Menu

Compliance

February 2022 cover

Sustainable Governance: Building the governance, risk and compliance bridge

0

THE ENVIRONMENT

Fraud Prevention & Cybersecurity

OpenSea UI vulnerability allowed hackers to get NFTs below market with an inadvertent acceptance of a buy offer.

State Securities Regulators Warn of Top Risks in 2022 – fraud is in the top 4 – crypto is #1.

A measured approach to preventing fraud in DeFi – A Florida regulator provides educational guidance.

Example of global collaboration to cover opportunities and risks of digital assets.

SEC and Other Enforcement Actions

Registrations Requirements. CFTC Enforcement filed an enforcement action against Polymarket, alleging it violated federal commodities laws by offering prediction markets in the U.S. without registering with the agency. Polymarket cooperated with the investigation leading to a reduced penalty of $1.4M.

State jury finds crypto-related products not securities. A Connecticut jury addressed whether cryptocurrency products were securities and cleared the defendants of liability in an alleged fraudulent operation. The jury’s decision hinged on the finding that the company’s customers were not passive investors.

SEC EXAMS published a Risk Alert of observations from private fund adviser examinations.

Proposed definition of exchange to expand to capture new digital asset projects and tough sentiment only allows for 30 days of comment.  Commissioner Peirce’s Dissenting Statement describes some of the challenges.

YOUR COMPLIANCE & RISK PROGRAM

Does your Code of Ethics cover all assets or is it too narrow? This NFT example is a good use case for considering an expansion.

Have you wished for more engagement & better culture of compliance? Look at DAOs with a lens for increased ownership of compliance. In this video – there is an interesting discussion about the opportunity in web3 investment clubs.

Jan 2022 image 2

Innovation in Blockchain and Fintech

0

We are excited for 2022! We believe innovation in blockchain and fintech will not replace but improve traditional finance allowing for strides in sustainable governance with

  • Increased stakeholder participation
  • Increased operational efficiencies
  • Smart tech to increase ROI on compliance & risk programs

We hope you continue to find the Warburton Report a helpful resource. Feedback is welcome so we continue to give you the content you find most helpful.

THE ENVIRONMENT

Predictions of a big year ahead and how innovation in blockchain will not replace but augment traditional financial services.
  • Possible clarity of crypto from SEC
  • Acceleration of mainstream global banks and traditional companies acquiring and merging with crypto firms and stablecoins

Cybersecurity and Data Privacy

Attacks reported by companies. Hack of personal info must be reported under US and EU requirements. bZx hack  (ETHDenver); Akropolis hack; Coincheck hack (500 mil stolen); Kucoin hack (exchange & highlight of new controls)

SEC and Other Enforcement Actions

Registration Requirements – SEC Charged Ripple in December 2020 with operating $1.3B unregistered securities offering. The complaint alleges failure to register offerings and sales of digital assets or satisfaction of any exemption from registration. This is a case to watch in 2022.

Telegram settled with SEC after the Commission did not accept their defense that tokens was a private placement (Reg D) exemption. $18.5M penalty and $1.2M payment to investors.

Fraud and Cryptocurrency Investment Scams. Crypto scammers reportedly took $14B taken in 2021.

“Code is Law” Challenge –Pending Canadian $15.8M class action. Plaintiffs argue that “code is law” convention in DeFi does not provide immunity from securities laws.

Materially Misleading Statements. American CryptoFed DAO charged with materially misleading statements about tokens including employee benefit plan. Company filed registration statement with SEC. Class action lawsuit Anderson and Dolifka v. Tether, USDC (filed 12/20/21- pending) Plaintiffs allege Tether made misleading and deceptive statements concerning its backing and reserves.

YOUR COMPLIANCE & RISK PROGRAM

This month’s focus is on fraud prevention measures. As you consider training, operational controls and regulatory strategy, fraud prevention should be a critical priority. Consider whether your efforts are combating these risks to prevent fraud in your business and the broader ecosystem and protect you from regulatory and criminal liability by designing an adequate compliance program.

What are fraud risks?

  • Your company or your strategic partner, service provider or agent including employees and consultants facilitates a fraud
  • Insiders or trader digital assets based on non-public material info for their own benefit to detriment of public
  • Your company is held accountable for consumer fraud or statements deemed to be materially misleading about the project and/or digital assets. i.e., Twitter and business development efforts
Oct 2021 blog photo

Compliance Scorecard for Transparency and Duties to Investors

0

Investor protection continues to be a common theme and strategy for regulatory compliance and enforcement pressure points.  As you consider year-end efforts, think about your compliance scorecard for transparency and duties to investors.

COMPLIANCE NEWS

Conflicts and Insider Trading with NFTs- OpenSea’s Nate Chastain is at the center of an insider trading scandal involving its NFT marketplace. Chastain has resigned after a number of NFT traders on Twitter posted they noticed that a wallet belonging to Chastain was often at the center of transactions involving NFTs that appear on the front page of OpenSea.

Watch Banking Developments – Biden’s pick for the Head of the OCC has said she wants to “end banking as we know it,” including greater government oversight of Wall Street and cryptocurrencies.  Read more about her nomination.

Read the First Speech from the New Head of Broker Enforcement – In a recent speech, the new Director of the SEC Division of Enforcement commented on a shared mission and top priorities for his Division. More than once, he referred to his perspective on “proactive compliance steps” and he referred to a comment by Chair Gensler to hold compliance officers accountable for proactive compliance.

