Home -> Law Blog Directory -> Corporate & Securities Law Blogs -> OverRegd - Securities Regulation and Litigation Blog

Corporate & Securities Law

: OverRegd - Securities Regulation and Litigation Blog

FINRA Speaks to Small Firms (Part II)

Last week, as you may recall, I wrote about FINRA's Small Firm Conference, which took place in Chicago, IL on July 16. In this author's opinion, there were so many key points made by the regulators and attendees, I have decided to post a follow-up article to highlight a few additional issues and "best practices" that were discussed.

An interesting point made by one of the regulators was the rise of "social networking" sites like Twitter, Linked In and Facebook and how this will affect compliance review of incoming and outgoing client communications - particularly if brokers attempt to conduct business through use of these websites - a course of conduct seemingly fraught with peril.

There was also a good deal of discussion of Reg S-P and the FACT Act, which govern what information departing brokers may take with them when they leave their firm and protection of client information. Current and proposed amendments contemplate firms having adequate safeguards in place to protect customer account information as well as broadening the scope of "information" so as to protect consumer report and similar information, and requiring firms to develop and maintain a comprehensive program to protect the use of confidential information, including monitoring and documenting this oversight, as well as designating one or more persons to be responsible. Of course, the "devil is in the details," as it remains to be seen what policies and procedures will ultimately be deemed "adequate" under the rules in case there is breach of security. To emphasize the importance of this area, the regulators discussed one SEC enforcement action in particular - In the Matter of LPL Financial Corporation ("LPL"), formerly known as Linsco/Private Ledger Corp., alleging a failure to adopt policies and procedures to safeguard customers' personal information. The conference materials provided a website link to the case - www.sec.gov/litigation/admin/2008/34-58515.pdf

In the LPL action, the SEC alleged that the firm violated Reg S-P (17 CFR § 248.30(a)) (the "Safeguards Rule"), requiring broker-dealers and SEC-registered investment advisers to adopt written policies and procedures reasonably designed to protect customer information. The SEC's complaint further alleged that despite LPL's having been "aware as early as 2006 that it had insufficient security controls to safeguard customer information at its branch offices, LPL failed to implement adequate controls, including some security measures, which left customer information at LPL's branch offices vulnerable to unauthorized access. Between mid-July 2007 and February 2008, LPL experienced a series of computer system security breaches in which an unauthorized person(s) accessed and traded, or attempted to trade, in the customer accounts of several of LPL's registered representatives. As of the date of the "hacking" incidents, LPL had failed to implement increased security measures and adopt policies and procedures reasonably designed to safeguard customer information as required by Regulation S-P. LPL detected the breaches and absorbed the losses in the customer accounts. Nonetheless, LPL's failures left customer information vulnerable to identity thieves or other unauthorized users at the firm's branch offices."  Ultimately, the matter was settled, with LPL agreeing to take various remedial measures to correct any noted perceived deficiencies in its systems and to pay a civil penalty of $275,000.  While this action was resolved in September 2008, the specific reference to it during the conference in conjunction with Reg S-P, suggests that consumer data and privacy protection still remain a prime focus of examinations in 2009.

As far as "2009 Examination Priorities" go, the regulators did not provide a "top 10" list but rather a list of 26 items. In no particular order, those topics include: FTC's Red Flags Rule; Alternative Investments; Cash Alternatives; Supervision; Anti-Money Laundering (AML); Unregistered Resale of Restricted Securities (Penny Stocks); Senior Investors; Foreign Corrupt Practices Act; Circulation of Rumors; Order-Entry Controls; Marking the Close; Trade Reporting; Order Audit Trail System (OATS); Variable Annuities; Protection of Customer Information and IT Security; Outsourcing; Information Barriers; Basic Customer Protection; Excess SIPC Protection Inventory and Collateral Valuations; Funding and Liquidity; Counterparty Credit Risk; Intercompany Reconciliations; Suspense Account Reconciliations; Bank Sweep Programs; Fully Paid Lending Programs; and Sales of Equity Securities. Obviously, some of these have been a focus for several years now, e.g. senior investors and variable annuities - with new areas like privacy protection and outsourcing joining the mix.

At this point, it is anyone's guess as to which of these areas the regulators will focus most of their attention during routine exams in the second half of the year.  But it is probably safe to say that customer privacy and information protection will be at the forefront.

Full post as published by OverRegd - Securities Regulation and Litigation Blog on July 24, 2009 (boomark / email).