Fact-ish: The FACT Act and Reg. S-P Amendments

I'm writing this to let you know I'm looking into something--that is, this is preliminary and I'll follow up later. So, put this information in the category of 'truthiness.'

I saw on FINRA's weekly e-mail the announcement of its online workshop on the subject of customer data protection issues (see: http://www.finra.org/Industry/Education/OnlineLearning/OnlineWorkshops/P117068 ). Within the workshop description the “new FACT Act” is mentioned.

This mention made me look into the FACT Act; I'd certainly seen references to new 'ID theft' compliance in other documents and online sources, but I was not familiar with the Act, nor its applicability to broker-dealers. Sometimes I'm lazy (no, not lazy: overworked!), and I rely on FINRA's Notices to announce important new requirements that will effect my clients.

Note that the FACT Act was referenced in NtM 05-49, but only in the footnotes and in reference to preventing identity theft by destruction of consumer reports.

The FACT Act is a banking regulation: the Fair and Accurate Credit Transactions Act of 2003. Financial institutions, under the Act, have a mandatory deadline of November 1, 2008, to comply with three new parts, called the Red Flag Rules (in sections 114 and 315 of the Act). New requirements include:

• Creating an identity theft prevention program
• Implementing change of address safeguards when issuing credit/debit cards
• Verifying identity upon notice of address discrepancy from a consumer reporting agency

As you can see, this stuff doesn't really seem to relate to your brokerage business. Well, my read of the FACT Act is that it doesn’t apply to broker-dealers. Here's an excerpt from the Act proposal that appears to exempt BD’s from complying with the red flag rules, including having an ID theft program:

334.90 Duties regarding the detection, prevention, and mitigation of
identity theft.
(a) Purpose and scope. This section implements section 114 of the Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681m, which amends section 615 of the Fair Credit Reporting Act (FCRA). It applies to financial institutions and creditors that are insured state nonmember banks, insured state licensed branches of foreign banks, or subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

But, within the Act, “account” and "transaction" as defined may include certain types of brokerage accounts that allow for check writing, debit transactions,etc., that would then throw the requirements into a BD's realm. Since you, the small BD offering mutual fund investments on an application way basis, doing private placements or hedge funds offerings, or running an institutional trade desk, do not allow check writing on customer accounts, this stuff seems inapplicable and worthy of ignoring.

But.... why the mention in the online workshop announcement? The mention, itself, is a red flag for me: ooh-oh, is this something I missed? Maybe the workshop will confirm just what I surmise: the FACT Act doesn't apply to you; no worries. I would have liked it better had FINRA released guidance first, though, so that the message was way more broadly-distributed (most firms don't listen to the online workshops). I've asked FINRA if guidance is forthcoming. I'll keep you posted.

We're not done yet.

Reg. S-P is subject to pending amendments that cross reference the FACT Act. So, this may be a good thing for you or a bad thing. That is, if S-P will definitively require all BD’s to comply with the red flag rules under the Fact Act, then you'll have to waste time building procedures or justifications for not having procedures to comply. Perhaps the amendments--and FINRA's expectations of compliance—will be nuanced, such that you won't have to waste time on this. We will see.

Now remember, my knowledge base is minimal on this subject. No facts expressed here, only factish information. My goal is let you know that you don't have to react with alarm if you hear about firms complying with the Fact Act. Most likely it does not concern you. But stay tuned, because the Reg. S-P changes might.

If only politics were this straightforward. ... oh wait, they are.

Outside In

What does Heidi Klum say? "You are either in or you are out." It's one or the other, and the other goes home.

In years past this distinction for me has been clear: as an "outside consultant" to securities firms, I've always been treated that way by regulators--as an unwelcome outsider. I remember a few years ago, standing at a gas station in Some City, USA, on business travel. I was on my cell with a District liaison, fighting to get information from her about a rule interpretation or some such other clarification. My purpose was to assist my BD client--not to waste the liaison's time to build my personal knowledge base. I was speaking to the subject without divulging the client's name--that would have defeated my client's purpose at the time. Anyway, this experience was similar to many I've had over the past 8 years as a consultant: I act as a go-between in order to help my BD clients better meet Finra's Rules, and I'm shut down in the process by Finra staff due to a procedure they put in place that requires, without exception, the caller to identify the member firm's name when making inquiries.

