Just a few notes on AML

Hey there, busy over here. Year-end always comes too quickly. I wish you all well in the markets and in your securities business. Hang in there.

Kinda recently, FinCEN published their newest SAR Activity review… here is the link: FinCEN Publishes SAR Activity Review- By the Numbers – Issue 11

Here is their summary analysis regarding SAR filing increases in the first 6 months of 2008:

Suspicious Activity Reports characterizing the suspicious activity type as Credit/Debit Card Fraud increased 58%, compared to the corresponding six month period in 2007.

In 2008, Suspicious Activity Reports characterizing the suspicious activity type as Mail Fraud increased 49%, compared to reports filed during the same period in 2007.

The total suspicious activity reporting volume in the first six months of 2008 increased 18%, compared to the same period in 2007.

Suspicious Activity Reports characterizing the suspicious activity type as Money Laundering/Structuring increased 15%, compared to the corresponding six month period in 2007.

And, this came out last month… as you know, investment advisers are not currently required to have AML programs in place, although most these days are adopting programs to meet the expectations of investors and broker-dealers. The announcement (see below) informs us that the proposed rule to require IA’s (SEC-registered IA’s and unregistered IA’s with $30mm under management) to have AML programs has been dropped. They say that if IA’s in the future are to be subject to FinCEN AML program requirements, a new rule will have to be proposed and adopted.

What that means for you, maybe: if you as a BD had hoped your unregistered IA friends would have their own darned AML rules to follow, so that you could rely on them to do it for you when they introduce investors to you, well, forget it. The currently-effective SEC no-action letter (effective 1-12-08) allows you to rely on federally-regulated IA's to do that--not unregulated IA's. I have that letter in my files; if you want me to email it to you, just ask.

Here is FinCEN's announcement, pulling the proposed IA rule proposal:
From: http://www.fincen.gov/news_room/nr/html/20081030.html
October 30, 2008

FinCEN Withdraws Dated AML Rule Proposals for Unregistered Investment Companies, Commodity Trading Advisors, and Investment Advisers

VIENNA, Va. – As part of its overall effort to increase its efficiency and effectiveness in administering the Bank Secrecy Act (BSA), the Financial Crimes Enforcement Network (FinCEN) has withdrawn its proposed anti-money laundering (AML) program rules for unregistered investment companies, commodity trading advisors and investment advisers. The withdrawals of the proposed program rules have been submitted for publication in the Federal Register.

Given the passage of time since these rules were first proposed in 2002 and 2003, FinCEN has determined that it will not proceed with BSA requirements for these entities without publishing new proposals and allowing for industry comments. FinCEN will continue to consider whether and to what extent it should impose requirements under the BSA on these entities.
Since the proposed rules were first published, FinCEN has concluded rulemakings for banks, broker-dealers and futures commission merchants. The financial transactions of unregistered investment companies, investment advisers, and commodity trading advisors and their clients must be conducted through, and their assets carried by, other financial institutions that are subject to BSA requirements. Thus, as FinCEN continues to consider the extent to which BSA requirements should be imposed on these entities, their activity is not entirely outside the current BSA regulatory regime.

In an effort to make its rulemaking processes more transparent, FinCEN today also established a section of its website entitled "Pending Rules" where those rules that are still awaiting comments or finalization will be made easily available.

I'm Going as a Conversion Chart for Halloween

Reason? It's the scariest thing I can think of.

Remember when NASD Reg. merged with NYSE reg.? And they said they'd be consolidating the rulebooks? Well, the first set of Rule Conversions was released by FINRA on October 16. For 34 pages of fright, see Notice 08-47 at: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p117255.pdf

This shows the changes that are effective in 60 days. Many changes are simply adopting current NASD Rules and incorporating old NYSE Rules into brand new FINRA Rules—with no substantive changes. But the quantity of information is scary: 564 items in the handy “Conversion Chart.”
http://www.finra.org/Industry/Regulation/FINRARules/p085560 . This chart shows the old NASD Rule number and the new, corresponding FINRA Rule number (I'm not addressing NYSE Rule changes here, since that's not my area of expertise). That’s helpful, but not as great as it could be. I mean, each of these conversion listings has links to the old and new Rules, the Federal Register with the Rule Filings and approval orders, and any amendments to Rule Filings. The chart doesn’t comment on the nature of the changes represented: minor, technical or substantive. You have to cross reference the Notice (above) for any mention of that. Or open up the Rule Filing and start reading… a lengthy process, for sure.

