Internal Testing of AML: Loophole Closed

Just yesterday I was blathering about the loophole in NASD IM-3011-1, which allows firms to have internal staff do annual testing of their AML programs. This rule lets firms have someone in the AML chain of command do the testing. The way it was written was always a bit curious: as if meant to strictly limit firms, but with a nice rabbit hole to jump into to safely avoid the limitation. Don't get me wrong: I've been a fan of the loophole, since I tend to sympathize with really small firms that have to meet onerous, big-firm requirements....and that's who would have relied on the loophole until now: very small firms with no staff remote enough from the AML staff and supervisor (usually the same person) to be considered independent. Well, thanks to FinCEN, these small firms will henceforth have no choice but to pay up for their annual independent AML testing.

You see, in Notice 09-60 FINRA announced its recent slate of rule consolidation changes. One of those is new FINRA Rule 3310, replacing NASD Rule 3011 and its IM's. The rule essentially stays the same except for the removal of the independence carve-out.

Firms can still appoint an internal staff member to conduct the testing, but that person must absolutely meet the following requirements:

1. The person must not perform the functions being tested,
2. The person may not be the designated AML compliance person, and
3. The person may not report to either anyone performing AML functions or the designated AML compliance person.

So if your firm is big enough such that you have senior staff who do not get involved at all in AML stuff, and you have employees who are well-versed in BSA/other AML requirements who do not do any AML work, you should be able to continue to rely on in-house AML testing.

The reason for the change? FINRA blames it on FinCEN, which stated that "the independent testing provision of the BSA precludes AML program testing by personnel with an interest in the outcome of the testing..." Seems reasonable--if you believe that our current AML rules, regulations and applied guidance have proven useful in fighting terrorism and if you believe that it is the role of the broker and the brokerage firm to police its clientele. Might seem unreasonable if you closely run a very small firm with a local, familiar clientele and have seen the cost of compliance sky-rocket right along with the increase in regulatory expectations, and you now have to pay a third-party to come in and verify the obvious: you're trying hard to follow the rules.

(Oops. I let myself go for a second, there... back to the subject at hand...)

The rule change is effective Jan. 1, 2010. You tiny firms out there will have to find someone to do your independent testing next year. (This is not a sales pitch, by the way--could you tell?)

SIPC Assessments: Something You Might Not Know

...but which your accountant should know.

Okay, so you know by now that SIPC assessments went from a coins-under-the-couch-cushions-amount ($150) to a revenue-based number (.0025 of annual net operating revenues). This change happened as of April 1 and there are new assessment reporting forms that apply: see http://www.sipc.org/members/members.cfm for links to the new forms: Form 7T (interim reporting) and Form 6 (general form used for semi-annual reporting/payment). Depending on your fiscal year end, SIPC will mail you the correct forms to complete. You will be given credit for the $150 you might have paid earlier this year. But be prepared to pay a bunch more: firms making millions in revenue will pay tens of thousands.

The last time SIPC imposed a revenue-based assessment was 14 years ago. When the SIPC Fund balance gets low (under $1 billion), they invoke their right to raise money this way. If you're feeling sorry for yourself, maybe because your investors are institutions or otherwise won't be relying on SIPC coverage anytime soon, here's the theory behind this universal assessment: your business is dependent on a robust market; that market consists of individuals—they drive the market by virtue of their investments. Without them you wouldn’t do the business you do. You therefore benefit from the retail market in the end. And you want those investors to have confidence, some of which is provided by SIPC coverage. So you pay for SIPC, along with every other broker, regardless of your niche.

Onto the meaningful part of this message...

When your auditor does your annual audit, he/she has to remember to do an 'e-4 report.' That refers to paragraph (e)(4) of SEC Rule 17a-5: 'Reports to be made by certain brokers and dealers.' Your accountant knows to what to provide to FINRA and SEC, based on years of service in this industry. But now that the SIPC assessment is based on revenues, he/she has to provide this new item, too--and he/she may not know about it. It's basically a 'negative assurance letter' and will include either a schedule of payments to SIPC or copies of the assessment forms that were filed for the period. The bummer is, SIPC does NOT address this on its members site....they say it's an SEC Rule, not theirs, and that's why...but hey, give a BD a break! It would be nice if they provided clear guidance on this. I guess that's why I'm writing this entry--to introduce the subject and suggest that you talk to your auditor to make sure he/she is prepared to comply.