I'm happy to say that my recent interaction with some Finra staff members has strayed from this model. I've been treated to assistance by folks in various offices--such as District offices and the Office of General Counsel--without the bias I was used to confronting. A great guy in Advertising has been helpful on several occasions. A kind examiner in NYC has been generous with his time. I haven't been made to feel like a spy or a cheater when engaging in intelligent dialogue. I'm hoping this trend continues. While I understand the old mantra, 'firms can call us for information without raising red flags or risking retribution...,' I also understand that many small firms simply prefer to avoid that direct contact. They'd rather have someone like me act as an information gatherer and interpreter. In my opinion, the result is the same (and mutually desirable): BD's are well-informed and better able to meet their responsibilities. The means to that end should not be restricted. It is in the investing public's best interest to let information/guidance/interpretation flow to BD's and their consultants.

I also want to thank some Finra staff members for their good-natured, prompt and extremely helpful assistance to me in months past...I won't name them, but the folks in the online learning and waiver departments are good at what they do and pleasant to work with. Thanks to all of you!

So, Heidi, am I in or am I out? I think for the time being, I'm a little of both. And on this particular reality show, that means I'm a winner.

The Law of Opposites

I haven't written for a while. Too much going on. I've been busy watching my son balance speed with caution at the age of 16, marvelling at my other son as he defies gravity on his unicycle, questioning the sanity of our polarized political system, and witnessing the end of the beginning of the end. These directional changes are making me nauseous. At least I have my work to keep me facing forward... I think.

A few thoughts for the day:

Finra has redesigned its website, just when I became adept at navigating the old site. Oh well, it's not about me. Anyway, it looks nice. www.finra.org

FinCEN's most recent report on suspicious activity reporting--SAR by the Numbers--includes totals for 2007. It's here: http://www.fincen.gov/news_room/rp/files/sar_by_numb_10_sec4.xls

From 2006 to 2007, there was a 58% increase in the number of SAR's filed by the securities and futures industry. One of the fastest areas of growth was in identity thefts. I imagine we'll see high growth again this year, since it's one of SEC's and Finra's priorities to make sure firms are filing SAR's, even in the face of 'potential' suspicious activity. (On that subject, please read Bill Singer's 'Cases of Note' comment on the James I. Black & Company and Jess Gove Tucker III case, August 2008 at: http://www.rrbdlaw.com/RegulatoryLinks/CASESOFNOTE/NASD/2008.htm .) Oh, and if you look closely at the report, you'll see only one state where, since 2003, there has never been a SAR filed. Where? The State of Alaska. Does that mean Sarah Palin supports money laundering by terrorists? Probably not, but I bet someone on cable TV would make that connection.

Back in May, Finra released a series of Notices related to the Rule Consolidation project. Notice 08-24 requested comment on revisions to supervision and supervisory controls rules. This is what we've been waiting for, right? The big Rule Consolidation Re-Write... the one that will bring us closer to an intelligent, principles-based regulatory structure that allows for flexibility depending on firm size and business niche?

Not so fast.

First, they're going to rewrite the rules so that there is less clarity, more cause for misinterpretation, broader authority leading to even more onerous procedural changes, and... oops, I didn't mean to be critical. I admit it must be a very difficult job: to take a HUGE rulebook governing many different business models, full of cross-references, overlapping definitions and nuanced contradictions, and attempt to improve it with a little tweaking. My take is, it's not gonna happen with edits--it will only happen with a complete re-write.

In the end, firms should be required to simply do the right thing and a well-managed regulatory body should be capable of discerning when those firms are not doing the right thing. The more minutia- and legalese-laden, arbitrary and seemingly non-applicable rules, the more likely firms are to treat compliance like a chess match: outwit the opponent by seizing on his lack of peripheral vision. That's not the way it should work.

