ERISA Fiduciary - Improving Investment Advice for Workers and Retirees

  

ERISA Fiduciary
Improving Investment Advice for Workers and Retirees

On December 18, 2020, The Department of Labor (“DOL”) adopted Prohibited Transaction Exemption 2020-02 (“PTE 2020-02”). PTE 2020-02, called Improving Investment Advice for Workers and Retirees, expands the definition of advice covered under ERISA law to include recommendations about retirement plan rollovers and Individual Retirement Accounts (“IRAs”). PTE 2020-02 went into effect on February 16, 2021, and included a non-enforcement policy until December 20, 2021.

The result of expanding the DOL definition of investment advice to include recommendations to rollover a client's assets from an ERISA sponsored retirement plan to an IRA is significant, as ERISA fiduciaries are prohibited from engaging in transactions where they receive increased compensation as a result of the advice provided, otherwise categorized as “conflicting advice”. There is a myriad of disclosures and policies and procedures that require implementation in order to receive compensation for rollover recommendations.

The DOL has established a Five-Part Test in order to assist advisors in determining whether a recommendation to roll over retirement plan assets into an IRA falls under ERISA. The regulation states that a person provides “investment advice” if he or she: (1) renders advice to a plan or participant as to the value of securities or other property, or makes recommendations as to the advisability of investing in, purchasing, or selling securities or other property; (2) on a regular basis; (3) pursuant to a mutual agreement or understanding; (4) that such advice will be a primary basis for investment decisions; and that (5) the advice will be individualized to the plan or participant.

How does this impact Registered Investment Advisors? Many that once did not offer retirement plan advisory services will now find themselves subject to the ERISA fiduciary standard when providing recommendations to roll over a participant’s retirement plan assets into an IRA. Certain of these requirements and standards were already required under the Investment Advisers Act of 1940 (“Advisers Act”), so the DOL requirements below shouldn’t come as a major surprise. Under the DOL there are requirements to adhere to the following:

1. acknowledgment from the advisor of their fiduciary status under Title I of ERISA and the Internal Revenue Code;
2. due diligence and written documentation of the specific reasons that any recommendation to roll over assets (whether from an ERISA plan to an IRA, from one IRA to another IRA, or from one type of account to another (e.g. commission-based account to fee-based account) is in the best interest of the client.
3. written disclosure to clients that include (i) the scope of the relationship, (ii) all material conflicts of interest, and (iii) the reasons the rollover recommendation is in their best interest;
4. compliance with the Impartial Conduct Standards which includes (i) provide prudent investment advice, (ii) charge only reasonable compensation, and (iii) avoid misleading statements; and
5. an annual compliance review with the results in a written report to a Senior Executive Officer of the advisor.

ACKNOWLEDGEMENT OF FIDUCIARY STATUS

The written fiduciary acknowledgment is designed to ensure that the fiduciary nature of the relationship under Title I of ERISA and/or the Code is clear to the advisor, as well as the client, at the time of the recommended investment transaction. This requirement reflects the DOL’s view that parties wishing to take advantage of the broad prohibited transaction relief in the new exemption should make a conscious up-front determination that they are acting as fiduciaries; tell their client’s that they are rendering advice as fiduciaries; and, based on their decision to act as fiduciaries, implement and follow the exemption’s conditions.

DUE DILIGENCE AND DOCUMENTATION

There are a number of specific considerations to be reviewed and compared before executing any action. Considerations include the following:

• The range of investment options between the existing plan and proposed rollover account, and which is in the client's best interest.
• A comparison of the fees and expenses associated with the existing plan and the proposed rollover account.
• What, if any, tax implications exist for the individual client should they choose to accept rolling over their ERISA plan assets into an IRA?
• Are there services that the client would receive from the existing plan that would benefit them that they would not receive in a new account?
• Is the client's age a factor? Are they planning to retire early or do they plan to work past the age where Required Minimum Distributions (RMD’s) will come into play?
• ERISA plans typically have unlimited protection from creditors, whereas IRA assets are only protected in bankruptcy proceedings. Is this a concern for the client?

Advisors are expected to make diligent and prudent efforts to obtain information about the existing employee benefit plan and the participant’s interest in it. The focus should not be solely based on the client’s current holdings, but instead should consider the overall options available in the plan. Consideration of factors like the long-term impact of any increased costs, why the rollover is appropriate (notwithstanding any additional costs), and the impact of any economic investment features that exist are critical components in determining suitability with each individual client. In the event that a client won’t provide the information, even after an explanation of its significance, and the information is not otherwise readily available, the institution and professional should make a reasonable estimation of expenses, asset values, risk, and returns based on publicly available information. Documentation should be maintained whenever assumptions are being used and their limitations.

WRITTEN DISCLOSURES

Prior to engaging in a transaction under the exemption, the Advisor must provide its clients a written description of the Advisor’s material conflicts of interest arising out of the services it provides and any recommended investment transaction. These conflicts must include those associated with proprietary products, payment from third parties, and compensation arrangements for both the advisor and its investment advisor representatives. Disclosures with material omissions will be considered inaccurate and will not satisfy the exemption. It should be further noted that the disclosure cannot be a “check-the-box” activity. As it pertains to the written disclosure of the recommendation, advisors should consider, discuss, and document the alternatives to executing a rollover. Those alternatives include leaving the money in the existing plan, rolling the money into a new employer-sponsored plan, or withdrawing money from the ERISA plan completely.

Disclosures with material omissions will be considered inaccurate and will not satisfy the exemption. It should be further noted that the disclosure cannot be a “check-the-box” activity. As it pertains to the written disclosure of the recommendation, advisors should consider, discuss, and document the alternatives to executing a rollover. Those alternatives include leaving the money in the existing plan, rolling the money into a new employer-sponsored plan, or withdrawing money from the ERISA plan completely.

IMPARTIAL CONDUCT STANDARDS

The cornerstone of the exemption is the requirement that advisors adopt and adhere to the Impartial Conduct Standards. The essence of these standards should come as no surprise, as they speak directly to the duty of care and loyalty that should be paid to all clients and transactions at all times as an advisor. Those standards are outlined below:

• Investment advice must be in the best interest of the client and must not place any other interests ahead of that interest.
• Compensation paid for such advice must be reasonable.
• Statements made with respect to the transaction must not be materially misleading.

ANNUAL REVIEW

The Advisor’s annual review should be designed to assist the firm in detecting and preventing violations of, and archiving compliance with, the impartial conduct standards and their policies and procedures. The results of the review must be reduced to a written report that is submitted to one of the institution's senior executive officers. The officer must make certain certifications related to their review of the report. The report, certification, and supporting data must be retained for six years and provided to the DOL within 10 business days of a request.

How will the DOL Oversee Compliance with PTE 2020-02?

To the extent that advisors experience violations of the exemption, PTE 2020-02 contains a self-correction procedure for violations of the conditions under the exemption. To self-correct, an advisor must:

1. Determine that the violation did not result in investment loss, or it must make the client whole for any such loss;
2. Correct the violation and notify the DOL within thirty (30) days of correction;
3. Complete the correction no later than ninety days after the advisor learned of (or reasonably should have learned of) the violation; and
4. Notify the person(s) responsible for conducting the retrospective review during the applicable review cycle so the correction can be included in the report.

