Menu

Compliance

Copy of Charcoal Photo Sustainable and Energy Efficient Architecture Presentation

Compliance & Sustainable Investing in the First 100 Days

0

We wish you the best in 2021. This year is expected to be a year of change, especially as it relates to issues about the future of finance – blockchain, ESG and sustainable governance programs that deliver a compliance ROI. As always, we are here as a resource. Please reach out with questions and we hope you find this edition of the Warburton Report helpful and interesting.
Welcome to our guest columnist Courtney Lang!

Compliance Trends

Mega trends to watch this year include ESG rule-making from the SEC, privacy and data governance developments and new leadership in the federal government and regulatory agencies. In this edition, we cover some of those themes.

Sustainable Investing in the First 100 Days

We anticipate constructive changes for ESG investing in 2021, aided by the Biden Administration and increased collaboration among sustainability reporting entities. There are many ESG investing developments to track  To help frame the issues to watch, keep these 5 topics in mind.

Guest Column

The Biden Administration has the following opportunities to advance and repair the state of ESG investing in the United States, as outlined by Bhakti Mirchandani in Forbes.
  • Define Pecuniary Considerations for Pension Investments to Include Material ESG Factors
  • Commit Resources to Enforce the SEC’s 2010 Guidance on the Materiality of Climate Change.
  • Establish SEC Internal and External ESG Task Forces
  • Comment on IFRS Sustainability Standards and Develop Global Sustainability Disclosure Requirements in conjunction with leading reporting organizations
  • In September, CDP (formerly “Carbon Disclosure Project”), Climate Disclosure Standards Board (CDSB), Global Reporting Initiative (GRI), International Integrated Reporting Council (IIRC), and Sustainability Accounting Standards Board (SASB) released a statement of intent to work together towards comprehensive corporate reporting. Climate-related reporting will be in line with TCFD (Task Force on Climate-related Financial Disclosures) recommendations. Collaboration among these groups could benefit writers and consumers of corporate sustainability information as frameworks morph and grow to complement each other.
Additionally, the Biden Administration could reverse the amendment made to SEC Rule 14a-8 under the Trump Administration. The amendment requires higher ownership thresholds for filing shareholder proposals; thus, it strips power from smaller shareholders.
by Courtney Lang, Guest Columnist

Consider adopting a compliance review for all ESG-related statements to confirm they are objectively supported with written evidence for each factual statement; most importantly, for statements related to performance. Although the new SEC Marketing Rule is not effective yet, this is a good practice to start to socialize.

Data Governance and Marketing 

Use of data in marketing is another complex issue to watch in 2021. In addition to the new privacy regulation in California and on Capitol Hill, as mentioned above, the SEC recently released its new marketing rule. We encourage compliance and risk officers to consider a re-fresh (or creation) of a data map.  Requirements for use of data particularly for marketing will be easier to prioritize if there is a detailed map of current and anticipated use of data.
Interesting lessons from a recent French Data Protection Authority case highlighted below. The case provides good reminders about obtaining informed consent for use of cookies, the regulatory environment in Europe and the ease of investigations via public sites.
CNIL, the French data protection authority, issued fines totaling €135 million in a new ePrivacy directive case against Google LLC, Google Ireland and Amazon Europe. CNIL launched investigations into the companies’ cookies practices including the failure to obtain users’ consent to use and the failure to inform users about the right to object to the use of cookies. CNIL noted that the websites immediately dropped cookies upon a user’s visit to the Google and Amazon websites prior to communication concerning use of cookies and obtaining consent. Google and Amazon currently are under an injunction to comply within three (3) months of the December 7, 2020 order, and a penalty of €100,000 a day until compliance.

Regulatory Guidance

At the end of the year, we saw the continued momentum in fintech and blockchain led to developments about custody of digital assets and further approval of use for payments and settlements.

Custody of Digital Assets

Although the recent request for comment isn’t definitive, it is helpful for compliance officers considering safekeeping and custody of digital assets to read the “measures a broker-dealer can employ to comply with Rule 15c3-3 and mitigate these risks.” See page 8-13 for the 7 steps firms should consider. A compliance officer could review these mitigants with the business and rate controls against these proposals.  Custody Of Digital Assets

OCC Support for FinTech

The Office of the Comptroller of the Currency (OCC) published a letter clarifying national banks’ and federal savings associations’ authority to participate in independent node verification networks (INVN) and use stablecoins to conduct payment activities and other bank-permissible functions. OCC Guidance

Disclosures & Fees

At the end of the year, the SEC settled several cases. Below is a highlight of one with a reminder that following the flow of funds and critically reviewing disclosures remains a priority.
In the Matter of Voya Financial Advisors, Inc. (Dec 21, 2020) the SEC alleges Voya violated Advisor Act Sections 206(2) and 206(4). It claims that Voya breached its duty by failing to disclose 1) it received 12b-1 fees on certain transactions and 2) was paid certain fees from an unaffiliated clearing broker for some transactions, and that it caused certain advisory clients to pay higher fees in the form of upfront fees when purchasing certain products, when the same products were offered with waived commission for other clients.
To settle the action, Voya agreed to implement several undertakings including hiring an
independent compliance consultant and notice to clients; it consented to entry of a cease-and-desist order and censure, as well as disgorgement of $11,547,820, $9 million in penalty and prejudgment interest.
Year-End and 2021 Planning