Anyway, what IS interesting are the comment letters--go here, and choose some to read. http://www.finra.org/Industry/Regulation/Notices/2008/P038502 It's encouraging that firms are voicing opposition to things like: broadened supervisory requirements on outside business activities; requiring principals be assigned to supervise business areas of firms that do not require BD registration; duplicative supervisory sign-off on investment banking transactions; closer oversight of one-person OSJ's; and transaction review of reps' family member accounts, among others. I especially enjoyed reading the letter from ING Advisors Network, June 30. The author's comments are clear and rational. See: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/noticecomments/p038858.pdf

Now, back to the end of the beginning of the end... Did I really just say that firms should have simple, principles-based rules to follow in the way they see fit, and our regulators should be smart, motivated, united and reasonable in enforcing these new 'just do it' rules? I said that, in this market environment? What, am I nuts? Every day on the news shows all I hear is 'more regulation, more regulation, more regulation,' even from those who oppose it. I pity the team of Finra authors even more: if their mission was challenging before, it's now darned-near impossible. Whose advice do they take? Alan Greenspan said leave the short sellers alone--they're necessary and smart. Other talking heads say the short sellers are greedy and irresponsible. I hear Cox is a genius, then I hear he's an idiot. I'm not savvy enough to make up my own mind. But as a compliance consult, I do know one thing: there will be more rule changes and more rules and much, much more work to do on the part of my small BD firm clients who ALWAYS do the right thing.

In the name of opposites, I'll close quoting someone else, whose name I don't know (he was on Fresh Air): "In our country we privatize profits and socialize losses." Isn't that perfect? -er, I mean, not perfect? ....there I go again.

FinCEN's Better Website

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.

Another Cover-Up

Remember when John Ashcroft, serving as Attorney General under President Bush 2001-2005, required that the statues in his press room be made, well, less revealing? In an effort to protect the public, expensive fabric was draped over the age-worn marble of both Spirit of Justice and Majesty of Justice--well, at least over the more love-worn parts. The language of art was muted to satisfy our government's assumptions about our well-being. The thought art provokes, the questions it raises, and the beauty it portrays were denied an audience (what audience? ...not sure anyone was watching Ashcroft, anyway).

Mr. Ashcroft opposed nudity in art. Last week, the SEC decided it would oppose nudity in short selling. In an emergency order released July 15 (see: http://www.sec.gov/news/press/2008/2008-143.htm) SEC announced that for 19 publicly-traded financial company stocks (such as Lehman Bros., B of A, Citigroup, and of course, Freddie Mac and Fannie Mae), short sellers have to pre-borrow the subject securities, as opposed to the standard pre-locate practice. Trading firms everywhere are scurrying to devise procedures to meet this order. Some are saying 'forget it'--we just won't trade in those stocks for 8 days. And maybe that's what the SEC is hoping for: shrouding the market in a blanket heavy enough to silence the critics.

The SEC's mission was to "protect investors, maintain orderly markets, and promote capital formation." Is it possible that what the SEC is really doing is denying the rightful power of the free market to self-adjust? I mean, by shielding these firms from what the market wants to do--short the hell out of them in expectation of falling prices--isn't the federal government, with its artificial drapery, silencing the thinkers? ignoring the questions? rejecting the beauty of a sophisticated investment community? Why not let things progress as they otherwise might--let these financial houses of cards fall? Let the investors suffer for their bad choices? As they say in sports, no pain, no gain. The gain we sacrifice here is badly needed. Corporate bail-outs, no matter what form they take, don't help us progress. They just delay the pain.

On a practical note, by now you should have talked to your clearing firm about rules engines or other means of ensuring this temporary rule is enforced. And you should have informed your traders of the specific requirements. Be sure to notate your short sales as having complied with the 'pre-borrow' ethic. Keep the records; have a supervisor review the records. As for keeping your clothes on, well, that depends on how hot it gets...and your definition of 'art.' ;)

I won't call it a reversal

...but it seems like one.

Oh, I'm talking about electronic storage rules again. When I die, will someone please make sure my tombstone says something about my dedication to this cause? ...says something...not necessarily flattering.