NEXT STEPS: We are currently building various tools embedded within AdvisorCloud360® to assist with these requirements. In the meantime, we strongly encourage advisors to adopt policies and procedures to help with their due diligence and documentation efforts, as well as ongoing disclosure requirements.

If you’d like to receive more information on the new DOL rule, please reach out to AdvisorAssist at info@advisorassist.com.

RESOURCES:

DOL Final Rule

Read More

CCO Series - Trade Errors

What You Need to Know

In developing policies and procedures for a Registered Investment Advisor ("RIA") a topic that must be addressed is trade errors. To uphold the fiduciary duty owed to clients of your RIA, your policies and procedures must cover how you handle errors that may occur when trading in a client's account. If a trading error occurs in a client's account managed by an RIA there are critical response items to consider in order to uphold your fiduciary duty. Implementing these compliance components can demonstrate to a regulator that you are satisfying your regulatory requirements.

What is a Trade Error?

The most common trade error is buying the wrong security or the wrong amount. Here are a few other examples of events that are considered trade errors:

• Trading in the wrong client account
• Trading in the wrong direction (buy vs. sell)
• Trading at the wrong price (limit orders, etc)
• Incorrect block trade allocation
• Violation of client account restriction (tobacco, oil, military)
• Violation of client account suitability (aggressive vs conservative)
• Delayed execution of trade instructions
• Duplicate execution of trade instructions

How to Handle Trade Errors

Even if the error does not fit into one of these examples you must discuss any potential or actual trade errors with your CCO to ensure compliance. CCOs should document the event within their trade error log and save all related documentation for the RIA's books and records. Consider communicating with the clients as needed to explain events in their statements or other irregular trading activity. Most trade errors can be resolved prior to settlement by the custodian if they are promptly discovered and communicated.

Reviewing Policies and Procedures

Advisors must ensure their policies and procedures require the disclosure of trade errors to the CCO and that trade errors are documented in the Advisor's trade error log. The log must also include any related backup or other documentation, that the trade errors are resolved in a way that makes the client whole and absolves the client of consequences of the Advisor's error. Additionally, trade errors should be reviewed at least annually by the CCO or delegate to ensure that any reasonable changes to the Advisor's business practices that could eliminate future errors are considered for implementation. During this annual review, the CCO or delegate must also update the Advisor's trade error policy as needed to ensure it accurately reflects how trade errors are resolved.

What are the Next Steps for a CCO?

Sample review transactions from your firm’s trading blotter to ensure trades are placed accurately in accordance with documentation and client objectives. Ensure any and all trade errors are documented in your firm's trade error log. Confirm that trade error files maintain documentation related to the specifics of the trade error as well as documentation substantiating the resolution. Consider reasonable changes to business practices that could eliminate the potential for future errors. Finally, remain aware of any changes to trade error policies and procedures that may be imposed by your custodian and ensure your internal policies remain accurate. Ensure proper communication of trade error policies and procedure to supervised persons.

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program. Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Read More

CCO Series - Client Suitability

As a fiduciary, an RIA firm is required to make investment decisions in the best interests of its clients. When making decisions regarding the investment options for accounts an RIA firm needs to be able to defend such decisions as being reasonably suitable to the goals and needs of its beneficial owners. Regulators will seek to ensure that decisions made by the firm during the course of providing its services primarily benefit the client and are suitable for a particular account's objectives. Documentation that define a fund's investment objectives or a model portfolio strategy will be compared against the trading history and the decisions made for clients to validate whether or not the firm is making suitable investment decisions when providing its services.

RIA Client Suitability In a Nutshell

Client suitability starts with information about how the RIA firm's investment managers will provide its advisory services and the information about the client or fund that will be relied upon to guide those decisions. For a typical retail RIA situation, this may include your client profile, risk tolerance questionnaire, investment policy statement (IPS), or client notes capturing similar information. For structured investment products this may include the operating agreements, offering documents, and similar information about the funds, parties and entities involved. As these documents are executed, modified, updated or amended the advisor should keep and maintain this additional documentation for their firm's books and records.

Risks related to strategies used by an RIA firm must be disclosed to clients through Form ADV. Specifically in Form ADV Part 2A, the Disclosure Brochure, Item 8 Methods of Analysis, Investment Strategies and Risk of Loss should contain information regarding how the firm's investment management services will be applied to the client's accounts and the potential losses that can occur due to the way the firm will invest the client's assets. It is important for firms to review these disclosures and ensure they accurately reflect the firm's investment methods and cover the risks related to the firm's advisory services.

Confirming Suitability

After collecting a client's information, having them sign an advisory agreement and providing a copy of your ADV and other new client paperwork, suitability becomes a compliance matter for the relationship as you move to digest the information and start making investment decisions for the client's account(s). While your documentation may tell the client to notify your firm of any changes to their profile, goals or objectives, every RIA firm still has an obligation to reach out to the client and confirm the information you have is still accurate and that ultimately to confirm your current understanding of what is suitable for that client.

Confirming suitability can take the shape of having the client complete a new risk questionnaire, sign a new IPS, or to have a meeting with the client where you discuss the management of their account and address suitability matters. Documenting this confirmation is critical to the firm's books and records for compliance purposes on this topic, and can take the form of client notes indicating suitability was discussed and the results of that discussion, or the updated formal documents such as the questionnaire or IPS. For fund managers, this activity means ensuring that the decisions being made for the fund are reasonably accomplishing the objectives of the fund as described in its documentation and ensuring that due diligence documentation is retained for various non-public investments. By having this documentation in your firm's books and records you can demonstrate that your firm has upheld their fiduciary duty when making investment decisions for its various clients.

Through the Regulator's Eyes

Regulators expect RIA firms to maintain documentation on each advisory client to support the investment decisions made for their account(s). During an examination, regulators will typically ask firms to provide their risk questionnaires or similar documents used to obtain information about their clients, and will also request information about trades in client accounts, and will reconcile the two to ensure that decisions made for clients are suitable and that there is a rational basis between the documentation, analysis, and investments. Further, regulators will review the information in your firm's disclosure brochure to reconcile to the types of investments to ensure that the strategies and risks are properly and fully disclosed to clients.

CCO Best Practices

Conduct a random sampling review of client files to verify that suitability is appropriately documented. Run a comparison between the client's trading history and the suitability documented to ensure investment decisions are in line with investment objectives. Validate that the last outreach attempt to each client is within one year. Additionally, review your firm’s client intake/onboarding and ongoing review process to ensure you are capturing adequate information to make, or continue to make, appropriate investment decisions in client accounts and provide advice that is in the client’s best interest.

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program. Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Read More

The AdvisorAssist CCO Series: Anti-Money Laundering (AML)

This is one of those subjects that are difficult to imagine until it happens. Fortunately, to date, the regulators have not imposed onerous requirements on RIA firms, like they have with custodians and broker-dealers. AML for investment advisors is one of those regulatory topics that always seems to resurface and we believe that more formal AML procedures will be eventually be expected from RIAs. In the interim, we have produced some best practices so that your RIA firm is aware of the subject and is armed with the basics of identifying suspicious activities.