Year End and 2021 Planning Reminders

0

Compliance Trends

Revamp of FTC Data Privacy Enforcement

On October 16, 2020, FTC Commissioner Slaughter delivered the keynote address titled “Confronting Cybersecurity and Data Privacy Challenges in Times of Unprecedented Change”. Slaughter proposed important changes to the enforcement regime. Below is a summary. Compliance Officers should track potential developments including personal liability for those that participated in the illegal practices or “had authority to control them.”

  • Utilization of more meaningful deterrent remedies including a combination of injunctive relief and monetary sanction;
  • Expand corporate accountability by naming corporate executives as individual defendants;
  • Increased relief to consumers including monetary relief and direct notice of violations;
  • Expand efforts to curb abusive data practices from AI and machine learning, as well as the use of data to increase levels of children and teen engagement on social media;
  • Expand the Commission’s authority by reviving the Magnuson-Moss rulemaking; and
  • Pleading not just deception in a complaint but also pleading “unfairness”. e. Failure to take proper care of consumer data is illegal even if the wrongful actor is not deceptive about it.

New Standards: Anti-Corruption and Ethics are Core to ESG

A recently released report included important clarification about the importance of compliance and compliance officers in ESG efforts. The International Business Council (IBC) of the World Economic Forum(WEF), in collaboration with the Big 4 accounting firms, released a white paper, “Toward Common Metrics and Consistent Reporting of Sustainable Value Creation” which recommend a set of common ESG metrics and disclosures. It shows the G in ESG should include an analysis of ethics and compliance.

Recent Guidance

CCO Liability

SEC Commissioner Peirce spoke on October 19, 2020, at the NSCP National Conference.  Below are some practical take-aways for you to consider as you review your efforts in light of Commissioner Peirce’s comments.

  1. Manage Personal Liability: Are your policies written so the CCO approves policies without business approval first? This may be a helpful reminder to consider a change to policy approval governance so adequacy of policies and procedures involves a fulsome review, discussion and approval by the business.
  2. Document Compliance Budget and Requests for Resources: Are you documenting your efforts to align resources and professional development and training? Documentation via issue tracking and/or metrics and budget requests can be useful.

“The Commission has declined to impose personal liability on compliance officers who were ill-equipped for their jobs, who were denied the resources necessary to do their jobs, or who were genuinely over-burdened with other duties.“

  1. Track Discussions About CCO Liability for Negligence: How are you tracking developing expectations? Be aware of liability for negligence and track potential changes to the CCO framework.

“In contrast, to establish in an administrative cease and desist proceeding that a compliance officer was the cause of a company’s violation, it is only necessary to show that the individual committed an “‘an act or omission the person knew or should have known would contribute’” to the violation.  The phrase “should have known” is “classic negligence language,” and the Commission and courts both have concluded that it sets a negligence standard for liability. Thus, where a company has committed a violation that does not require scienter—such as failing to have sufficient policies and procedures—a compliance officer can be held to have caused the violation based on her own negligent conduct.”

Cryptocurrency

The Department of Justice published a report titled “The Cryptocurrency Enforcement Framework” on October 9, 2020. It provides an overview of the asset class and complex regulatory regime focused on AML and other anti-fraud risks.

SEC Enforcement Annual Report

On November 2, 2020, SEC Division of Enforcement published its annual report for fiscal year 2020. The report outlines its 2020 accomplishments, lists noteworthy enforcement actions, as well as covers areas of strategic change. This is a good time of year to review the report and the SEC examination priorities as you conduct your annual review. Make sure your priorities are aligned with regulatory expectations and risk assessments, testing and policy reviews address any gaps. OCIE 2020 National Examination Program Priorities

Adequate Disclosures and Support for ESG Claims

Adequate Disclosures and Support for ESG claims

0

ESG Developments

Adequate disclosures and support for ESG claims continue to be a priority and a trend to watch. Warburton is here to help support your efforts including serving as an independent verifier of your claims.

Early this year, the SEC Investor Advisory Committee made recommendations relating to ESG Disclosures. Under current SEC regulations and guidance, the disclosure of ESG issues is required only if “material”― information regarding an ESG issue is required to be disclosed only if it would be viewed as significantly altering the “total mix” of information available for investor. In September 2020, at a “Virtual Roundtable on the Role of Asset Management in ESG Investing” hosted by Harvard Law School, SEC Commissioner Hester Peirce cautioned against a standardized formula approach to ESG disclosures. Ms. Peirce stated that although she understood the requests for the SEC to establish a mandatory framework for ESG disclosures, she believes the SEC should adhere to its “tried and true principles-based disclosure framework.” Ms. Peirce raised concerns that a prescriptive approach to ESG disclosures would have negative effects including increasing costs, would be contrary to the SEC’s “principles-based disclosure framework,” which is “rooted in materiality,” and not guarantee consistency, as companies may apply ESG metrics to the specific characteristics of their “operations, judgments and assumptions.”

