SEC’s OCIE Issues Risk Alert for Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P

On April 16, 2019, the staff from the Office of Compliance Inspections and Examinations (the “OCIE”) of the US Securities and Exchange Commission (“SEC”) published a Risk Alert describing privacy and related customer information safeguarding issues it has identified in recent examinations of registered investment advisers and broker-dealers (“Registered Entities”).¹ These issues continue to be an oversight concern of OCIE, more recently in connection with the safeguarding of client information from cybersecurity incidents and breaches. This Legal Update summarizes certain observations identified by OCIE related to those exams and provides certain key takeaways for Registered Entities.

Background

Under the SEC’s Regulation S-P (“Reg S-P”), a Registered Entity is required to (i) provide an initial privacy notice describing its privacy policies and practices to customers at the time of onboarding, (ii) provide an annual privacy notice describing its current privacy policies and practices (to the extent not excluded from the requirement) and (iii) notify customers of their right to opt out of some disclosures of non-public personal information to nonaffiliated third parties (commonly referred to as an “opt-out” notice).²

Reg S-P also contains the Safeguards Rule, which requires Registered Entities to adopt “written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information” and to properly dispose of consumer report information. Under the Safeguards Rule, these written policies and procedures must be reasonably designed to:

1. Ensure the security and confidentiality of customer records and information;
2. Protect against any anticipated threats or hazards to the security or integrity of customer records and information; and
3. Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.³

Issues Identified by OCIE from Recent Exams

In the Risk Alert, OCIE described the following three categories of common exam deficiencies  related to Reg S-P.

• Privacy and Opt-Out Notices: OCIE identified that certain Registered Entities failed to provide the required initial or annual privacy notices as well as opt-out notices to customers. OCIE noted that even when Registered Entities did provide the required notices, it observed that in certain instances the notices did not accurately describe the Registered Entity’s privacy policies and practices and/or did not provide notice of the customer’s right to opt out of the Registered Entity’s sharing of certain customer information with nonaffiliated third parties.
  
  
• Lack of Reg S-P Policies and Procedures: OCIE also observed that some Registered Entities did not have written policies and procedures as required under the Safeguards Rule. In particular, OCIE noted certain examples of non-compliance that included a Registered Entity having (i) a document that stated the text of the Safeguards Rule but failed to tailor that document to the firm’s actual compliance activities, (ii) template versions of Reg S-P policies and procedures that had blank spaces for the firm’s terms and practices and (iii) a policy that addressed the privacy requirements of Reg S-P but did not address the Safeguards Rule.
  
  
• Deficient Policies and Procedures Related to the Safeguards Rule: In addition, OCIE observed that certain Registered Entities had written policies and procedures that did not appear to be implemented or reasonably designed to satisfy the three main elements of the Safeguards Rule. For example, OCIE noted that some policies and procedures did not address:
• Employees’ use of personal devices for business purposes (in particular, employees safeguarding customers’ personally identifiable information (“PII”) on their personal devices such as home laptops);
• Training employees on the firm’s safeguarding requirements and monitoring whether such requirements were being followed;
• The use of outside vendors (such as requiring outside vendors to comply with the firm’s safeguarding policies in connection with customer PII);
• Cataloging firm systems that maintain customer PII;
• Maintaining incident response plans that address cybersecurity threats and assess firm system vulnerabilities;
• The security of the storage of customer PII in physical locations (for example, in locked file cabinets);
• System access (including, but not limited to, the process for granting access rights to appropriate employees and procedures for revoking system access for departing employees); and
• Other considerations for electronic communications and networks (such as email encryption and securing networks that have customer PII).
  
  

Key Takeaways for Registered Entities

All Registered Entities should review their written policies and procedures, and implementation of those policies and procedures, to ensure that they comply with Reg S-P. Registered Entities should evaluate whether their customer safeguarding procedures—as well as any related procedures that may touch on privacy and customer PII, such as cybersecurity procedures—address or mitigate OCIE’s most recent observations as well as prior SEC staff guidance. Furthermore, Registered Entities should regularly monitor, evaluate and adjust their information safeguarding and incident response programs in light of any relevant changes in (i) technology, (ii) the sensitivity of customer information, (iii) internal or external threats to information and (iv) their own businesses arrangements (e.g., new mergers, joint ventures, and outsourcing arrangements and changes to information systems).

