Menu

admin

About admin

http://www.warburtonadvisers.com

Posts by Beth Haddock:

Data Breach

Time to Update Risk Assessments & Training

0

This Report is filled with developments you should consider for updating your outreach, training and risk assessments. We hope this will help you get ready for the 2nd half of 2021!

FINTECH DEVELOPMENTS

Custody and anti-manipulation controls remain important for compliance programs and risk assessment priorities particularly as SEC resistance to digital assets continues.

A recent SEC Staff Statement is another negative signal for crypto. Read the latest May Statement Investing Bitcoin Futures Market

SEC continues its focus on whether digital assets are properly registered securities; it charges BitConnect for its $2 billion lending program of alleged unregistered securities.

Insider Trading Bill proposed to create a statutory ban on insider trading that also addresses more contemporary fraud – use of MNPI by hacking or theft when there is no breach of a fiduciary duty.

Weeks after the Colonial Pipeline hack, CNA, one of the largest insurance companies disclosed that it paid $40 million in ransom after it was locked out of its network. Perhaps not coincidently, CNA itself is an insurer of cyber insurance.

Institute for Security & Technology Ransomware Task Force presented a report to the Biden Administration just days before the Colonial hack. The report offers 48 suggestions to increase cybersecurity & some sobering statistics you should feel free to use in your training.
  • 21 Days-Average downtime due to ransomware attacks;
  • 287 Days – Average days it takes a business to fully recover after an  attack
  • $350 Million -Victims paid a ransom in 2020
  • $312,493 – Average ransom payment in 2020
  • 2,400 – U.S. Governments, healthcare facilities and schools were victims of ransomware in 2020

SEC DEVELOPMENTS

Signals for SEC Priorities Continue. On May 6, Chair Gensler testified before the House Committee on Financial Services. Gensler’s testimony indicates the SEC priorities & therefore adjustments for your inherent ratings in your risk assessments such as: gamification to induce trading, payment for order flow and equity market structure. The new Chair indicated that a report is forthcoming.

In testimony a few weeks later, SEC Chair Gensler indicated the regulatory agenda may include testing private fund controls and disclosures, proxy voting changes, ESG claims and crypto assets. May 26 Gensler Testimony
Portfolio Managers & CRO Charged by SEC.  SEC filed a civil action against investment management firm LJM and two of its portfolio managers for fraudulently misleading investors and its Board about the level of risk in its portfolios resulting in $1 billion trading loss. This case also involved personal liability for the chief risk officer who separately settled the claims and is now barred from the industry.
Another Failure to File SAR Case – In the Matter of GWFS Equities, Inc. (May 12, 2021). Over a three-year time period, the firm allegedly failed to detect and report efforts by bad actors to gain access to its processes through the use of improperly obtained PII. During this time, the firm failed to file SARs relating to 130 bad actor attempts.  In another 279 instances, the firm filed SARs, but omitted material information. The firm consented to a cease and desist order, and agreed to pay $1.5 million penalty. This is a good case to add to your annual AML training.

Financial Materiality & ESG – SEC Commissioner Allison Herren Lee made significant remarks in a speech titled “Living in a Material World: Myths and Misconceptions about Materiality” Her remarks focused on the definition of material disclosure standards and whether non-financial or quantitative factors can be material. She refuted the idea that climate and ESG are matters of social or political concerns and not material to investment or voting concerns. Also read the Executive Order to understand this evolving issue and efforts to determine the financial impact of climate change risks. May 20 Executive Order.

June 2, the SEC announced more than $23 million in whistleblower claims.  This is a good reminder to refresh your self-reporting and escalation incentives. It’s costly if your compliance program does not effectively encourage reporting.

Guest Column

by Courtney Lang
ESG is Changing Governance.
In case you missed it, stakeholders brought landmark changes to the oil and gas extraction and production industry at the end of last month. ExxonMobil, Chevron, and Royal Dutch Shell were affected by growing climate concerns amongst shareholders and governments.
After decades of climate disinformation campaigns and unsatisfactory responses to shareholder questions about stranded asset risk, climate risk, and its place in the transition to the low carbon economy, Exxon’s day of reckoning came on May 26th during its annual shareholder meeting. I watched with delight as the company lost two board seats to a small, activist hedge fund, Engine No. 1. My feeling of schadenfreude increased last week, when it was announced that a third Engine No. 1-nominated board member preliminarily won the shareholder vote that was previously too close to call.  If these election results are finalized, Engine No.1-backed board members will make up 25% of Exxon’s 12-member board despite the small activist investor owning only 0.02% of Exxon’s shares. To accomplish this feat, Engine No. 1 was supported by large institutional investors in Exxon such as CalPERS, CalSTRS, the New York State Common Retirement Fund, BlackRock, and Vanguard. Hopefully this coup will drive material changes to Exxon’s core business strategies including shifting to renewable energy and decreased anti-climate lobbying. Furthermore, I am skeptically optimistic that other boards will see this as a wakeup call that maintaining the status quo may cost them their board seats.

Meanwhile at Chevron, shareholders voted 61% in favor of the proposal to cut Scope 3 carbon emissions but missed the majority vote by 2% on shareholder proposals to limit lobbying and to report material risks to business posed by Biden’s and the EU’s Net Zero plans.

On the same day, a Dutch court ruled that Royal Dutch Shell must decrease its 2019-level greenhouse gas emissions 45% by 2030 on the grounds that contributing to global climate change violates human rights. I agree wholeheartedly.
ezgif.com for blog post

Proactive Regulatory Guidance

0

This month we present several examples of proactive regulatory guidance. We recommend you use this optimistic time of year to review your programs and proactively communicate these developments to your board, management and other stakeholders. Please reach out. We are here as a resource and look forward to hearing from you.

FINTECH

Interesting case to watch re: regulatory strategy for offering products and global securities requirements. European regulators are examining whether Binance, one of the world’s biggest cryptocurrency exchanges, has complied with securities rules over its launch of trading in stock tokens.