“… three key steps towards achieving this mission, and the first starts with each of you. In a speech he gave in May, Chair Gensler said: “[I]f you’re asking a lawyer, accountant, or adviser if something is over the line, maybe it is time to step back from the line. Remember that going right up to the edge of a rule or searching for some ambiguity in the text or a footnote may not be consistent with the law and its purpose.” This is a critical point and let me explain why…

Training Alert: Failure to register as a FCM Case. – The CFTC issued a $1.25 million penalty fine against Kraken to settle charges against the crypto-exchange company after it allegedly failed to register as a futures commission merchant (FMC) and offered illegally margined digital asset services, among other violations.

Protect Your Data – Carefully consider the risks before you agree to let a vendor use your firm’s aggregated data. In this case, the vendor gathered and sold source data to hedge funds in violation of reps and warranties in the legal agreement to limit its use to aggregated data.

SEC DEVELOPMENTS

Guidance by Testimony – In recent Testimony by Chair Gensler before the House of Representative Committee on Financial Services, Chair Gensler noted  that Congress could be helpful in filling the gaps between the SEC and CFTC oversight of the crypto assets market. He commented “Currently, we just don’t have enough investor protection in crypto finance, issuance, trading, or lending” as he listed the Commission’s priority efforts.

Conflicts of Interest Remain a Priority. This recent speech by Chair Gensler highlights issues with Data Analytics “In the case of robo-advisers or investment advisers, I wonder what they are doing within the predictive data analytics algorithms — if, statistically speaking, they are maximizing for our returns as investors, or, say, the revenues of the platforms. Further, to the extent that they’re maximizing revenues or doing a bit of both, how do we address the potential conflicts of interests that arise?”

Sept 2021 blog image

How Ready Are You For Change?

0

We are reminded that sustainable governance can be simple as tracking regulatory developments so the compliance program covers basic regulatory priorities. This edition is full of developments which are great reminders for training and policy discussions.

What’s a recent example of why an effective compliance program protects founders and companies? DOJ investigations into Tether show, why regardless of regulatory licenses, an adequate compliance program can deliver a ROI for fintech and blockchain companies.

BLOCKCHAIN & FINTECH

Risk Priorities: Need a primer on digital asset risk? Here is a good overview of the top 3 risks.

Crypto Leading Debate: Follow the important debate defining regulatory jurisdiction over securities, banking and tech services. SEC will sue Coinbase if it launches Lend, and Crypto’s Rapid Move into Banking elicits Alarm in Washington

Cash Management Clarity: How should digital advisors handle cash? This SEC matter is a good reminder to review and discuss whether fees on cash and cash management meets fiduciary obligations.

Engagement vs. Inducements: SEC Request for Comment re: Digital Engagement Practices. Track these developments to adjust risk assessments and provide advice about platform products.

Penalty for Willful Compliance Gap: CFTC and FinCEN impose $100M penalty on BitMEX in the first enforcement action against a FCM in the crypto space. The sizable penalty was because of BitMEX willful failure to implement a written AML program and among other things failed to conduct any OFAC screening, KYC screenings, failed to hire a CCO, and conducted transactions with counterparties linked to known darknet markets.

SEC ENFORCEMENT HIGHLIGHTS

Failure to Provide Sufficient Disclosure: Have you tested your breach disclosure process? SEC levies $1M penalty for allegedly misleading Cybersecurity incident disclosures.

Gaps in Cyber Protections for PII: SEC announced three actions for deficient cybersecurity procedures that resulted in exposure of PII of thousands of customers and clients at each of the eight firms.

Gensler’s interesting perspective on SEC’s priorities and what to expect in 2022 for conflicts of interest and payments for order flow.

Lack of Product Training: Reminder product training is important for IARs especially as the product offering becomes more complex. In the recent SEC Cease and Desist Order issued in Frontier Wealth Management LLC (September 3, 2021), the Commission took note of Frontier’s failure to provide policies, procedures, training and supervision concerning the features and risks of complex products and the assessment of whether such products are suitable for each client.

DATA PRIVACY

Deficient Use of Data Disclosure: Before the year end-review your data map re: data sharing and use. Confirm that your practices are aligned with your compliance program. Compliance Officers can ask for help by highlighting this new case: Facebook’s WhatsApp Fined €270Million for EU Privacy Violations. EU regulators fined the chat service for failing to be sufficiently transparent about what is does with EU resident’s data. The fine came as part of a decision that found WhatsApp advise Europeans how their personal information is gathered and used, including the sharing of their information with other Facebook units.

Green Inspirational Spring Quote Facebook Post

Summer Round-Up

0

This edition is a round-up of anti-fraud and data protection developments.  Please let us know if you have questions or comments.

FINTECH

Interesting diverse opinions from U.S. regulators regarding blockchain and cryptocurrency

In what some call a landmark speech, the Federal Reserve’s vice chair for Supervision Randal Quarles argues that stablecoins “could encourage [international] use of the dollar by making cross-border payments faster and cheaper, and it potentially could be deployed much faster and with fewer downsides” than a central bank digital currency (CBDC).

Crypto remains a priority for regulators as FINCEN hires another expert with prosecution experience.

