December Dates

These kinds of dates are not the fun ones, but they're worth paying attention to:

1. December 10: Due date for notification of change of accountant. If you have appointed a different accountant to do your annual audit, you have to tell SEC and FINRA about it. Please reference my blog entry of last December for specifics--the information is still good and you'll save me time. You're great: thanks!

2. December 13: FINRA renewal payments due. Remember, even if you disagree with what is on your preliminary renewal statement, pay it! You can make amendment filings now that will be reflected on the final statement (Jan. 3): at that point you can get a refund if you overpaid. Here is a link to FINRA's page on payment options.

3. December 15: Effective date of new Rule 3270 requiring reps to pre-notify the firm of their new outside business activities--and requiring the firm to consider those activities in the context of its securities business. I blabbed about this in a recent (yeah, October was recent in my mind) entry. See here.

4. December 23: Deadline for all year-end filings on CRD. Remember, you can post-mark termination filings (like dropping states or dropping reps) to December 31 if you want.

5. December 31: End of your right to use self-congratulatory Privacy Notices. The use of SEC's "model form" is advisable for those who want to be sheltered by the safe harbor. Not sure what I'm talking about? Search my blog for "Privacy Notices" and you'll hear all about it. 

6. December 31: The last day of the year. Oh, and as of the next day, in theory, the FACT ACT is enforceable. Since that effective date changes more often than I do when getting ready for a holiday party, I'm not convinced it will stick. See this blog for details and sarcasm.

Happy December, everyone!

The Difference Between June 1 and June 2: Red Flags Rule Delayed AGAIN

June 1:
>The effective/enforcement date of FTC's Red Flags Rule, whereby you, my broker-dealer friends, had to put in place an Identity Theft Prevention Program.
>The date by which I (against my better judgment/procrastination instincts) worked my buttocks off in an attempt to customize/deliver FTC's neat-o PDF customizable 'low-risk' form.
>The date before which, if a regulatory body were going to announce a delay in enforcement of the Rule, said regulatory body should have announced a delay of said Rule.

June 2:
>The date after which you, my broker-dealer friends, put into effect your IDTPP's, after having struggled to customize either FINRA's template or FTC's 'customizable low-risk form.
>The date after which we all collectively considered this topic done/handled/put to rest and happily forgotten about it.
>The date we got notice from FINRA that the enforcement date of the Rule had been delayed AGAIN...now to Dec. 31, 2010.
>The date, perhaps, you and I both swore under our breath something profane and un-American.


Here is the announcement, in case you missed it:

The FTC has again delayed enforcement of its Fair and Accurate Credit Transactions Act of 2003 (FACT Act) Red Flags Rule, from June 1, 2010, to December 31, 2010. The delay will allow Congress to consider legislation limiting the businesses covered by the rule. If legislation passes with an effective date earlier than December 31, 2010, the FTC will begin enforcement as of that effective date.

Firms subject to this rule—which include most broker-dealers—must have in place by the FTC enforcement date a written program to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

As a reminder, FINRA has developed an optional template that firms may use as a guide when fulfilling their requirements under the FTC's Red Flags Rule. You can find more information about the FACT Act regulations in Regulatory Notice 08-69.

I won't start babbling about how I think this Rule is redundant and how the criteria for determining applicability is being interpreted in a bogus way. You can always search the subject on my blog to read more. But why bother? Let's just forget this all happened. And let's hope the Rule NEVER gets enforced for you BD's who are already, under AML rules, required to act as law enforcement and root out any nefarious attempts to usurp identities (even if they're not terrorists).

What a Difference a Day Makes: No, what a difference two weeks would have made! Now that kind of lead-time would have been appreciated! (Here I am again, Daydream Believer.)

Identity Theft and Privacy Notice

As you know I'm not happy about the ID Theft/Red Flags rules for introducing firms that offer margin accounts through their clearing firms. Doesn't make sense that these firms are considered 'creditors.' But don't get me started on bad rules that require time, money and effort for the sake of token compliance. Yuk. But a trusted informant from another consulting firm told me that FINRA is obsessing about compliance with these new rules--even though they don't take effect until June 1 and even though FINRA does not have authority to enforce the rules (FTC does). So gear up. Read this Notice Red Flags Rule and Template Procedures and customize the template FINRA provides.

On Privacy (wait, why is this separate from ID theft: isn't protecting customer information all under the same umbrella? Ugh. Whatever.): I came across this, about changes to Reg. S-P: eCFR Link to S-P Amendment. The Reg change eliminates the 'sample clauses' that most of you are using in your Privacy Notices right now. After this year, you won't be able to use those clauses to meet the disclosure requirements under Reg. S-P. Rather, there is a new 'model privacy form.' As of 2011, firms must either use the model form or be sure that their custom privacy notices meet all Reg. S-P criteria. You don't have to wait until 2011--the model form may be used now, and will give you the comfort of knowing your notice meets federal requirements (i.e., it is a safe harbor). You may want to begin the process of switching over from your currently-used notice.

