duplicative NASD/NYSE rules;
·Looking at both sets of rules to determine if one set can ‘inform’ the
other—meaning, turn two bad rules into one good rule;
·Considering different approaches to the application of rules, such as a
principles-based or tiered approach according to firm size, business model and customer type (retail or institutional). (Did I just write this or am I dreaming? Let’s all keep our fingers crossed on this one!)
·The process will be lengthy (my word, not theirs): the SEC will have to approve all rule changes. Some changes will be put out for comment first (don’t be shy);others will go directly to the SEC. Importantly for small firms, the newly-elected Small Firms Advisory Board will have a say in the changes.

In a March 6 news release we heard about some State Farm RR’s being busted for not taking their firm element online training; rather, they had someone else do it for them. Read my entry below about the $5,000/hour C/E course for a Word to the Wise.

A March 10 podcast reminds us of an earlier announcement about not having to keep copies—paper or electronic—of certain CRD filings. Yahoo! Filings that don’t require a Rep’s signature will now be officially maintained on your behalf by CRD. This applies to U4 and U5 amendments (but not DRP’s or any such filing that requires the rep to sign it) and BR filings. See the information notice from February 21 to read all about it.

We learned on March 17 that certain webcasts had been converted to a new format: the “video tutorial.” The VT is more like an E-Learning Course; it has a mastery test so you can use it as a C/E firm element training tool that will test your reps’ comprehension. The bad news it, now these lessons cost money, whereas before they were free. There are still many free webcasts online, but I’m wondering if eventually they’ll all go the way of VT? I don’t have the scoop on this. (Anyway, at the bargain annual subscription rate of $45 for unlimited E-Learning and VT courses, who’s complaining?)

On March 24, FINRA put out a Q&A on electronic filing requirements under Rule 3170. I can’t say I learned anything, but maybe if you’ve never dealt with the system this info piece will be useful. I was hoping for a bright, shining light on ESM rules (see my numerous, proof-I’m-obsessed-with-this-issue entries, below)…for instance what does ‘audit system’ mean, anyway?...but no such luck.

Lastly, on March 28 FINRA announced changes to the New Membership Application process...again. Form NMA has been restructured to be more logical and to prompt more detailed input; fewer items are sent hardcopy; funding of the application fees is done right up front; and applications are no longer filed with the district office--now they go to FINRA's HQ ("the Department"). These changes are effective June 26, 2008. Before then, follow the old process. These changes seem good to me; see Notice 08-14 for the details.

I did not comment on all recent announcements; if you want to see the full list go to http://www.finra.org/Resources/RecentAnnouncements/index.htm .

One last thing, not from FINRA: Investment News wrote on March 24 about the SEC’s expected proposal (by summer) that would cap 12(b)-1 fees charged to investors in Class C mutual fund shares. Here is the link to their article: http://www.investmentnews.com/apps/pbcs.dll/article?AID=2008468162776.

Thanks for reading. Now let’s hope that lamb shows up.

Link to Sources for Going Paperless

Investment News delivers stories and information useful to investment advisors. They started a newsletter about technologoy developments called IN: Tech and Davis Janowski posted an article on February 19 about going paperless. The article references vendors providing applications and other solutions that may be of interest to you, the broker-dealer struggling to keep up with record keeping demands.

I got pemission to provide the link to the article... go to: A Paperless Office Can Boost Your ROI and see what you think.

Remember to read my other entries on electronic record keeping if you want to test your ability to see cross-eyed. :)

ESM: Outsourced or In-House?

If you keep any primary records exclusively in electronic format you know you have to meet all those tedious requirements under SEC 17a-4(f) (see other blog entries, below). ESM=Electronic Storage Media.

You have a choice to make: do you attempt to meet the requirements using an in-house system or by hiring a third-party vendor? Or both? Some firms use third parties to archive and monitor their e-mails, IM’s and external message systems like Bloomberg; and they use an internal system to store and backup their other—non-communications—records. The goal in either case is to ensure proper archiving, back-up and recovery, and content management.

