The Law of Opposites

I haven't written for a while. Too much going on. I've been busy watching my son balance speed with caution at the age of 16, marvelling at my other son as he defies gravity on his unicycle, questioning the sanity of our polarized political system, and witnessing the end of the beginning of the end. These directional changes are making me nauseous. At least I have my work to keep me facing forward... I think.

A few thoughts for the day:

Finra has redesigned its website, just when I became adept at navigating the old site. Oh well, it's not about me. Anyway, it looks nice. www.finra.org

FinCEN's most recent report on suspicious activity reporting--SAR by the Numbers--includes totals for 2007. It's here: http://www.fincen.gov/news_room/rp/files/sar_by_numb_10_sec4.xls

From 2006 to 2007, there was a 58% increase in the number of SAR's filed by the securities and futures industry. One of the fastest areas of growth was in identity thefts. I imagine we'll see high growth again this year, since it's one of SEC's and Finra's priorities to make sure firms are filing SAR's, even in the face of 'potential' suspicious activity. (On that subject, please read Bill Singer's 'Cases of Note' comment on the James I. Black & Company and Jess Gove Tucker III case, August 2008 at: http://www.rrbdlaw.com/RegulatoryLinks/CASESOFNOTE/NASD/2008.htm .) Oh, and if you look closely at the report, you'll see only one state where, since 2003, there has never been a SAR filed. Where? The State of Alaska. Does that mean Sarah Palin supports money laundering by terrorists? Probably not, but I bet someone on cable TV would make that connection.

Back in May, Finra released a series of Notices related to the Rule Consolidation project. Notice 08-24 requested comment on revisions to supervision and supervisory controls rules. This is what we've been waiting for, right? The big Rule Consolidation Re-Write... the one that will bring us closer to an intelligent, principles-based regulatory structure that allows for flexibility depending on firm size and business niche?

Not so fast.

First, they're going to rewrite the rules so that there is less clarity, more cause for misinterpretation, broader authority leading to even more onerous procedural changes, and... oops, I didn't mean to be critical. I admit it must be a very difficult job: to take a HUGE rulebook governing many different business models, full of cross-references, overlapping definitions and nuanced contradictions, and attempt to improve it with a little tweaking. My take is, it's not gonna happen with edits--it will only happen with a complete re-write.

In the end, firms should be required to simply do the right thing and a well-managed regulatory body should be capable of discerning when those firms are not doing the right thing. The more minutia- and legalese-laden, arbitrary and seemingly non-applicable rules, the more likely firms are to treat compliance like a chess match: outwit the opponent by seizing on his lack of peripheral vision. That's not the way it should work.

Anyway, what IS interesting are the comment letters--go here, and choose some to read. http://www.finra.org/Industry/Regulation/Notices/2008/P038502 It's encouraging that firms are voicing opposition to things like: broadened supervisory requirements on outside business activities; requiring principals be assigned to supervise business areas of firms that do not require BD registration; duplicative supervisory sign-off on investment banking transactions; closer oversight of one-person OSJ's; and transaction review of reps' family member accounts, among others. I especially enjoyed reading the letter from ING Advisors Network, June 30. The author's comments are clear and rational. See: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/noticecomments/p038858.pdf

Now, back to the end of the beginning of the end... Did I really just say that firms should have simple, principles-based rules to follow in the way they see fit, and our regulators should be smart, motivated, united and reasonable in enforcing these new 'just do it' rules? I said that, in this market environment? What, am I nuts? Every day on the news shows all I hear is 'more regulation, more regulation, more regulation,' even from those who oppose it. I pity the team of Finra authors even more: if their mission was challenging before, it's now darned-near impossible. Whose advice do they take? Alan Greenspan said leave the short sellers alone--they're necessary and smart. Other talking heads say the short sellers are greedy and irresponsible. I hear Cox is a genius, then I hear he's an idiot. I'm not savvy enough to make up my own mind. But as a compliance consult, I do know one thing: there will be more rule changes and more rules and much, much more work to do on the part of my small BD firm clients who ALWAYS do the right thing.