In September the CFTC published the report, Managing Climate Risk in The U.S. Financial System. The report lists a set of 53 recommendations that regulators together with the private sector should initiate as soon as possible including:

  1. The U.S. should establish a price on carbon. It must be fair, economy-wide, and effective in reducing emissions consistent with the Paris Agreement. This is the single most important step to manage climate risk and drive the appropriate allocation of capital.
  2. All relevant federal financial regulatory agencies should incorporate climate-related risks into their mandates and develop a strategy for integrating these risks in their work, including into their existing monitoring and oversight functions;
  3. Financial authorities should consider integrating climate risk into their balance sheet management and asset purchases, particularly relating to corporate and municipal debt;
  4. Regulators should consider additional, appropriate avenues for firms to disclose other substantive climate risks that do not pass the materiality threshold over various time horizons outside of their filings;
  5. Regulators should consider that a growing number of companies are creating greenhouse gas reduction targets and strategies out to the year 2035 or 2050, and targeted disclosure related to these items may be appropriate to facilitate robust efforts toward this positive trend; and
  6. Financial regulators should consider the following principles for effective climate-related disclosures:
    • Disclosures should represent relevant information.
    • Disclosures should be specific and complete.
    • Disclosures should be clear, balanced, and understandable.
    • Disclosures should be consistent over time.
    • Disclosures should be comparable among companies within a sector, industry, or portfolio.
    • Disclosures should be reliable, verifiable, and objective.
    • Disclosures should be based on current consensus science (and updated as the science evolves) and the best available projections regarding climate change impacts.
    • Disclosures should be provided on a timely basis.
Checklist for Auditing a Fintech Compliance Program

DIY Fintech Compliance

0

To support the financial services industry you may not trigger the same regulatory compliance requirements as of your customers, but basic compliance is still required in many jurisdictions as well as by contract.  Below are 3 steps toward creating your own compliance program.

Confirm you have Privacy, Cookies, Cyber-Security and Information Security policies and procedures including breach reporting. Also consider the following:

  • Designate a CISO/Privacy Officer
  • Consider security standards such as NIST
  • Create a data map and risk assessment of information collected and used including non-US information, employee information etc.
  • Determine due diligence standards and agreement terms for service providers and vendors. Review and confirm terms previously agreed to re: existing agreements
  • Calendar training, testing of data controls & annual review of your policies
  • Consider changes to use of data to streamline compliance

Confirm you have applicable sanctions (OFAC) and anti-money laundering (AML) policies and procedures. Also consider the following:

  • Designate an AML Officer
  • Consider work flow for know your customer (KYC) and to screen vendors
  • Consider if your company has an obligation to conduct transaction monitoring and file suspicious activity reports (SARs)
  • Create a risk assessment for customers and vendors
  • Determine due diligence standards and agreement terms for service providers and vendors. Review and confirm terms previously agreed to re: existing agreements
  • Calendar training, testing of data controls & annual review of your policies
  • Consider changes to the business plan to streamline compliance

Confirm your company, investors and board agree to other governance as needed, keeping in mind the Department of Justice (DOJ) sentencing guidelines continue to give credit to companies with well-designed compliance programs. Also consider adopting the following:

  • Consider a Code of Conduct and a Code of Ethics to address employee conflicts.
  • Consider a vendor management and oversight program that addresses applicable Foreign Corrupt Practices Act (FCPA) and other anti-bribery laws or government contracts.
  • Consider a record retention policy to address litigation risks.
  • Consider periodic independent audits as a reality check on marketing, requests for proposal (RFPs), compensation and other activities to confirm the business has not triggered a state or federal licensing requirement.
  • Consider changes to the compliance program to create a ROI while mitigating risks.
Staying Engaged Regulatory and Career Developments

How to Stay Engaged with Regulatory and Career Developments

0

Staying Engaged

Summer months, a pandemic and an economic slow-down may make it hard to stay engaged with regulatory and career developments. In this issue of the Warburton Report we present several podcasts and training videos to help you more easily stay on top of developments in compliance & data governance, asset management and ESG trends.