Fighting Deceptive Cookie Practices. The European Center for Digital Rights (aka NOYB) is  threatening to file formal complaints against companies across the EU/EEA who use deceptive cookie practices. This is a good reminder to review your cookie practices, particularly if you have EU/EEA clients. Below is a summary of the types of practices to audit for and avoid.

  • Type A—No “reject” option on the first layer.
  • Type B—Pre-ticked boxes on second layer.
  • Type C—Deceptive link design.
  • Types D and E—Deceptive button colors and contrast.
  • Type H—Legitimate interest claimed.
  • Type I—Inaccurate classification of cookies.
  • Type K—Not as easy to withdraw as to give consent.

Global Cyber Standards and Due Diligence is Changing. China’s cybersecurity regulator launched data-security reviews of apps operated by two U.S.-listed tech companies, days after announcing a similar probe into Didi Global Inc. The latest action is a reminder of the importance of self-assessments and reviews before any such regulatory scrutiny.

More State Privacy legislation. Colorado is the newest state with comprehensive privacy legislation: The Colorado Privacy Act (CPA) was adopted in July with similar provisions to GDPR including opt out provisions, data controller and processor obligations and data contract requirements.  Effective in 2023, the CPA applies to those who do business in Colorado as well as to those who operate outside of Colorado, if their products or services intentionally target Colorado residents. There are carve outs, so compliance officers should coordinate with the privacy officer, CISO and CTO as needed to assess a strategy for compliance.

EU Proposes New Regulatory Agency.  The EU will reportedly increase anti-fraud and AML enforcement of crypto currencies. New EU Anti-Money Laundering Authority

ESG

ESG Disclosure Resource. UK Financial Conduct Authority recently released an ESG disclosure consultant paper. It is a helpful resource for compliance officers 1) considering their own climate disclosure compliance programs, 2) tracking evolving standards under the proposed new handbook and 3) reviewing responses to requests for proposal (RFP) for UK prospects.

SEC MATTERS

Reminder to Reconcile Investment Adviser Fees & Agreements. SEC v. Elstun. In the complaint, the SEC alleges violations of Advisers Act Sections 206(1), 206(2), 206(4) and 204 related to various fee discrepancies including charging a higher percentage fee than agreed in contracts and charging advisory for non-advisory accounts.

Robinhood Files Complaint. Robinhood filed a injunctive and dec. relief action in response to Mass. regulatory action against Robinhood for violating the new fiduciary rule for broker-dealers. Robinhood’s suit claims the new fiduciary rule is invalid under state and federal law. Robinhood argues that federal law preempts this new rule, given the introduction of Reg BI. Robinhood also asserts that under Mass law the new fiduciary rule does not apply to the firm as a “self-directed” brokerage firm.
Data Breach

Time to Update Risk Assessments & Training

0

This Report is filled with developments you should consider for updating your outreach, training and risk assessments. We hope this will help you get ready for the 2nd half of 2021!

FINTECH DEVELOPMENTS

Custody and anti-manipulation controls remain important for compliance programs and risk assessment priorities particularly as SEC resistance to digital assets continues.

A recent SEC Staff Statement is another negative signal for crypto. Read the latest May Statement Investing Bitcoin Futures Market

SEC continues its focus on whether digital assets are properly registered securities; it charges BitConnect for its $2 billion lending program of alleged unregistered securities.

Insider Trading Bill proposed to create a statutory ban on insider trading that also addresses more contemporary fraud – use of MNPI by hacking or theft when there is no breach of a fiduciary duty.

Weeks after the Colonial Pipeline hack, CNA, one of the largest insurance companies disclosed that it paid $40 million in ransom after it was locked out of its network. Perhaps not coincidently, CNA itself is an insurer of cyber insurance.

Institute for Security & Technology Ransomware Task Force presented a report to the Biden Administration just days before the Colonial hack. The report offers 48 suggestions to increase cybersecurity & some sobering statistics you should feel free to use in your training.
  • 21 Days-Average downtime due to ransomware attacks;
  • 287 Days – Average days it takes a business to fully recover after an  attack
  • $350 Million -Victims paid a ransom in 2020
  • $312,493 – Average ransom payment in 2020
  • 2,400 – U.S. Governments, healthcare facilities and schools were victims of ransomware in 2020

SEC DEVELOPMENTS

Signals for SEC Priorities Continue. On May 6, Chair Gensler testified before the House Committee on Financial Services. Gensler’s testimony indicates the SEC priorities & therefore adjustments for your inherent ratings in your risk assessments such as: gamification to induce trading, payment for order flow and equity market structure. The new Chair indicated that a report is forthcoming.

In testimony a few weeks later, SEC Chair Gensler indicated the regulatory agenda may include testing private fund controls and disclosures, proxy voting changes, ESG claims and crypto assets. May 26 Gensler Testimony
Portfolio Managers & CRO Charged by SEC.  SEC filed a civil action against investment management firm LJM and two of its portfolio managers for fraudulently misleading investors and its Board about the level of risk in its portfolios resulting in $1 billion trading loss. This case also involved personal liability for the chief risk officer who separately settled the claims and is now barred from the industry.
Another Failure to File SAR Case – In the Matter of GWFS Equities, Inc. (May 12, 2021). Over a three-year time period, the firm allegedly failed to detect and report efforts by bad actors to gain access to its processes through the use of improperly obtained PII. During this time, the firm failed to file SARs relating to 130 bad actor attempts.  In another 279 instances, the firm filed SARs, but omitted material information. The firm consented to a cease and desist order, and agreed to pay $1.5 million penalty. This is a good case to add to your annual AML training.