There are two versions of the new model form: Notice with Opt-Out and Notice without Opt-Out. You'll want to decide which is right for your firm and then customize it. Remember, Privacy Notices are NOT required for institutional customers; for individuals, you must deliver the Notice at account opening and yearly thereafter.

Now go forth and confidently protect the privacy and identies of your customers. And do it in a well-documented fashion. Or else.

Procrastination Pays Off Again: Red Flags Rule Enforcement Delayed

How did I miss this last week?? Received November 4...

"At the request of Members of Congress, the Federal Trade Commission (FTC) has delayed until June 1, 2010, its enforcement of the new Red Flags Rule. The rule requires most broker-dealers to have in place a written program to identity, detect and respond to patterns, practices or specific activities that could indicate identity theft ("red flags"). Enforcement of the Red Flags Rule, which implements a section of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), was previously scheduled to begin on November 1, 2009."

I wonder which "Members of Congress" we have to thank for this? Well, anyway, most small firms aren't pulling credit reports and don't have proprietary online account access systems that would be vulnerable to attack. So if you didn't put an Identity Theft Prevention Program in place by now, I understand why. And you know how I feel about introducing firms that open margin accounts being characterized as 'creditors' for the sake of this rule, right? Baloney. Let's hope with this third? fourth? delay, the enforcers-that-be will come to their senses on that topic.

Another Delay of Red Flags Rule Enforcement (and other stuff)

Greetings, surfers!

Topic 1: Red Flags Rule (dedicated to my tipster: Mr. B. Gray)

FTC announced yesterday that they would delay enforcement of the Red Flags Rule--again. Now you have until November 1 to figure out what it all means for your broker-dealer firm. On this note, I tried to create a flow chart to help you decide if you needed an Identity Theft Prevention Program, but I ran out of ink (and brains) in the process. It's complicated--and I disagree with the going interpretation, so I should just stay out of it.

I guess I can be a little helpful by providing some reference links for you:

http://imhoffconsultingproject.blogspot.com/2008/11/update-on-fact-act.html and http://imhoffconsultingproject.blogspot.com/2009/07/useful-information-on-rainy-day.html contain my ranting (I mean, informative content) on the subject.

FINRA's ITPP template: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119093.pdf

FINRA's page that has all kinds of references to guidance and stuff: http://www.finra.org/Industry/Issues/CustomerInformationProtection/p118480

FTC site on the Rule: http://www.ftc.gov/redflagsrule

FTC site on ID Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

+++++++++++++++

Topic 2: Investment Banking Registration Category

Wow! At last, for investment bankers, a test of their own! I'm impressed. If you are an investment banker, now you have your very own registration category: the Series 79. (Monty Python's Life of Brian came out this year--but that's off topic.)

Notice 09-41 does a terrific job explaining this new test and registration requirement. Here is a summary:

• If you're currently doing only private placements (not of munis, govt's or DPP's) you only need the Series 82 so don't worry about this.
• If you're currently doing investment banking activities--such as originating offerings, underwriting, marketing, structuring, syndication, or doing M&A deals like advising on restructurings, asset sales, corporate reorganizations, writing fairness opinions, etc., then YES, you need the Series 79.
• If you're doing this business, and you're not registered--better get that way.
• If you're doing this business and you have your Series 7, you have to 'opt-in' between November 2, 2009 and May 3, 2010. During that 6-month period, make sure a U4 amendment is filed for you, adding the Series 79 registration. That's all you need to do.
• If you miss the opt-in period, you have to pass the Series 79 to keep doing your investment banking business.
• If you're a Series 7 and you just kinda want the Series 79, well, that's not okay. You can't opt-in, because, technically, you have to be engaged in investment banking business to earn the opt-in registration.
• If you're new to the business and were going to get your 7 so that you could work as an investment banker, you can still take your 7 during the six-month period before May 3, 2010...after you pass the 7, do the U4 amendment to add the 79 and voila! It's yours!
• If you're an intern like I was, guess what? You don't have to get the 79 (see the Notice for details on this one--some qualifying factors).
• If you also do general securities business or other business like muni structurings or DPP's or whatever, you need the 7 in addition to the 79.
• If you are a Series 24 who supervises investment banking activities, you now need the Series 79. You can opt-in (see above) by May 3, 2010.
• If you're thinking of being a supervisor of investment banking activities, but aren't yet licenced, the Series 79 will qualify as a prerequisite to the 24. Take both and supervise away! But wait: if you supervise any other securities activities, like trading or retail sales, you'll need the 7, too.
• You know how you can take the Series 66 instead of the 65 and 63 to register as agent and IA in states? Well, the Series 7 is a pre-requisite for the 66...you can't rely on the 79 to do that job. The 79 is, however, a pre-requisite for the 63.