I've added two columns to the chart: "Summary of Changes" and "In WSP? Changes Necessary?" This way, I'll record the results of my painstaking investigation into each and every cited change. Process: open up 'filing number' link on chart; read summary; open up 'text of proposed rule change' and any amendment links, read 'til I'm cross-eyed, then summarize changes on the table. Next, go to WSP, look for old Rule citations, change them, and add any text necessary to incorporate substantive Rule changes. That's it! I only have 547 items to go. I'm on a roll.

Seriously though, many of these changes relate to things like arbitration claims procedures and other administrative Rules that are generally not included in a firm's WSP. So, maybe in the end only a handful of these announced conversions will result in real written procedural changes. (Wait, this reminds me of the difference between the 'real America' and the, well, not-so-real America and that silly Congresswoman's call for Congressional hearings to route out the fakers... oops, wrong scary blog site...) Anyway, I'm not one to make assumptions and will therefore poke through every item on this chart. I'm praying to the Great Pumpkin and Santa Claus that the next released Conversion Chart will be waaaaaay less lengthy/frightening.

I encourage you to take the time to look at the recent Notice and to open up subsequent bi-monthly Notices. Scroll down through the list of Rule changes for those that are relevant to your business. It certainly won't pay to put off attention to this. Face these demons now: 'tis the season.

Have a sweet Halloween.

FACT Act for BD's? Maybe.

A very helpful member of FINRA's Office of General Counsel looked into the whole FACT Act/ID Theft/Red Flags Rules subject. A big shout out to that person--thanks again!

I had asked him about 2 weeks ago about how these new rules might apply to registered B-D’s. He let me know that it is, specifically, FTC Rule 681, implemented under the FACT Act, that may apply. This rule goes into effect November 1. I guess FINRA is considering publishing either a reminder or guidance on the topic. Since it’s not an SEC Rule, SEC won’t be enforcing this; whether or not FINRA adds it to their examination protocols, we won’t know yet. A parallel example of FINRA enforcing an FTC rule is in the area of telemarketing restrictions. As you know, FINRA/NASD ‘adopted’ them and enforces cold calling rules.

Here is the link to the Federal Register announcing the FTC’s (and other agencies’) implementation of the FACT Act: http://frwebgate1.access.gpo.gov/cgi-bin/PDFgate.cgi?WAISdocID=080421251418+19+1+0&WAISaction=retrieve.

The operative terms within the rule are “financial institution,” “creditor” and “covered account.” I have a sense that M&A/private placement firms and straight up check & app firms (no brokerage accounts) will be able to exempt themselves; OGC seems to think introducing firms whose clients have brokerage accounts will not be exempt. But let’s wait and see…my opinion is, it’s only fair that FINRA provide some help on this complicated subject. Because let's face it: your compliance staff is working hard these days on many other issues. They're not pro-actively reading the Federal Register on weekends in an attempt to find new, unannounced rules to follow. (If they are, give them a raise or ask them to call me for a job.)

So be on the lookout for something from FINRA. In the mean time, think about clicking that link above and searching "681." You'll be way ahead of the game. (Unlike the Sox.) (Go Sox.)

Fact-ish: The FACT Act and Reg. S-P Amendments

I'm writing this to let you know I'm looking into something--that is, this is preliminary and I'll follow up later. So, put this information in the category of 'truthiness.'

I saw on FINRA's weekly e-mail the announcement of its online workshop on the subject of customer data protection issues (see: http://www.finra.org/Industry/Education/OnlineLearning/OnlineWorkshops/P117068 ). Within the workshop description the “new FACT Act” is mentioned.

This mention made me look into the FACT Act; I'd certainly seen references to new 'ID theft' compliance in other documents and online sources, but I was not familiar with the Act, nor its applicability to broker-dealers. Sometimes I'm lazy (no, not lazy: overworked!), and I rely on FINRA's Notices to announce important new requirements that will effect my clients.

Note that the FACT Act was referenced in NtM 05-49, but only in the footnotes and in reference to preventing identity theft by destruction of consumer reports.