Quick apology: I have no expertise in this area—the tech side, that is. The vocabulary is foreign to me and therefore I use layman terms when speaking to the issues. But consider this: I’m not very different from small B-D business owners who are struggling to understand the rules and implement a compliant system. Regulators should—and I’ve seen evidence that they do—cut firms some slack in this area.

Your choices of third parties are many: Seccas, Smarsh, Iron Mountain Digital, Amicus and AdvisorMail, to name a few. As time goes by these services become more conversant in SEC-speak and more able to meet your regulatory compliance needs without resistance or ignorance. They meet the storage, serializing, indexing and backup requirements, they provide back-up copies on disk when requested, they issue representation letters as required, and they provide nice software tools for searching data and completing lexicon-based compliance reviews. And their pricing is pretty good: a one-time set up fee plus a small fee per month, per user/mailbox. This is a nice way for very small firms to meet ESM rules because you are leaving the technical stuff and the hardware expense to folks in the know. [That said, remember that member firms have been cited with violating the rules because their vendors didn’t meet the rules…that is, compliance is ultimately your responsibility, not the vendor’s.]

In-house systems for very small firms tend to be, well, non-compliant. Many firms keep records on their hard drives, then periodically download them to disk or tape. Their records are rewritable and erasable for a period of time prior to being stored in WORM (write once, read many) format. That gap of time is technically not okay under the rule. Also, they generally do not have indexing or auditing capabilities. Lastly, they may not make back-up copies of the archives that, too, are serialized, indexable and subject to an audit system. And, while these firms may have notified FINRA/SEC of their use of electronic storage, a) their representations may not be true; and b) they may not understand or meet the obligation under 17a-4(f)(3)(vii) to have a non-affiliated third party issue an ‘access letter’—a statement that the third party can get to and provide records requested by regulatory authorities. Firms that meet every letter of the ESM rules most likely have an expensive system or full IT staff in place. One such system is put out by EMC. Their software and hardware products are, as far as I can tell, state of the art and—important for you—completely compliant. And at least one third party vendor I know uses the EMC system in providing services to firms like yours. The problem here, depending on the firm’s size, is cost. EMC’s policy engines, ‘E-Mail Xtender’ and “Disk Xtender,” may be affordable choices for establishing records storage, indexing and destruction parameters, but in both cases you’ll still need a hardware storage system to hold those records and enforce the established policies (such as EMC’s “Centera” product). That’s where it gets expensive. Then again, if you’re spending a lot of time and money storing your records and updating your servers, breakeven may be just a few years away.

How far to go in attempting to meet every aspect of the ESM rules?—that is the question. Is a good faith, less-than-absolutely-compliant approach acceptable? It is if you say it is, but you may be forced to defend your choices. The more resolute and sincere your defense, the more apt you are to win your own principle-based vs. rule-based battle. Not the war, though: that rages on.


Footnote: Another consideration… the cost of discovery. If your system feels good enough, but doesn’t meet every requirement, and if your firm is subject to a regulatory investigation, you will spend huge bucks to recover and produce requested records. This possibility should be built into any cost benefit analysis.

Links (without permission but with luck, permitted):
EMC: http://www.emc.com/solutions/business-need/compliance-ediscovery/index.htm
Smarsh: http://www.smarsh.com/prinsite/my/default.asp
Seccas: http://www.seccas.com/
Amicus: https://www.amicus.com/solutions/EMM/
Iron Mountain Digital: http://www.ironmountain.com/digital/
AdvisorMail: http://www.advisormail.net/emailcompliance/index.asp



Stay tuned; another--maybe my last?--entry on the audit aspect of ESM rules is forthcoming.

Electronic Storage Media: Audit System?

Warning: you will need energy to get through this... if there's a power source nearby, plug in and read on.

This blog entry addresses a specific instance of what many have experienced: differing expectations from FINRA on meeting SEC rules. With regard to electronic storage, this is typical. On the one hand, we are informed that there are no interpretations: the rule is the rule and must be followed. On the other hand, we're expected to accept different degrees of testing during exams and differing exam findings--some tolerant and seemingly 'principle-based' and some strictly by the book. FINRA staff do not apologize for this. Exam methodologies are 'risk-based' and therefore can vary greatly--even for firms with identical business niches. While that seems reasonable, it also seems unfair.