In the name of opposites, I'll close quoting someone else, whose name I don't know (he was on Fresh Air): "In our country we privatize profits and socialize losses." Isn't that perfect? -er, I mean, not perfect? ....there I go again.

FinCEN's Better Website

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.

Another Cover-Up

Remember when John Ashcroft, serving as Attorney General under President Bush 2001-2005, required that the statues in his press room be made, well, less revealing? In an effort to protect the public, expensive fabric was draped over the age-worn marble of both Spirit of Justice and Majesty of Justice--well, at least over the more love-worn parts. The language of art was muted to satisfy our government's assumptions about our well-being. The thought art provokes, the questions it raises, and the beauty it portrays were denied an audience (what audience? ...not sure anyone was watching Ashcroft, anyway).

Mr. Ashcroft opposed nudity in art. Last week, the SEC decided it would oppose nudity in short selling. In an emergency order released July 15 (see: http://www.sec.gov/news/press/2008/2008-143.htm) SEC announced that for 19 publicly-traded financial company stocks (such as Lehman Bros., B of A, Citigroup, and of course, Freddie Mac and Fannie Mae), short sellers have to pre-borrow the subject securities, as opposed to the standard pre-locate practice. Trading firms everywhere are scurrying to devise procedures to meet this order. Some are saying 'forget it'--we just won't trade in those stocks for 8 days. And maybe that's what the SEC is hoping for: shrouding the market in a blanket heavy enough to silence the critics.

The SEC's mission was to "protect investors, maintain orderly markets, and promote capital formation." Is it possible that what the SEC is really doing is denying the rightful power of the free market to self-adjust? I mean, by shielding these firms from what the market wants to do--short the hell out of them in expectation of falling prices--isn't the federal government, with its artificial drapery, silencing the thinkers? ignoring the questions? rejecting the beauty of a sophisticated investment community? Why not let things progress as they otherwise might--let these financial houses of cards fall? Let the investors suffer for their bad choices? As they say in sports, no pain, no gain. The gain we sacrifice here is badly needed. Corporate bail-outs, no matter what form they take, don't help us progress. They just delay the pain.

On a practical note, by now you should have talked to your clearing firm about rules engines or other means of ensuring this temporary rule is enforced. And you should have informed your traders of the specific requirements. Be sure to notate your short sales as having complied with the 'pre-borrow' ethic. Keep the records; have a supervisor review the records. As for keeping your clothes on, well, that depends on how hot it gets...and your definition of 'art.' ;)

I won't call it a reversal

...but it seems like one.

Oh, I'm talking about electronic storage rules again. When I die, will someone please make sure my tombstone says something about my dedication to this cause? ...says something...not necessarily flattering.

Okay, so in the last two days I've run into situations where it appeared that 3rd party electronic storage vendors would not provide the representation letters generally expected under 17a-4(f)(2)(i)--you know the letter--the one that says the media will do the things listed under (f)(2)(ii), as follows:

(A) Preserve the records exclusively in a non-rewriteable, non-erasable format;

(B) Verify automatically the quality and accuracy of the storage media recording process;

(C) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media; and

(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member.

Since way back, when this subject was just a shadow across compliance officers' desks, the expectation--and instructions from then-NASD, I might add--was that, if the firm used a 3rd party vendor to store its electronic records, it was the 3rd party vendor who was required to make those representations in writing, on their letterhead, to the regulators. The firm would engage the vendor to store information (such as e-mails), would request the letter, would get the letter, and would mail it to Susan DeMando's office. Later, firms had to submit it to FINRA online.

Firms storing their own records electronically would make the representations themselves, in writing to FINRA.

What I just learned from a helpful and trusted FINRA staff member is this: the format representations letter does NOT have to come from the 3rd party vendor. Quoting (f)(2)(i) of the Rule: "...the member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2)." The staff member said that the BD would make the representations 'unless they don't have the knowledge' to make them.