Compliance Trends

The DOJ Fraud Section has issued its’ first compliance guidance since 2015. See, here.The guidance emphasizes the crucial role in leadership in compliance and the importance of the company’s commitment to compliance. Prosecutors review the company implementation and enforcement policies of compliance including:
  • Has the company performed a risk assessment and tailored their compliance program to their specific needs, risks, and challenges? (Section I)
  • Is the company proactively addressing third-party risks? (Section I)
  • What value does the company assign to compliance? (Section II)
  • How much experience, resources and authority does the company grant compliance personnel? (Section II)
  • What concrete actions have company leaders taken to demonstrate leadership in compliance and remediation? (Section II)
  • Has the company re-evaluated its program following a compliance failure? (Section III)
New What’s Ethical podcasts on data analytics & family office trends 

Data Privacy and Fintech

The Emergence of State Enforcement of Privacy Breaches
Around the country, states are enacting their own legislation governing use of data and privacy breaches. Among the leaders are California and NY.
On July 1, 2020 despite the Covid19 pandemic California has begun enforcement of California Consumer Protection Act (CCPA). A quick 3-minute briefing about the CCPA is available from the National Law Review. See, here.
One of the initial CCPA lawsuits have been filed in California Atkinson v. Minted Inc. The class action litigation, filed in a California federal court, claims that Minted failed to implement “reasonable security measures” and to properly encrypt certain personal information. As a result, hackers allegedly accessed the company’s database that contained customers’ names and login credentials, including unredacted and unencrypted account information. Some 73.2 million records were allegedly stolen and included passwords, names, and other information. The putative class seeks compensatory damages, punitive damages, and penalties. Under the statute penalties, can range from $100 to $750 for each violation. In a breach involving 73.2 million records, these penalties can be significant.
On March 21, 2020, the NY Shield Act’s data security requirements took effect, like California’s CCPA, NY law require businesses that own or license private information of state residents, employ “reasonable” security protections, including:
  • reasonable administrative safeguards such as: designation of employees to coordinate the security program, identifying internal and external risks, assessing safeguards to control the risks identified, training of workforce, and selecting 3rdparty vendors that maintain appropriate safeguards;
  • reasonable technical safeguards such as: risk assessments of network, software design, information processing, transmission, and storage; measures to detect, prevent, and respond to system failures; and testing and monitoring of the effectiveness of key controls; and
  • reasonable physical safeguards for storage and disposal of information, such as: risk assessments for storage and disposal; measures to detect, prevent, and respond to intrusions; and protections against unauthorized access to or use of private information
Training – Contact us if you would like a complimentary copy of these videos to distribute.
Data Protection and Cybersecurity
AML
Join this Global Cybersecurity Webinar on August 5. Beth Haddock is presenting on a panel about “Better Together: Compliance Meets Managed Services.”

Recent SEC Risk Alerts & Enforcement Cases

Increased Phishing during COVID-19: Ransomware Risk Alert
Patterns in Examination Deficiencies:  Private Fund Alert
Discontinuation of LIBOR:  LIBOR Alternative Preparation Alert
Breach of Duty of Due Diligence: SEC v. Temenos Advisory Complaint alleged that Defendants George Taylor and his advisory firm, Temenos Advisory put $19 million in investment capital into four risky private security offerings without performing due diligence or disclosing risks and prospects of the investments. The Defendants consented to entry of permanent injunction prohibiting future violation of Advisers Act and agreed to pay disgorgement, prejudgment interest, and penalties in excess of $2 million.
Advertising: In the Matter of Raymond J. Lucia Companies, Inc. On remand from the Supreme Court, the proceeding which names Respondents as a registered investment adviser and its owner, centered on marketing efforts by Lucia and his company concerning his “Buckets of Money” investment program. At seminars, investors were shown a slide presentation with allocated assets to short, medium, and long term buckets. Part of the strategy involved reallocating the investments. The approach was supposedly based upon historical backtests. However, the SEC alleged that the backtests were materially misleading and did not follow the buckets of money approach, and failed to disclose key issues regarding fees and other matters in violation of Advisers Act Section 206(1), 206(2) and 206(4). The commission issued a cease and desist order, barred Lucia from securities business for a period of years and issued a penalty.
A Case for a Different Type of Computer Code

A Case for a Different Type of Computer Code: A Code of Data Ethics

, 0

This article was originally published in the NSCP Currents May 2020 publication.

Compliance officers routinely build and maintain compliance programs to protect confidential information related to covered securities accounts and investments as required under applicable U.S. federal laws, rules and regulations1 (“investment laws”). Arguably, these efforts, including the mandated code of ethics, establish a clear standard to guard against misuse of such coveted information (“investment data”). This article explores the case for considering a similarly clear standard for consumer information, company proprietary information, security information and other confidential information (“privacy data”) traditionally covered by targeted privacy programs and legal liability mitigants such as written privacy, cybersecurity and information policies and procedures, training, assessments and non-disclosure agreements and contractual obligations. This type of confidential information is the subject of evolving and a somewhat converging body of federal and state privacy and cybersecurity-related laws, rules and regulations2 (“privacy laws”) and state attorney general offices and federal regulators’3 efforts to combat unfair or deceptive trade practices and prosecute violations of privacy laws. We consider whether adoption of a code of data ethics could lead to more effective, efficient and impactful compliance with privacy laws and protection of valuable privacy data.