Anti-Money Laundering (AML) In a Nutshell

Money laundering is the process by which individuals or entities attempt to conceal the true origin and ownership of the proceeds of criminal activities, such as organized crime, drug trafficking or terrorism. Anti-money laundering (AML) is a general term that describes the controls used by financial institutions to prevent, detect and report money laundering activities. AML program requirements for financial institutions are laid out in various laws including the Bank Secrecy Act of 1970, the Money Laundering Control Act of 1986, and the USA Patriot Act.

For a more digestible summary of all AML-related laws can be found here.

Through the Regulator's Eyes

Registered investment advisors do not fall under the definition of "financial institution", so (at this point) they are not subject to extensive anti-money laundering requirements. There have been many overtures by the U.S. Treasury Department's Financial Crimes Enforcement Network ("FINCEN") to bring RIAs under similar requirements. The director of FINCIN reignited these efforts by indicating that Treasury intends to revisit this topic and finalize rules for RIAs. By all indications, advisors will ultimately have increased AML rules at some point in the near future. For the time being, we recommend that RIAs adopt certain best practices related to AML.

CCO Best Practices

• Perform due diligence on each new investor to ensure you can confirm their identity and that the individual or entity is not on the Office of Foreign Asset Control (OFAC) sanctioned list. (This may be delegated to a third party like a custodian.)
• Monitor client transactions for suspicious activity (e.g. reluctance to provide identifying information, frequent deposits of cash, cashier's checks or money orders, or wire transfers slightly under $10,000, or acting on behalf of an undisclosed person or entity.

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program.  Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Read More

CCO Series (2019) - Financial Statements

The financial statements that you maintain for your RIA firm, which include income statements, balance sheets, statements of cash flows, are powerful tools. Apart from the fact that they are a required to be maintained for books and records purposes, the data that they contain hold the key to many other critical regulatory and practice management activities.

RIA Financial Statements In a Nutshell

Maintaining complete and accurate financials on your business simply makes good business sense. However, the primary purpose here is the maintenance of financial statements for compliance purposes, which may include:

• Balance Sheet and Income Statement
• Cash Journals - Documentation including cash receipts and disbursements, records, and any other records of original entry forming the basis of entries in any ledger
• Banking Information - All checkbooks, bank statements, cancelled checks and cash reconciliations for your firm
• Business Expenses - All bills or statements (paid or unpaid) relating to the business of your firm
• Other Financial Statements - All trial balances, financial statements, and internal audit working papers relating to the business of the firm

While maintaining proper financial statements is required in order to avoid regulatory sanctions, it can also be a useful tool for RIAs. Creating and reviewing financial statements on a regular basis can prove to be an indicator of the health of the firm. The financial statements can demonstrate that the firm is performing as intended and disclosed, or act as a tool to show areas where it can improve. Ensuring financial stability of a firm is an important step in gaining client and regulatory confidence. Proving to be solvent and possess secure financials could be the difference between gaining and losing clients, or spending more time with regulators during an exam.

State Specific Requirements

Many of the regulations regarding financial statements for RIAs are dependent on the advisor’s principal state of business. Along with U.S Securities and Exchange Commission ("SEC") requiring specific actions regarding financial statements, each state also has specific requirements on the issue. It is important to recognize your specific state’s requirements in order to avoid unnecessary regulatory issues. Currently, there are states that require financial statements to be sent to their state regulatory agency each year. This applies only if the firm is registered with the state, and does not apply to SEC registered firms.

It is important to stay updated on your specific state’s requirements in order to avoid unnecessary regulatory issues. Depending on the state, there may be minimum net worth requirements that are to be demonstrated through the financial statements. Where applicable, your firm’s books and records archive should contain the necessary financial statements.

Through the Regulator's Eyes

Regulators have put an emphasis on monitoring the financial statements of newly-registered advisors. If they are not completed correctly, it may be a sign that a further examination is needed. Accurate financial statements prove to the regulators that the firm is running effectively. Proper maintenance and submission, if required, of updated financial statements is one key way to avoid regulatory sanctions.

CCO Best Practices

• Do not approach financial statements as just a way to avoid regulatory sanctions. They are important at spotting financial irregularities which might benefit you.
• Utilize financial statements as a powerful tool to indicate advisory effectiveness and compliance.
• Always stay informed of specific state requirements, which may differ from SEC and other states’ regulations.
• Maintain accurate financial statements, in accordance with generally accepted accounting principles (GAAP).

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program.  Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Thomas Yates

Read More

CCO Series (2019) - Voting Client Proxies

The right to cast votes on certain corporate matters is an important power given to shareholders of publicly traded companies and mutual funds. Your RIA firm is expected to address its role with respect to voting proxies on behalf of clients. You may agree to take on the responsibility to vote proxies on securities your client's own, or you may elect to not vote their proxies. In each instance, regulators expect you to disclose your proxy voting practices. In addition, that you have clearly defined and communicated policies and procedures related to this aspect of corporate governance so clients understand your proxy voting practices.

Advisor Proxy Voting In a Nutshell

Shareholders of publicly traded companies and mutual funds have the right to express their opinion on certain business matters that impact the value of the securities they own. Board of director elections, mergers and acquisitions and changes in fee schedules (in the case of mutual funds) are examples of voting decisions that are delegated to shareholders.

Since most shareholders do not attend annual meetings in person, their opinions on these matters are communicated by casting a ballot either electronically or via mail.

Accepting the responsibility to vote on behalf of your clients is a significant undertaking, so it is important to consider the pros/cons of doing so. On one hand, clients may appreciate that you serve as their voice in significant matters that affect the value of their investments. But agreeing to vote client proxies requires a significant amount of process monitoring and record keeping.

For this reason, most RIA firms elect to not vote proxies.

Your firm’s policies and procedures on voting proxies should be disclosed and clearly described in:

• Form ADV Part 2A, Item 17 - Voting Client Securities
• Advisory Agreements, either in the section that describes your investment discretion authority or in a standalone section

Note: If you have discretionary investment authority over client accounts and your ADV and agreements remain silent on this topic, it is assumed that you vote proxies.

If your firm does not vote proxies

If your firm does not intend to vote proxies, and you do not intend to advise clients on how to vote proxies, you must disclose this in Form ADV and communicate to clients that they retain the authority and responsibility for voting their own proxies.

If a client has questions regarding a particular proxy vote, you may assist them in understanding the background and intent of the proxy. However, your guidance must not influence their voting decision. As best practice, you should remind them that they assume the responsibility for the voting decision and making the contractual decision of their voting shares. Also, that you are prohibited from providing the service of that advice.

Your clients will receive proxy statements directly from the Custodian. The proxy statements should not be sent directly to you. If you do receive a proxy statement, you should immediately forward it to your client and remind them that they maintain sole authority for voting proxies. In addition, you should take proactive steps to have proxy statements delivered to the client moving forward.