SEC Commissioner Advocates for Facilitating Tech Innovation. This Token Safe Harbor Proposal 2.0 from Commissioner Peirce is an interesting indication for product development and discussions about when it is appropriate to proactively reach out to regulators.

Risk of Cryptocurrencies Study – Surprising Perspective from a Former CIA Head including:

  • The broad generalizations about the use of Bitcoin in illicit finance are significantly overstated; and
  • The blockchain ledger on which Bitcoin transactions are recorded is an underutilized forensic tool for intelligence gathering and highly effective crime fighting.

SEC DEVELOPMENTS

SEC Commissioner asks Questions to Asset Managers about ESG to inform potential regulatory efforts.

Whistleblower awards claims are a good reminder to make sure your internal reporting process is fulsome so complaints are reported internally providing an opportunity to address them before regulatory action.

ESG

Considering Investing or Starting an ESG Fund? This SEC Division of Examinations Risk Alert is helpful for compliance officers. Of note – the comments about Compliance Officers’ ESG experience and the inconsistency between claims and practices. This could be converted into a roadmap for a mock audit.

Commissioner Hester Peirce’s recent public statement “Rethinking Global ESG Metrics” focuses on the perspective of ESG as a good investment approach (as opposed to purpose-driven), the complexity of shifting to a stakeholder (as opposed to shareholder) orientation and the challenge with aligning with European standards in drafting appropriate disclosure statements.

For personal trading requests or capital raising activities, SPACs are in the spotlight.

 

Guest Column

by Courtney Lang

Last month, two people said to me on separate occasions, “you can’t swing a dead cat these days without hitting a SPAC.” Having never heard that expression before, I wondered why everyone was suddenly talking about dead cats, who was killing all of these cats, and why on Earth I would swing one. I hoped it wasn’t a morbid new TikTok trend. Luckily (for the cats) it is not. However, it was understandable that everyone was metaphorically hitting SPACs with said cats. Those things were everywhere. SPAC IPOs have raised more than $100 billion in 2021 thus far. SPACs have become so popular that the SEC even released an investor alert warning the public not to invest in certain SPACs based on celebrity endorsement. Which leads me to my own investor alert: if you are investing in something solely because A-Rod told you to, please log off of Reddit, slowly back away from your computer, and consult an investment professional immediately.

A SPAC (Special Purpose Acquisition Company), often referred to as a “blank-check company,” is a public shell company that raises funds to acquire a private company and take it public. It is viewed as a quicker, easier way for a company to go public because it requires less disclosure than the traditional IPO route does. When raised, a SPAC has no operations and its only business plan is to take a company public. Which company? They might not know yet. SPACs have 18-24 months after raising funds to identify firms they can merge with or they will be liquidated and the purchase price plus interest will be returned to investors.

Some hail SPACs as a way to democratize investing. At an average of $10 per unit (with a unit being one share plus one fractional warrant), SPACs provide individuals with the opportunity to invest in companies that would otherwise exit to private funds with high investment minimums. Individuals get the chance to invest with more upside than they may typically encounter, though this may come with a correspondingly higher level of risk that the financial markets usually hinder unaccredited investors from taking. Investors are accredited by providing proof of access to liquid cash via salary or savings or proof of financial knowledge through passing FINRA Series exams. Some think it is paternalistic to require an investor to be accredited before they invest in certain riskier types of securities. They argue that just because someone is not currently wealthy or working in the financial industry does not mean he or she is incapable of making intelligent and informed investment decisions.

On the other side of the coin, some fear SPACs take advantage of uninformed retail investors while the already wealthy sponsors get richer. They worry that fewer disclosures may equate to less due diligence prior to investment. In the first quarter of this year, investors sued eight companies that combined with SPACs. Also, individual investors don’t have the power to negotiate terms with SPACs in the way that an LP in a private fund may be able to. Thus, the terms for SPAC shareholders aren’t typically as favorable as the terms of private funds. Some have even suggested that the misalignment of incentive structure between the shareholder and the sponsor, wherein the sponsor is incentivized to complete a merger rather than liquidate and return shareholder capital, presents an unethical conflict of interest.

Ultimately, whether SPACs continue to amass billions of dollars will depend on the SEC, among other market conditions such as investor demand and the number and market value of potential acquisition targets. According to Dealogic, SPACs raised roughly $17 billion during the first 20 days of January, but that fell to $2.5 billion during the corresponding period in April, likely due to uncertainty surrounding SEC regulations. The SEC may release guidance on the treatment of warrants on a SPAC’s financial statements as liabilities and whether the legal safe harbor for forward-looking projections applies to SPACs.

April 2021 - blog photo

Fintech and SEC Developments

0

We are optimistic as spring is in bloom and many of the annual filings and reports are behind us. We hope you enjoy this edition which is full of developments for you to consider as you focus on keeping pace in 2021. Please reach out with feedback. We love to hear from our readers.

Fintech

The consensus continues towards seeking more certainty with regulation and enforcement in the virtual asset sector: Former SEC Chairman Jay Clayton on regulation of digital assets; UK regulators announce increased enforcement to combat market manipulation.

Read this Stablecoin white paper to learn more about this growing digital asset class.

How will a T+0 environment change your compliance risk assessment? Learn more about this amazing development. T+0

FinCEN Innovation Hours Program issued report on Emerging and Future Role in AML Act Implementation. The report covers innovative solutions for AML compliance including evolving themes and regulatory priorities.
In the 2021 FINRA Report on Examination and Risk Monitoring Program, FINRA highlights emerging cybersecurity risks, exam observations and effective practices. It may not be a surprise that this topic should be a priority for your compliance plan. One of the take aways from the report is an increased number of cyber or technology related incidents including:
  • System outages;
  • email and account takeovers;
  • fraudulent wire requests;
  • imposter websites; and
  • ransomware

SEC Division of Exams highlights SAR risks: Read this new RISK ALERT “Compliance Issues Related to Suspicious Activity Monitoring and Reporting at Broker Dealers.”

