Compliance

It’s that time of year again – time to prepare for your annual Form ADV Review. 

Disclosures to clients and prospects are even more important this year in light of new requirements announced last summer.  

This is arguably the most important compliance project for the quarter.

Annual Form ADV Review

As you conduct your annual review, I have laid out some reminders based on recent enforcement cases, guidance about the new Regulation Best Interest (Reg BI) requirements and resources to help you address the details. This can serve as your ADV Review checklist.

Although the narrative in Part II of the Form ADV is typically treated as the core of the filing, remember to prioritize Part I and Part III.

•  Review Regulatory Expectations

Don’t rely on your memory. Make sure to consult the glossary and frequently asked questions to make sure you understand terms and regulatory expectations. They change over time and it’s important not to guess when it comes to the technical details in Part I of the Form ADV.  Also see SEC Instructions.

•  Involve the business

Review a draft of the Form ADV filing with the business and document the process, especially private funds disclosures, regulatory assets under management (RAUM) calculations and AUM against marketing claims. If you need support to help prioritize this work, review some of the recent enforcement cases highlighting Form ADV mistakes. Feel free to highlight these cases on your annual training or periodic compliance alerts:

1. Exaggerated AUM in Marketing – Bennett and Bennett Group
2. False statements regarding AUM not continuously managed and custody rule violations – Clayborne Group
3. Failure to file updated form regarding AUM and Form PF – HEP Management
4. Fraud and failure to file conflicts of interest disclosures – Northeast Asset Management
5. See SEC Risk Alert Form ADV for more 

•  Start early

Prepare the new Part III – Form Client Relationship Summary (CRS) – before June and review disclosures related to Reg BI and recently announced SEC OCIE Exam Priorities (pages 9-12 regarding seniors, retail and retirement accounts)

1. Firms must comply with Reg BI and Form CRS by June 30, 2020. Be prepared for scrutiny of your new disclosures. The regulators have signaled there won’t be a grace period.  See Bloomberg Law; JD Supra.
2. Remember to check the SEC website for updates. Recently the FAQs were updated to address implementation questions. See SEC FAQs as of Feb; Summary of Further Guidance on Reg BI; Small Firm Resource Guide.
3. Remember to update your procedures and work-flow for delivering the new Form CRS. If you are a dual registrant, this applies to brokers and advisers. See FINRA Checklist and Resource Hub.

Consider using a “Disclosure Committee” so there is an efficient process for sign-off before the Form ADV is submitted to the SEC or delivered to clients.

•  Collaborate and Document

Create a forum so it is easy to gather feedback on this complex filing. For example, in a cross functional meeting or call, HR and others can more easily contribute for compensation and conflicts disclosures while Finance and others can contribute for disclosures related to valuation and expenses.

•  Avoid Mistakes

By collaborating you can avoid inadvertent inflation of calculations in Part 1 and confirm revenue sharing and inaccurate fee and conflicts of interest disclosures in Part II. See Deer Park Road Management case as an example of compliance failures related to fund asset valuation. Also see FAQs Regarding Disclosure of Conflicts Related to Investment Adviser Compensation.

Complete a 360 Cyber review in light of recent guidance and importance of data protection to the resilience of your business.

•  Review Vendors and Data

Review vendor sections in Part 1 and make sure your description of cybersecurity, cloud, record retention and other data management oversight is solid. 

•  Review Ethics

Review the code of ethics description In Part II and consider whether it is prudent to add data ethics as well. Likewise, review your risk disclosures in Part II and consider adding cybersecurity and data protection risks.  

•  Consolidate Delivery

With so many new privacy laws (GDPR, CCPA), check to see if your privacy policy or privacy practices have changed. If they have, and your company finds itself treating non-public personal information more stringently or differently than is required under Reg S-P, consider delivering your updated privacy policy and Part IIA to your clients at the same time to meet both annual requirements. See SEC 2020 Cybersecurity Guidance for more.

Review ESG and impact claims for consistency and omissions.

•  Support ESG Investment Claims

If you have any investment analysis claims about impact, ESG or sustainability investments, confirm they are supported by objective investment methodologies and avoid unsubstantiated claims or claims that conflict with any Corporate Social Responsibility (CSR) or sustainability reports. You can visit the SEC OCIE Exam Priorities to find evolving investment themes on pg. 15. Also see the Columbia Law Review Article if you are interested in the history of disclosures related to environmental claims.