If your firm does vote proxies

You are required to vote proxies in the best interest of your clients. When assisting your clients in setting up new accounts at the custodian, ensure that the account opening paperwork designates your authority to receive and vote proxies.

In addition, regulators consider it fraudulent for advisors to exercise proxy voting authority without fulfilling the following three requirements:

• Develop and implement policies and procedures that are reasonably designed to ensure that your firm votes proxies in the best interest of its clients,
• Describe your firm’s proxy voting policy to clients (via Form ADV 2A and advisory agreements) and provide copies to clients upon request, and
• Disclose how clients can obtain information on how your firm voted their proxies.

Through the Regulator's Eyes

When it comes to proxy voting, regulators simply expect that you clearly communicate your policy on voting proxies for your clients. When you do accept this responsibility, you are expected to exercise this duty in the client's best interest, avoid and disclose any conflicts of interest that may come up in these corporate matters and maintain proper books and records that demonstrate that you are fulfilling this duty in accordance with the Advisers Act.

CCO Best Practices

• Consider whether or not your clients would gain a material benefit by your advising their proxy voting responsibilities, and if that benefit would be worth the related compliance responsibilities.
• If your firm does not vote client proxies:
  • Review client activities to ensure that your firm has not voted proxies for any clients.
  • Review any exceptions made to the proxy voting policy and all supporting documentation and ensure that all were properly documented and approved by the CCO.
  • If you ever decide to start voting proxies, revise your proxy voting policy, ADV 2A and agreements to comply with the Adviser's Act.
• If your firm does vote client proxies:
  • Confirm that existing proxy voting policies and procedures are adequately designed to ensure that votes are consistent with client interests.
  • Conduct a forensic test by reviewing a sample of proxies voted during a particular period and confirm that each proxy was voted in accordance with your policy and that each were voted in the best interest of the client.
  • Review any exceptions made to the proxy voting policy and all supporting documentation.
  • Ensure that all exceptions were properly documented and approved by your firm’s CCO.
  • Review your firm’s books and records to confirm that for the previous five years you can produce a copy of each proxy you received, records for all proxies voted (with any related back up), a log of any proxy voting information requests by clients and your firm’s responses to those requests.

The AdvisorAssist CCO Series is a collection of blog posts that cover each of the elements of your RIA's compliance program. Each post will provide an overview of one compliance topic, including our insights on how regulators view each topic as well as some practical steps to help Chief Compliance Officers address this topic. As always, we would welcome your comments and thoughts.

Read More

Cybersecurity for RIA Firms

We recently hosted 175 RIA firms on a webinar discussing the relevance and importance of protecting advisory clients from cyber threats.

We began by addressing three common misperceptions that sometimes prevail within our industry.

1) Cyber threats against RIA firms are rare.

Regrettably, this isn't the case. Just among our client base, we see attempted (and in one case successful) cyber frauds occur all the time. In fact, 10% of our clients (the clients of our clients, to be exact) have been the target of cyber fraud, usually by means of a hacked email account and a fraudulent wire request.

Michelle Wraight, vice president and chief privacy officer at Pershing agrees: “We’re seeing wire transfer fraud at epidemic levels,”

2) Cybersecurity is a “big firm” problem.

Every RIA - big or small - have points of vulnerability. In fact, regulators have specifically noted that smaller RIA firms will not get a pass when it comes to putting procedures in place to protect clients.

3) Cybersecurity is an IT issue.

Cybersecurity requires a multi-pronged approach. Effective cybersecurity goes way beyond information technology. Effective cybersecurity risk management is a cross-functional challenge that must also address operational processes, vendor management, regulatory requirements and human resources.

We then addressed the topic from a reguator's perspective. Regulators expect that compliance and risk management be an integrated part of the operations of your business. Cybersecurity is not just a technology concern.

The SEC's Office of Compliance Inspections and Examinations' (OCIE) recent cybersecurity initiative was designed to assess the preparedness of RIAs and ensure that firms are taking necessary steps to mitigate cyber threats. These include: preparedness, firm governance, identification and assessment of risks, protection of networks and information, remote access and funds transfer requests

We then provided some practical steps for RIAs to follow that would not only satisfy their regulatory expectations but also protect their clients from the very real threats that exist today. They include: maintaining a working knowledge of all clients (and their "normal" activity with respect to wire requests), securing mobile devices, securing hardware/office space and setting procedures and controls that govern how your firm processes client wire requests.

Read More

The AdvisorAssist CCO Series: Books & Records

Books and records compliance for registered investment advisers is one of those activities that can be as simple or as difficult as one chooses to make it.

Admittedly, it does take some time and know-how to understand exactly must be maintained. But if you think about it, each of these records are really just outputted from a well-managed firm (e.g. financial statements, communication tracking, version-controlled document storage). By and large, each requirement has a purpose behind it that will help you manage your firm in a more effective and risk-managed manner.

So if you approach records retention not as a compliance requirement but as a result of sound business management, you will be amazed by how it can be simplified, while at the same time improving the effectiveness of how your firm is run.

Investment Advisor Books and Records In a Nutshell

Investment advisors are expected to make and keep true, accurate and current books and records relating to its investment advisory business. The overarching objective behind these requirements is the protection of your clients and the general public. Regulators expect advisors to be able to produce any information that may be used to substantiate their finances, support the decisions behind all of the decisions they make on behalf of their clients, and validate that they are always adhering to their fiduciary duty.

The records that advisors must maintain fall into these general categories: Compliance Program, Client Management, Trading, Marketing, and Business Management. The majority of these must be maintained by all advisors, but there are a number that depends on your specific business practices (e.g. soft dollar usage, proxy voting, custody, government-related clients, use of solicitors).
For reference, here is a link for the complete books and records requirements for investment advisors. Click Here.

Most records have a prescribed retention duration of five years (the most recent two of which must be on-site or accessible from your office). Some records must be retained for longer periods of time, or indefinitely. For example, an advertisement for a one-time event must be kept for 5 years from the date of the event (it's last use) and a Client Agreement (while the client is active) must be kept as long as you have this client under this agreement. And then you must keep for at least 5 more years.

Thankfully, regulators allow for records to be maintained electronically using cloud-based storage. When doing so, advisors must demonstrate their ability to reasonably safeguard them from loss, alteration or destruction and to prevent unauthorized access from individuals outside your firm. Scanning and storing hard copies is fine as well, as long you can attest that the retrieved record is legible, complete and true.

Through the Regulator's Eyes

It's helpful to keep in mind that the purpose of advisor records retention is to protect the general public, including your clients. Regulators expect you to be able to produce any information that may be used to substantiate your finances, support the decisions made on behalf of your clients, and validate that you are always adhering to your fiduciary duty.

Thinking through an example of a client complaint sometimes helps reveal the regulators' logic. Regulators are obliged to respond to every complaint lodged against an advisor. When doing so, they will likely want to see the documentation of everything that client received from you (historical versions of your ADV, marketing collateral), nature of the relationship (client agreement), any interim communications (client communications log), and any supporting documentation for your investment decisions.