1. What is a Code of Data Ethics?

Sets a Tone: A code of data ethics can be used to communicate company-wide cultural and governance standards. With a commitment to such a standard, the compliance officer and related team of privacy officer, Chief Information Security Officer (“CISO”) and/or risk officer (“compliance team”) can more effectively set the tone for use of privacy data which is increasingly more necessary as they grapple with data questions related to complex technology. To understand compliance with privacy laws and the adequacy of the compliance program, it is not uncommon for compliance officers to address questions about development of a technology platform, launch of a new digital product or a new marketing and business development tool and/or use of artificial intelligence, machine learning and biometrics. In the same manner governance and culture is crucial to support an adequate compliance program for investment data, arguably, that same strategic approach is needed to support adequate compliance controls for privacy data. Both types of information are of bottom-line value to the company and need priority protection and, in both cases, it is difficult to incentivize employees and others to act as though they are accountable for protecting the data. We believe compliance officers and the programs they administer should cover both types of data by clearly setting expectations designed to drive desired behavior. This will enable the compliance team to reasonably rely on management and employees to use good business judgment, promptly escalate issues and collaborate to align the compliance program in a dynamic business environment. By way of example, many compliance programs adopt an investment code of ethics to strategically address insider trading risks and mitigate exposure to misuse of information by third parties such as temporary outsiders and tippees4 because, among other things, a compliance officer faces challenges controlling the flow and use of the firm’s investment data in compliance with investment laws. Likewise, a code of data ethics could be used by compliance teams to more effectively manage the challenge of adequately controlling access to and use of privacy data in adherence with privacy laws. The challenge of controlling behavior is similar. In the case of privacy data, the compliance team does not typically have the expertise, authority and resources to control this vast and mutable data including its use across the company and by a network of strategic partners and third party vendors. In sum, a code of data ethics is more strategic; it helps increase engagement and accountability across an organization. Something a compliance officer, without the support of a company standard, will struggle to achieve.

2. Why Align Privacy and Investment Efforts?

Harness Efficiencies to do a Better Job: There are at least three potential benefits to aligning data privacy and other compliance efforts. The benefits involve more efficiently deploying compliance resources, so compliance officers have more time to proactively address priority matters at their companies.

  • 1. An aligned approach can help eliminate siloes that can lead to inefficient risk monitoring and mitigation and instead treat protection of privacy data as an enterprise risk. Investment data is subject to a code in part because of precedent that deems failure to protect it an enterprise risk. Without that precedent, the compliance team will need to share the research that shows data protection is a systemic risk and then advocate why it should be mitigated as strategic priority.5 Additionally, the compliance officer could present a comparison to senior management, and a board if appropriate, of the risk of non-compliance with privacy and investment laws. It is reasonable to consider failure to escalate and resolve compliance gaps create commensurate reputational, regulatory enforcement and legal risks.
  • 2. Additionally, an aligned approach can help minimize confusion by employees about the importance of their role in protecting privacy data. A code of data ethics could be an efficient method to minimize unintentional data breaches. Research shows employee access and use of privacy data is a major risk and potential cause of data breaches6. A code of data ethics will more clearly communicate employees are stakeholders that are accountable for protecting privacy data.
  • 3. Alignment will help facilitate fulsome and accurate regulatory reporting, board reporting and third party due diligence about the company’s data protection and privacy controls. This approach will elevate the discussion of the treatment of privacy data and promote more natural coordination among the CISO, Chief Compliance Officer (“CCO”) and Chief Technology Officer (“CTO”) for such reports and certifications.

3. How To Implement a Code of Data Ethics

Keep it Simple. Start a Conversation: To consider making a change within a compliance program, it will be important to build a company-specific case for heightened attention to a data ethics governance and culture. The need for a more strategic approach could be based on the need to make more of an impact with current budgeted, or decreased, resources. For example, compliance officers could consider recent experiences, such as the below, to support needed change:

  • Has your company had a recent data breach or increase in data incidents such that self-reporting is more of a priority to ensure those incidents are promptly handled? i.e., A code is a foundation for incentivizing employees to self-report and deter willful blindness. The benefit of a code is apparent in the investment compliance arena because data is subject to whistleblower reporting. Likewise, a compliance officer could make an analogy that privacy data is similarly subject to whistleblower and breach reporting protocols.
  • Is your company considering use of privacy data practices or have you found your Privacy Policy isn’t transparent enough to address business practices? A code of data ethics can facilitate an executive discussion about a commitment to collect only what is needed, to consider masking display of all personally identifiable information and/or adopt heightened security for data in transit and at rest or other best practices such as those included in the National Institute of Standards and Technology (NIST) Cybersecurity Framework. www.nist.gov/cyberframework7.
  • To facilitate global and interstate business, is your company tracking regulatory changes such as CCPA and other state laws and finding it is too risky and/or complicated without a strategic approach to data privacy? A code of data ethics could establish a framework that allows the company to be more agile as it focuses on business stability and development and digital marketing campaigns at the same time it adjusts to new privacy laws. Adoption of a code of data ethics can be implemented as a stand-alone document or a new section of the current code of ethics or code of conduct. Regardless of the end result, this is an opportunity for compliance officers to lead a strategic discussion about the need to identify enterprise data risks and protect privacy data, and present an innovative idea about how to deliver a more effective, efficient and impactful return on investment for data privacy and compliance resources.