Compliance Takeaways

Keeping current with regulatory changes while also doing your job and running your business is difficult. Existing registered advisors must update and file an amended Form ADV within 90 days of their fiscal year-end – the due date for 2020 is March 30, 2020. The time is now to start thinking and preparing for this important compliance deadline.

It is generally considered a best practice to complete the annual compliance review by the end of the first quarter or early in the second quarter of the year – but not required. Investment advisors should review their compliance policies, code of ethics, and overall compliance program.

Are you taking proper actions to remain compliant? Feel free to reach out if you have any questions.

Today on the blog we’re highlighting data governance and privacy. We’ve provided takeaways for your compliance program. We hope you find these helpful. Let us know what you think!

• Data governance is not just a regulatory issue. It also raises various state consumer laws and data breach statutes. Recently, Equifax settled over 300 class action cases for 138 billion USD. This is a good reminder, as you audit, to refresh your perspective on data governance and that cases like this can be worked into your company’s training program. Read a summary of this data breach incident in Security Magazine.

• The FTC recently finalized settlements with 5 companies over allegations that they made false and misleading representations when they stated that they participated in the EU’s Privacy Shield — when they did not. Here’s the FTC Settlement. Be sure to check your company’s website to confirm the statements on it are current and otherwise accurate.

• Investing in data privacy governance is well worth it. According to Cisco’s 2020 data privacy benchmark study, companies that have invested resources in privacy and data compliance have seen positive returns on investment. If you need to request budget allocations, consider using this study as support.

• 2019 was a record year for AML fines and 2020 appears to be keeping that pace. AML and anti-fraud efforts should continue to be a priority in 2020. According to the ACFCS Fincrime Briefing, “As regulators learn that the financial crime risks of Libra and other stablecoins can be managed using techniques like blockchain analytics, they will provide clearer guidance to the market on regulatory requirements to ensure that stablecoin projects can be launched in more parts of the world, in a safe and trusted manner. “

• Austin Gerig was named as the SEC’s new Chief Data Officer: The SEC Press Release covers his resources including a team of data scientists, data engineers, financial economists, and research associates.

• Reminder & Resource: Your independent AML testing should be underway. Check out the ACAMS AML videos for professional development and/or training ideas.

• The SEC recently launched a new advisory committee. In an Opening Statement of the new SEC Asset Management Advisory Committee, Dalia Blass, a Director in the SEC’s Division of Investment Management, stated: “debates surrounding long term trends in the asset management industry, such as the rise of index investing, increased globalization, increased scale and trends in retirement funding, would benefit from thoughtful discussion among experts with diverse viewpoints.“

In the coming year, regulators will continue to prioritize review of innovative products and new technology.

● Expect a more nuanced approach for scrutiny of digital advisors and assets including review of the adequacy of compliance programs, use of service providers and mitigation of conflicts of interest. SEC Exam Priorities for Virtual Assets

● Recently, the NY DFS also issued proposed guidance on the adoption or listing of virtual currencies, updating its 2014 guidance on the regulatory framework for virtual currency (VC) firms. The NY DFS is accepting comments on two proposed coin/listing options that it wishes to make available to VC licensees. Read the guidance at the following link: comments are due by January 27, 2020! DFS Proposed Guidance

● Another important development to watch: This month in Paris, FATF organized a supervisors forum to make progress on global consistency for supervising digital assets and related service providers. Supervisor Forum 2020

● Check out the latest What’s Ethical podcast with Matthew Blake. Matthew shares his insights as Head of the Future of Shaping Financial and Monetary Systems at the World Economic Forum (WEF).

This year the SEC provided a steady stream of guidance illustrating which compliance and governance programs worked and which ones fell short. To help you plan for 2020, we have distilled the highlights in this Regulatory Year in Review. As you study enforcement cases, rule proposals and risk alerts, you’ll see there are trends for RIAs to consider in the year ahead.

Enforcement Wrap-Up

Registered investment advisors remained a top enforcement priority for the SEC with cases focused on failures with cybersecurity, fair valuation of assets and appropriate client and investor charges and fees. 36% of the 862 SEC enforcement actions pertained to investment advisors and investment company issues. See: SEC Enforcement Annual Report

Stand-alone enforcement actions pursued against investment advisers or investment companies totaled 191 which represents a nearly 77% annual increase compared to the 108 stand-alone enforcement actions filed in the 2018 fiscal year.