SEC DEVELOPMENTS

SEC Alleges No Basis for 506(b) Exemptions and Material Misrepresentation
SEC v. Jason P. Wooten; Ronald Steven; Family Tree Estate Planning, et. al. The SEC filed a complaint alleging the sale and material misrepresentations of investment funds offered to more than 550 investors. It alleges the offering did not qualify for a Rule 506(b) exemption as the investors were neither accredited nor sophisticated. A reminder to add onboarding to your compliance testing plan to confirm there is a strong eligibility process.

SEC Alleges Materially Misleading Fund Statements

SEC v. Paul Haarman, Patrick Duke and APEG Energy GP, LLC. The SEC has filed a complaint alleging factual misrepresentations and omissions in offering documents, and written and oral communications concerning limited partnership securities in an investment fund. The statements included that the fund offering “guaranteed returns with no risk”. Allegations also include misrepresentations about biographical information including exaggerated expertise. This is a good reminder to confirm all bio information to make sure credentials are not overstated.

Marketing Compliance FAQs – Changes to Advertising and Solicitation Rule

Ahead of the effective date of the new Advertising Rule, the SEC has updated its FAQs. March 18 Update to FAQs
SEC and the Dark Web – A Gentlemen’s Insider Trading Forum on the Dark Web
In the first of its kind, the SEC Filed an action involving alleged securities violations on the dark web. The  SEC charged the defendant with perpetuating a fraudulent scheme to sell what he deemed “insider tips’ that he falsely described as material, nonpublic information from insider trading forum or corporate insiders.

Contemporaneous vs. Edited Notes

In re David B. Tysk, addressed the issue of making contemporaneous notes and carefully editing such notes. As in this case during regulatory investigations, regulators may assume editing of notes is inappropriate. One take away from the case is to carefully respond to all requests and use a caveat such as “based upon information and belief” to preserve the ability to explain responses were in good faith. Another take away is to reminder to understand and, when appropriate, consult with any tech provider to make sure you understand the features for version control, archiving and storage. Ultimately, in this case the charges against the defendant were dropped but there was a lot of time and money spent to litigate whether revisions to notes were inappropriate. This case also raises interesting questions about record retention policies and whether policies should mention editing is permitted when version control protocols are implemented.

ESG

Guest Column

by Courtney Lang

The SEC cultivated a fertile regulatory environment for ESG investing throughout the first quarter of this year. Of the five ESG regulation wish list items laid out by Bhakti Mirchandani in January, the Biden Administration has delivered on three:
  • The DoL Employee Benefits Security Administration released an enforcement policy statement on ESG investments, proxy voting by employee benefit plans. The statement encourages ESG investment by declaring that the previous final rule under the Trump Administration had a chilling effect on ESG integration in investment decisions and did not align with the present public health obstacles posed by climate change.
  • The SEC released a Statement on the Review of Climate-Related Disclosure, stating plans to review the extent to which public companies address the topics identified in the 2010 guidance on the materiality of climate change, assess compliance with disclosure obligations under the federal securities laws, engage with public companies on these issues, and absorb critical lessons on how the market is currently managing climate-related risks.
  • The SEC created a Climate and ESG Enforcement Task Force to develop initiatives to proactively identify ESG-related misconduct, starting with identifying any material gaps or misstatements in issuers’ disclosure of climate risks under existing rules.
The remaining two items are in sight:
  • SEC Division of Corporate Finance acting director John Coates signaled that the SEC may be in favor of the IFRS Sustainability Standards, a single global reporting framework.
  • Senate Banking Committee Chair Sherrod Brown introduced a joint resolution to overturn the amendment made to SEC Rule 14a-8 under the Trump Administration that would strip power from smaller shareholders. To overturn this recently adopted rule, both houses of Congress must vote in favor and President Biden must sign.
Additionally, Marty Walsh was confirmed as Secretary of Labor. The senate confirmation vote will take place on the week of April 12th for Gary Gensler, nominee for Chairman of the SEC. If Gensler is confirmed, he will inherit a contentious SEC agenda, not least of which will include SPACs. Reuters recently reported that the enforcement division of the SEC sent letters to several large banks inquiring about their SPAC dealings. The banks were asked to provide the information voluntarily, rather than as part of a formal investigation.
compliance March 2021 blog photo3

Spring Refresh – Compliance and Fintech Developments

0

With spring around the corner, it’s a good time for clean-up and a refresh of regulatory filings, testing and policies. This edition encourages a reset on expectations for OFAC, privacy, digital assets and disclosures. This spring we are also launching a new NSCP Fintech & Blockchain Round Table for a fresh approach to networking, bench marking and staying ahead of regulatory trends. Save the Date April 13 @ 12:30. Details to follow.

Fintech and Blockchain Developments

OFAC Enforcement Cases

Recent Office of Foreign Assets Control (OFAC) enforcement cases are a reminder that screening names alone is not an adequate sanctions compliance program; the location of transactions through IP address surveillance is also crucial.  This OFAC enforcement case against BitPay is another example of OFAC citing companies for violations based, at least in part, on a failure to implement IP geo-blocking.

BitPay, the Atlanta-based payment processor, settled claims it maintained an inadequate sanctions compliance program for a penalty just over $500,000. Notably, penalties were reduced for BitPay’s cooperation and remediation efforts. The sanctions related to digital currency transactions on the BitPay platform between individuals located in Cuba, North Korea, Iran, Sudan, Syria, and Crimea and merchants primarily in the US. BitPay had screened its customers, against US sanctions lists but, OFAC alleged that BitPay had reason to know that purchasers were located in sanctioned jurisdictions, because the company had location information including IP address data. OFAC noted that this case “emphasized the importance of screening all available information including IP addresses and other location data of customers and counter-parties to mitigate sanctions risks….”

Likewise, late last year,  OFAC settled an enforcement action against another digital asset company, BitGo. BitGo incorporated IP address screening into its security process for account log in, but it failed to check the data against sanctions lists for transactions.