Here's the text from the SEC Rule that applies (from http://edocket.access.gpo.gov/cfr_2002/aprqtr/17cfr240.17a-5.htm):

(4) The broker or dealer shall file with the report a supplemental report which shall be covered by an opinion of the independent public accountant on the status of the membership of the broker or dealer in the Securities Investor Protection Corporation (``SIPC'') if, pursuant to paragraph (e)(1) of this section, a report of the broker or dealer is required to be covered by an opinion of a certified public accountant or a public accountant who is in fact independent. The supplemental report shall cover the SIPC annual general assessment reconciliation or exclusion from membership forms not previously reported on under this paragraph (e)(4) which were required to be filed on or prior to the date of the report required by paragraph (d) of this section: Provided, That the broker or dealer need not file the supplemental report on the SIPC annual general assessment reconciliation or exclusion from membership form for any period during which the SIPC assessment is a minimum assessment as provided for in section 4(d)(1)(c) of the Securities Investor Protection Act of 1970, as amended.

The supplemental report, an original of which shall be submitted to the regional or district office of the Commission for the region or district in which the broker or dealer has its principal place of business, the Commission's principal office in Washington, the principal office of the designated examining authority for such broker or dealer and the office of SIPC, shall be bound separately, be dated and be signed manually, and shall include the following:

(i) A schedule of assessment payments also showing any overpayments applied and overpayments carried forward including: payment dates, amounts, and name of SIPC collection agent to whom mailed, or

(ii) If exclusion from membership was claimed, a statement that the broker or dealer qualified for exclusion from membership under the Securities Investor Protection Act of 1970, and the date and name of the SIPC collection agent with whom a Certification of Exclusion from Membership (Form SIPC-3) was filed, and

(iii) An accountant's report which shall state that in the accountant's opinion either the assessments were determined fairly in accordance with applicable instructions and forms, or that a claim for exclusion from membership was consistent with income reported. If exceptions are noted, the accountant shall state any corrective action taken or proposed.

The accountant's review on which his report is based shall include as a minimum the following procedures:

(A) Comparison of listed assessment payments with respective cash disbursements record entries;

(B) For all or any portion of a fiscal year ending in 1976 and each fiscal year thereafter, comparison of amounts reflected in the annual report as required by paragraph (d) of this section, with amounts reported in the Annual General Assessment Reconciliation (Form SIPC-7);

(C) Comparison of adjustments reported in Form SIPC-7 with supporting schedules and working papers supporting adjustments;

(D) Proof of arithmetical accuracy of the calculations reflected in Form SIPC-7 and in the schedules and working papers supporting adjustments; and

(E) Comparison of the amount of any overpayment applied with the Form SIPC-7 on which it was computed; or

(F) If exclusion from membership is claimed, the accountant shall review the annual report required by paragraph (d) of this section for all or any portion of a fiscal year ending in 1976 and each fiscal year thereafter to ascertain that the Certification of Exclusion from Membership (Form SIPC-7) was consistent with the income reported.

[Some of this is outdated due to changes in form names, but you get the idea.]

OH--and this 'e-4 report' has to go to SIPC, too. So include it in your filings with FINRA and SEC, and also send it (alone, not with the annual audited f/s) to SIPC.

Talk to your accountant; make sure this is clear. And chat it up over drinks, too. You'll impress your peers by being up on this subject way ahead of the crowd. Ah, the joys of compliance.

Another Delay of Red Flags Rule Enforcement (and other stuff)

Greetings, surfers!

Topic 1: Red Flags Rule (dedicated to my tipster: Mr. B. Gray)

FTC announced yesterday that they would delay enforcement of the Red Flags Rule--again. Now you have until November 1 to figure out what it all means for your broker-dealer firm. On this note, I tried to create a flow chart to help you decide if you needed an Identity Theft Prevention Program, but I ran out of ink (and brains) in the process. It's complicated--and I disagree with the going interpretation, so I should just stay out of it.