As noted previously, the SEC staff’s focus on privacy and information safeguarding issues (including Reg S-P compliance) in an ongoing matter. For example, last year the SEC’s Division of Enforcement brought its first settlement action against a dual-registered investment adviser/broker-dealer for violations of the Identity Theft Red Flags Rule (which addresses the Identity Theft Prevention Program requirements) and included in the action charges related to violations of Reg S-P.⁴ That action built on other high-profile settlement actions that the SEC brought against registered investment advisers in 2015 and 2016 for Reg S-P violations.⁵

In addition, OCIE has touched on privacy and safeguarding issues in other related topics, such as cybersecurity. For example, recent cybersecurity sweeps by OCIE on registered advisers include document requests focused on OCIE’s key cybersecurity topics that are similar or closely related to the above exam observations, including access rights and controls, training, incident response, vendor management and governance and risk management.⁶ Last December, OCIE also released a Risk Alert relating to electronic messages, which included OCIE observations from recent exams covering employee use of personal devices for business purposes and whether registered advisers have adequate policies and procedures in place to train and monitor staff regarding the use of electronic messaging and compliance with applicable laws (such as, but not limited to, Reg S-P).⁷

Lastly, the Financial Industry Regulatory Authority (“FINRA”), the self-regulatory organization for registered broker-dealers, also has been active in enforcing Reg S-P by making it an item of focus for its 2019 examination priorities and publishing a report of effective practices it has seen broker-dealers use to implement information security controls.⁸ Dual-registered firms and broker-dealers should also review the applicable FINRA guidance and regulation when evaluating whether their customer information safeguarding and cybersecurity policies and procedures address both applicable SEC and FINRA requirements.

¹ OCIE, Risk Alert: Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P - Privacy Notices and Safeguard Policies (Apr. 16, 2019), available at https://www.sec.gov/ocie/announcement/ocie-risk-alert-regulation-s-p.

² Privacy of Consumer Financial Information (Regulation S-P), Rel. Nos. 34-42974, IA-1883, 65 Fed. Reg. 40,334 (June 29, 2000) (codified at 17 C.F.R. §§ 248.1-248.30).

³ Id.; Disposal of Consumer Report Information, Rel. Nos. 34-50781, IA-2332, IC-26685, 69 Fed. Reg. 71,329 (Dec. 8, 2004) (codified at 17 C.F.R. § 248.30(b)).

⁴Rel. Nos. 34-84,288, IA-5,048 (Sept. 26, 2018), available at https://www.sec.gov/litigation/admin/2018/34-84288.pdf. The SEC brought the action for violations of (i) the Safeguards Rule’s requirement that every broker-dealer or investment adviser registered with the SEC adopt “written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information” and (ii) the Identity Theft Red Flags Rule’s requirement that every broker-dealer or investment adviser registered with the SEC “develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. For a more detailed summary of this action, please see our Legal Update, available at https://www.mayerbrown.com/en/perspectives-events/publications/2018/10/sec-brings-first-enforcement-action-under-the-iden.

⁵ Please see our Legal Updates on the 2016 and 2015 actions, available at https://www.mayerbrown.com/en/perspectives-events/publications/2016/07/us-sec-highlights-focus-on-cybersecurity-in-enforc and https://www.mayerbrown.com/en/perspectives-events/publications/2015/09/us-securities-and-exchange-commission-continues-fo, respectively.

⁶ Cybersecurity also continues to be an OCIE exam priority, with the most recent emphasis on the application of Registered Entity cybersecurity policies on “branch” locations and offices. See OCIE, National Exam Program, Examination Priorities for 2019 (Dec. 20, 2018), available at https://www.sec.gov/files/OCIE 2019 Priorities.pdf. For a more detailed summary of this and other 2019 OCIE exam priorities, see our Legal Update on the topic, available at https://www.mayerbrown.com/en/perspectives-events/publications/2019/02/ocies-2019.

⁷ OCIE, Risk Alert: Observations from Investment Adviser Examinations Relating to Electronic Messaging (Dec. 14, 2018), available at https://www.sec.gov/files/OCIE Risk Alert - Electronic Messaging.pdf.

⁸ FINRA, 2019 Annual Risk Monitoring and Examination Priorities Letter (Jan. 22, 2019), http://www.finra.org/industry/2019-annual-risk-monitoring-and-examination-priorities-letter#_ednref3; FINRA, FINRA Publishes Report on Selected Cybersecurity Practices – 2018 (Dec. 20, 2018), available at http://www.finra.org/newsroom/2018/finra-publishes-report-selected-cybersecurity-practices-2018.