The FACT Act is a banking regulation: the Fair and Accurate Credit Transactions Act of 2003. Financial institutions, under the Act, have a mandatory deadline of November 1, 2008, to comply with three new parts, called the Red Flag Rules (in sections 114 and 315 of the Act). New requirements include:

• Creating an identity theft prevention program
• Implementing change of address safeguards when issuing credit/debit cards
• Verifying identity upon notice of address discrepancy from a consumer reporting agency

As you can see, this stuff doesn't really seem to relate to your brokerage business. Well, my read of the FACT Act is that it doesn’t apply to broker-dealers. Here's an excerpt from the Act proposal that appears to exempt BD’s from complying with the red flag rules, including having an ID theft program:

334.90 Duties regarding the detection, prevention, and mitigation of
identity theft.
(a) Purpose and scope. This section implements section 114 of the Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681m, which amends section 615 of the Fair Credit Reporting Act (FCRA). It applies to financial institutions and creditors that are insured state nonmember banks, insured state licensed branches of foreign banks, or subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

But, within the Act, “account” and "transaction" as defined may include certain types of brokerage accounts that allow for check writing, debit transactions,etc., that would then throw the requirements into a BD's realm. Since you, the small BD offering mutual fund investments on an application way basis, doing private placements or hedge funds offerings, or running an institutional trade desk, do not allow check writing on customer accounts, this stuff seems inapplicable and worthy of ignoring.

But.... why the mention in the online workshop announcement? The mention, itself, is a red flag for me: ooh-oh, is this something I missed? Maybe the workshop will confirm just what I surmise: the FACT Act doesn't apply to you; no worries. I would have liked it better had FINRA released guidance first, though, so that the message was way more broadly-distributed (most firms don't listen to the online workshops). I've asked FINRA if guidance is forthcoming. I'll keep you posted.

We're not done yet.

Reg. S-P is subject to pending amendments that cross reference the FACT Act. So, this may be a good thing for you or a bad thing. That is, if S-P will definitively require all BD’s to comply with the red flag rules under the Fact Act, then you'll have to waste time building procedures or justifications for not having procedures to comply. Perhaps the amendments--and FINRA's expectations of compliance—will be nuanced, such that you won't have to waste time on this. We will see.

Now remember, my knowledge base is minimal on this subject. No facts expressed here, only factish information. My goal is let you know that you don't have to react with alarm if you hear about firms complying with the Fact Act. Most likely it does not concern you. But stay tuned, because the Reg. S-P changes might.

If only politics were this straightforward. ... oh wait, they are.

Outside In

What does Heidi Klum say? "You are either in or you are out." It's one or the other, and the other goes home.

In years past this distinction for me has been clear: as an "outside consultant" to securities firms, I've always been treated that way by regulators--as an unwelcome outsider. I remember a few years ago, standing at a gas station in Some City, USA, on business travel. I was on my cell with a District liaison, fighting to get information from her about a rule interpretation or some such other clarification. My purpose was to assist my BD client--not to waste the liaison's time to build my personal knowledge base. I was speaking to the subject without divulging the client's name--that would have defeated my client's purpose at the time. Anyway, this experience was similar to many I've had over the past 8 years as a consultant: I act as a go-between in order to help my BD clients better meet Finra's Rules, and I'm shut down in the process by Finra staff due to a procedure they put in place that requires, without exception, the caller to identify the member firm's name when making inquiries.

I'm happy to say that my recent interaction with some Finra staff members has strayed from this model. I've been treated to assistance by folks in various offices--such as District offices and the Office of General Counsel--without the bias I was used to confronting. A great guy in Advertising has been helpful on several occasions. A kind examiner in NYC has been generous with his time. I haven't been made to feel like a spy or a cheater when engaging in intelligent dialogue. I'm hoping this trend continues. While I understand the old mantra, 'firms can call us for information without raising red flags or risking retribution...,' I also understand that many small firms simply prefer to avoid that direct contact. They'd rather have someone like me act as an information gatherer and interpreter. In my opinion, the result is the same (and mutually desirable): BD's are well-informed and better able to meet their responsibilities. The means to that end should not be restricted. It is in the investing public's best interest to let information/guidance/interpretation flow to BD's and their consultants.

I also want to thank some Finra staff members for their good-natured, prompt and extremely helpful assistance to me in months past...I won't name them, but the folks in the online learning and waiver departments are good at what they do and pleasant to work with. Thanks to all of you!

So, Heidi, am I in or am I out? I think for the time being, I'm a little of both. And on this particular reality show, that means I'm a winner.