A complete set of records will allow you to produce this history quickly and efficiently so that the regulator can come to a swift resolution.

State regulators have stepped up "books and records" examinations, especially with newly-registered advisors. Their objective is to assess not only the ability to produce these records but also the business practices that surround them. If they perceive sloppiness or indifference, they come back for a more complete examination.

CCO Best Practices

• Create an "inventory list" that includes all books and records requirements. Then, mark off those which pertain to your particular business model and practices. For example, your inventory list will include proxy voting records, but if you don't vote proxies, mark it as "NA". This way you are demonstrating that you understand that proxy voting records should be maintained, but since your agreements and ADV state that you don't, this doesn't apply.
• Don't approach records retention as a "compliance chore". The path of least resistance in the long term is to incorporate these responsibilities into your everyday activities. For instance, your client on-boarding process should include each of the activities and documents needed for compliance retention. If you are using your CRM religiously, you can be confident that all client communications are archived in an easily accessible manner as well.
• Be wary of over-reliance on third-party generated records. Your portfolio management system may not store all of the order ticket and confirmation data you need to pass muster with a regulator.
• Remain mindful of regulatory "hot spots". Hot spots include advertising (review and archiving), email/social media archiving, security of electronic storage, and documented investment decision making.
• Pay particular attention to your firm's "high risk" areas. These may include trade allocation procedures, social media advertising, soft dollars, or any area where there is a disclosed conflict of interest.
• Conduct (and document) annual due diligence on cloud storage vendors to ensure that they have appropriate physical, electronic and procedural safeguards in place to secure your data.

Read More

Who's Who in the Eyes of RIA Regulators

Years ago, as a partner in a small advisory firm, I was asked to review and update our compliance program. This firm was a bit more complex than most, in that we had a pretty expansive set of outside shareholders, contractors and advisory board members in place. When I got to the topic of reviewing "roles" of each of these individuals I got a bit stumped. Who exactly were our "access persons"? Supervised persons?

Fortunately in most wealth management business models, determining "who's who" in your advisory firm is fairly simple ..assuming you understand the SEC's definitions of each role.

Here is an overview of each defined role that advisors must identify and monitor.

Chief Compliance Officer (CCO)

This is an individual that is responsible for administering and enforcing your firm’s compliance program. The CCO may delegate responsibilities to appropriate designees as long as he/she remains primarily responsible for compliance oversight and administration.

The CCO must be empowered with full authority to develop and enforce your firm’s compliance policies and procedures. The CCO and designees must be competent and knowledgeable regarding the Investment Advisers Act of 1940 as well as securities laws that apply to your investment process.

Key Takeaways: Be able to demonstrate that your CCO is knowledgeable of securities regulations and has sufficient authority to enforce and affect change.

Investment Adviser Representative (IAR)

Any person that (for compensation) makes any recommendations or delivers advice to clients; manages client portfolios; determines which recommendation or advice regarding securities should be given; solicits, offers, or negotiates for the sale of or sells investment advisory services, or supervises people that perform any of these activities.

Key Takeaways: Essentially anyone that provides (or sells) advice for your firm will be considered an IAR. With the exception of administrative duties (like answering the phone, taking messages, or setting up meetings) everyone that has client contact should be an appropriately-licensed IAR of your firm. This includes solicitors.

Supervised Person

A supervised person is any partner, officer, director (or other person occupying similar status or performing similar functions), or employee of an investment adviser, or another person who provides investment advice on behalf of the investment adviser.  This definition essentially defines those individuals that are considered to be under the supervision and control of your firm.

Key Takeaways: Essentially includes your entire team including external solicitors. Your Written Supervisory Procedures apply to all Supervised Persons.

Access Person

Access Persons are anyone that has access to nonpublic information regarding client transactions or who is involved in making securities recommendations to your clients or has access to recommendations that are non-public.

Key Takeaways: Non-public information includes client information, trading activity, and model portfolios. Access persons are subject to your firm's Code of Ethics and Personal Trading Policies.

CCOs should maintain an up-to-date list of people that fall under each of these categories. By doing so, they will be in a solid position to ensure (and document) that policies are applied to appropriate people that fall under their firm's compliance program.

Read More

The AdvisorAssist CCO Series: Privacy & Information Security

A central element of your RIA firm’s fiduciary duty is the protection of clients’ confidential information. These responsibilities are laid out in your firm’s Privacy Policy.

A topic that is closely related to your duty of privacy and confidentiality is information security. Formal information security policy manuals for RIAs, a proposed (but not yet codified) regulatory requirement, offer many best practices that help advisors demonstrate their commitment to protecting client information.

The RIA Firm's Privacy & Information Security Responsibilities In a Nutshell

Supervised Persons of an RIA firm must keep confidential at all times any nonpublic information that they obtain during the course of carrying out their advisory responsibilities.

This includes client or prospective client identities, their identifying information (e.g. addresses, dates of birth, social security numbers), their investments and their account activity. (Some states maintain distinct definitions of identifying information that must be protected)

As a policy, Supervised Persons must not release confidential or nonpublic information without consulting the Chief Compliance Officer (“CCO”) in advance. When disclosure is necessary to conduct business for a client, nonpublic personal information should be limited to the extent necessary or appropriate.

At least annually, RIA firms must provide notice to clients describing the firm’s privacy policies, to the extent required by law. This can be accomplished by delivering a copy of the firm’s Privacy Policy.

Your firm’s Privacy Policy should contain the following:

1. What information you collect from clients
   
2. What sources you collect information from, over and above information provided by the client
   
3. Your firm’s basis for sharing this information
   
4. Any state-specific privacy regulations (Currently CA, MA, and VT have specific privacy laws that extend beyond federally-mandated rules.)
   

Advisors must also ensure that appropriate safeguards are in place to protect client information (i.e. information security practices).

Through the Regulator's Eyes

In 2000, the SEC adopted Regulation S-P, which covers the rules related to the Privacy of Customer Financial Information. In the hyper-networked, digital world we live in, regulators obviously want to continue to ensure the general public that their private information is adequately safeguarded. Regulation S-P requires advisors to adopt and maintain written supervisory procedures to protect the privacy of customer data.

CCO Best Practices for Privacy

• Provide a copy of your firm’s Privacy Policy to new clients along with your investment advisory agreement.
  
• Deliver a copy of your Privacy Policy to all clients at least annually. This is most easily accomplished by including it with your annual ADV delivery in April (October RIA firms with 6/30 fiscal year ends.)
  
• Confirm that your investment advisory agreements contain an acknowledgment of receipt of the privacy notice if required.
  

CCO Best Practices for Information Security

• Identify any reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information and personal information systems. Consider potential options to mitigate or eliminate these risks.
  
• Adopt written policies that address the proper disposal of personal information that is not required to be maintained for Books and Records purposes.
  
• Be judicious about the amount of personal information that you collect and limit it to what is necessary to perform your duties.
  
• Adopt a “clear desk” policy (so that employees don’t leave sensitive information out in the open) and ensure that physical client files are locked when not in use.
  