Financial Materiality & ESG – SEC Commissioner Allison Herren Lee made significant remarks in a speech titled “Living in a Material World: Myths and Misconceptions about Materiality” Her remarks focused on the definition of material disclosure standards and whether non-financial or quantitative factors can be material. She refuted the idea that climate and ESG are matters of social or political concerns and not material to investment or voting concerns. Also read the Executive Order to understand this evolving issue and efforts to determine the financial impact of climate change risks. May 20 Executive Order.

June 2, the SEC announced more than $23 million in whistleblower claims.  This is a good reminder to refresh your self-reporting and escalation incentives. It’s costly if your compliance program does not effectively encourage reporting.

Guest Column

by Courtney Lang
ESG is Changing Governance.
In case you missed it, stakeholders brought landmark changes to the oil and gas extraction and production industry at the end of last month. ExxonMobil, Chevron, and Royal Dutch Shell were affected by growing climate concerns amongst shareholders and governments.
After decades of climate disinformation campaigns and unsatisfactory responses to shareholder questions about stranded asset risk, climate risk, and its place in the transition to the low carbon economy, Exxon’s day of reckoning came on May 26th during its annual shareholder meeting. I watched with delight as the company lost two board seats to a small, activist hedge fund, Engine No. 1. My feeling of schadenfreude increased last week, when it was announced that a third Engine No. 1-nominated board member preliminarily won the shareholder vote that was previously too close to call.  If these election results are finalized, Engine No.1-backed board members will make up 25% of Exxon’s 12-member board despite the small activist investor owning only 0.02% of Exxon’s shares. To accomplish this feat, Engine No. 1 was supported by large institutional investors in Exxon such as CalPERS, CalSTRS, the New York State Common Retirement Fund, BlackRock, and Vanguard. Hopefully this coup will drive material changes to Exxon’s core business strategies including shifting to renewable energy and decreased anti-climate lobbying. Furthermore, I am skeptically optimistic that other boards will see this as a wakeup call that maintaining the status quo may cost them their board seats.

Meanwhile at Chevron, shareholders voted 61% in favor of the proposal to cut Scope 3 carbon emissions but missed the majority vote by 2% on shareholder proposals to limit lobbying and to report material risks to business posed by Biden’s and the EU’s Net Zero plans.

On the same day, a Dutch court ruled that Royal Dutch Shell must decrease its 2019-level greenhouse gas emissions 45% by 2030 on the grounds that contributing to global climate change violates human rights. I agree wholeheartedly.
ezgif.com for blog post

Proactive Regulatory Guidance

0

This month we present several examples of proactive regulatory guidance. We recommend you use this optimistic time of year to review your programs and proactively communicate these developments to your board, management and other stakeholders. Please reach out. We are here as a resource and look forward to hearing from you.

FINTECH

Interesting case to watch re: regulatory strategy for offering products and global securities requirements. European regulators are examining whether Binance, one of the world’s biggest cryptocurrency exchanges, has complied with securities rules over its launch of trading in stock tokens.

SEC Commissioner Advocates for Facilitating Tech Innovation. This Token Safe Harbor Proposal 2.0 from Commissioner Peirce is an interesting indication for product development and discussions about when it is appropriate to proactively reach out to regulators.

Risk of Cryptocurrencies Study – Surprising Perspective from a Former CIA Head including:

  • The broad generalizations about the use of Bitcoin in illicit finance are significantly overstated; and
  • The blockchain ledger on which Bitcoin transactions are recorded is an underutilized forensic tool for intelligence gathering and highly effective crime fighting.

SEC DEVELOPMENTS

SEC Commissioner asks Questions to Asset Managers about ESG to inform potential regulatory efforts.

Whistleblower awards claims are a good reminder to make sure your internal reporting process is fulsome so complaints are reported internally providing an opportunity to address them before regulatory action.

ESG

Considering Investing or Starting an ESG Fund? This SEC Division of Examinations Risk Alert is helpful for compliance officers. Of note – the comments about Compliance Officers’ ESG experience and the inconsistency between claims and practices. This could be converted into a roadmap for a mock audit.

Commissioner Hester Peirce’s recent public statement “Rethinking Global ESG Metrics” focuses on the perspective of ESG as a good investment approach (as opposed to purpose-driven), the complexity of shifting to a stakeholder (as opposed to shareholder) orientation and the challenge with aligning with European standards in drafting appropriate disclosure statements.

For personal trading requests or capital raising activities, SPACs are in the spotlight.

 

Guest Column

by Courtney Lang

Last month, two people said to me on separate occasions, “you can’t swing a dead cat these days without hitting a SPAC.” Having never heard that expression before, I wondered why everyone was suddenly talking about dead cats, who was killing all of these cats, and why on Earth I would swing one. I hoped it wasn’t a morbid new TikTok trend. Luckily (for the cats) it is not. However, it was understandable that everyone was metaphorically hitting SPACs with said cats. Those things were everywhere. SPAC IPOs have raised more than $100 billion in 2021 thus far. SPACs have become so popular that the SEC even released an investor alert warning the public not to invest in certain SPACs based on celebrity endorsement. Which leads me to my own investor alert: if you are investing in something solely because A-Rod told you to, please log off of Reddit, slowly back away from your computer, and consult an investment professional immediately.