Click here to view our Decision Tree for Creating a Code of Ethics 

1. For example, Rule 17j-1 and Rule 38a-1 under the Investment Company Act of 1940, as amended (“1940 Act”), section 15(f) of the Securities Exchange Act of 1934 (“Exchange Act”), FINRA Rule 3210, NFA Compliance Rules 2-36 and section 204A of the Investment Advisers Act of 1940 and Rule 204(A)-1 and Rule 206(4) (“Advisers Act”), Insider Trading and Securities Fraud Enforcement Act of 1988 (“ITSFEA”).

2. For example, the Gramm-Leach-Bliley Act (“GLB”), Section 5 of the Federal Trade Commission (“FTC”) Act, California Consumer Privacy Act (“CCPA”), NY SHIELD Act, Department of Financial Services New York Cybersecurity Requirements: 23 NYCRR 500; SEC and FINRA rules, regulations and guidance for compliance programs related to SEC Regulation S-ID: Identity Theft Red Flags (“Red Flags Rule”).

3. See more information about FTC enforcement – https://www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act; Important SEC notices include the following: Risk Alert: Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features; Risk Alert: Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies; Risk Alert: Observations from Cybersecurity Examinations; Risk Alert: OCIE’s 2015 Cybersecurity Examination Initiative; Risk Alert: Cybersecurity Examination Sweep Summary.

4. See Dirks v. SEC, 463 U.S. 646, 655 n.14 (1983) temporary outsiders such as underwriters, lawyers, accountants, and consultants are covered in the code; Chiarella v. United States, 445 U.S. 222 (1980). Recipients of investment data from corporate insiders who do not owe a fiduciary duty (known as “tippees”), are covered as well.

5. https://advisory.kpmg.us/articles/2019/ten-key-challenges-2020.html; https://www.nist.gov/system/files/documents/2017/06/05/privengworkshop_preso.pdf; https://www.cisco. com/c/dam/en/us/products/collateral/security/2020-data-privacy-cybersecurity-series-jan-2020.pdf. Recipients of investment data from corporate insiders who do not owe a fiduciary duty (known as “tippees”), are covered as well.

6. https://info.varonis.com/hubfs/Varonis%202019%20Global%20Data%20Risk%20Report.pdf

7. Many companies voluntarily adhere to or are required by contract to comply with cybersecurity requirements such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. www.nist.gov/cyberframework. The NIST Cybersecurity Framework provides voluntary cybersecurity standards for protecting company computer networks owned or operated by critical infrastructure entities. The Framework is divided into three parts: Framework Core, Implementation Tiers and Framework Profile. The Framework Core is designed to identify key cybersecurity activities common across all critical infrastructure networks. These are activities that companies should address when creating programs to protect critical computer systems and that identify best practices for communicating risks throughout an organization. Specifically, the Framework Core consists of five functions designed to provide company decision-makers with a strategic view of cybersecurity risk management: identify, protect, detect, respond and recover. Cybersecurity (United States) 06/18/2019 by Benjamin A Powell, Jason C Chipman, Leah Schloss, Maury Riggan, Wilmer Cutler Pickering Hale and Dorr LLP

Sustainable Governance Back to Basics

How to Get Back to Basics with Sustainable Governance | 3 Reminders

0

With so many challenges and distractions, we decided to dedicate this post to a back-to-basics theme focusing on updating your compliance program as operational processes and business plans change, regulators announce new guidance and privacy and data governance remain a top priority. We offer three important reminders.

1. Adjust the Compliance Framework

  • Contingency Planning: Remember to update your business continuity plan (BCP) and draft an infection response plan in adherence with OSHA requirements. SEC COVID-19 Announcement
  • Testing & Monitoring: Continue your independent reviews and calendar quarterly testing, so you aren’t playing catch-up later in the year. We are almost mid-way through 2020, so it’s a good time to confirm you are in sync with marketing and business development plans as well as access to confidential or non-public information. Recent SEC Enforcement Case re: COVID-19 Fraud; New SEC Advisory Committee
  • Benchmark & Connect: Join us for Compliance Call-in Fridays if you have any questions. We are here to help. RSVP at team@warburtonadvisers.com.
  • Keep Learning: Listen to What’s Ethical podcast Episode 19 and learn from CCO at Ladder Insurance Cara St. Martin about being agile in the current environment and Episode 18 with CEO Matt Kunkel of LogicGate about how to manage through the pandemic. The podcast is available on many platforms as well as under Media on our new website. What’s Ethical Podcast