OFAC Compliance Program is more than a KYC exercise. This guidance is a good reminder to also review, test and refresh sanctions software and your sanctions risk assessments for changes to business and any data feeds.  Sanctions Enforcement Blog

Privacy Developments

The Biden administration is expected to join the states’ focus on privacy issues which could result in increased compliance obligations. In addition to watching for implementation regulations for the new California privacy law,  watch for further developments from the Federal Trade Commission (FTC).  In 2019, the FTC proposed amendments to the Gramm-Leach-Bliley Act (GLBA). With the recent influx of cyber security events, the amendment is expected to receive attention this year. The GLBA proposed amendment includes:
  • Broadening the definition of security events to include any unauthorized access;
  • Expanding audit trail obligations;
  • Mandating real-time monitoring of digital financial services to improve fraud detection; and
  • Time-limiting data retention.

Recent SEC Actions

License and Business Development Reminders

SEC v. Moleski. In this recent complaint, the SEC alleges defendants promoted and solicited investments in private funds they controlled. In doing so, the SEC claims defendants made a series of misrepresentations including false claims that: “investor funds would be put into “high grade investments”; the investment objective was “phenomenal returns:’ a “full-time licensed broker would monitor the investments daily;” “investors would achieve financial freedom;” and, that “we treat you money like it’s our own.” Defendants are also alleged to have solicited individuals to purchase securities without proper securities registrations. This is a good reminder to stay aligned and connected to business development including which individuals are paid for success.

SEC v. Coinseed, Inc. In another recent complaint, the SEC brought an action against the founder of Coinseed. The complaint alleges that defendants inappropriately offered and sold tokens, called CSD, to the public. Purchasers were allegedly told that they would receive a percentage of revenue from certain fees generated by the business, and that their funds would be used to develop the firm’s business which was claimed to include a mobile phone app that would enable users to purchase and sell digital assets. No registration statement was in effect. The complaint alleges violation of Securities Act Sections 5(a) and 5(c) and is a good reminder to work carefully with experts for any capital raising efforts. The SEC’s recent Risk Alert covering digital assets is another important development. Compliance officers can audit their compliance programs against the 8 pages of issues.

ESG Investing and Sustainability Developments

ESG Developments to watch include the Department of Labor (DOL) leadership. There are indications that the DOL rules curbing ESG retirement investments may be revisited by new DOL leadership.

The first sentence of the SEC’s recently announced exam priorities mentions the need to appropriately address climate-related risks.

How are you reviewing and sourcing climate-related disclosures?  In the wake of the severe storm in Texas, this is an opportunity to review your process and test its effectiveness.  Two practical questions to ask are 1) Is the process objective and documented? 2) Have you permitted use of media sources or non-media institutions such as the Task Force on Climate-related Financial Disclosures (“TCFD”)?

Guest Column

by Courtney Lang

When I think of climate change affecting Texas, I immediately picture sea level rise and stronger hurricanes. My brain can easily associate these occurrences with a warming planet. Although I have a formal education in climate science, the counterintuitive effects of climate change such as increasing snowfall in certain regions aren’t top-of-mind. Nonetheless, the intensity of the North American winter storm was most likely caused by climate change. The rate of warming in the Arctic is faster than that of the rest of the planet because of the ice-albedo positive feedback loop wherein warmer temperatures cause snow to melt over land-ice, reducing its “whiteness” and therefore its ability to reflect the sun’s energy back to space. Thus, the planet absorbs more of the sun’s energy, and gets even warmer, and so on. As the Arctic region warms, the difference in temperature between the typically circular-flowing “polar vortex” of colder winds in the North Pole and warmer winds in North America, called Westerlies, decreases thereby decreasing pressure and allowing the polar jet stream to meander south and cause large storms. Here is a helpful visualization.

To write about the above phenomenon, I had to Google it, cross-check my notes from climate science courses, and explain it to my mom for good measure. While much of nature seems intuitive to us, earth science is not common knowledge. But it must become common if we are to effectively prepare for climate change. Investors can avoid losses and reap benefits by understanding and evaluating geographical climate risks to real assets as showcased by this storm. The TCFD provides a framework to consider these risks in context of different climate change scenarios.

Take Texas’s energy grid as an example. Despite what many believe Fox News has wrongfully stated 128 times thus far, wind power is not to blame for the tragic losses of life. Fossil fuel-created climate change is most likely to blame for the intensity of this storm and the vast majority of the power outages in Texas were caused by coal and gas-fired power plants. However, wind and fossil fuel-fired power plant projects alike may have benefitted financially from selecting equipment better suited for climate change and lives could have been saved by a more resilient energy grid. Wind turbines can be equipped with de-icing technologies such as a special coating that prevents ice from forming. The specific technologies chosen for Texas would need to be conducive to the typically warm climate and rare wet, icy winter events. Similarly, fossil fuel-fired power plants, wells, and pipes, can be equipped with devices that combat freezing. Current Texas energy infrastructure could be retrofitted and new builds could incorporate winterization technology from the start as long as it does not significantly compromise the output of power plants as climate warms in the region. In the event of another storm like this, power plants that can operate will benefit financially from high energy prices due to decreased supply and increased demand on the grid. 

Much of United States infrastructure needs to be retrofitted and built with climate change scenarios in mind. I hope the tragedies and financial losses caused by this winter storm can serve as a wake-up call to all investors, owners, and operators of real assets in regions likely to be affected by climate change.
compliance February 2021 cover photo BLOG

Compliance Trends – Data Privacy, ESG and Risks

0

This month we cover increasing cyber risks and reg developments such as the Everalbum settlement and ESG guidance.  As you consider your annual review of compliance and governance controls, refresh regulatory filings and keep pace with Q1 work, use the Warburton Report as a helpful resource to track developments and prepare training content.