17a-4(f) rules relating to electronic storage are hard to live by. Most small firms do not meet those standards. But then again, most small firms are forgiven by FINRA examiners (not officially, of course) who witness the firms making good faith efforts towards compliance. A firm that backs up its server daily and takes the tapes home is generally not penalized for not having WORM compliant media and not evidencing instantaneous compliance with the rules (that is, there is a gap between record creation and compliant-format storage). And that's good.

But how to plan for this sort of non-uniform enforcement? I mean, a compliance consultant like moi can't just say, "Awe, don't worry about it--your system is close enough!" Our job--I should say my job--is to help firms understand what is expected of them (i.e., rules) and help them put in place procedures that meet those expectations (i.e., compliance). It's not up to me to exempt firms from certain aspects of certain rules, where there is no official regulatory exemption. I have to promote compliance to the highest degree. But in cases like electronic storage, my job is hard.

Here is an example: SEC 240.17a-4(f)(3)(v) says, "The member, broker, or dealer, must have in place an audit system providing for accountability regarding inputting of records required to be maintained and preserved pursuant to Rules 17a-3 and 17a-4 to electronic storage media and inputting of any changes made to every original and duplicate record maintained and preserved thereby."

This little (v) is down deep in the electronic storage rules and not typically seen in exam findings. In fact, many compliance personnel and FINRA staff don't even know about this rule. Lately some firms were written up in exit conferences for lack of compliance. I did some research and had some conversations in an attempt to understand what, exactly, is expected under this rule. Here's what I can report:

• There is no published guidance on this specific paragraph under 17a-4(f)--the audit system; that is, there is no Notice or other such wonderful distillation of FINRA or SEC expectations for compliance.
  
• There is no conspiracy, in my judgment, by FINRA examiners to suddenly pick on small firms in examinations; no master plan to increase awareness of this subject by including it in every LOC henceforth. There is however--dare I say the word--inconsistency among Districts and examiners, so that you may or may not be tested for compliance with this little paragraph (v).
  
• 'Audit system' appears to imply a system that keeps records of every record saved on the firm's ESM (electronic storage media). The records show the creation time and date of each record created, as well as every change made to those records. The system also must keep information on every duplicate record created/changed. This might be easy for some IT folks to understand and implement; it may be insanely impossible for non-IT minded small firms attempting to understand and implement.
  
• The only thing close to an explanation of SEC's expectations for an audit system are included in their release of the final rule from 1997 (SEC Release No. 34-38245--http://sec.gov/rules/final/34-38245.txt ). Here's the paragraph:

'The Proposing Release would have required a broker-dealer to "have in place an audit system providing for accountability regarding all access to records maintained and preserved using optical storage technology and any changes made to every original and duplicate optical disk." Commenters sought clarification as to whether this provision requires maintenance of a log of all persons who have the capability or authority to access optical disks, or maintenance of a log indicating each instance where data is added to a disk. The rule adopted by the Commission today requires an audit system to be utilized only when records required to be maintained under Rule 17a-4 are being entered or when any additions to existing records are made. Therefore, an audit record is not required when a record is accessed but cannot be altered by the reader.'

So this can be interpreted--or can it?--to mean firms that have their records in truly WORM compliant format do not have to have an audit system for tracking changes to the records--duh, they can't be changed. But they do have to have a system that tracks inputting of records; some way to track at what date and time a record was created in the WORM format. And of course, the duplicate records also have to have such a tracking system.

