1. establishing a dedicated examination unit to identify and examine brokers who may pose a high risk to investors, including “rigorously” reviewing these brokers’ interactions with customers and compliance with rules regarding suitability, know-your-customer, outside business activities, private securities transactions, commissions and fees;
2. reviewing firms’ supervisory procedures for hiring or retaining statutorily disqualified and recidivist brokers; monitoring for the timely submission of disclosures required on Forms U4 and U5; assessing the existence of supervisory plans reasonably tailored to detect and prevent misconduct; and identifying member applicants that employ, or seek to employ, brokers with “problematic regulatory histories”; and
3. continuing to evaluate firms’ branch office inspection programs and supervisory systems for branch and non-branch office locations (including independent contractor branches), focused on: supervision of account activity; advertising and communications, including the potential use of unapproved email addresses for business; communications with customers, including through the use of social media, seminars, radio shows or podcasts; registered representatives’ websites; outside business activities; the use of consolidated account statements; and operational activities such as distribution of funds and changes of address or investment objectives.

Sales Practices
FINRA once again has identified sales practices relating to senior investors as a “top priority” in 2017. The Priorities Letter highlights a number of specific issues, including the suitability of recommendations made to senior investors to purchase speculative or complex products in search of yield; microcap fraud schemes specifically targeting the elderly; and an observed increase in 2015 and 2016 in the use of aggressive boiler room tactics by unregistered persons in pump-and-dump schemes targeting elderly investors. Many firms have moved aggressively to add other family members as “trusted contacts” to whom questionable activity can be reported. And 2016 saw significant legislative developments – both at the federal level with the House Senior Safe Act, and at the state level with NASAA model legislation – as well as the proposed FINRA rule changes in NTM 15-37. Notwithstanding these advances, the fact remains that as much as 55% of all senior financial abuse is by family members, caregivers, and friends of seniors, and therefore difficult to detect and prevent.

Also under the umbrella of sales practices issues, FINRA continues to observe recommendations of products that are believed to be unsuitable to customers, particularly in situations in which customers – and perhaps the brokers themselves – do not understand important product features. FINRA also will increase its focus on recommendations that could result in excess concentration in customers’ accounts, such as excessive concentration in long-duration fixed income instruments and over-concentration that could be caused by shifts in the interest rate environment. Another area of recent concern involves unsophisticated or elderly investors buying into speculative energy-based investments and complex or novel exchange-traded products (ETPs), structured retail products, leveraged and inverse exchange-traded funds, non-traded real estate investment trusts (REITs) and unlisted business development corporations (BDCs).

Other sales practices topics addressed in the Priorities Letter include: firms’ ability to monitor for short-term trading of long-term products (e.g., mutual funds, variable annuities, and UITs); firms’ obligations with respect to their registered representatives’ outside business activities and private securities transactions (including compliance with rules requiring OBA reviews and documentation thereof); and firms’ compliance with their supervisory and record-retention obligations with respect to social media and other electronic communications in light of the increasingly important role they play in the securities business. 

Cybersecurity
In the area of operational risks, FINRA identifies cybersecurity threats as “one of the most significant risks many firms face.” While recognizing that there is no one-size-fits-all approach to cybersecurity, FINRA intends to continue to assess firms’ programs to mitigate these risks. Among the areas of interest for FINRA are firms’ methods for preventing data loss, controls used to monitor and protect this data, and management of vendor relationships. In the area of protecting customer or employee personally identifiable information or sensitive firm information, FINRA clearly is focused both on outside access and threats, as well as insider threats. As explained in the Priorities Letter, the nature of the insider threat “is rapidly changing as the workforce evolves to include more employees who are mobile, trusted external partnerships and vendors, internal and external contractors, as well as offshore resources.”

FINRA explains it has observed repeated shortcomings in two cybersecurity areas in particular: (1) cybersecurity controls at branch offices, particularly independent contractor branch offices, related to the use of passwords, encryption of data, use of portable storage devices, implementation of patches and virus protection, and the physical security of assets and data; and (2) firms’ failure to fulfill one or more of their obligations under Securities Exchange Act (SEA) Rule 17a-4(f), which requires firms to, among other things, preserve certain records in a non-rewriteable, non-erasable format, commonly known as “write once read many” (WORM) format. Both of these areas have been the subject of recent enforcement actions and significant fines and penalties. 

Conclusion
While the 2017 Priorities Letter does not make explicit reference, as in past letters, to the “culture of compliance,” FINRA in so many words continues to urge firms to maintain such a culture through their review, assessment and, if necessary, improvement of compliance, supervision and risk management practices to better protect investors, the markets and firms themselves. Firms would do well to closely review the Priorities Letter, including the very specific examples of shortcomings and areas of concern identified by FINRA, to prepare for regulatory and compliance exams and avoid enforcement actions.

Information contained in this publication should not be construed as legal advice or opinion or as a substitute for the advice of counsel. The articles by these authors may have first appeared in other publications. The content provided is for educational and informational purposes for the use of clients and others who may be interested in the subject matter. We recommend that readers seek specific advice from counsel about particular matters of interest. 

Copyright © 2017 Stradley Ronon Stevens & Young, LLP. All rights reserved.