Data Privacy and Risks

The FTC recently entered into a settlement with Everalbum concerning its use of AI for facial recognition. The FTC ordered Everalbum to delete any facial recognition models and algorithms it developed using photos or videos uploaded by its users without their consent. Previously FTC commissioners had allowed violators to retain their algorithms and technologies, and just delete the illegally gained data. This case raises new concerns about use of biometric technology, privacy considerations and trends to watch. Consider covering this case in training to show the evolving standards for use of customer’s data. The concerns involve more than protecting personally identifiable information (PII).  Remedy of Destruction.

January 28, 2021 was Data Privacy Day, an annual global effort that generated awareness about the importance of privacy. Pew Research Center reported that 79% of Americans feel an increasing lack of control of their personal data. CSIAC recommends businesses follow many of the best practices and requirements financial services companies have built in to their internal controls:

  • Follow reasonable security measures to keep individuals & data protected and save from unauthorized use;
  • Consider adopting a privacy framework;
  • Conduct an assessment of data collection practices including the privacy lase and regs that apply to your business;
  • Maintain oversight of partners and businesses and their collection and use of your client’s personal data; and
  • Be open and honest about collection, use and sharing of consumers’ personal information.

Consider calendaring awareness training on January 28 each year.

Cyber risks and ransomware attacks are on the rise as is indirect funding of organized crime by insurance companies processing claims to those who paid ransoms to regain access to data and systems after hacking attacks. UK National Cyber Security expert,  Ciaran Martin calls the situation “close to getting out of control” due to the lack of legislation preventing insurance claim payouts for such ransom demands. This is a good reminder to discuss the topic with your board and/or senior management to consider options before there is a crisis.

Cyber Risks in Asia: The Monetary Authority of Singapore issued revised its Technology Risk and Management Guidelines.

Regulatory Developments

In December, the SEC adopted a new Marketing Rule. The new rule is not effective until 18 months after it is published in the Federal Register. Further guidance is expected this year; however, the rule release includes advice based on existing SEC no-action letters. So it pays to review your program in the event you are subject to an exam and/or changes in market conditions. See the article in the Resources section for an overview of the potential impact on investment advisory business development.

On January 1, 2021, Congress overrode President Trump’s veto of the National Defense Authorization Act (NDAA) for the 2021 fiscal year. The NDAA includes the Anti-Money Laundering Act of 2020 (AMLA), the first major reform of the U.S. anti-money laundering (AML) since the 2001 USA PATRIOT Act. The updates to the AMLA include:

  • Creating a non-public registry that tracks the beneficial owners of certain corporations
  • Enhancing the AML Whistleblower Program similar to the Dodd-Frank Act’s SEC Whistleblower Program
  • Expanding US regulators’ statutory authority to seek documents from foreign financial institutions
  • Increasing penalties for BSA and AML violations
  • Allowing Suspicious Activity Report (SAR) sharing with foreign affiliates
  • Establishing priorities to govern AML/CFT policy
  • Creating an annual reporting requirement to Congress of all Department of Justice (DOJ) settlements involving the Bank Secrecy Act (BSA)

Corporate Governance

McKinsey’s recent report on the defining trends for 2021 and beyond highlights the importance of keeping pace with changes in fintech and governance. Read the report to examine trends in digitally enabled productivity, stakeholder capitalism and the potential impact of the trends on your business and compliance risk assessments.

In a recent Harvard Business Review article, the author considers how shareholder centric or “agency theory” of governance is giving way to a model which focuses on what we have referred to as “sustainable governance” or a stakeholder focus where the priority is the health and resilience of the company itself. See Covid-19 impact on Corporate Governance.  If your firm is considering ESG concepts, this is an important concept to understand and track.

ESG Developments

Following the CFTC published report prepared by the Climate Related Market Risk Subcommittee, SEC acting Chair, Allison Herman Lee and Commissioner Caroline Crenshaw issued a joint statement regarding the failure of the SEC to address climate risk and seek better disclosure requirements under Regulation S-K.

Executives from Bank of America, Mastercard, KPMG, and about 60 other large companies announced on January 25, 2021, they’ll be adopting a new reporting framework for ESG in partnership with the World Economic Forum.

by Courtney Lang, Guest Columnist

Before President Biden’s inauguration, I outlined his administration’s top five opportunities to advance and repair the state of ESG investing in the U.S. President Biden’s nominees for Secretary of Labor, Martin J. Walsh, and Chair of the SEC, Gary Gensler, are strong picks to do just that.

As mayor of Boston, Walsh launched an ESG Investment Initiative with $200 million committed during his tenure. In 2020, Walsh was named Chair of Climate Mayors and Boston went to market with its first-ever series of green bonds, issuing $24 million to fund energy efficiency projects in the city. Given Walsh’s history of support for sustainability, those who want the DOL to include ESG factors in the definition of “pecuniary” for ERISA plan fiduciaries may remain reasonably optimistic.

Gensler’s track record on increased regulation and enforcement as former Chairman of the Commodity Futures Trading Commission following the Great Recession has many expecting the SEC to mandate ESG and climate-related disclosures under his leadership. In collaboration with Active Chair Allison Herren Lee and Caroline Crenshaw, Gensler’s confirmation could bring about a 3-2 consensus in favor of ESG on important matters. With Gensler at the helm, the SEC could enforce past guidance on the materiality of climate change, comment on the IFRS Sustainability Standards, establish an internal ESG task force, and reverse the amendment made to SEC Rule 14a-8.

Copy of Charcoal Photo Sustainable and Energy Efficient Architecture Presentation

Compliance & Sustainable Investing in the First 100 Days

0

We wish you the best in 2021. This year is expected to be a year of change, especially as it relates to issues about the future of finance – blockchain, ESG and sustainable governance programs that deliver a compliance ROI. As always, we are here as a resource. Please reach out with questions and we hope you find this edition of the Warburton Report helpful and interesting.
Welcome to our guest columnist Courtney Lang!

Compliance Trends

Mega trends to watch this year include ESG rule-making from the SEC, privacy and data governance developments and new leadership in the federal government and regulatory agencies. In this edition, we cover some of those themes.