I guess I can be a little helpful by providing some reference links for you:

http://imhoffconsultingproject.blogspot.com/2008/11/update-on-fact-act.html and http://imhoffconsultingproject.blogspot.com/2009/07/useful-information-on-rainy-day.html contain my ranting (I mean, informative content) on the subject.

FINRA's ITPP template: http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119093.pdf

FINRA's page that has all kinds of references to guidance and stuff: http://www.finra.org/Industry/Issues/CustomerInformationProtection/p118480

FTC site on the Rule: http://www.ftc.gov/redflagsrule

FTC site on ID Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

+++++++++++++++

Topic 2: Investment Banking Registration Category

Wow! At last, for investment bankers, a test of their own! I'm impressed. If you are an investment banker, now you have your very own registration category: the Series 79. (Monty Python's Life of Brian came out this year--but that's off topic.)

Notice 09-41 does a terrific job explaining this new test and registration requirement. Here is a summary:

• If you're currently doing only private placements (not of munis, govt's or DPP's) you only need the Series 82 so don't worry about this.
• If you're currently doing investment banking activities--such as originating offerings, underwriting, marketing, structuring, syndication, or doing M&A deals like advising on restructurings, asset sales, corporate reorganizations, writing fairness opinions, etc., then YES, you need the Series 79.
• If you're doing this business, and you're not registered--better get that way.
• If you're doing this business and you have your Series 7, you have to 'opt-in' between November 2, 2009 and May 3, 2010. During that 6-month period, make sure a U4 amendment is filed for you, adding the Series 79 registration. That's all you need to do.
• If you miss the opt-in period, you have to pass the Series 79 to keep doing your investment banking business.
• If you're a Series 7 and you just kinda want the Series 79, well, that's not okay. You can't opt-in, because, technically, you have to be engaged in investment banking business to earn the opt-in registration.
• If you're new to the business and were going to get your 7 so that you could work as an investment banker, you can still take your 7 during the six-month period before May 3, 2010...after you pass the 7, do the U4 amendment to add the 79 and voila! It's yours!
• If you're an intern like I was, guess what? You don't have to get the 79 (see the Notice for details on this one--some qualifying factors).
• If you also do general securities business or other business like muni structurings or DPP's or whatever, you need the 7 in addition to the 79.
• If you are a Series 24 who supervises investment banking activities, you now need the Series 79. You can opt-in (see above) by May 3, 2010.
• If you're thinking of being a supervisor of investment banking activities, but aren't yet licenced, the Series 79 will qualify as a prerequisite to the 24. Take both and supervise away! But wait: if you supervise any other securities activities, like trading or retail sales, you'll need the 7, too.
• You know how you can take the Series 66 instead of the 65 and 63 to register as agent and IA in states? Well, the Series 7 is a pre-requisite for the 66...you can't rely on the 79 to do that job. The 79 is, however, a pre-requisite for the 63.

Okay, that's enough of that topic. One little thing...did you see the words "asset sales" above? That's kinda scary for unregistered M&A shops out there who always thought that arranging asset sales didn't require registration. Well, then again, those folks aren't reading this, so why waste my words.

++++++++++++++

Topic 3: U4 Disclosure Questions: no 'wet' signatures

New FINRA Rule 1010 allows firms to amend the U4 disclosure answers without having the rep manually sign the U4 amendment. Instead, you have to: provide the rep with a copy of the amended disclosure information prior to filing and get the rep's written acknowledgement (like an email or signature on internal form) prior to filing that shows the rep received and reviewed the changes. Keep records of this for examiner review.

(Note: My firms had reps answer the new disclosure questions on an internal form, sign the form and return it. To me, this satisfies the new Rule.)

If reps are on military duty, otherwise unavailable or refuse to acknowledge the disclosure information, you should note that in the rep's electronic signature field.