The Law of Opposites

I haven't written for a while. Too much going on. I've been busy watching my son balance speed with caution at the age of 16, marvelling at my other son as he defies gravity on his unicycle, questioning the sanity of our polarized political system, and witnessing the end of the beginning of the end. These directional changes are making me nauseous. At least I have my work to keep me facing forward... I think.

A few thoughts for the day:

Finra has redesigned its website, just when I became adept at navigating the old site. Oh well, it's not about me. Anyway, it looks nice. www.finra.org

FinCEN's most recent report on suspicious activity reporting--SAR by the Numbers--includes totals for 2007. It's here: http://www.fincen.gov/news_room/rp/files/sar_by_numb_10_sec4.xls

From 2006 to 2007, there was a 58% increase in the number of SAR's filed by the securities and futures industry. One of the fastest areas of growth was in identity thefts. I imagine we'll see high growth again this year, since it's one of SEC's and Finra's priorities to make sure firms are filing SAR's, even in the face of 'potential' suspicious activity. (On that subject, please read Bill Singer's 'Cases of Note' comment on the James I. Black & Company and Jess Gove Tucker III case, August 2008 at: http://www.rrbdlaw.com/RegulatoryLinks/CASESOFNOTE/NASD/2008.htm .) Oh, and if you look closely at the report, you'll see only one state where, since 2003, there has never been a SAR filed. Where? The State of Alaska. Does that mean Sarah Palin supports money laundering by terrorists? Probably not, but I bet someone on cable TV would make that connection.

Back in May, Finra released a series of Notices related to the Rule Consolidation project. Notice 08-24 requested comment on revisions to supervision and supervisory controls rules. This is what we've been waiting for, right? The big Rule Consolidation Re-Write... the one that will bring us closer to an intelligent, principles-based regulatory structure that allows for flexibility depending on firm size and business niche?

Not so fast.

First, they're going to rewrite the rules so that there is less clarity, more cause for misinterpretation, broader authority leading to even more onerous procedural changes, and... oops, I didn't mean to be critical. I admit it must be a very difficult job: to take a HUGE rulebook governing many different business models, full of cross-references, overlapping definitions and nuanced contradictions, and attempt to improve it with a little tweaking. My take is, it's not gonna happen with edits--it will only happen with a complete re-write.

In the end, firms should be required to simply do the right thing and a well-managed regulatory body should be capable of discerning when those firms are not doing the right thing. The more minutia- and legalese-laden, arbitrary and seemingly non-applicable rules, the more likely firms are to treat compliance like a chess match: outwit the opponent by seizing on his lack of peripheral vision. That's not the way it should work.

Anyway, what IS interesting are the comment letters--go here, and choose some to read. http://www.finra.org/Industry/Regulation/Notices/2008/P038502 It's encouraging that firms are voicing opposition to things like: broadened supervisory requirements on outside business activities; requiring principals be assigned to supervise business areas of firms that do not require BD registration; duplicative supervisory sign-off on investment banking transactions; closer oversight of one-person OSJ's; and transaction review of reps' family member accounts, among others. I especially enjoyed reading the letter from ING Advisors Network, June 30. The author's comments are clear and rational. See: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/noticecomments/p038858.pdf

Now, back to the end of the beginning of the end... Did I really just say that firms should have simple, principles-based rules to follow in the way they see fit, and our regulators should be smart, motivated, united and reasonable in enforcing these new 'just do it' rules? I said that, in this market environment? What, am I nuts? Every day on the news shows all I hear is 'more regulation, more regulation, more regulation,' even from those who oppose it. I pity the team of Finra authors even more: if their mission was challenging before, it's now darned-near impossible. Whose advice do they take? Alan Greenspan said leave the short sellers alone--they're necessary and smart. Other talking heads say the short sellers are greedy and irresponsible. I hear Cox is a genius, then I hear he's an idiot. I'm not savvy enough to make up my own mind. But as a compliance consult, I do know one thing: there will be more rule changes and more rules and much, much more work to do on the part of my small BD firm clients who ALWAYS do the right thing.

In the name of opposites, I'll close quoting someone else, whose name I don't know (he was on Fresh Air): "In our country we privatize profits and socialize losses." Isn't that perfect? -er, I mean, not perfect? ....there I go again.

FinCEN's Better Website

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.