Sustainable Investing in the First 100 Days

We anticipate constructive changes for ESG investing in 2021, aided by the Biden Administration and increased collaboration among sustainability reporting entities. There are many ESG investing developments to track  To help frame the issues to watch, keep these 5 topics in mind.

Guest Column

The Biden Administration has the following opportunities to advance and repair the state of ESG investing in the United States, as outlined by Bhakti Mirchandani in Forbes.
  • Define Pecuniary Considerations for Pension Investments to Include Material ESG Factors
  • Commit Resources to Enforce the SEC’s 2010 Guidance on the Materiality of Climate Change.
  • Establish SEC Internal and External ESG Task Forces
  • Comment on IFRS Sustainability Standards and Develop Global Sustainability Disclosure Requirements in conjunction with leading reporting organizations
  • In September, CDP (formerly “Carbon Disclosure Project”), Climate Disclosure Standards Board (CDSB), Global Reporting Initiative (GRI), International Integrated Reporting Council (IIRC), and Sustainability Accounting Standards Board (SASB) released a statement of intent to work together towards comprehensive corporate reporting. Climate-related reporting will be in line with TCFD (Task Force on Climate-related Financial Disclosures) recommendations. Collaboration among these groups could benefit writers and consumers of corporate sustainability information as frameworks morph and grow to complement each other.
Additionally, the Biden Administration could reverse the amendment made to SEC Rule 14a-8 under the Trump Administration. The amendment requires higher ownership thresholds for filing shareholder proposals; thus, it strips power from smaller shareholders.
by Courtney Lang, Guest Columnist

Consider adopting a compliance review for all ESG-related statements to confirm they are objectively supported with written evidence for each factual statement; most importantly, for statements related to performance. Although the new SEC Marketing Rule is not effective yet, this is a good practice to start to socialize.

Data Governance and Marketing 

Use of data in marketing is another complex issue to watch in 2021. In addition to the new privacy regulation in California and on Capitol Hill, as mentioned above, the SEC recently released its new marketing rule. We encourage compliance and risk officers to consider a re-fresh (or creation) of a data map.  Requirements for use of data particularly for marketing will be easier to prioritize if there is a detailed map of current and anticipated use of data.
Interesting lessons from a recent French Data Protection Authority case highlighted below. The case provides good reminders about obtaining informed consent for use of cookies, the regulatory environment in Europe and the ease of investigations via public sites.
CNIL, the French data protection authority, issued fines totaling €135 million in a new ePrivacy directive case against Google LLC, Google Ireland and Amazon Europe. CNIL launched investigations into the companies’ cookies practices including the failure to obtain users’ consent to use and the failure to inform users about the right to object to the use of cookies. CNIL noted that the websites immediately dropped cookies upon a user’s visit to the Google and Amazon websites prior to communication concerning use of cookies and obtaining consent. Google and Amazon currently are under an injunction to comply within three (3) months of the December 7, 2020 order, and a penalty of €100,000 a day until compliance.

Regulatory Guidance

At the end of the year, we saw the continued momentum in fintech and blockchain led to developments about custody of digital assets and further approval of use for payments and settlements.

Custody of Digital Assets

Although the recent request for comment isn’t definitive, it is helpful for compliance officers considering safekeeping and custody of digital assets to read the “measures a broker-dealer can employ to comply with Rule 15c3-3 and mitigate these risks.” See page 8-13 for the 7 steps firms should consider. A compliance officer could review these mitigants with the business and rate controls against these proposals.  Custody Of Digital Assets

OCC Support for FinTech

The Office of the Comptroller of the Currency (OCC) published a letter clarifying national banks’ and federal savings associations’ authority to participate in independent node verification networks (INVN) and use stablecoins to conduct payment activities and other bank-permissible functions. OCC Guidance

Disclosures & Fees

At the end of the year, the SEC settled several cases. Below is a highlight of one with a reminder that following the flow of funds and critically reviewing disclosures remains a priority.
In the Matter of Voya Financial Advisors, Inc. (Dec 21, 2020) the SEC alleges Voya violated Advisor Act Sections 206(2) and 206(4). It claims that Voya breached its duty by failing to disclose 1) it received 12b-1 fees on certain transactions and 2) was paid certain fees from an unaffiliated clearing broker for some transactions, and that it caused certain advisory clients to pay higher fees in the form of upfront fees when purchasing certain products, when the same products were offered with waived commission for other clients.
To settle the action, Voya agreed to implement several undertakings including hiring an
independent compliance consultant and notice to clients; it consented to entry of a cease-and-desist order and censure, as well as disgorgement of $11,547,820, $9 million in penalty and prejudgment interest.
Year-End and 2021 Planning

Year End and 2021 Planning Reminders

0

Compliance Trends

Revamp of FTC Data Privacy Enforcement

On October 16, 2020, FTC Commissioner Slaughter delivered the keynote address titled “Confronting Cybersecurity and Data Privacy Challenges in Times of Unprecedented Change”. Slaughter proposed important changes to the enforcement regime. Below is a summary. Compliance Officers should track potential developments including personal liability for those that participated in the illegal practices or “had authority to control them.”

  • Utilization of more meaningful deterrent remedies including a combination of injunctive relief and monetary sanction;
  • Expand corporate accountability by naming corporate executives as individual defendants;
  • Increased relief to consumers including monetary relief and direct notice of violations;
  • Expand efforts to curb abusive data practices from AI and machine learning, as well as the use of data to increase levels of children and teen engagement on social media;
  • Expand the Commission’s authority by reviving the Magnuson-Moss rulemaking; and
  • Pleading not just deception in a complaint but also pleading “unfairness”. e. Failure to take proper care of consumer data is illegal even if the wrongful actor is not deceptive about it.