• Limit systems access to active users (Supervised Persons) only and delete access credentials for departed staff.
  
• Ensure that work computers are set up to require periodic updates of strong passwords. Here’s a great tool to test exactly how strong your passwords are: HowSecureisMyPassword.net.
  
• Encrypt and password protect all portable electronic devices.
  
• Use encryption when sending data electronically.
  
• Secure and password protect wireless networks.
  
• Install (and update!) firewalls and anti-virus protection for all computers that are used to access client data (including personal computers if employees do work from home).
  
• Monitor and limit the information that is brought into your firm by new employees and ensure that this information is in accordance with the privacy policies of their prior employer and does not breach confidentiality agreements.
  
• Take reasonable steps to select and retain service providers that maintain appropriate safeguards for the personal information at issue. Request copies of your service providers’ information security protocols.
  
• Include information security training as part of your annual CCO meeting with Supervised Persons.

Read More

CCO Series - Business Continuity and Succession Planning

Each of us tends to either ignore or underestimate the possibility of disasters occurring in our futures. This has been proven time and again by cognitive science research and often referred to as "normalcy bias."
In our experience, RIA firms place high importance on business continuity planning, yet often (particularly with smaller firms), either postpone or abbreviate the process of creating, testing and maintaining their BCP document.
These tendencies leave them exposed to the risk of disruptions in their ongoing responsibilities to clients.

Advisor Business Continuity Planning (BCP) In a Nutshell

We employ this framework to help RIA firms implement their business continuity planning:

• Business Analysis. Identify the critical business processes that you must perform daily, as well as those that become critical in a typical 10-day period. Think through the possible and likely scenarios that could result in a business disruption (i.e. power outages, weather, systems failures in your office building). Take an inventory of all technologies and external partners that you rely on to run your business.
• Plan Design. Define the scope of your plan. Ensure that the plan covers disaster recovery as well as succession planning (see the “key-man risk section” below). Your BCP must also contain:
  • firm policy/plan expectations, contingency scenarios, critical business functions (Day 1 vs. Day 10),
  • critical business systems and how to access them,
  • contact information for employees, vendors, and partners, alternate work location(s),
  • back-up and restoration of critical information,
  • protection of client information, and
  • protocols for testing, updates, and revisions.
• Implementation. With the buy-in and support of your leadership, socialize and review the plan with your team and provide training (and cross-training) for key activities, data access, and data protection. Ensure that your plan is accessible to everyone from a remote location (e.g. current copy at home, copy on separate secure server or Intranet).
• Testing. Perform a "live" test at least annually by following the BCP as written. Document gaps in the plan and document deviations from the plan. Require full participation (at the same time!) and test all critical functions and systems, including, operations, vendors, and communications.
• Maintenance. Update your plan on a real-time basis for process changes, technology enhancements, regulatory changes, and contact information. Deliver and train your team on changes.

Consider the “Key Person” Risk

It is critical that RIAs integrate succession into their business continuity planning. The unexpected death, incapacitation or departure of key advisory staff is an additional risk that may affect an RIA’s ability to protect client interests and fulfill their fiduciary responsibility, and it is up to advisors to take reasonable steps now to ensure their clients are relatively protected from this risk.
To protect against this risk, RIA’s should adopt management practices that mitigate their reliance on any one individual or to allow for process continuity during planned absences like vacations. These include:

• Establishing and documenting defined roles and responsibilities
• Cross-training of operational processes and controls
• Knowledge sharing (so that more than one person is familiar with the firm’s investment process and clients)

Technology will play a central role here. Active (and universal) use of a CRM will ensure that client information is centrally stored and easily accessible. Likewise, an internal website may be used to store the firm’s operations manual, which documents all critical processes and procedures. In the absence of a formal operations manual, RIAs may post a set of documents that detail their investment process, workflows, and operational procedures.
In addition to these operational controls, RIAs should consider establishing a legal agreement that governs their firm in the event of the death or incapacity of an owner.

Single-Owner RIA

Single-Owner RIAs may wish to establish a “continuity agreement.” A continuity agreement is a legal contract that appoints an “alternate” registered investment adviser to assume client responsibilities in the event of the death or incapacity of an RIA. If this were to occur, the “alternate” adviser would be responsible for offering to assume the advisory role (the client has the ability, of course, to decline). The extent of the alternate adviser’s responsibilities can vary. They may be limited to interim oversight (to give clients the opportunity to seek a new RIA) or the alternate RIA may be charged with overseeing a sale of the business or acquire the advisory business themselves.

Multiple-Owner RIA

Multiple-Owner RIAs may wish to establish a “buy-sell agreement.” Buy-sell agreements establish guidelines for an orderly internal sale of the advisory firm to the other owners. Typically these owners are employees of the firm and should be familiar with the firm’s clients and investment process.

Through the Regulator's Eyes

The SEC has identified business continuity and succession planning as a requirement for RIA firms arising from their fiduciary duty. (See SEC Release IA 2204) While they require policies and procedures to address business continuity, they do not mandate specific requirements for the BCP, other than it must address the procedures to meet the fiduciary responsibility to protect client interests from being at risk as a result of an advisor’s inability to operate. Certain states have adopted formal BCP requirements for state-registered RIA firms. Given this, ensure that you take the time to check your state regulatory requirements regarding your BCP.
Regardless of the implicit or explicit requirements, all RIAs should have a formal BCP in place to demonstrate to regulators and clients that they have planned for the undisrupted performance of their fiduciary duty.

CCO Best Practices

• Plan for the 99.5% and not the 0.5%.
• Ensure buy-in from senior management and owners.
• Test your plan at least annually by selecting one day to conduct business from an alternate location(s).
• Update your plan with new/changing contact information for staff and external partners.
• Ensure that the protection of client information is a priority during business disruptions.
• Leverage your BCP obligations to use as a foundation for a documented operating plan (Operating Manual) for your business.
• Begin to integrate succession planning into business continuity planning preparation.
• Consider establishing legal agreements that govern the firm to mitigate against the “Key Person" risk.

Read More

SEC Action Lookup Website

The U.S. Securities and Exchange Commission ("SEC") has launched a new website [https://www.sec.gov/litigations/sec-action-look-up] to assist investors as well as recruiting advisors with a search tool to search for those individuals for which the SEC has taken action.

The website search includes individuals against whom a judgment or order has been issued by the SEC, including individuals who settled, defaulted, or contested their actions, provided a judgment or order was issued against them.

The results will not include individuals whose cases are currently pending at the trial court or those against whom no judgment or order has been issued. Results will also not include individuals named in district court actions as “relief defendants.” See https://www.sec.gov/sec-action-lookup-information for a full description.

Advisor Takeaways:

The SEC continues to try and close information gaps for investors. Compliance personnel should reference this site before hiring any supervised person. In addition, while reviewing these regulatory actions may provide some entertainment value, there are lessons to be learned. Not every action is rooted in intent. Mistakes happen and mistakes can be costly. Compliance Officers should add this resource to their toolkit.

AdvisorAssist is here to assist with any compliance or regulatory questions you may have.