But here's a possible contradiction... in FINRA's release of amendments to the SEC Rule, they state this: "Audit Systems: Requires the implementation and use of an audit system where required records pursuant to Rule 17a-4 are being entered or when any additions to existing records are made. No audit records will be required for records that can be accessed but not altered by the reader." That would imply that firms do not have to have audit records at all if their data is non-rewriteable. Perhaps firms should think about quoting this in their next exam, if tested. Here's the link to this text: http://www.finra.org/RulesRegulation/NoticestoMembers/1997NoticestoMembers/P004673

• Explanations from two District staff members treat the subject this way: audit system means firms have to periodically check to see that their electronically stored records are indeed still there; that is, they should access their records once in a while to see if the records are intact. That seems simplistic to me and not in-line with the SEC's language, above. But then again, if the District staff will examine for compliance under this interpretation, it's not a difficult standard to meet.
• On the subject of third-party ESM providers... who knows? The rule itself speaks to the member having an audit system in place: does that mean the third party provided can't run the audit system? My helpful FINRA contacts did not have an answer for this. The question must be directed to the SEC.
  
• In talking to EMC squared, their systems are most likely to include such a tool, but it's not necessarily called that, which makes the subject hard to sort out.
  
• On the broader topic of ESM, here's some good news (old news, but still good): SIFMA has requested that SEC amend 17a-4(f) to create a reasonableness standard for ESM compliance. Ahhhh, wouldn't that be nice? It is also pursuing changes to 17a-4(b)(4)--retention of communications. See http://www.sifma.org/regulatory/erecords/index.html for reading on the subject.

All that may not sound helpful in the way I like to be. This is not black and white: it's a lovely shade of grey. If you are unsure about whether your firm meets this 'audit system' requirement, may want to ask your IT people or third party vendor, then decide if it's worth worrying about. You may want to also call your liaison to ask what your District expects to see. To meet the rule may mean you're exceeding the expectations of your District. Or not--you may be charged with non-compliance in your next exam. The good news is, you'll be prepared to discuss the topic. Knowledge is power.


More power to you.

Accentuate the Negative; Or, How to Record Nothing

There's a wonderful song about accentuating the positive and eliminating the negative. It seems in FINRA's case, they want you members to accentuate the negative--that is, to keeps records of what DIDN'T happen.

Specifically, certain examiners have requested that firms that have not filed any suspicious activity reports and have had no suspicions arise (during a certain period of time), put a memo in the AML files to the effect of: "during the period x to y, we did not note any suspicious activity.”

So, while you all have a detailed AML program that explains how you detect illegal activities, how you report them in-house, how you vet them, how you report them to officials and how you document the whole process, the examiners want to see more. They want a record of something that evidences nothing. Or is it, they want a record of nothing that evidences something? Hmmm.

Your firm may want to start documenting such nothingness, if applicable. That way, in your next exam, you won't be surprised by this curious request. Oh, and let's remember not to blame FINRA examiners. I'm serious--they are bending to the will of SEC and federal authorities when enforcing these rules. I bet they think it's curious, too.

Post Primary Thoughts on AML

Hello from NH, where today, at last, we are free of pollsters, campaigners and political junk mail! Quick note: Chris Matthews said we lied to pollsters. We did not. The difference in the numbers was the weather. But we'll let him figure that out...

http://www.finra.org/web/groups/educ_progs/documents/education_programs/p037702.pdf
This is a link to Mary Shapiro's recent webcast text on what to expect in an exam, re: AML compliance. I wanted to comment on two things: independent annual exams and CIP for friends and relatives.

The Independent Exam Quandary
Independent exams must happen every year for almost all firms. If your BD is nothing but a prop desk, it can be every two years. For firms that have anything to do with customers and securities transactions (and yes, you private placement firms out there now know that your are, indeed, conducting securities business), audits of AML programs must take place once/calendar year. FINRA, back in early 2006, clarified this and also what it meant to be independent; they also offered exceptions to the independence standard. That's the background.