New Standards: Anti-Corruption and Ethics are Core to ESG

A recently released report included important clarification about the importance of compliance and compliance officers in ESG efforts. The International Business Council (IBC) of the World Economic Forum(WEF), in collaboration with the Big 4 accounting firms, released a white paper, “Toward Common Metrics and Consistent Reporting of Sustainable Value Creation” which recommend a set of common ESG metrics and disclosures. It shows the G in ESG should include an analysis of ethics and compliance.

Recent Guidance

CCO Liability

SEC Commissioner Peirce spoke on October 19, 2020, at the NSCP National Conference.  Below are some practical take-aways for you to consider as you review your efforts in light of Commissioner Peirce’s comments.

  1. Manage Personal Liability: Are your policies written so the CCO approves policies without business approval first? This may be a helpful reminder to consider a change to policy approval governance so adequacy of policies and procedures involves a fulsome review, discussion and approval by the business.
  2. Document Compliance Budget and Requests for Resources: Are you documenting your efforts to align resources and professional development and training? Documentation via issue tracking and/or metrics and budget requests can be useful.

“The Commission has declined to impose personal liability on compliance officers who were ill-equipped for their jobs, who were denied the resources necessary to do their jobs, or who were genuinely over-burdened with other duties.“

  1. Track Discussions About CCO Liability for Negligence: How are you tracking developing expectations? Be aware of liability for negligence and track potential changes to the CCO framework.

“In contrast, to establish in an administrative cease and desist proceeding that a compliance officer was the cause of a company’s violation, it is only necessary to show that the individual committed an “‘an act or omission the person knew or should have known would contribute’” to the violation.  The phrase “should have known” is “classic negligence language,” and the Commission and courts both have concluded that it sets a negligence standard for liability. Thus, where a company has committed a violation that does not require scienter—such as failing to have sufficient policies and procedures—a compliance officer can be held to have caused the violation based on her own negligent conduct.”

Cryptocurrency

The Department of Justice published a report titled “The Cryptocurrency Enforcement Framework” on October 9, 2020. It provides an overview of the asset class and complex regulatory regime focused on AML and other anti-fraud risks.

SEC Enforcement Annual Report

On November 2, 2020, SEC Division of Enforcement published its annual report for fiscal year 2020. The report outlines its 2020 accomplishments, lists noteworthy enforcement actions, as well as covers areas of strategic change. This is a good time of year to review the report and the SEC examination priorities as you conduct your annual review. Make sure your priorities are aligned with regulatory expectations and risk assessments, testing and policy reviews address any gaps. OCIE 2020 National Examination Program Priorities

Adequate Disclosures and Support for ESG Claims

Adequate Disclosures and Support for ESG claims

0

ESG Developments

Adequate disclosures and support for ESG claims continue to be a priority and a trend to watch. Warburton is here to help support your efforts including serving as an independent verifier of your claims.

Early this year, the SEC Investor Advisory Committee made recommendations relating to ESG Disclosures. Under current SEC regulations and guidance, the disclosure of ESG issues is required only if “material”― information regarding an ESG issue is required to be disclosed only if it would be viewed as significantly altering the “total mix” of information available for investor. In September 2020, at a “Virtual Roundtable on the Role of Asset Management in ESG Investing” hosted by Harvard Law School, SEC Commissioner Hester Peirce cautioned against a standardized formula approach to ESG disclosures. Ms. Peirce stated that although she understood the requests for the SEC to establish a mandatory framework for ESG disclosures, she believes the SEC should adhere to its “tried and true principles-based disclosure framework.” Ms. Peirce raised concerns that a prescriptive approach to ESG disclosures would have negative effects including increasing costs, would be contrary to the SEC’s “principles-based disclosure framework,” which is “rooted in materiality,” and not guarantee consistency, as companies may apply ESG metrics to the specific characteristics of their “operations, judgments and assumptions.”

In September the CFTC published the report, Managing Climate Risk in The U.S. Financial System. The report lists a set of 53 recommendations that regulators together with the private sector should initiate as soon as possible including:

  1. The U.S. should establish a price on carbon. It must be fair, economy-wide, and effective in reducing emissions consistent with the Paris Agreement. This is the single most important step to manage climate risk and drive the appropriate allocation of capital.
  2. All relevant federal financial regulatory agencies should incorporate climate-related risks into their mandates and develop a strategy for integrating these risks in their work, including into their existing monitoring and oversight functions;
  3. Financial authorities should consider integrating climate risk into their balance sheet management and asset purchases, particularly relating to corporate and municipal debt;
  4. Regulators should consider additional, appropriate avenues for firms to disclose other substantive climate risks that do not pass the materiality threshold over various time horizons outside of their filings;
  5. Regulators should consider that a growing number of companies are creating greenhouse gas reduction targets and strategies out to the year 2035 or 2050, and targeted disclosure related to these items may be appropriate to facilitate robust efforts toward this positive trend; and
  6. Financial regulators should consider the following principles for effective climate-related disclosures:
    • Disclosures should represent relevant information.
    • Disclosures should be specific and complete.
    • Disclosures should be clear, balanced, and understandable.
    • Disclosures should be consistent over time.
    • Disclosures should be comparable among companies within a sector, industry, or portfolio.
    • Disclosures should be reliable, verifiable, and objective.
    • Disclosures should be based on current consensus science (and updated as the science evolves) and the best available projections regarding climate change impacts.
    • Disclosures should be provided on a timely basis.
Checklist for Auditing a Fintech Compliance Program

DIY Fintech Compliance

0

To support the financial services industry you may not trigger the same regulatory compliance requirements as of your customers, but basic compliance is still required in many jurisdictions as well as by contract.  Below are 3 steps toward creating your own compliance program.