Read More

SEC 2018 Examination Priorities

Each year, the Office of Compliance Inspections and Examinations (“OCIE”) of the U.S. Securities and Exchange Commission (“SEC”) communicates its examination priorities for the upcoming year. The SEC has narrowed their focus on the following common themes:(1) Retail Investors (2) Compliance and risks in critical market infrastructure (3) Cybersecurity. Based on these themes, the SEC has pinpointed several key areas of concern that will be focus areas for 2018. Some of which are similar to years past, however, continue to be a priority for the SEC. We have provided an overview below of the key topics that RIAs need to be mindful of in 2018.

Disclosure of the Costs of Investing

The SEC will focus on the calculation of fees and expenses paid to the Advisor as well as any compensation that is paid to affiliates of the Advisor.

Focus areas include:

• Consistency of the advisory fee calculations and the advisory fee methodology disclosures.
• If charging an asset-based fee, the consistency of the valuation of client securities and the valuation methodology disclosures.
• Advisors that receive financial incentives to recommend mutual fund share classes (ie. high sales loads or distribution fees).
• Client accounts that are not re-assigned to a new IAR when an employee leaves the firm.
• Advisors that transition from commission based accounts to fee based accounts.

Electronic Investment Advice

As in prior years, the SEC will continue to focus on advisors that offer investment advice through automated programs (ie. robo-advisors).

Focus areas include:

• Oversight of the algorithms used to generate general investment advice.
• Marketing materials.
• Policies and procedures related to client data protection.

Wrap Fee Programs

For advisors that charge a wrap fee (ie. fee that includes both advisory fees and execution costs), they will need to demonstrate that the wrap fee is in the best interest of the client.

Focus areas include:

• Any conflicts of interest are disclosed.
• Review for best execution.
• Disclosure of execution costs with broker-dealers.

Never Before Examined Investment Advisors

Due to the large volume of newly registered advisors and the limited resources of the SEC, the SEC will continue to prioritize advisors that have “elevated risk profiles”. This likely includes advisors that fall under the scenarios outlined by the 2018 exam priorities.

Senior Investors and Retirement Accounts and Products

Advisors that provide investment advisory services to seniors and/or retirement accounts will continue to be a focus for the SEC. Advisors will need to have internal controls in place to identify and mitigate financial exploitation of seniors.

Focus areas include:

• Investment product recommendations.
• Sales of variable insurance products.
• Usage of target date funds.
• Advisors that serve state and local government employees and non-profit employees (ie. 403(b) and 457 plans).

Mutual Funds and ETFs

As the primary investment products for retail clients, the SEC will focus on the types of mutual funds and ETFs recommended to clients.

Focus areas include:

• Funds that experienced poor performance or liquidity.
• Funds that are managed by advisors with little experience managing a fund.
• Funds that hold securities that are difficult to value due to market stress (ie. securitized loans or mortgage backed securities).
• Ensure that risk disclosures are provided to investors.

Cryptocurrency, Initial Coin Offerings (ICOs), Secondary Market Trading, and Blockchain

Cryptocurrency has wildly risen in popularity over the past year. The SEC will monitor this space as advisors engaged in this market continues to grow.

Focus areas include:

• If advisors maintain controls and safeguards to protect assets from theft.
• If advisors are providing adequate disclosures associated with the risks of these type of investments including: investment losses, trading liquidity, price volatility, and potential fraud.

Cybersecurity

Cybersecurity continues to be a priority for the SEC as we have witnessed large scale cyber attacks over the past year.

Focus areas include:

• Governance and risk assessment.
• Access rights and controls.
• Data loss prevention.
• Vendor management.
• Training.
• Incident response.

Please remember that OCIE and the SEC communicate these as PRIORITIES, and not an all-inclusive list of all focus areas. To read the full report, click here: "2018 National Exam Program Examination Priorities"

Contributors:

Brian Young
Conor Anderson

Read More

Three Actionable Tips to Become SEC Examination Ready

Over the summer, we heard rumblings that the SEC was conducting unannounced examinations on RIAs in the Boston area. While we have certainly seen a significant uptick in the examinations of never before examined advisors, none of which have been unannounced. Regardless if it is a routine exam or unannounced, it is best practice for advisors to stay examination ready regardless of location or if registered with the SEC or applicable State(s). As we preach to our clients, make sure you take proactive measures to become “examination ready”. Don’t wait until the SEC or a state level examiner comes knocking at your door!

Here are three (3) actionable tips to consider:

1. Customize your Compliance Program

We see far too many advisors that think they are “plain vanilla” and therefore think they can get by with a generic compliance manual (Wrong!). Most firms do not create their compliance manual from a blank page. They start with a model document to address the broad regulatory structure and industry requirements. Although, a model document is a good starting point, it does not amount to a finished product. RIAs need to know that a one-size-fits-all compliance manual does not exist and no consultant or legal resource knows the firm better than the people actually operating it on a daily basis. The creation of a firm specific compliance manual should include three broad steps:

• Review the model document for content and applicability (ask questions).
• Customize the model document to be firm specific, which means customize language specific to your business practice and make sure to remove language that is not relevant to your firm. Then operate your firm in a manner that is consistent with your compliance manual.
• Regularly review, and update your compliance manual as the dynamics of the business evolve and the regulatory environment changes. A compliance manual should never be considered a final document but a current draft of a “living document”.

Always remember that SEC or State regulators expect there to be evidence to demonstrate that policies and procedures are being implemented. Simply put, if there is no evidence, it did not happen.

2. Complete an annual review of your Policies and Procedures

On an (at least) annual basis, you should complete a review of the adequacy and effectiveness of your compliance program. Ideally, the firm should conduct risk assessments of your compliance program throughout the year to test the risk controls and identify any weaknesses. If any issues are identified, make sure to take corrective action and document, document, document! If you don’t document the steps you have taken, (*in the regulator’s eyes) it never happened!

Keep in mind that an effective compliance program should identify potential risks and mitigation opportunities. If the established controls never identify a risk or a mitigation opportunity, the controls should be evaluated and potentially revised.

3. Organize your Books and Records

During the examination process, the regulators will want to complete a sampling of your books and records. You should make sure that your books and records are maintained in an organized fashion to ensure they can be readily delivered. The examination process typically starts with a document request letter including (but not limited to):

• Financial Statements including income statements, balance sheets, and other key accounting records.
• Client Records including a full list of current and past client accounts, supporting client agreements, profiles, investment policy statements and trade data.
• Communications with existing or prospective clients including emails, advertisements, and social media accounts.
• Regulatory filings and other compliance program documents including your ADV 2A/2B, compliance manual, compliance certifications, business continuity plan, code of ethics, and cyber-security policy.

This is by no means an exhaustive list, but should get you started on the right track. If you have any additional questions, please feel free to post a comment below or send an email to info@advisorassist.com.

Contributors:

Brian Young
Dan Rome

Read More

Addressing the Equifax Breach with your Clients

If it is not yet apparent, cybersecurity is the biggest risk facing independent RIAs. When the fraud protector becomes the weakest link, it is time to take notice.