A SPAC (Special Purpose Acquisition Company), often referred to as a “blank-check company,” is a public shell company that raises funds to acquire a private company and take it public. It is viewed as a quicker, easier way for a company to go public because it requires less disclosure than the traditional IPO route does. When raised, a SPAC has no operations and its only business plan is to take a company public. Which company? They might not know yet. SPACs have 18-24 months after raising funds to identify firms they can merge with or they will be liquidated and the purchase price plus interest will be returned to investors.

Some hail SPACs as a way to democratize investing. At an average of $10 per unit (with a unit being one share plus one fractional warrant), SPACs provide individuals with the opportunity to invest in companies that would otherwise exit to private funds with high investment minimums. Individuals get the chance to invest with more upside than they may typically encounter, though this may come with a correspondingly higher level of risk that the financial markets usually hinder unaccredited investors from taking. Investors are accredited by providing proof of access to liquid cash via salary or savings or proof of financial knowledge through passing FINRA Series exams. Some think it is paternalistic to require an investor to be accredited before they invest in certain riskier types of securities. They argue that just because someone is not currently wealthy or working in the financial industry does not mean he or she is incapable of making intelligent and informed investment decisions.

On the other side of the coin, some fear SPACs take advantage of uninformed retail investors while the already wealthy sponsors get richer. They worry that fewer disclosures may equate to less due diligence prior to investment. In the first quarter of this year, investors sued eight companies that combined with SPACs. Also, individual investors don’t have the power to negotiate terms with SPACs in the way that an LP in a private fund may be able to. Thus, the terms for SPAC shareholders aren’t typically as favorable as the terms of private funds. Some have even suggested that the misalignment of incentive structure between the shareholder and the sponsor, wherein the sponsor is incentivized to complete a merger rather than liquidate and return shareholder capital, presents an unethical conflict of interest.

Ultimately, whether SPACs continue to amass billions of dollars will depend on the SEC, among other market conditions such as investor demand and the number and market value of potential acquisition targets. According to Dealogic, SPACs raised roughly $17 billion during the first 20 days of January, but that fell to $2.5 billion during the corresponding period in April, likely due to uncertainty surrounding SEC regulations. The SEC may release guidance on the treatment of warrants on a SPAC’s financial statements as liabilities and whether the legal safe harbor for forward-looking projections applies to SPACs.

April 2021 - blog photo

Fintech and SEC Developments

0

We are optimistic as spring is in bloom and many of the annual filings and reports are behind us. We hope you enjoy this edition which is full of developments for you to consider as you focus on keeping pace in 2021. Please reach out with feedback. We love to hear from our readers.

Fintech

The consensus continues towards seeking more certainty with regulation and enforcement in the virtual asset sector: Former SEC Chairman Jay Clayton on regulation of digital assets; UK regulators announce increased enforcement to combat market manipulation.

Read this Stablecoin white paper to learn more about this growing digital asset class.

How will a T+0 environment change your compliance risk assessment? Learn more about this amazing development. T+0

FinCEN Innovation Hours Program issued report on Emerging and Future Role in AML Act Implementation. The report covers innovative solutions for AML compliance including evolving themes and regulatory priorities.
In the 2021 FINRA Report on Examination and Risk Monitoring Program, FINRA highlights emerging cybersecurity risks, exam observations and effective practices. It may not be a surprise that this topic should be a priority for your compliance plan. One of the take aways from the report is an increased number of cyber or technology related incidents including:
  • System outages;
  • email and account takeovers;
  • fraudulent wire requests;
  • imposter websites; and
  • ransomware

SEC Division of Exams highlights SAR risks: Read this new RISK ALERT “Compliance Issues Related to Suspicious Activity Monitoring and Reporting at Broker Dealers.”

SEC DEVELOPMENTS

SEC Alleges No Basis for 506(b) Exemptions and Material Misrepresentation
SEC v. Jason P. Wooten; Ronald Steven; Family Tree Estate Planning, et. al. The SEC filed a complaint alleging the sale and material misrepresentations of investment funds offered to more than 550 investors. It alleges the offering did not qualify for a Rule 506(b) exemption as the investors were neither accredited nor sophisticated. A reminder to add onboarding to your compliance testing plan to confirm there is a strong eligibility process.

SEC Alleges Materially Misleading Fund Statements

SEC v. Paul Haarman, Patrick Duke and APEG Energy GP, LLC. The SEC has filed a complaint alleging factual misrepresentations and omissions in offering documents, and written and oral communications concerning limited partnership securities in an investment fund. The statements included that the fund offering “guaranteed returns with no risk”. Allegations also include misrepresentations about biographical information including exaggerated expertise. This is a good reminder to confirm all bio information to make sure credentials are not overstated.

Marketing Compliance FAQs – Changes to Advertising and Solicitation Rule

Ahead of the effective date of the new Advertising Rule, the SEC has updated its FAQs. March 18 Update to FAQs
SEC and the Dark Web – A Gentlemen’s Insider Trading Forum on the Dark Web
In the first of its kind, the SEC Filed an action involving alleged securities violations on the dark web. The  SEC charged the defendant with perpetuating a fraudulent scheme to sell what he deemed “insider tips’ that he falsely described as material, nonpublic information from insider trading forum or corporate insiders.