My opinion is this: most firms are hiring out because they don't have that knowledge or anything close to it. But hey, I've been wrong--or at least misled--before.

Most 3rd party vendors, in my experience, give those letters to their clients for delivery to FINRA. I would expect it if I were you. If the vendor wants to charge you for the letter, save your money and write the letter yourself.

Here's the thing , though: make sure you, the BD, get solid, written clarity from your 3rd party vendor before writing and submitting your letter to FINRA. You have to be sure the media meets the criteria. You're hiring the vendor because you can't or don't want to store the records yourself... you'll need to rest assured that the records meet the regulator's expectations, right? Otherwise, why pay their prices??

Oh, and remember: you always have to submit an 'access letter' to FINRA-complying with 17a-4(f)(3)(vii)--and that letter has to come from an independent third party (any old third party will do--as long as they know what they're talking about and they're not an affiliate or relative). Your third party storage vendor will write that letter for you--if they don't, fire them.

Thanks to Davis for his inspiration... he knows that nothing gets me going like ESM.

>

Little more input on audit function under electronic r/k rule

Quick--I promise--update on the 'audit function' under 17a-4(f)(3)(v). This week a FINRA examiner provided verbal guidance in response to a firm's written request for such. The guidance was not specific; it was based only common sense, not formal guidance from SEC or FINRA higher-ups. It consisted of recommending a periodic review of stored records to confirm that they are intact.

Okay then.

Obviously more on this subject is necessary for firms to fully understand their responsibilities.

AND...I came across another outside vendor for e-mail archiving: Global Relay Communications. I haven't gotten permission to link to them--please google them and check out their broker-dealer services. They seem quite thorough in their comprehension of FINRA members' regulatory burdens. Their materials plainly address all requirements and describe how their systems meet them... nice to see. Here's an excerpt from their presentation on the audit function (okay, I didn't get permission to copy this--but I'm hopeful the G.R. folks will appreciate the plug):

"All messages stored in the Message Archiver are forwarded directly from the Member firm’s email server, with no User intervention. During the lifecycle of a message, all actions (viewing, replying, forwarding, downloading, flagging, notation, review) by any User, Reviewer, Super Reviewer, Administrator or the system itself associated with the message are logged. The Message Archiver’s detailed logs provide a full audit trail verifying the integrity of the message. These logs automatically appended to the messages and are viewable and made available to authorized administrative Users.

As detailed directly above, Message Archiver immediately provides a full audit trail accessible to any authorized administrative User. A side benefit of the system, is that a firm also builds an audit trail for the auditors actions in the archive during an online audit.

Global Relay’s Message Archiver employs retention schedules for all audit results. Audit results are retained for the lifecycle of the message. The SEC three and six year retention requirement for records set out in paragraph (a) and (b) of this Rule 17a-4 can be applied to the audits within Message Archiver."

Happy Summer!

Bill Singer, Put Your Holster Back On

"When I decide whether to ride out of town into the sunset or slap the iron back on and walk the streets, you'll know -- I'll post that decision here."

That is a quote from Bill Singer's blog entry of May 16. The good news is, he wrote a subsequent entry--"The Dead-Animal Man"--yesterday, on May 21. The bad news is, he didn't reveal his decision. I'm reluctant to assume he's back in the saddle again, since this latest, delightfully-dreary, entry did not address our favorite subject (the one that so wears on Mr. Singer that he is forced to consider retiring to the comforting chaos of his Pandora's box): securities regulation and its many splendid forms. Is Bill back? Or still in the barn? I, for one, am waiting with great hope that he'll darken FINRA's doorway again soon.