Okay, that's enough of that topic. One little thing...did you see the words "asset sales" above? That's kinda scary for unregistered M&A shops out there who always thought that arranging asset sales didn't require registration. Well, then again, those folks aren't reading this, so why waste my words.

++++++++++++++

Topic 3: U4 Disclosure Questions: no 'wet' signatures

New FINRA Rule 1010 allows firms to amend the U4 disclosure answers without having the rep manually sign the U4 amendment. Instead, you have to: provide the rep with a copy of the amended disclosure information prior to filing and get the rep's written acknowledgement (like an email or signature on internal form) prior to filing that shows the rep received and reviewed the changes. Keep records of this for examiner review.

(Note: My firms had reps answer the new disclosure questions on an internal form, sign the form and return it. To me, this satisfies the new Rule.)

If reps are on military duty, otherwise unavailable or refuse to acknowledge the disclosure information, you should note that in the rep's electronic signature field.

The effective date is July 27, 2009. Notice 09-40 explains that this new rule helps out with the new disclosure questions that have to be answered by November 14....but it doesn't explicitly say that if your firm was conscientious enough to have made all those U4 amendment filings already--that is, before 7-27--then you don't need 'wet' signatures under the new rule. Hmmm. Let's assume you don't, and that your documentation of rep approval of the new disclosure answers will suffice. Wouldn't seem fair otherwise.

Back to the beach. Surf's up!

Useful Information on a Rainy Day

I walked to my NEW office this morning without drowning in a puddle. High of 61 today with downpours. Feel sorry for us, here in coastal NH. We deserve your pity.

Few things:

1. Remember the FTC Red Flags Rule? FINRA released its brand new written ID Theft Prevention Program template!--and it has an acronym: ITPP! This is great. Thank-you, FINRA. Now all you small firms that have no idea what this rule is all about, and believe that it is completely duplicative with AML and unnecessary, given that you are a tiny shop that does not use credit reports, does not provide debit cards or checkwriting, and does not extend credit (but wait, you have a clearing firm and your clients may open margin accounts through your firm), can create an ITPP without much effort. And the better news is, if FINRA examines for compliance with this rule like it did with AML, you will have years before your written program actually has to be fully customized and implemented. FTC enforcement of the Red Flags Rule begins August 1, 2009. So get going. Here is the link to the template, courtesy of FINRA:
www.finra.org/customerprotection/redflags.

2. As of August 17 you have to provide a new disclosure to customers. New FINRA Rule 2267 is based on old NASD Rule 2280 (Investor Education and Protection). The old rule applied only to firms carrying customer accounts. Now it applies to everyone. BUT: if your firm has an clearing firm that will make the disclosures for you, you're all set (confirm this with them, ok?). If you have other (or only) customers that aren't serviced by a clearing firm and that don't, for instance, receive statements or confirms, then your firm will have to make the disclosures. An example would be an 'application-way' shop that processes MF/VA applications and does not have brokerage accounts. I'm guessing PP/M&A firms are in this category, too, but let's not expect FINRA to be clear on that (you know how I feel about this subject, right?).

So, if all your customers are receiving statements, etc. from the clearing firm, make sure they'll include the disclosures annually to your customers.

Otherwise, you have to provide the disclosures (annually if you carry accounts). If you don't carry accounts, as I desdcribed above, or have some customers not receiving statements, you have to provide the disclosures at or prior to the time of the customer’s initial purchase, in lieu of once every calendar year.

Disclosures may be provided electronically (yahoo).

Here is what you have to disclose:

1. FINRA Broker Check Hotline Number -- (800) 289-9999;
2. FINRA Web site address -- www.finra.org; and
3. A statement as to the availability to the customer of an investor brochure that includes information describing FINRA Broker Check. ...Harder than it sounds. Here's what I recommend: "You may find information about Broker Check online by visiting this link http://www.finra.org/web/groups/industry/@inv/@tools/documents/industry/p009888.pdf or by calling the Hotline number and requesting a hard copy via mail."

Here's what FINRA says about the due date: "Any firm subject to NASD Rule 2280 that complies with its annual (calendar year) mailing requirement on or after January 1, 2009 but prior to the August 17, 2009 effective date of FINRA Rule 2267 will be deemed to have complied with FINRA Rule 2267 for the 2009 calendar year."

So check with your clearing firm to see it they will have complied with old 2280 by 8-17; if not, you're not in compliance. For other firms (see above), start making the disclosures for new accounts. And what the heck, if you send out an annual disclosure notice with other things, like privacy policy and SIPC info, why not include this one, too?

