The US Securities and Exchange Commission’s (SEC) Office of Compliance Inspections and Examinations (OCIE) published a Risk Alert[1] on August 12 highlighting compliance considerations created by the coronavirus (COVID-19) pandemic for SEC-registered investment advisers and broker-dealers (Firms). This LawFlash highlights the areas of focus in the Risk Alert and provides a checklist of considerations and actions to assist Firms in addressing COVID-19-related compliance issues.
As Firms continue their remote working arrangements for longer than initially anticipated, OCIE acknowledged that Firms have been faced with operational, technological, commercial, and other challenges relating to the pandemic, noting that such challenges have given rise to regulatory and compliance risks, including risks of firm and registered representative misconduct arising from market volatility due to COVID-19. OCIE, in consultation and coordination with other SEC departments and other regulators, identified several COVID-19-related issues, risks, and practices relevant to investment advisers and broker-dealers.
OCIE’s observations and recommendations fall into six areas of focus: (1) protection of investor assets; (2) supervision of personnel; (3) fees, expenses, and financial transactions; (4) investment fraud; (5) business continuity; and (6) protection of sensitive information. We highlight each area of focus below and we have compiled and appended to this LawFlash a checklist of specific recommendations identified by OCIE (a PDF of which is available here).
Firms have a responsibility to ensure the safety of investor assets.[2] OCIE observed that in light of the pandemic some Firms have modified their procedures for collecting and processing checks and transfer requests. For example, some Firms no longer pick up mail daily, but investors still may mail checks to these Firms. OCIE also noted that investors may be making unusual or unscheduled withdrawals from their accounts (particularly COVID-19-related distributions from retirement accounts). As a result, OCIE noted that Firms should, among other things, add steps to ensure authentication of disbursement instructions.
Even as Firms have shifted to telework and remote working due to COVID-19, Firms must meet their regulatory obligation to have policies and procedures in place to supervise personnel[3] and update policies and procedures as necessary to reflect current business operations.[4] OCIE observed that many Firms should consider changes to their business operations and oversight programs given the current shift towards remote working. OCIE also encouraged Firms to modify their supervisory policies and procedures to address related issues outlined in the appended checklist.
Firms have obligations to consider and disclose to investors the costs of services and products, and information related to compensation the Firm and its supervised persons receive.[5] However, OCIE is concerned that current market volatility is increasing pressure on firms to compensate for lost revenue and is creating increased potential for misconduct as financial pressures continue to increase.[6] OCIE focused on the potential for misconduct based on:
OCIE recommended that Firms consider enhancing their compliance monitoring to control for these risks in various ways enumerated in the attached checklist.
As in previous times of crisis, OCIE has observed a heightened risk of fraudulent offerings that should be considered in light of COVID-19. OCIE recommended that Firms consider these risks when conducting due diligence on investments and determining what is in the best interest of investors.[7] According to OCIE, although Firms should have a reasonable basis to believe that an investment offering is not fraudulent before recommending the offering so as not to breach the Firm’s duty of best interest on behalf of its investors, it is often the case that a Firm may have no way of knowing of a fraud until the fraud is actually uncovered.[8] This creates a challenge for Firms seeking to adhere to their regulatory obligations. OCIE encouraged Firms and investors who suspect fraud to report it to the SEC.
OCIE reminded Firms in the Risk Alert to reevaluate their business continuity plans to determine if modification is required in light of COVID-19-related shifts to operating predominantly from remote locations. The Risk Alert noted that these transitions may raise compliance issues and other risks impacting prolonged remote operations. We encourage Firms to refer to the appended checklist to address OCIE’s recommendations related to business continuity matters.
OCIE observed that due to increasing remote activity during the pandemic, Firms are using more videoconferencing and other remote electronic means of communication that create a higher risk of loss of personally identifiable information (PII).[9] Remote communications are increasing the potential opportunities for fraudsters to improperly access Firm systems and investor accounts because such electronic means of communication are more susceptible to phishing, data breaches, and targeted cyberattacks, especially if Firms use unsecure web-based video chat and other platforms that lack proper encryption and authentication processes for access.[10]
The Risk Alert recommended that Firms review their policies and procedures (and technology) related to risks regarding system access, investor data protection, and cybersecurity. Firms may refer to the attached checklist for a more comprehensive list of recommendations related to the protection of sensitive information.
Collecting and Processing Investor Checks and Transfer Requests
Disbursements to Investors
Monitor risks with systems access, investor data, and cybersecurity and related policies and procedures and consider:
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
New York
Robert Raghunath
Ellen G. Weinstein
Philadelphia
G. Jeffrey Boujoukos
Timothy W. Levin
Christine M. Lombardo
Jack O’Brien
Washington, DC
Amy Natterson Kroll
Steven W. Stone
Kyle D. Whitehead
Matthew Wolock
[1] OCIE Risk Alert (“Risk Alert”), Select COVID-19 Compliance Risks and Considerations for Broker-Dealers and Investment Advisers (Aug. 12, 2020).
[2] See Risk Alert at 2, note 2.
[3] See Risk Alert at 3, note 6.
[4] See Risk Alert at 3, note 7.
[5] See Risk Alert at 4, note 10.
[6] We note that the focus on fees and expenses in this Risk Alert may be of particular interest to the SEC in light of Regulation Best Interest examinations in order to ensure that product offerings and descriptions, as well as product-related fees and expenses, are accurate.
[7] See Risk Alert at 5, note 14.
[8] See id.
[9] See Risk Alert at 6, note 18.
[10] See Risk Alert at 7, note 20.