The effective date is July 27, 2009. Notice 09-40 explains that this new rule helps out with the new disclosure questions that have to be answered by November 14....but it doesn't explicitly say that if your firm was conscientious enough to have made all those U4 amendment filings already--that is, before 7-27--then you don't need 'wet' signatures under the new rule. Hmmm. Let's assume you don't, and that your documentation of rep approval of the new disclosure answers will suffice. Wouldn't seem fair otherwise.

Back to the beach. Surf's up!

YES--Material Event Disclosures for 529 Plans

So I should trust my FINRA sources more, that is my conclusion. I've taken my skeptical hat off for now.

Spoke to a very helpful, very pleasant gentleman at MSRB today. He very clearly conveyed this reality: SEC has determined that Rule 15c2-12 applies to municipal fund securities. I'm talking about material event disclosure requirements--G-17 (see blog entry below)--in the context of 529 plans. To the extent municipal issuers file notices on MSRB's new EMMA portal, firms that offer/sell 529 plans MUST review those notices and provide the material event information to their customers prior to the sale. As a practical matter, you won't see many such notices relating to 529 plans.

So here's what you do: build into your procedures this requirement; train your reps on how to use EMMA; supervise 529 sales to make sure disclosures are being made when required.

The EMMA site is easy to use. Go to http://emma.msrb.org/. Click on the '529 Plan Search' box with the graduation cap icon; accept the site terms; in the orange box, select a state and hit the arrow; then look for the plan you are about to sell to a customer. Click on that plan and you'll see links to the disclosure statements and, IF there are material event notices, you'll see a link to those. That is what you'll review and discuss with your customer... ta da!

So, while this is one more thing you have to worry about (and document), it's pretty easy to implement.

It's not a bad idea to inform your customers about the EMMA portal--knowledge is power. That way, you'll be educating your customers as you should.

One more helpful link for you, courtesy of the nice man at MSRB: http://www.msrb.org/msrb1/mfs/mfs7.asp This is the 'securities regulation' page explaining which regs apply to 529 plan sales.

Hmm. Wonder how long it will take before I put that hat back on? Stay tuned.

Update: It's Sunny (and a note on MSRB Rule G-17)

One of my favorite clients just reprimanded me for not updating my blog to correctly identify our NH weather as SUNNY. Which it is. Thanks so much, Mr. Get Back to Work...

Oh, and I just talked to a gentleman at FINRA who was happy I wasn't a reporter when I asked about a rule interp. ?? Are they bombarded these days by the Geraldos of the world who aren't busily churning M.J. rumors? Guess so.

His answer to my question was that, yes, BD's who do nothing but 529 plans--that is, they sell municipal FUND securities, not municipal securities--are required to comply with interpretive material on G-17 about material event disclosures. See Notice 09-35 at http://www.finra.org/web/groups/industry/@ip/@reg/@notice/documents/notices/p119067.pdf .

This means that before having your customer sign onto that 529 plan, make sure you visit MSRB's new EMMA site at http://emma.msrb.org/ to gather and convey important disclosures about the issuer. Document that you did this; and you supervisors: check the records to make sure it's being done. Oh, and update your procedures for this new one.

I dunno. I'm a bit skeptical. I have a call into MSRB. I hope they call back before it starts raining again...

Useful Information on a Rainy Day

I walked to my NEW office this morning without drowning in a puddle. High of 61 today with downpours. Feel sorry for us, here in coastal NH. We deserve your pity.

Few things:

1. Remember the FTC Red Flags Rule? FINRA released its brand new written ID Theft Prevention Program template!--and it has an acronym: ITPP! This is great. Thank-you, FINRA. Now all you small firms that have no idea what this rule is all about, and believe that it is completely duplicative with AML and unnecessary, given that you are a tiny shop that does not use credit reports, does not provide debit cards or checkwriting, and does not extend credit (but wait, you have a clearing firm and your clients may open margin accounts through your firm), can create an ITPP without much effort. And the better news is, if FINRA examines for compliance with this rule like it did with AML, you will have years before your written program actually has to be fully customized and implemented. FTC enforcement of the Red Flags Rule begins August 1, 2009. So get going. Here is the link to the template, courtesy of FINRA:
www.finra.org/customerprotection/redflags.