What I'd like to comment on is that, if a firm uses an outside party to do the audit, and that same party provided template language for the firm's AML program--but does not otherwise implement or control the firm's AML compliance process in any way--that outside party in my opinion is independent for the purposes of meeting FINRA's expectations. My belief is that, if you look at their exceptions for in-house auditors who are not independent, and imagine a scenario whereby a firm relies on those exceptions (for instance, trains some staff person to do AML testing and has that person report the results to someone other than the AML compliance officer), in most cases, the testing will not be sophisticated enough or adequate to detect important deficiencies. In that scenario, the tester will apply his/her limited knowledge of applicable regulation to broadly review evidence of compliance. This will not result in effective testing and the firm, if failing to comply with the more esoteric or topical requirements, will continue to do so, given the lack of focused and informed reviews.

The other scenario, where an outside consultant who has provided template language--either originally or on an on-going, update basis--and who is engaged daily in the business of compliance; that is, who spends his or her time researching new rules, interpretations and guidance put out by securities or federal regulators, and who visits clients once a year to ensure, in a lengthy and thorough examination process, all aspects of AML compliance, is bound to be more effective than the in-house model. That was a long sentence--my apologies. Remember too that many of these firms who may rely on the in-house model are those who downloaded FINRA's AML template and just barely customized it. The outside consultant procedures+audit model has to be preferable to the FINRA template+in-house audit model, in my opinion. Better to have expertise than confusion.

If your firm runs into an examiner who expresses displeasure with your outside AML auditor because that same auditor provided update language to your written program, you may want to use my argument to defend your choice. Or rely on the the Rule itself, which requires that, in summary, the tester should neither be one who performs the AML functions being tested, nor any designated AML compliance person or a person who reports to either one. You will be meeting this restriction and should be confident about doing so.

CIP for Friends and Relatives
Oh, my second point. In the recent guidance, Ms. Shapiro reiterates what was included in last year's online workshop--that you have to ID your own mother-in-law. Well, here's the exact quote: "Be sure to note that just because a customer is a registered representative’s personal acquaintance, this does not satisfy CIP verification requirements. But, the risk-based approach is flexible enough to make identity verification for personal acquaintances as unobtrusive as possible. For example, if the customer is a relative or a close personal friend of the registered
representative, the firm may not require more than the minimum verification required by the rules, such as checking her driver’s license. However, the verification that is undertaken must still be documented."

You see, the requirement to verify the identities of customers is so bound up in legalese and paranoid FederalSpeak, that broker-dealers cannot be trusted to vouch for the identities of their own family members. Crazy, huh? I'm sure the folks at FINRA hate enforcing this and also find it ludicrous, but as they always say, it's not their Rules, it's the government's. With that sad excuse in mind, don't forget to check your brother's driver's license next time he opens an account--just to be sure he really is your brother.

Final Renewal Statement--Pay or Get a Refund

All you broker-dealers out there know by now that your final renewal statements have been posted on CRD. Check out your balance, and if you owe money, pay it by Feb. 4 (they recommend Jan. 31 to be safe). Here is the link to instuctions on payment: http://www.finra.org/RegulatorySystems/CRD/UserSupport/p036951

If you have excess funds in your account, they have been transferred to your daily account. If you'd like them refunded, send a fax to:
FINRA, FAX NO. (240) 386-5344, ATTENTION: Finance Department

Make sure it's on your letterhead and also include a copy of your daily account statement. Remember to name the amount you want refunded and have an authorized person sign the request.

Deferred Variable Annuities Rule -- some parts delayed

Oh my gosh...for how long has the new rule on Deferred Variable Annuities been forthcoming?? The Rule (2821) was to be effective May 5, but certain parts of it will now be delayed until August 4. FINRA has asked the SEC for more time to consider three issues related to paragraph (c):

• the seven-business-day period within which principal review must be completed;
• principal review of all transactions as if they had all been recommended; and
• the prohibition on depositing customer funds in an insurer's suspense account prior to completion of an affiliated broker-dealer's principal's review.

The rest of the Rule will be effective May 8. Please see Notice 07-53 for details. http://www.finra.org/RulesRegulation/NoticestoMembers/2007NoticestoMembers/P037403

Expectations Under 17a-4 for Electronic Records

Here's a summary of the Books and Records rules, as they relate to electronic storage. This is technical, so it's okay if you get sleepy reading it... but it's a nice reference for when you need it.