See page 23 for notable enforcement cases including an action against BMO Harris Financial Advisors and BMO Asset Management for failing to inform clients about certain aspects of how they selected investments in their advisory program, which included the selection of more expensive investments from which BMO profited.

For state advisors and brokers, there is a similar report from NASAA. See: NASAA Annual Enforcement Report

If you are an advisor that is focused on retail clients or senior citizens, you should expect your business model to continue to be a priority for the regulators. Regardless, it’s a good idea to calendar a way to stay on top of enforcement cases in 2020, so you can review and confirm you haven’t made similar mistakes within your own compliance program.

New Rules and Proposals 

One of the most important changes for 2019 will continue as a focus in 2020: the dual SEC releases in June which announced a new Part 3 to the Form ADV (Form CRS) and a new standard for broker-dealers under Regulation Best Interest. One of the biggest takeaways for you is to start your annual review of the Form ADV early and add a conflicts of interest review matrix to your compliance program if you don’t already have one. See: SEC Press Release Reg BI & Form CRS

In November, the SEC also announced proposed changes to the rules related to investment adviser advertisements and compensation for solicitations to include non-cash compensation.

The proposal covers many areas including permitting testimonials in certain circumstances, exempting unsolicited communications from the definition of advertisements and enhancing requirements and prohibitions related to use of gross and hypothetical performance. There is also a new requirement to disclose advertising practices on the Form ADV to facilitate SEC oversight. See: SEC Rule Proposal – Advertisements and Solicitors

If you are interested in the full list of proposals, the SEC publishes an index on their website.

Risk Alerts

Another key point from the SEC’s guidance this year is the importance of understanding and testing adherence with privacy, information security and cybersecurity including cloud storage as well as potential or actual conflicts of interest with clients.

The SEC announced its top findings in an important mid-year risk alert for RIAs covering supervision, testing and oversight, disclosures and conflicts of interest. See: RIA Exam Findings Risk Alert

For more information, below is a reading list of the 6 SEC Office of Compliance Inspections (OCIE) Alerts:

Nov. 7th

Top Compliance Topics Observed in Examinations of Investment Companies and Observations from Money Market Fund and Target Date Fund Initiatives

Sept. 4th

Investment Adviser Principal and Agency Cross Trading Compliance Issues

July 23rd

Observations from Examinations of Investment Advisers: Compliance, Supervision, and Disclosure of Conflicts of Interest

May 23rd

Risk Alert:  Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features

April 16th

Risk Alert: Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies 

Feb. 13th

Transfer Agent Safeguarding of Funds and Securities 

SEC (OCIE) Examination Guidance 

Finally, the SEC announced its examination priorities almost a year ago. We saw the results of those priorities in the enforcement cases and guidance issued throughout the year. You may want to review that report as we await the announcement of the 2020 priorities expected before year-end. See: SEC 2019 Exam Priorities

By way of reminder, the SEC indicated a focused commitment to retail investors and that examinations would focus on 9 specific areas. Three of which are identified below:

• Fees and Expenses: Disclosure of the Cost of investing: “For these examinations, OCIE will select firms with practices or business models that may create increased risks of inadequately disclosed fees, expenses, or other charges. With respect to mutual fund share classes, OCIE will continue to evaluate financial incentives for financial professionals that may influence their selection of particular share classes. In addition, OCIE remains focused on investment advisers participating in wrap fee programs, which charge investors a single bundled fee for both advisory and brokerage services. Continued areas of interest include the adequacy of disclosures and brokerage practices.” See: SEC OCIE 2019 Priorities Report (page 6)
• Conflicts of Interest:  The SEC identified three areas vulnerable to conflicts of interest for investment advisors. Examinations will review policies and procedures addressing the following: advisers using affiliates services and products; securities backed by non-purpose loans and lines of credit; and loans from clients. See: SEC OCIE 2019 Priorities Report (pages 6 and 7)
• Portfolio Management and Trading:  The SEC will also examine investment advisor portfolio recommendations to assess, among other things, whether investment or trading strategies of advisers are: (1) suitable for and in the best interests of investors based on their investment objectives and risk tolerance; (2) contrary to, or have drifted from, disclosures to investors; (3) venturing into new, risky investments or products without adequate risk disclosure; and (4) appropriately monitored for attendant risks. See: SEC OCIE 2019 Priorities Report (page 7)

We can expect to see a similar volume of developments in 2020, so you may want to calendar a quarterly review to ensure you are addressing compliance issues as needed.