2. Track Regulatory Developments

  • Focus on Priorities: Retail investor protection is still a top priority. This speech summarizes the sentiment to protect retail investors and reminds us about the importance of advertising compliance including the SEC’s proposal to revamp the advertising rules and potentially consider the adequacy of Climate Risk Disclosure. Consider redistributing this as a helpful email to stay in touch with the business or use it as training content to share regulatory priorities. SEC Commissioner Lee Speech
  • Refresh Valuation Oversight: As you consider your investment and best execution process, review the long-awaited guidance on valuation. SEC Fund Valuation Proposal
  • Regulation Best Interest: To date, the SEC has not extended the compliance deadline for Regulation Best Interest (Reg BI) and Form CRS due to the COVID-19 pandemic. SEC Risk Alert Reg BI OCIE has indicated initial examinations of Reg BI and Form CRS will begin shortly after the compliance date and may focus on assessment of the following:
          Whether a Broker-Dealer or RIA firm
  • has made a good faith effort to implement policies and procedures designed to comply with Reg. BI and Form CRS;
  • filed and delivered a Form CRS (relationship summary) as required. OCIE will verify if a firm has published the relationship summary on the firm’s website and delivered to retail investors before the compliance date. OCIE will further evaluate the process of delivery and the firm’s policies and procedures relating to the relationship summary;
  • adequately adhered with requirements for content and format for the relationship summary.
  • has updated its compliance manual or otherwise established policies and procedures for updating the relationship summary within 30 days of information becoming materially inaccurate and the communications to retail investors of the changes; and
  • has updated its record retention policy or otherwise addressed the firm’s record keeping obligations concerning the delivery of the relationship summary.
Reach out if you would like our template Reg BI mock exam tool which will help you confirm you are ready for a go-live date in June.

3. Prioritize Data Governance

National Institute of Standards and Technology (NIST) has issued guidelines on telework and remote access to help organizations mitigate security risks associated with the technologies used for teleworking, such as remote access servers, telework devices, and remote access communications. Recent NIST Bulletin This is a good resource for coordinating with IT, your CISO or senior management to confirm you have adequate data and cybersecurity controls. A few of the suggestions from NIST are as follows:
  • Consider developing a Telework Security Policy which includes a definition of telework, remote access and the use of personal devices and the scope of access each teleworker is permitted;
  • Protect data stored on company devices by encryption and not permitting any client data to be stored on personal devices;
  • Require the use of multi-factor authentication passwords;
  • The installation of encryption technology to protect email communications; and
  • The installation of anti-malware.
Wealth Management

Annual Form ADV Review Checklist

0

It’s that time of year again – time to prepare for your annual Form ADV Review. 

Disclosures to clients and prospects are even more important this year in light of new requirements announced last summer.  

This is arguably the most important compliance project for the quarter.

Annual Form ADV Review

As you conduct your annual review, I have laid out some reminders based on recent enforcement cases, guidance about the new Regulation Best Interest (Reg BI) requirements and resources to help you address the details. This can serve as your ADV Review checklist.

Although the narrative in Part II of the Form ADV is typically treated as the core of the filing, remember to prioritize Part I and Part III.

•  Review Regulatory Expectations

Don’t rely on your memory. Make sure to consult the glossary and frequently asked questions to make sure you understand terms and regulatory expectations. They change over time and it’s important not to guess when it comes to the technical details in Part I of the Form ADV.  Also see SEC Instructions.

•  Involve the business

Review a draft of the Form ADV filing with the business and document the process, especially private funds disclosures, regulatory assets under management (RAUM) calculations and AUM against marketing claims. If you need support to help prioritize this work, review some of the recent enforcement cases highlighting Form ADV mistakes. Feel free to highlight these cases on your annual training or periodic compliance alerts:

  1. Exaggerated AUM in Marketing – Bennett and Bennett Group
  2. False statements regarding AUM not continuously managed and custody rule violations – Clayborne Group
  3. Failure to file updated form regarding AUM and Form PF – HEP Management
  4. Fraud and failure to file conflicts of interest disclosures – Northeast Asset Management
  5. See SEC Risk Alert Form ADV for more 

•  Start early

Prepare the new Part III – Form Client Relationship Summary (CRS) – before June and review disclosures related to Reg BI and recently announced SEC OCIE Exam Priorities (pages 9-12 regarding seniors, retail and retirement accounts)

  1. Firms must comply with Reg BI and Form CRS by June 30, 2020. Be prepared for scrutiny of your new disclosures. The regulators have signaled there won’t be a grace period.  See Bloomberg Law; JD Supra.
  2. Remember to check the SEC website for updates. Recently the FAQs were updated to address implementation questions. See SEC FAQs as of Feb; Summary of Further Guidance on Reg BI; Small Firm Resource Guide.
  3. Remember to update your procedures and work-flow for delivering the new Form CRS. If you are a dual registrant, this applies to brokers and advisers. See FINRA Checklist and Resource Hub.