Contemporaneous vs. Edited Notes

In re David B. Tysk, addressed the issue of making contemporaneous notes and carefully editing such notes. As in this case during regulatory investigations, regulators may assume editing of notes is inappropriate. One take away from the case is to carefully respond to all requests and use a caveat such as “based upon information and belief” to preserve the ability to explain responses were in good faith. Another take away is to reminder to understand and, when appropriate, consult with any tech provider to make sure you understand the features for version control, archiving and storage. Ultimately, in this case the charges against the defendant were dropped but there was a lot of time and money spent to litigate whether revisions to notes were inappropriate. This case also raises interesting questions about record retention policies and whether policies should mention editing is permitted when version control protocols are implemented.

ESG

Guest Column

by Courtney Lang

The SEC cultivated a fertile regulatory environment for ESG investing throughout the first quarter of this year. Of the five ESG regulation wish list items laid out by Bhakti Mirchandani in January, the Biden Administration has delivered on three:
  • The DoL Employee Benefits Security Administration released an enforcement policy statement on ESG investments, proxy voting by employee benefit plans. The statement encourages ESG investment by declaring that the previous final rule under the Trump Administration had a chilling effect on ESG integration in investment decisions and did not align with the present public health obstacles posed by climate change.
  • The SEC released a Statement on the Review of Climate-Related Disclosure, stating plans to review the extent to which public companies address the topics identified in the 2010 guidance on the materiality of climate change, assess compliance with disclosure obligations under the federal securities laws, engage with public companies on these issues, and absorb critical lessons on how the market is currently managing climate-related risks.
  • The SEC created a Climate and ESG Enforcement Task Force to develop initiatives to proactively identify ESG-related misconduct, starting with identifying any material gaps or misstatements in issuers’ disclosure of climate risks under existing rules.
The remaining two items are in sight:
  • SEC Division of Corporate Finance acting director John Coates signaled that the SEC may be in favor of the IFRS Sustainability Standards, a single global reporting framework.
  • Senate Banking Committee Chair Sherrod Brown introduced a joint resolution to overturn the amendment made to SEC Rule 14a-8 under the Trump Administration that would strip power from smaller shareholders. To overturn this recently adopted rule, both houses of Congress must vote in favor and President Biden must sign.
Additionally, Marty Walsh was confirmed as Secretary of Labor. The senate confirmation vote will take place on the week of April 12th for Gary Gensler, nominee for Chairman of the SEC. If Gensler is confirmed, he will inherit a contentious SEC agenda, not least of which will include SPACs. Reuters recently reported that the enforcement division of the SEC sent letters to several large banks inquiring about their SPAC dealings. The banks were asked to provide the information voluntarily, rather than as part of a formal investigation.
compliance March 2021 blog photo3

Spring Refresh – Compliance and Fintech Developments

0

With spring around the corner, it’s a good time for clean-up and a refresh of regulatory filings, testing and policies. This edition encourages a reset on expectations for OFAC, privacy, digital assets and disclosures. This spring we are also launching a new NSCP Fintech & Blockchain Round Table for a fresh approach to networking, bench marking and staying ahead of regulatory trends. Save the Date April 13 @ 12:30. Details to follow.

Fintech and Blockchain Developments

OFAC Enforcement Cases

Recent Office of Foreign Assets Control (OFAC) enforcement cases are a reminder that screening names alone is not an adequate sanctions compliance program; the location of transactions through IP address surveillance is also crucial.  This OFAC enforcement case against BitPay is another example of OFAC citing companies for violations based, at least in part, on a failure to implement IP geo-blocking.

BitPay, the Atlanta-based payment processor, settled claims it maintained an inadequate sanctions compliance program for a penalty just over $500,000. Notably, penalties were reduced for BitPay’s cooperation and remediation efforts. The sanctions related to digital currency transactions on the BitPay platform between individuals located in Cuba, North Korea, Iran, Sudan, Syria, and Crimea and merchants primarily in the US. BitPay had screened its customers, against US sanctions lists but, OFAC alleged that BitPay had reason to know that purchasers were located in sanctioned jurisdictions, because the company had location information including IP address data. OFAC noted that this case “emphasized the importance of screening all available information including IP addresses and other location data of customers and counter-parties to mitigate sanctions risks….”

Likewise, late last year,  OFAC settled an enforcement action against another digital asset company, BitGo. BitGo incorporated IP address screening into its security process for account log in, but it failed to check the data against sanctions lists for transactions.

OFAC Compliance Program is more than a KYC exercise. This guidance is a good reminder to also review, test and refresh sanctions software and your sanctions risk assessments for changes to business and any data feeds.  Sanctions Enforcement Blog

Privacy Developments

The Biden administration is expected to join the states’ focus on privacy issues which could result in increased compliance obligations. In addition to watching for implementation regulations for the new California privacy law,  watch for further developments from the Federal Trade Commission (FTC).  In 2019, the FTC proposed amendments to the Gramm-Leach-Bliley Act (GLBA). With the recent influx of cyber security events, the amendment is expected to receive attention this year. The GLBA proposed amendment includes:
  • Broadening the definition of security events to include any unauthorized access;
  • Expanding audit trail obligations;
  • Mandating real-time monitoring of digital financial services to improve fraud detection; and
  • Time-limiting data retention.