Bill's blog: http://www.rrbdlaw.com/brokeandbroker/index.php

Exam Priorities

FINRA just put out its annual notice on exam priorities. Below I've listed the areas they prioritize (many), along with summaries and few comments. Far below, I note some recent findings I've seen on exams. This isn't overly original or interesting, but I thought I'd throw it in my blog, since I've been way too busy lately to write anything else... :)

Senior Investors – hot topics include misleading advertising, shameless, fear-inducing sales pitches and of course, suitability. Advice: don’t let your reps claim to be qualified
‘senior investing’ specialists and make sure each transaction is well documented to establish suitability.
Deferred Variable Annuities – new Rule 2821 went into effect, sort of, on May 5. Reps have to document their reasonable basis for recommending a Def. V/A purchase or switch; principals in the future will also be required to ensure reasonableness. Training is in Def. V/A rules and products is required. Here is the link to the April Phone-In Workshop on the subject - phone-in workshop; also reference my notes on this in an earlier blog entry.
Anti-Money Laundering (AML) – final rule 312 of Patriot Act went into effect in Feb; most small firms are not effected since they don’t have foreign banking relationships. Examiners are looking for suspicious activity monitoring and SAR filings; also making sure firms are having independent testing as required. Remember, follow-up on testing recommendations and keep records of your follow-up action taken.
Protection of Customer Information – issues include online account hacking (not relevant for most small firms) and protecting information stored electronically (on hard drives, portable drives, laptops and PDA’s). Exam deficiencies include failure to provide privacy notices (and keep records of providing them), failure to have procedures addressing disposal of consumer report information, failure to obtain required confidentiality agreements from third parties; failure to insure that outsourcing entities maintained the confidentiality of customer information; and failure to include a required “opt out” clause in their privacy policies. While firm procedures may address safeguarding their information, it’s a good idea to have a separate “IT” type document detailing the administrative, technical and physical safeguards used to secure data.
Supervision and Supervisory Controls – I guess a lot of firms are still struggling with the difference between supervisory procedures under 3010 and control procedures under 3012/3013. Exams focus on separate control procedures, review of producing manager, heightened supervision of high-risk brokers, annual testing and verification and CEO certifications.
Sales of New or Non-Conventional Products – firms have to have procedures for approving of new products; examiners are also focusing on recommendations in new and non-conventional products, such as hedge funds, CMOs/CDOs, REITS, auction rate securities and other structured products. Guidance references MSRB notices for firms doing muni business.
Transaction Reporting – accuracy of reported transaction information is the firm’s responsibility, no matter how it’s reported. Trade Reporting Facility participants must transmit certain information regarding last sale reports of transactions in designated securities. Examiners are also finding firms to have incorrectly reported riskless principal transactions, incorrectly reported transactions with the long/short-sale indicator and not properly submitted OATS data with accurate order information, terms and conditions, and/or special handling codes.
Business Continuity Planning (BCP) – the exam priorities publication states that firms should periodically test their plan to ensure all of its components work as envisioned…but this is not required by the Rule itself or in FINRA’s 2006 NTM 06-74 on the subject. Firms should decide if periodic testing is necessary, given their size and customer services.
Data Integrity – exams will look at CRD filings, complaint reporting and clearing firm reporting to ensure accuracy and timeliness. Firms face steep fines for late filings.
Bank Sweep Programs – for broker-dealers sweeping customer credit balances into deposits at banks. All sorts of issues, here, including: protection of funds, net capital requirements, written agreements, reconciliations, books and records, SIPC/FDIC coverage, and account statements. Call district contact to discuss before setting up such a program.
Agency Lending Disclosure – for firms that operate an agency securities lending business. Exam findings show firms not performing principal counterparty credit risk monitoring or reconciliations and not resolving contract differences nor computing securities borrow deficit capital charges at the principal counterparty level. Ref: 05-45.
Inventory Valuations – firms should have controls to independently validate the pricing of inventory positions.
Outsourcing – outsourcing is not a substitute for internal controls and compliance monitoring; outsourcing should be monitored and overseen. Outsourcing to foreign entities may result in risks and should be closely monitored.
Order Audit Trail System (OATS) – as of February 4, 2008, OATS reporting requirements include OTC equity securities such as orders for OTC equity securities traded on the OTCBB, Pink Sheets or otherwise, as well as orders for certain foreign equity securities and other securities meeting the definition of OTC equity security in NASD Rule 6951. Best to visit the OATS web site (OATS) and FAQs to understand the complexities of OATS reporting.
Regulation NMS -- SEC Rules 610 (the Access Rule) and 611 (the Order Protection Rule) were fully implemented for all NMS stocks as of October 8, 2007. Initial FINRA exams show that some firms mistakenly may believe that Reg NMS does not apply to them, either because they make markets in a limited number of NMS stocks or because they infrequently execute orders internally. Note that Reg NMS does not include any exception to the definition of “trading center” based on de minimis activity. Firms are reminded that the requirements for ISOs apply to “any broker or dealer” that uses ISOs, and are not limited solely to broker-dealers that operate as trading centers. Refer to online resources for clarity on this: Spotlight On Regulation and Frequently Asked Questions on Rules 610 and 611.