1. Funding & Resources – When determining fines, prosecutors will consider whether “there has been sufficient staffing for compliance personnel to effectively audit, document, analyze, and act on the results of the compliance efforts” and whether “there been times when requests for resources by compliance and control functions have been denied, and if so, on what grounds.”
2. Behavioral Incentives – In their training, prosecutors learn that a “hallmark of effective implementation of a compliance program is the establishment of incentives for compliance and disincentives for non-compliance.” They will consider efforts to drive compliance by “providing positive incentives – personnel promotions, rewards, and bonuses for improving and developing a compliance program or demonstrating ethical leadership.”
3. Improvement & Sustainability – Prosecutors also learn that another “hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment… Prosecutors may reward efforts to promote improvement and sustainability. In evaluating whether a particular compliance program works in practice, prosecutors should consider ‘revisions to corporate compliance programs in light of lessons learned.’”

On June 4th, the SEC settled a case against the hedge fund investment adviser Deer Park Road Management Company LP (“Deer Park”). Deer Park’s missteps create a uniquely teachable moment for compliance-oriented professionals whose controls may not always focus as intently as they should on the technical details of their organization’s models and processes. While Deer Park’s compliance processes were unusually deficient, such professionals should take caution when deferring to the business on technical matters such as valuation. The devil often resides in such overlooked details.

In particular, Deer Park and its CIO were censured and fined for failing to maximize observable inputs while developing GAAP-compliant valuations for a portion of the residential mortgage-backed securities it managed. In such cases, traders were given undue authority to undervalue such securities or to misreport their value to the investment adviser’s outside pricing vendors. The CIO signed off on these valuations, directly implicating himself. As Daniel Michael of the SEC Enforcement Division’s Complex Financial Instruments Unit said of the case, “Deer Park’s pervasive compliance failures allowed its traders to mark assets up gradually instead of marking them to market, in violation of the accounting principles they were required to follow.”

Deer Park’s program also suffered from insufficient oversight of the valuation process, despite the firm’s pricing expertise. In this case, the SEC focused on the inadequacy of Deer Park’s valuation procedures and conflicts of interest that arose when the firm’s traders and CIO allowed themselves to disregard observable market inputs.

Moreover, it acknowledged Deer Park’s retention of a new CCO with relevant experience after the firm’s violation period as a remedial action. This specifically underscores this case’s relevance for Compliance: the case implies in order to avoid regulatory action, the CCO needed the expertise to confirm the adequacy of the controls.

Deer Park reminds us that what compliance professionals don’t know about the underlying business can hurt them. But help is always available.

Outside resources exist to help you stay current and informed. Know when to ask for help!

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

In the wake of the SEC’s dual release of Regulation Best Interest (“Reg BI”) for broker-dealers and its Interpretation of Standards of Conduct for investment advisers (“RIAs”), this is an opportunity to consider the efficiency and impact of compliance controls. For instance, are programs designed to quickly detect and prevent conflicts of interest (“COI”) that either act against the best interest of the retail investor, in the case of broker-dealers, or violate the fiduciary duty of RIAs? If not, Compliance Officers should implement strong behavioral incentives throughout the organization that can detect and/or eliminate COIs when they first arise.

Both Reg BI and the SEC Interpretation indicate the importance of such proactive measures in Compliance programs going forward. Take, for instance, the Interpretation’s mandate to “eliminate or at least expose through full and fair disclosure all conflicts of interest which might incline an investment adviser—consciously or unconsciously—to render advice which was not disinterested.” A top-down, reactive approach to compliance detection may cause friction without effectively addressing this comprehensive requirement. Before the implementation date, Compliance can begin to assess COI exposure using a sustainable governance framework during annual reviews, compliance testing and new product and business projects.

By implementing these six COI review projects early, Compliance departments can not only determine the impact of the SEC pronouncements, but buy precious time to efficiently align Compliance, operational and business controls:

1. an inventory of actual COIs
2. an inventory of potential conflicts that do not currently exist but might reasonably present themselves in the future
3. an inventory and schedule review of regulatory filings, client disclosures and agreements
4. a process for reviewing incentive compensation programs
5. a process for reviewing new business and products, including revenue sharing arrangements for conflicts
6. a process for reviewing personal COIs regarding non-cash compensation, gifts and personal investments

With an emphasis on horizontal engagement across departments, Compliance can assess the prevalence of COIs within business processes and design incentives, so COIs aren’t only found after they are baked into existing work flows.