Okay, so in the last two days I've run into situations where it appeared that 3rd party electronic storage vendors would not provide the representation letters generally expected under 17a-4(f)(2)(i)--you know the letter--the one that says the media will do the things listed under (f)(2)(ii), as follows:

(A) Preserve the records exclusively in a non-rewriteable, non-erasable format;

(B) Verify automatically the quality and accuracy of the storage media recording process;

(C) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media; and

(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member.

Since way back, when this subject was just a shadow across compliance officers' desks, the expectation--and instructions from then-NASD, I might add--was that, if the firm used a 3rd party vendor to store its electronic records, it was the 3rd party vendor who was required to make those representations in writing, on their letterhead, to the regulators. The firm would engage the vendor to store information (such as e-mails), would request the letter, would get the letter, and would mail it to Susan DeMando's office. Later, firms had to submit it to FINRA online.

Firms storing their own records electronically would make the representations themselves, in writing to FINRA.

What I just learned from a helpful and trusted FINRA staff member is this: the format representations letter does NOT have to come from the 3rd party vendor. Quoting (f)(2)(i) of the Rule: "...the member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2)." The staff member said that the BD would make the representations 'unless they don't have the knowledge' to make them.

My opinion is this: most firms are hiring out because they don't have that knowledge or anything close to it. But hey, I've been wrong--or at least misled--before.

Most 3rd party vendors, in my experience, give those letters to their clients for delivery to FINRA. I would expect it if I were you. If the vendor wants to charge you for the letter, save your money and write the letter yourself.

Here's the thing , though: make sure you, the BD, get solid, written clarity from your 3rd party vendor before writing and submitting your letter to FINRA. You have to be sure the media meets the criteria. You're hiring the vendor because you can't or don't want to store the records yourself... you'll need to rest assured that the records meet the regulator's expectations, right? Otherwise, why pay their prices??

Oh, and remember: you always have to submit an 'access letter' to FINRA-complying with 17a-4(f)(3)(vii)--and that letter has to come from an independent third party (any old third party will do--as long as they know what they're talking about and they're not an affiliate or relative). Your third party storage vendor will write that letter for you--if they don't, fire them.

Thanks to Davis for his inspiration... he knows that nothing gets me going like ESM.

>

Little more input on audit function under electronic r/k rule

Quick--I promise--update on the 'audit function' under 17a-4(f)(3)(v). This week a FINRA examiner provided verbal guidance in response to a firm's written request for such. The guidance was not specific; it was based only common sense, not formal guidance from SEC or FINRA higher-ups. It consisted of recommending a periodic review of stored records to confirm that they are intact.

Okay then.

Obviously more on this subject is necessary for firms to fully understand their responsibilities.

AND...I came across another outside vendor for e-mail archiving: Global Relay Communications. I haven't gotten permission to link to them--please google them and check out their broker-dealer services. They seem quite thorough in their comprehension of FINRA members' regulatory burdens. Their materials plainly address all requirements and describe how their systems meet them... nice to see. Here's an excerpt from their presentation on the audit function (okay, I didn't get permission to copy this--but I'm hopeful the G.R. folks will appreciate the plug):

"All messages stored in the Message Archiver are forwarded directly from the Member firm’s email server, with no User intervention. During the lifecycle of a message, all actions (viewing, replying, forwarding, downloading, flagging, notation, review) by any User, Reviewer, Super Reviewer, Administrator or the system itself associated with the message are logged. The Message Archiver’s detailed logs provide a full audit trail verifying the integrity of the message. These logs automatically appended to the messages and are viewable and made available to authorized administrative Users.

As detailed directly above, Message Archiver immediately provides a full audit trail accessible to any authorized administrative User. A side benefit of the system, is that a firm also builds an audit trail for the auditors actions in the archive during an online audit.

Global Relay’s Message Archiver employs retention schedules for all audit results. Audit results are retained for the lifecycle of the message. The SEC three and six year retention requirement for records set out in paragraph (a) and (b) of this Rule 17a-4 can be applied to the audits within Message Archiver."

Happy Summer!