2. As of August 17 you have to provide a new disclosure to customers. New FINRA Rule 2267 is based on old NASD Rule 2280 (Investor Education and Protection). The old rule applied only to firms carrying customer accounts. Now it applies to everyone. BUT: if your firm has an clearing firm that will make the disclosures for you, you're all set (confirm this with them, ok?). If you have other (or only) customers that aren't serviced by a clearing firm and that don't, for instance, receive statements or confirms, then your firm will have to make the disclosures. An example would be an 'application-way' shop that processes MF/VA applications and does not have brokerage accounts. I'm guessing PP/M&A firms are in this category, too, but let's not expect FINRA to be clear on that (you know how I feel about this subject, right?).

So, if all your customers are receiving statements, etc. from the clearing firm, make sure they'll include the disclosures annually to your customers.

Otherwise, you have to provide the disclosures (annually if you carry accounts). If you don't carry accounts, as I desdcribed above, or have some customers not receiving statements, you have to provide the disclosures at or prior to the time of the customer’s initial purchase, in lieu of once every calendar year.

Disclosures may be provided electronically (yahoo).

Here is what you have to disclose:

1. FINRA Broker Check Hotline Number -- (800) 289-9999;
2. FINRA Web site address -- www.finra.org; and
3. A statement as to the availability to the customer of an investor brochure that includes information describing FINRA Broker Check. ...Harder than it sounds. Here's what I recommend: "You may find information about Broker Check online by visiting this link http://www.finra.org/web/groups/industry/@inv/@tools/documents/industry/p009888.pdf or by calling the Hotline number and requesting a hard copy via mail."

Here's what FINRA says about the due date: "Any firm subject to NASD Rule 2280 that complies with its annual (calendar year) mailing requirement on or after January 1, 2009 but prior to the August 17, 2009 effective date of FINRA Rule 2267 will be deemed to have complied with FINRA Rule 2267 for the 2009 calendar year."

So check with your clearing firm to see it they will have complied with old 2280 by 8-17; if not, you're not in compliance. For other firms (see above), start making the disclosures for new accounts. And what the heck, if you send out an annual disclosure notice with other things, like privacy policy and SIPC info, why not include this one, too?

3. Rule 2821 on Variable Annuities--they FINALLY finalized the rule. And the great news is, they took out that requirement to consider ALL deferred V/A purchases and exchanges as 'recommended.' The rule changes also clarify the 7-day review/approval process and funds transfers in that 7-day period. It's good, and the Notice is written well. Look it up: Notice 09-32 is at http://www.finra.org/Industry/Regulation/Notices/2009/P118955. BUT DON'T start enforcing the rule yet. It's effective 2-8-10. I have a call into FINRA about whether optional compliance before then is okay, but I haven't heard back yet :( . In the mean time, you have the usual 24 hour turnaround period to move funds out and approve the business.

Looking out my window: still raining.

Beat It, Bernie Madoff

"I'm Starting With The Man In The Mirror.
I'm Asking Him To Change His Ways
And No Message Could HaveBeen Any Clearer
If You Wanna Make The World A Better Place
(If You Wanna Make The World A Better Place)
Take A Look At Yourself, And Then Make A Change
(Take A Look At Yourself, And Then Make A Change)
(Na Na Na, Na Na Na, Na Na,Na Nah)"

There you go, the chorus from one of Michael's soul-searching songs. (I did the moonwalk in honor of our beloved--demented--King of Pop...did you? Did you join any Michael Jackson Flashmobs?) This song, Man in the Mirror, did Bernie ever listen to it? Did he, himself, look in the mirror while in the midst of defrauding thousands out of their billions? If he did, his own eyes believed his lies.

Michael's gone and doesn't know the world really did love him; Bernie's gone and finally knows how much the world despises him. Will both men meet soon on one of Dante's circles? I have to believe Bernie will be closer to the chewy center.

Bye for good, Bernie. "They're Out To Get You, Better Leave While You Can.... So Beat It. Just Beat It."