Recent SEC Actions

License and Business Development Reminders

SEC v. Moleski. In this recent complaint, the SEC alleges defendants promoted and solicited investments in private funds they controlled. In doing so, the SEC claims defendants made a series of misrepresentations including false claims that: “investor funds would be put into “high grade investments”; the investment objective was “phenomenal returns:’ a “full-time licensed broker would monitor the investments daily;” “investors would achieve financial freedom;” and, that “we treat you money like it’s our own.” Defendants are also alleged to have solicited individuals to purchase securities without proper securities registrations. This is a good reminder to stay aligned and connected to business development including which individuals are paid for success.

SEC v. Coinseed, Inc. In another recent complaint, the SEC brought an action against the founder of Coinseed. The complaint alleges that defendants inappropriately offered and sold tokens, called CSD, to the public. Purchasers were allegedly told that they would receive a percentage of revenue from certain fees generated by the business, and that their funds would be used to develop the firm’s business which was claimed to include a mobile phone app that would enable users to purchase and sell digital assets. No registration statement was in effect. The complaint alleges violation of Securities Act Sections 5(a) and 5(c) and is a good reminder to work carefully with experts for any capital raising efforts. The SEC’s recent Risk Alert covering digital assets is another important development. Compliance officers can audit their compliance programs against the 8 pages of issues.

ESG Investing and Sustainability Developments

ESG Developments to watch include the Department of Labor (DOL) leadership. There are indications that the DOL rules curbing ESG retirement investments may be revisited by new DOL leadership.

The first sentence of the SEC’s recently announced exam priorities mentions the need to appropriately address climate-related risks.

How are you reviewing and sourcing climate-related disclosures?  In the wake of the severe storm in Texas, this is an opportunity to review your process and test its effectiveness.  Two practical questions to ask are 1) Is the process objective and documented? 2) Have you permitted use of media sources or non-media institutions such as the Task Force on Climate-related Financial Disclosures (“TCFD”)?

Guest Column

by Courtney Lang

When I think of climate change affecting Texas, I immediately picture sea level rise and stronger hurricanes. My brain can easily associate these occurrences with a warming planet. Although I have a formal education in climate science, the counterintuitive effects of climate change such as increasing snowfall in certain regions aren’t top-of-mind. Nonetheless, the intensity of the North American winter storm was most likely caused by climate change. The rate of warming in the Arctic is faster than that of the rest of the planet because of the ice-albedo positive feedback loop wherein warmer temperatures cause snow to melt over land-ice, reducing its “whiteness” and therefore its ability to reflect the sun’s energy back to space. Thus, the planet absorbs more of the sun’s energy, and gets even warmer, and so on. As the Arctic region warms, the difference in temperature between the typically circular-flowing “polar vortex” of colder winds in the North Pole and warmer winds in North America, called Westerlies, decreases thereby decreasing pressure and allowing the polar jet stream to meander south and cause large storms. Here is a helpful visualization.

To write about the above phenomenon, I had to Google it, cross-check my notes from climate science courses, and explain it to my mom for good measure. While much of nature seems intuitive to us, earth science is not common knowledge. But it must become common if we are to effectively prepare for climate change. Investors can avoid losses and reap benefits by understanding and evaluating geographical climate risks to real assets as showcased by this storm. The TCFD provides a framework to consider these risks in context of different climate change scenarios.

Take Texas’s energy grid as an example. Despite what many believe Fox News has wrongfully stated 128 times thus far, wind power is not to blame for the tragic losses of life. Fossil fuel-created climate change is most likely to blame for the intensity of this storm and the vast majority of the power outages in Texas were caused by coal and gas-fired power plants. However, wind and fossil fuel-fired power plant projects alike may have benefitted financially from selecting equipment better suited for climate change and lives could have been saved by a more resilient energy grid. Wind turbines can be equipped with de-icing technologies such as a special coating that prevents ice from forming. The specific technologies chosen for Texas would need to be conducive to the typically warm climate and rare wet, icy winter events. Similarly, fossil fuel-fired power plants, wells, and pipes, can be equipped with devices that combat freezing. Current Texas energy infrastructure could be retrofitted and new builds could incorporate winterization technology from the start as long as it does not significantly compromise the output of power plants as climate warms in the region. In the event of another storm like this, power plants that can operate will benefit financially from high energy prices due to decreased supply and increased demand on the grid. 

Much of United States infrastructure needs to be retrofitted and built with climate change scenarios in mind. I hope the tragedies and financial losses caused by this winter storm can serve as a wake-up call to all investors, owners, and operators of real assets in regions likely to be affected by climate change.
compliance February 2021 cover photo BLOG

Compliance Trends – Data Privacy, ESG and Risks

0

This month we cover increasing cyber risks and reg developments such as the Everalbum settlement and ESG guidance.  As you consider your annual review of compliance and governance controls, refresh regulatory filings and keep pace with Q1 work, use the Warburton Report as a helpful resource to track developments and prepare training content.