Consider using a “Disclosure Committee” so there is an efficient process for sign-off before the Form ADV is submitted to the SEC or delivered to clients.

•  Collaborate and Document

Create a forum so it is easy to gather feedback on this complex filing. For example, in a cross functional meeting or call, HR and others can more easily contribute for compensation and conflicts disclosures while Finance and others can contribute for disclosures related to valuation and expenses.

•  Avoid Mistakes

By collaborating you can avoid inadvertent inflation of calculations in Part 1 and confirm revenue sharing and inaccurate fee and conflicts of interest disclosures in Part II. See Deer Park Road Management case as an example of compliance failures related to fund asset valuation. Also see FAQs Regarding Disclosure of Conflicts Related to Investment Adviser Compensation.

Complete a 360 Cyber review in light of recent guidance and importance of data protection to the resilience of your business.

•  Review Vendors and Data

Review vendor sections in Part 1 and make sure your description of cybersecurity, cloud, record retention and other data management oversight is solid. 

•  Review Ethics

Review the code of ethics description In Part II and consider whether it is prudent to add data ethics as well. Likewise, review your risk disclosures in Part II and consider adding cybersecurity and data protection risks.  

•  Consolidate Delivery

With so many new privacy laws (GDPR, CCPA), check to see if your privacy policy or privacy practices have changed. If they have, and your company finds itself treating non-public personal information more stringently or differently than is required under Reg S-P, consider delivering your updated privacy policy and Part IIA to your clients at the same time to meet both annual requirements. See SEC 2020 Cybersecurity Guidance for more.

Review ESG and impact claims for consistency and omissions.

•  Support ESG Investment Claims

If you have any investment analysis claims about impact, ESG or sustainability investments, confirm they are supported by objective investment methodologies and avoid unsubstantiated claims or claims that conflict with any Corporate Social Responsibility (CSR) or sustainability reports. You can visit the SEC OCIE Exam Priorities to find evolving investment themes on pg. 15. Also see the Columbia Law Review Article if you are interested in the history of disclosures related to environmental claims.

Compliance Takeaways

Keeping current with regulatory changes while also doing your job and running your business is difficult. Existing registered advisors must update and file an amended Form ADV within 90 days of their fiscal year-end – the due date for 2020 is March 30, 2020. The time is now to start thinking and preparing for this important compliance deadline.

It is generally considered a best practice to complete the annual compliance review by the end of the first quarter or early in the second quarter of the year – but not required. Investment advisors should review their compliance policies, code of ethics, and overall compliance program.

Are you taking proper actions to remain compliant? Feel free to reach out if you have any questions.

Beth Haddock Data Governance

Data Governance and Privacy Update

0

Today on the blog we’re highlighting data governance and privacy. We’ve provided takeaways for your compliance program. We hope you find these helpful. Let us know what you think!

  • Data governance is not just a regulatory issue. It also raises various state consumer laws and data breach statutes. Recently, Equifax settled over 300 class action cases for 138 billion USD. This is a good reminder, as you audit, to refresh your perspective on data governance and that cases like this can be worked into your company’s training program. Read a summary of this data breach incident in Security Magazine.
  • The FTC recently finalized settlements with 5 companies over allegations that they made false and misleading representations when they stated that they participated in the EU’s Privacy Shield — when they did not. Here’s the FTC Settlement. Be sure to check your company’s website to confirm the statements on it are current and otherwise accurate.
  • Investing in data privacy governance is well worth it. According to Cisco’s 2020 data privacy benchmark study, companies that have invested resources in privacy and data compliance have seen positive returns on investment. If you need to request budget allocations, consider using this study as support.
  • 2019 was a record year for AML fines and 2020 appears to be keeping that pace. AML and anti-fraud efforts should continue to be a priority in 2020. According to the ACFCS Fincrime Briefing, “As regulators learn that the financial crime risks of Libra and other stablecoins can be managed using techniques like blockchain analytics, they will provide clearer guidance to the market on regulatory requirements to ensure that stablecoin projects can be launched in more parts of the world, in a safe and trusted manner”.
  • Austin Gerig was named as the SEC’s new Chief Data Officer: The SEC Press Release covers his resources including a team of data scientists, data engineers, financial economists, and research associates.
  • Reminder & Resource: Your independent AML testing should be underway. Check out the ACAMS AML videos for professional development and/or training ideas.
  • The SEC recently launched a new advisory committee. In an Opening Statement of the new SEC Asset Management Advisory Committee, Dalia Blass, a Director in the SEC’s Division of Investment Management, stated: “debates surrounding long term trends in the asset management industry, such as the rise of index investing, increased globalization, increased scale and trends in retirement funding, would benefit from thoughtful discussion among experts with diverse viewpoints”.

Load More