Confirm you have Privacy, Cookies, Cyber-Security and Information Security policies and procedures including breach reporting. Also consider the following:

  • Designate a CISO/Privacy Officer
  • Consider security standards such as NIST
  • Create a data map and risk assessment of information collected and used including non-US information, employee information etc.
  • Determine due diligence standards and agreement terms for service providers and vendors. Review and confirm terms previously agreed to re: existing agreements
  • Calendar training, testing of data controls & annual review of your policies
  • Consider changes to use of data to streamline compliance

Confirm you have applicable sanctions (OFAC) and anti-money laundering (AML) policies and procedures. Also consider the following:

  • Designate an AML Officer
  • Consider work flow for know your customer (KYC) and to screen vendors
  • Consider if your company has an obligation to conduct transaction monitoring and file suspicious activity reports (SARs)
  • Create a risk assessment for customers and vendors
  • Determine due diligence standards and agreement terms for service providers and vendors. Review and confirm terms previously agreed to re: existing agreements
  • Calendar training, testing of data controls & annual review of your policies
  • Consider changes to the business plan to streamline compliance

Confirm your company, investors and board agree to other governance as needed, keeping in mind the Department of Justice (DOJ) sentencing guidelines continue to give credit to companies with well-designed compliance programs. Also consider adopting the following:

  • Consider a Code of Conduct and a Code of Ethics to address employee conflicts.
  • Consider a vendor management and oversight program that addresses applicable Foreign Corrupt Practices Act (FCPA) and other anti-bribery laws or government contracts.
  • Consider a record retention policy to address litigation risks.
  • Consider periodic independent audits as a reality check on marketing, requests for proposal (RFPs), compensation and other activities to confirm the business has not triggered a state or federal licensing requirement.
  • Consider changes to the compliance program to create a ROI while mitigating risks.
Staying Engaged Regulatory and Career Developments

How to Stay Engaged with Regulatory and Career Developments

0

Staying Engaged

Summer months, a pandemic and an economic slow-down may make it hard to stay engaged with regulatory and career developments. In this issue of the Warburton Report we present several podcasts and training videos to help you more easily stay on top of developments in compliance & data governance, asset management and ESG trends.

Compliance Trends

The DOJ Fraud Section has issued its’ first compliance guidance since 2015. See, here.The guidance emphasizes the crucial role in leadership in compliance and the importance of the company’s commitment to compliance. Prosecutors review the company implementation and enforcement policies of compliance including:
  • Has the company performed a risk assessment and tailored their compliance program to their specific needs, risks, and challenges? (Section I)
  • Is the company proactively addressing third-party risks? (Section I)
  • What value does the company assign to compliance? (Section II)
  • How much experience, resources and authority does the company grant compliance personnel? (Section II)
  • What concrete actions have company leaders taken to demonstrate leadership in compliance and remediation? (Section II)
  • Has the company re-evaluated its program following a compliance failure? (Section III)
New What’s Ethical podcasts on data analytics & family office trends 

Data Privacy and Fintech

The Emergence of State Enforcement of Privacy Breaches
Around the country, states are enacting their own legislation governing use of data and privacy breaches. Among the leaders are California and NY.
On July 1, 2020 despite the Covid19 pandemic California has begun enforcement of California Consumer Protection Act (CCPA). A quick 3-minute briefing about the CCPA is available from the National Law Review. See, here.
One of the initial CCPA lawsuits have been filed in California Atkinson v. Minted Inc. The class action litigation, filed in a California federal court, claims that Minted failed to implement “reasonable security measures” and to properly encrypt certain personal information. As a result, hackers allegedly accessed the company’s database that contained customers’ names and login credentials, including unredacted and unencrypted account information. Some 73.2 million records were allegedly stolen and included passwords, names, and other information. The putative class seeks compensatory damages, punitive damages, and penalties. Under the statute penalties, can range from $100 to $750 for each violation. In a breach involving 73.2 million records, these penalties can be significant.
On March 21, 2020, the NY Shield Act’s data security requirements took effect, like California’s CCPA, NY law require businesses that own or license private information of state residents, employ “reasonable” security protections, including:
  • reasonable administrative safeguards such as: designation of employees to coordinate the security program, identifying internal and external risks, assessing safeguards to control the risks identified, training of workforce, and selecting 3rdparty vendors that maintain appropriate safeguards;
  • reasonable technical safeguards such as: risk assessments of network, software design, information processing, transmission, and storage; measures to detect, prevent, and respond to system failures; and testing and monitoring of the effectiveness of key controls; and
  • reasonable physical safeguards for storage and disposal of information, such as: risk assessments for storage and disposal; measures to detect, prevent, and respond to intrusions; and protections against unauthorized access to or use of private information
Training – Contact us if you would like a complimentary copy of these videos to distribute.
Data Protection and Cybersecurity
AML
Join this Global Cybersecurity Webinar on August 5. Beth Haddock is presenting on a panel about “Better Together: Compliance Meets Managed Services.”

Recent SEC Risk Alerts & Enforcement Cases

Increased Phishing during COVID-19: Ransomware Risk Alert
Patterns in Examination Deficiencies:  Private Fund Alert
Discontinuation of LIBOR:  LIBOR Alternative Preparation Alert
Breach of Duty of Due Diligence: SEC v. Temenos Advisory Complaint alleged that Defendants George Taylor and his advisory firm, Temenos Advisory put $19 million in investment capital into four risky private security offerings without performing due diligence or disclosing risks and prospects of the investments. The Defendants consented to entry of permanent injunction prohibiting future violation of Advisers Act and agreed to pay disgorgement, prejudgment interest, and penalties in excess of $2 million.
Advertising: In the Matter of Raymond J. Lucia Companies, Inc. On remand from the Supreme Court, the proceeding which names Respondents as a registered investment adviser and its owner, centered on marketing efforts by Lucia and his company concerning his “Buckets of Money” investment program. At seminars, investors were shown a slide presentation with allocated assets to short, medium, and long term buckets. Part of the strategy involved reallocating the investments. The approach was supposedly based upon historical backtests. However, the SEC alleged that the backtests were materially misleading and did not follow the buckets of money approach, and failed to disclose key issues regarding fees and other matters in violation of Advisers Act Section 206(1), 206(2) and 206(4). The commission issued a cease and desist order, barred Lucia from securities business for a period of years and issued a penalty.

Load More