Data Privacy and Risks

The FTC recently entered into a settlement with Everalbum concerning its use of AI for facial recognition. The FTC ordered Everalbum to delete any facial recognition models and algorithms it developed using photos or videos uploaded by its users without their consent. Previously FTC commissioners had allowed violators to retain their algorithms and technologies, and just delete the illegally gained data. This case raises new concerns about use of biometric technology, privacy considerations and trends to watch. Consider covering this case in training to show the evolving standards for use of customer’s data. The concerns involve more than protecting personally identifiable information (PII).  Remedy of Destruction.

January 28, 2021 was Data Privacy Day, an annual global effort that generated awareness about the importance of privacy. Pew Research Center reported that 79% of Americans feel an increasing lack of control of their personal data. CSIAC recommends businesses follow many of the best practices and requirements financial services companies have built in to their internal controls:

  • Follow reasonable security measures to keep individuals & data protected and save from unauthorized use;
  • Consider adopting a privacy framework;
  • Conduct an assessment of data collection practices including the privacy lase and regs that apply to your business;
  • Maintain oversight of partners and businesses and their collection and use of your client’s personal data; and
  • Be open and honest about collection, use and sharing of consumers’ personal information.

Consider calendaring awareness training on January 28 each year.

Cyber risks and ransomware attacks are on the rise as is indirect funding of organized crime by insurance companies processing claims to those who paid ransoms to regain access to data and systems after hacking attacks. UK National Cyber Security expert,  Ciaran Martin calls the situation “close to getting out of control” due to the lack of legislation preventing insurance claim payouts for such ransom demands. This is a good reminder to discuss the topic with your board and/or senior management to consider options before there is a crisis.

Cyber Risks in Asia: The Monetary Authority of Singapore issued revised its Technology Risk and Management Guidelines.

Regulatory Developments

In December, the SEC adopted a new Marketing Rule. The new rule is not effective until 18 months after it is published in the Federal Register. Further guidance is expected this year; however, the rule release includes advice based on existing SEC no-action letters. So it pays to review your program in the event you are subject to an exam and/or changes in market conditions. See the article in the Resources section for an overview of the potential impact on investment advisory business development.

On January 1, 2021, Congress overrode President Trump’s veto of the National Defense Authorization Act (NDAA) for the 2021 fiscal year. The NDAA includes the Anti-Money Laundering Act of 2020 (AMLA), the first major reform of the U.S. anti-money laundering (AML) since the 2001 USA PATRIOT Act. The updates to the AMLA include:

  • Creating a non-public registry that tracks the beneficial owners of certain corporations
  • Enhancing the AML Whistleblower Program similar to the Dodd-Frank Act’s SEC Whistleblower Program
  • Expanding US regulators’ statutory authority to seek documents from foreign financial institutions
  • Increasing penalties for BSA and AML violations
  • Allowing Suspicious Activity Report (SAR) sharing with foreign affiliates
  • Establishing priorities to govern AML/CFT policy
  • Creating an annual reporting requirement to Congress of all Department of Justice (DOJ) settlements involving the Bank Secrecy Act (BSA)

Corporate Governance

McKinsey’s recent report on the defining trends for 2021 and beyond highlights the importance of keeping pace with changes in fintech and governance. Read the report to examine trends in digitally enabled productivity, stakeholder capitalism and the potential impact of the trends on your business and compliance risk assessments.

In a recent Harvard Business Review article, the author considers how shareholder centric or “agency theory” of governance is giving way to a model which focuses on what we have referred to as “sustainable governance” or a stakeholder focus where the priority is the health and resilience of the company itself. See Covid-19 impact on Corporate Governance.  If your firm is considering ESG concepts, this is an important concept to understand and track.

ESG Developments

Following the CFTC published report prepared by the Climate Related Market Risk Subcommittee, SEC acting Chair, Allison Herman Lee and Commissioner Caroline Crenshaw issued a joint statement regarding the failure of the SEC to address climate risk and seek better disclosure requirements under Regulation S-K.

Executives from Bank of America, Mastercard, KPMG, and about 60 other large companies announced on January 25, 2021, they’ll be adopting a new reporting framework for ESG in partnership with the World Economic Forum.

by Courtney Lang, Guest Columnist

Before President Biden’s inauguration, I outlined his administration’s top five opportunities to advance and repair the state of ESG investing in the U.S. President Biden’s nominees for Secretary of Labor, Martin J. Walsh, and Chair of the SEC, Gary Gensler, are strong picks to do just that.

As mayor of Boston, Walsh launched an ESG Investment Initiative with $200 million committed during his tenure. In 2020, Walsh was named Chair of Climate Mayors and Boston went to market with its first-ever series of green bonds, issuing $24 million to fund energy efficiency projects in the city. Given Walsh’s history of support for sustainability, those who want the DOL to include ESG factors in the definition of “pecuniary” for ERISA plan fiduciaries may remain reasonably optimistic.

Gensler’s track record on increased regulation and enforcement as former Chairman of the Commodity Futures Trading Commission following the Great Recession has many expecting the SEC to mandate ESG and climate-related disclosures under his leadership. In collaboration with Active Chair Allison Herren Lee and Caroline Crenshaw, Gensler’s confirmation could bring about a 3-2 consensus in favor of ESG on important matters. With Gensler at the helm, the SEC could enforce past guidance on the materiality of climate change, comment on the IFRS Sustainability Standards, establish an internal ESG task force, and reverse the amendment made to SEC Rule 14a-8.

Load More