Additional areas of exam findings:

Changes in Account Name or Designation – changes in account name or designation, including error accounts, must be approved by a designated principal and there must be records to show that s/he was personally made aware of the essential facts concerning the change. Approval must be noted on the order or another record.
Time and Price Discretion – when relying on a verbal, one-day time and price discretion exception to Rule 2510 (discretionary accounts), firms must note the reliance on tickets and must not extend the discretion beyond the close of business that day. (Doesn’t apply to institutional accounts in ‘good-til-cancelled’ transactions on a ‘not held’ basis.)
Net Capital – violations include inaccurate inventory valuations of prop. positions and mark-to-markets performed by traders; and improper treatment of ‘cash-like’ investments offered by banks (non-allowable).
Customer Protection – 15c3-3 violations include: inaccurate treatment of stock record allocation positions; non-bona fide reserve bank deposits; and creation of segregation deficits by deliveries, securities loaned and securities borrowed returns.
Back-Office Transaction Processing – inaccurate trade processing and reconciling. Conversions of processing systems often leads to a lot of trade breaks and unreconciled items, creating inaccuracies in books and records, charges against net capital and increased customer reserve requirements.

What I have seen lately in exam results:

Audit of Electronic Storage Input -- failure to have procedures for/comply with the ‘audit’ function under the SEC electronic books and records rule (17a-4(f)(3)(v). I have requested guidance from four FINRA staff members; three clients have directly requested guidance, verbally and/or in writing, from their examiners and/or liaisons, but NONE has been provided. At very least, perhaps firms should ‘check to see that the records are there’—paraphrased advice from one FINRA staff member.
Notify Outside Brokerage Firms of Employee Accounts – Rule 3050. If reps opened accounts prior to being associated persons of the firm, they will not have informed the outside brokerage firm of their status as RR. Firm should send letter to outside brokerage firm with request to provide duplicate statements/confirms.
Provide Copy of U5 to Term’d Rep – copies of U5’s must be provided to terminated reps within 30 days of termination; keep a record to show that the U5 was indeed provided.
Maintain Updated Contacts on FCS – be sure when updating contact information that you hit “save” or the changes will be lost. Changes of most CRD information should be made within 30 days of the change or of knowing of the change.
Provide BCP Disclosure Summary – required for all firms, including those with institutional customers. Provide at account opening and when the information changes (not an annual disclosure requirements, but a good idea to include in annual disclosures).
Register Personnel with Access to B/R – back office or administrative staff who have access to customer records or the firm’s financial b/r should be registered on CRD as “NRF” employees. Fingerprint cards and certain personal data are filed.
Obtain AML Information (CIP) -- new account forms or other such forms should include all required CIP information—name, physical address, TIN and DOB if individual. Verification must be in evidence and customers must be informed of firm’s CIP verification efforts—keep records of all compliance with this rule.