From mid-May through July 2017, the personal information of approximately 143 million consumers was exposed during a long running data breach at Equifax (one of the nation’s three major credit reporting agencies).

The personal information that was accessed during the breach included:

• Names
• Social Security numbers
• Birth dates
• Addresses
• Driver’s license numbers
• Credit card numbers for about 209,000 people
• Credit dispute documents for about 182,000 people

In response to the breach, Equifax published a press release late on Thursday (9/7) announcing the breach and the availability of resources on the Equifax website, www.equifaxsecurity2017.com to protect individuals from identity theft. The site will verify who has been affected by this breach. If an individual’s information was exposed, they can receive a year of free credit monitoring and other identity theft protection services. Once they enter their name, the site will give them a date when they can come back to enroll. Affected individuals must remember to write down the date and come back to the site and click “Enroll” on that date.The deadline to enroll is November 21, 2017.

Initially, by agreeing to the terms and conditions for Equifax's monitoring, individuals were waiving key consumer rights, such as agreeing to settle disputes through arbitration and waiving the right to participate in class-action lawsuits. After the waiver of rights was exposed by the news media (see the CNBC articles linked here and here), Equifax amended its terms and conditions and issued the following FAQ: “the free credit file monitoring and identity theft protection that we are offering as part of this cybersecurity incident does not waive any rights to take legal action. We removed that language from the Terms of Use on the website, www.equifaxsecurity2017.com.”

The fact that Equifax attempted to bury arbitration clauses and class action waivers into the terms of use of the free credit file monitoring and identity theft protection creates concerns about whether their actions are about fixing the issue or purely an attempt to limit their liability. However, the free credit file monitoring and identity theft protection may make sense as a measure to mitigate some of the negative effects of the breach.

To assist your clients in protecting themselves from identity theft due to this data breach, AdvisorAssist recommends that you, as the Advisor, consider the following best practices:

• Read through the consumer notice and related documents found at: https://www.equifaxsecurity2017.com/consumer-notice/ to determine if it makes sense for your clients to enroll in the free credit file monitoring and identity theft protection offering.
• Monitor the accounts and financial statements that you advise on for your clients. Report to the client any potentially unusual activity.
• Recommend that your clients change their passwords on all financial accounts.
• Have your clients request a free credit report from all three credit bureaus at www.annualcreditreport.com.
• Assist your client with setting up fraud alerts with the three major credit bureaus.
• Work with the client to address any accounts that were fraudulently opened in their name.
• If appropriate, assist your client with installing a security freeze on their credit. Please note the credit bureaus typically charge for a credit freeze. However, some states require that the fee be waived if the consumer provides a police report to the credit bureau.

Contributors:
Brian Young
Brendan Furey

Read More

Guest Post: 3 Critical Steps to Improve Your RIA's Cybersecurity

Wes Stillman is the chief executive officer of RightSize Solutions, a provider of cybersecurity and technology management services for wealth management firms. We have asked Wes to share a few tips on cybersecurity for RIAs:

Cybersecurity is a growing concern, and recently has become a hot button issue amongst business publications and consumer national news. Regulatory boards that monitor the financial services industry are taking note to quickly shift accountability to financial advisors.

While these may seem daunting at first glance, the better you plan to address these issues the more prepared you will be for an audit, and equally important, how you’ll respond to an unforeseen incident.

To help you manage this critical aspect of your business's health, success and security, as well as clients personal too, here are 3 proactive steps you can immediately take:

“9 out of 10 organizations do not believe their cybersecurity fully meets their needs.” EY Global Information Security Survey

1. Survey your existing technology environment. You can find easy wins, and avoid pitfalls, by just recognizing your strengths and weaknesses.

The best place to start is by looking at what you already have. Take an inventory of what policies, software and hardware your firm utilizes. Where are your weak points? Consider the business partnerships and data exchanges your company executes on a daily basis. In today’s interconnected business environment, our data supply chains create many access points to your customers’ data. Make sure you are doing your part to protect these connections. Understand and document how your partners are protecting your clients’ data. Some partners, like your custodian, may offer tools and assistance for improving your security. As a last line of defense, check your Errors and Omissions Insurance, many policies now include or require cybersecurity. If yours does not, consider a standalone Cyber-insurance policy. Keep in mind, having insurance protection is important, but it does not negate the need for proper processes and procedures in place.

“62% of cyber-breach victims are small to mid-size businesses, which are at the greatest risk for an attack. Their level of preparation is low, and the costs of customer notification alone can be enough to do a small company irreparable financial harm.” PropertyCaualty360

2. Make sure the IT/cybersecurity section of your employee handbook is up-to-date and enforceable

Establish a clear contingency plan for dealing with cybersecurity incidents. Make sure your plan has both preventative and reactive action items. Do you have a clear contingency plan set in place and a process for responding to cyberattacks? Do your employees know what is expected of them? To ensure this, create actionable steps for dealing with employees, clients, partners, members of the press, and police & government. Think about all of the levels of security at your company. Clearly lay out who has access to what and control administrative privileges accordingly (both with internal staff and outsourced vendors). For example, by limiting the ability to install drivers and execute applications can help control what gets onto your systems and prevent attacks like ransomware.

Lastly, recognize the impact of social media and create a policy specific to it. Not only does it distract employees, social media is a direct portal to cyber incidents. RIAs are prime targets for advanced phishing campaigns because much of their personal and business information is available online. Social Media should be monitored for both public and employee comments. Policies should restrict what employees can and/ or should be saying on Social Media accounts. Be sure to include any company social media accounts in your archive process for auditing purposes.

“Elite RIAs are more focused on maximizing their investments in existing technology as well as their partnerships with technology vendors.” InvestmentNews Research and BlackRock Elite RIA Study

3. Empowering your entire company to participate in awareness and rewarding employees when they do, can drastically improve your security

Building a culture of cybersecurity is one of the most important things you can do. Lead by example; regularly discuss cybersecurity in staff meetings and with other internal communication. Employees need to be empowered with knowledge and a shared commitment that goes far beyond the annual ‘check the box’ that you have read and understand the company IT policies. If an incident does occur, let your employees know about it. Not only will it help deter the impact of the incident, it will help your employees develop a team approach to cybersecurity. When employees alert management to mistakes early in the process, they are giving management the opportunity to prevent huge losses of time, data, and money. Specific ways that you can educate employees are by conducting mock cybersecurity drills, scheduling periodic ‘test’ phishing emails or phone calls. Discussions regarding recent and specific documented cases should be had in staff meetings. Question employees directly on how they would individually handle such situations.

In conclusion, the biggest stumbling block for registered investment advisors when it comes to guarding against cybersecurity breaches is not technology-based, it’s a people problem. The right technology is critical, but RIA leaders can face a bigger challenge in fostering a cybersecurity-sensitive culture in a way that resonates throughout all levels of their firms.

Read our ‘Managing Your Company’s Security Policy’ whitepaper for all 10 tips to help improve your firm’s cybersecurity.

Guest Contributor:

Wes Stillman is the chief executive officer of RightSize Solutions, a provider of cybersecurity and technology management services for wealth management firms.

Read More