3. Rule 2821 on Variable Annuities--they FINALLY finalized the rule. And the great news is, they took out that requirement to consider ALL deferred V/A purchases and exchanges as 'recommended.' The rule changes also clarify the 7-day review/approval process and funds transfers in that 7-day period. It's good, and the Notice is written well. Look it up: Notice 09-32 is at http://www.finra.org/Industry/Regulation/Notices/2009/P118955. BUT DON'T start enforcing the rule yet. It's effective 2-8-10. I have a call into FINRA about whether optional compliance before then is okay, but I haven't heard back yet :( . In the mean time, you have the usual 24 hour turnaround period to move funds out and approve the business.

Looking out my window: still raining.

Update on FACT Act

First, let me share my appreciation for FINRA's effort to explain the applicability of the FACT Act's Red Flag and other rules to member firms. The folks in OGC said they were working on it, and they did. Here's the link to Notice 08-69: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p117448.pdf

Now, let me express my dismay at the extreme lack of distinct clarity on this topic--not necessarily from FINRA, but embedded in the Act's definitions. Your firm may be subject to the regulation, or not--just read and re-read the definitions of 'financial institution,' 'transaction account, 'creditor' and 'covered account.' It's a little like solving a Rubik's cube. If all like colors end up on the same side, then yes, your firm has to implement Red Flag Rules under the Fact Act. But good luck getting there.

In reading the definitions provided in FINRA's notice, my first reaction is, "If they wanted broker-dealers to be covered, why didn't they just say so?" For instance, the term“financial institution” is specifically defined as “a State or National bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account . . . belonging to a consumer.” And a “transaction account” is specifically defined as “a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third persons or others. Such term includes demand deposits, negotiable order of withdrawal accounts, savings deposits subject to automatic transfers, and share draft accounts.” See what I mean? If they wanted B-D's to be subject to the regs, why not just include "SEC registered broker-dealers" or "brokerage accounts" or some such other simple identifiers in the definitions? That would have made it real easy... but instead, these definitions overtly exclude the whole subject of brokerage accounts and broker-dealers. And then your favorite SRO puts the onus on firms to twist and retwist the cube in order to solve the puzzle by themselves. Frankly, for most of the 5100 registered B-D's, I think this is like trying to force a square cube through a round hole: I don't think these rules should apply.

Also, while I'm ranting, this whole thing is crazy!! B-D's already have CIP rules to follow. And remember that AML rules are not just about preventing money laundering. We all know that most AML-triggered investigations end up focusing on fraud, including mail fraud and credit/debit card fraud. So firms are already obligated to attempt to identify and report fraud....why do they have to now be subject to seemingly duplicative rules? And at what cost? ...read the Notice... do you really have time to create a "Written Identity Theft Prevention Program"? One that will confuse your already confused Reps about the account opening process? This reminds me of redundant local ordinances--instead of having one rule that requires safe and responsible behavior on sidewalks, they have in place six different rules, pertaining to different possible ways to conduct unsafe and irresponsible behavior on sidewalks: skateboarding, bicycling, rollerblading, dog walking, etc.... get my point? I guess I just feel sorry for firms whose business has nothing at all to do with credit cards, withdrawals, payment transfers, etc. To think that they will have to adopt lengthy and complicated procedures on top of what they already have in place (which are already hardly deemed necessary and applicable): what a waste of resources.

But who am I ranting at, here? The Federal Trade Commission? That's a big target for a little person like me. And I don't want to trash FINRA--they did something cool by addressing the subject. I guess I would like if FINRA would go a bit farther out on the limb by actually giving its opinion on how application way firms, M&A/PP shops, and introducing firms who do not actually extend margin to clients fit into this definitional puzzle. I know they state up front that they're not the rulemakers or interpreters on this subject, but c'mon, since they go on to say that NOT complying would be a violation of just and equitable principles of trade, can't they show a little more mercy?

Another topic within this one: check out Part C of the Notice. It's about policies you have to have in place re: use of consumer reports. If your firm requests a consumer report about a new or existing customer and receives a notice of address discrepancy from a CRA, you'll have to be able to form a reasonable belief that the consumer report actually relates to the customer in question. FINRA did a nice job of laying out these responsibilities. I'm assuming the effective date of these requirements is the same delayed date as for Red Flag Rules: May 1, 2009 (although I could be wrong.)

Lastly, FINRA mentions in the Notice that FTC has indicated a willingness to work with them to "resolve on a consistent and industry-wide basis, interpretive questions that arise under these rules as applied to broker-dealers. " I love that! My advice to you and all your B-D friends: call OGC at (202)728-8071 to ask about this. Perhaps that kind of dialogue will result in 'interpretive challenges' being met head on with concrete directives from FINRA. Then you can throw that darned Rubik's cube out the window. Puzzle solved.