SEC Rule 17a-3 and 17a-4

SEC Rule 17a-3 requires broker-dealers to make certain records, including trade blotters, asset and liability ledgers, income ledgers, customer account ledgers, securities records, order tickets, trade confirmations, trial balances and various employment related documents. Rule 17a-4 specifies the manner and length of time that the records maintained by broker-dealers must be preserved. In combination, Rules 17a-3 and 17a-4 require broker-dealers to create and preserve a comprehensive record of all securities transactions the broker-dealer effects and of the securities business in general. The SEC views these requirements as the primary means of monitoring compliance with the securities laws, including anti-fraud provisions and financial responsibility standards.

Email is one of the most significant communications applications of the modern era and is no doubt a book and record under Exchange Act Rules 17a-3 and 17a-4 if it is a communication related to a broker-dealer's "business as such." The key requirements with regards to email archiving gleaned from SEC Rule 17a-4 are as follows:

SEC 240.17a-4(f)(2)(ii)(A)
"Preserve the records exclusively in a non-rewritable, non-erasable format."

SEC 240.17a-4(f)(2)(ii)(B)
"Verify automatically the quality and accuracy of the storage media recording process."

SEC 240.17a-4(f)(2)(ii)(C)
"Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media."

SEC 240.17a-4(f)(2)(ii)(D)
"Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member."

SEC 240.17a-4(f)(3)(i)
"At all times have available, for examination by the staffs of the Commission and self-regulatory organizations of which it is a member, facilities for immediate, easily readable projection or production of micrographic media or electronic storage media images and for producing easily readable images."

SEC 240.17a-4(f)(3)(ii)
"Be ready at all times to provide, and immediately provide, any facsimile enlargement which the Commission or its representatives may request."

SEC 240.17a-4(f)(3)(iii)
"Store separately from the original, a duplicate copy of the record stored on any medium acceptable under Rule 17a-4 for the time required."

SEC 240.17a-4(f)(3)(iv)
"Organize and index accurately all information maintained on both original and any duplicate storage media."

SEC 240.17a-4(f)(3)(iv)(A)
"At all times, a member, broker, or dealer must be able to have such indexes available for examination by the staffs of the Commission and the self-regulatory organizations of which the broker or dealer is a member."

SEC 240.17a-4(f)(3)(iv)(B)
"Each index must be duplicated and the duplicate copies must be stored separately from the original copy of the index."

SEC 240.17a-4(f)(3)(iv)(C)
"Original and duplicate indexes must be preserved for the time required for the indexed records."

SEC 240.17a-4(f)(3)(v)
"The member, broker, or dealer, must have in place an audit system providing for accountability regarding inputting of records required to be maintained and preserved pursuant to Rules 17a-3 and 17a-4 to electronic storage media and inputting of any changes made to every original and duplicate record maintained and preserved thereby."

SEC 240.17a-4(f)(3)(v)(A)
"At all times, a member, broker, or dealer must be able to have the results of such audit system available for examination by the staffs of the Commission and the self-regulatory organizations of which the broker or dealer is a member."

SEC 240.17a-4(f)(3)(v)(B)
"The audit results must be preserved for the time required for the audited records."

SEC 240.17a-4(f)(3)(vi)
"The member, broker, or dealer must maintain, keep current, and provide promptly upon request by the staffs of the Commission or the self-regulatory organization of which the member, broker, or broker-dealer is a member all information necessary to access records and indexes stored on the electronic storage media; or place in escrow and keep current a copy of the physical and logical file format of the electronic storage media, the field format of all different information types written on the electronic storage media and the source code, together with the appropriate documentation and information necessary to access records and indexes."

SEC 240.17a-4(f)(3)(vii)
"For every member, broker, or dealer exclusively using electronic storage media for some or all of its record preservation under this section, at least one third party (the undersigned), who has access to and the ability to download information from the member's, broker's, or dealer's electronic storage media to any acceptable medium under this section, shall file with the designated examining authority for the member, broker, or dealer the following undertakings with respect to such records."