Working alongside financial, product and sales experts, Compliance can use the results to assess and enhance Compliance and sales practices controls as needed; moreover, they can prepare to draft, file and deliver the new Form CRS Relationship Summary and other revised disclosures with greater confidence.

Finally, the effectiveness of Compliance efforts can be measured and fortified by the application of Compliance ROI calculations. These calculations not only illustrate how the investment of time and resources mitigates risks, but also reveals productivity gains and increased business opportunities afforded by the Compliance efforts. Metrics on prospective client inquiries, business engagement, behavioral incentives, efficiencies within operational processes, errors mitigated and IT and staffing budgets can substantiate the return on investment made on an improved COI framework.

Fraud and corruption exhibits a stubborn persistence throughout the world economy. Two-thirds of the world’s nation’s received a failing score on Transparency International’s CPI Statistics; all told, the world averages 43 out of a scale of 100. Prevention alone cannot shift these numbers; rather, financial professionals must be incentivized to do the right thing. Indeed, Reg BI and the Commission Interpretation indicates the time has come for a new approach to fighting COI; that’s where sustainable governance, horizontal engagement and Compliance ROI can improve our scores and our businesses alike.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

Federal, state and industry regulators mandate the timely and comprehensive execution of compliance risk assessments and conflicts of interest (COI) inventories. Naturally, compliance-minded professionals focus on performing due diligence and analysis of new laws and regulations these reports require. Yet merely presenting the risks, for instance, that a new global initiative or marketing campaign poses for the company can fall short. That’s where ROI assessments for compliance come in.

ROI assessments simultaneously test and enhance the effectiveness of your compliance risk assessments and COI inventories in important ways. For compliance risk assessments, ROI assessments confirm business priorities and where compliance is spending its time while proactively finding efficiencies within business processes. In addition, ROI assessments can help create or update a COI inventory or identify a plan to address conflicts of interest. With Reg BI, conflicts of interest management will continue to be scrutinized.

Compliance risk assessments also endeavor to deter fraud and corruption. Deutsche Bank’s recent KYC initiative, affecting 1000 investment bank clients, highlights the urgency to these tasks. ROI assessments can demonstrate the wisdom a pre-emptive compliance program brings to your business. They suggest models for robust anti-corruption programs which meet evolving standards and ensure that conflicts are addressed and avoided.  

In the meantime, as you approach midyear, you may find Blackrock CEO Larry Fink’s letter to CEOs to be a helpful resource. Fink covers how best practices and good compliance initiatives may help with recruiting and long-term profitability.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.

A Compliance ROI is the foundational component of Compliance as a Competitive Advantage, and like any new initiative, it requires a shift in perspective and focus. It requires a shift in emphasis away from one-day-at-a-time responsiveness towards building sustainable processes that also contribute to the business bottom-line. Federal authorities already recognize this value. The U.S. Department of Justice (“DoJ”) routinely instructs federal and state prosecutors to gauge the proactiveness and sustainability of a given firm’s compliance program when a violation is detected or reported. As the recently updated DoJ Guidance on Corporate Compliance Programs makes clear, the more sustainably a business is governed, the less likely it will be required to spend on fines and remediation.* Compliance programs can effectively demonstrate their ROI by mitigating such risks.

An organization’s routine compliance functions such as training, testing and the quarterly/annual reporting can serve as prime opportunities for evidencing a Compliance ROI.

But as the DoJ’s evaluation reminds us, this assessment should be ongoing so your compliance program is not static. Compliance issues, such as a cyberattack, can arise quickly. Internalizing Triple-Bottom Line Compliance means stretching any response above and beyond what is expected with a protection-only approach and applying new visions to find business benefits and operational efficiencies as well. That vision should be spearheaded by you, but fortified by experts and allies both within and without your organization. ROI is not only a proactive initiative, but a shared one as well.

*Further information on the DoJ guidelines can be found here.

Also consult Episode 10 of Warburton’s What’s Ethical podcast, where Craig Salm of Grayscale Investments gives valuable advice on how he delivers a ROI advising on digital assets.

Beth Haddock is the author of Triple Bottom-Line Compliance – How to Deliver Protection, Productivity and Impact. She advocates delivering sustainable compliance that increases brand protection, risk mitigation, productivity, and employee engagement.