Kreischer Miller Presenting at Operations & Compliance for Alternative Investment Funds

    Author Archives: kmco

    Kreischer Miller Presenting at Operations & Compliance for Alternative Investment Funds

    FRA’s Operations & Compliance for Alternative Investments Funds

    June 20-21, 2017
    The Princeton Club of NY
    New York, NY

    As the demand for greater transparency and lower fees continues to skyrocket, the complexities of efficiently running a private equity fund’s business operations has become more sophisticated. Combine that with an unclear regulatory environment and proposed tax reform, it’s absolutely essential to stay current. FRA’s Operations and Compliance for Alternative Investment Funds is the perfect mix of high-level industry insight and the sharing of practical tips and techniques that will promote an optimum performance from an operational standpoint.

    Kreischer Miller will be presenting and exhibiting at this event. We hope to see you there.

    More details about the conference.

     

    The Impact of the SEC’s Custody Clarification Guidance

    The Division of Investment Management (DIM) of the U.S. Securities and Exchange Commission (SEC) recently issued three different clarifications that have an impact on whether a registered investment adviser (RIA) has custody of client assets under Rule 206(4)-2 of the Investment Advisers Act of 1940, commonly known as the Custody Rule. The three clarifications included the following:

    • Guidance Update No. 2017-01 – “Inadvertent Custody: Advisory Contract Versus Custodial Contract Authority”
    • Staff No-Action and Interpretive Letter regarding certain standing letter of authorization (SLOA) arrangements
    • Staff Responses to Questions About the Custody Rule – Update to Question II.4 regarding first party transfers

    Each of the three clarifications is discussed in more detail below, with action steps to consider.

    Before jumping directly in, let us first take a step back and refresh our memory on what exactly constitutes custody and the requirements once an RIA has custody.

    What is Custody?

    SEC Release No. IA-2968 defines custody as holding, directly or indirectly, client funds or securities, or having the authority to obtain possession of them. This applies to both the RIA and its related persons. Custody includes:

    • Possession of client funds or securities (but not checks drawn by clients and made payable to third parties) unless received inadvertently by the RIA and returned promptly (i.e. within three business days of receiving) to the sender;
    • Any arrangement (including a general power of attorney) under which an RIA is authorized or permitted to withdraw client funds or securities maintained with a custodian upon the RIA’s instruction to the custodian; and
    • Any capacity (such as general partner of a limited partnership, managing member of a limited liability company, or trustee of a trust) that gives an RIA or an RIA’s supervised person legal ownership of or access to client funds or securities.

    What are the Requirements of Having Custody?

    The Custody Rule offers safeguards for investors against potential theft or misappropriation by an RIA. As such, the Custody Rule forces several requirements, with certain exceptions in each case, on RIAs that have custody.

    • Maintain client funds or securities with a qualified custodian either in a separate account for each client under that client’s name or in accounts that contain only client funds and securities under the name of the RIA as agent or trustee for the client;
    • Promptly notify clients in writing upon opening a custodial account or making any changes to a custodial account, including notification of the qualified custodian’s name, contact information, and the manner in which the funds or securities are maintained;
    • Have a reasonable basis to believe that qualified custodians send account statements not less than once a quarter;
    • Enter into an agreement with an independent public accountant to perform an annual surprise examination; and
    • If the qualified custodian is also the RIA or a related person of the RIA, obtain, on an annual basis, an internal control report (commonly known as a SAS 70 or SSAE 16) from the qualified custodian that includes an opinion of an independent public accountant regarding the effectiveness of the custodian’s procedures for safeguarding client funds and securities.

    Inadvertent Custody

    IM Guidance Update No. 2017-01 warns RIAs that they may inadvertently have custody due to agreements entered into by their clients directly with a qualified custodian. Although an RIA may not intend to have such access, these separate agreements could grant broader access than the RIA’s agreement with their client. The guidance update lists the following examples:

    • A custodial agreement that grants the client’s adviser the right to “receive money, securities, and property of every kind and dispose of same.”
    • A custodial agreement under which a custodian “may rely on [adviser’s] instructions without any direction from you [the client/investor]. You [the client/investor] hereby ratify and confirm any and all transactions with [the custodian] made by [adviser] for your [the client/investor] account.”
    • A custodial agreement that provides authorization for the client’s adviser to “instruct us [the custodian] to disburse cash from your [the client/investor] cash account for any purpose….”

    While there may be restrictions in an agreement between the RIA and its client, the qualified custodian does not necessarily know of those restrictions. As such, if an adviser attempted to withdraw funds, the qualified custodian would look to its agreement with the client as authorization.

    Action Steps

    RIAs should be aware of the possibility of inadvertent custody, which could in turn impute the need for an annual surprise examination. The guidance update indicates that one way to avoid inadvertent custody would be to draft a letter to the custodian, copying the client, and which limits the RIA’s authority to delivery versus payment (i.e. to effect or to settle trades / transfer funds out only upon corresponding transfer of securities in). The key is to obtain written acknowledgment from both the client and the custodian. Otherwise, the RIA would retain the authority under the client’s agreement with the qualified custodian, and would continue to have custody.

    SLOA Arrangements

    Investors commonly use SLOA arrangements to grant their RIA the limited power to disburse funds to one or more third parties. According to its no-action and interpretive letter, the SEC staff believes that an RIA with the limited power to dispose of client funds for purposes other than authorized trading of securities has access to the client’s assets and accordingly has custody. In the staff no-action letter, the DIM indicated that it would not recommend enforcement action to the SEC against the RIA if the adviser does not obtain a surprise examination while maintaining limited power under an SLOA arrangement to the extent the following seven representations are met:

    1. The client provides an instruction to the qualified custodian, in writing, that includes the client’s signature, the third party’s name, and either the third party’s address or the third party’s account number at a custodian to which the transfer should be directed;
    2. The client authorizes the investment adviser, in writing, either on the qualified custodian’s form or separately, to direct transfers to the third party either on a specified schedule or from time to time;
    3. The client’s qualified custodian performs appropriate verification of the instructions, such as a signature review or other method to verify the client’s authorization, and provides a transfer of funds notice to the client promptly after each transfer;
    4. The client has the ability to terminate or change the instruction to the client’s qualified custodian;
    5. The investment adviser has no authority or ability to designate or change the identity of the third party, the address, or any other information about the third party contained in the client’s instruction;
    6. The investment adviser maintains records showing that the third party is not a related party of the investment adviser or located at the same address as the investment adviser; and
    7. The client’s qualified custodian sends the client, in writing, an initial notice confirming the instruction and an annual notice reconfirming the instruction.

    Action Steps

    The purpose of these representations is to mitigate risks and concerns surrounding an RIA’s ability to “obtain possession of funds” under the Custody Rule. RIAs should consider the costs versus benefits of seeking relief of a surprise examination under the staff no-action letter. An RIA should report SLOA arrangements that result in custody in response to Item 9 of Form ADV regardless of whether or not the RIA decides to take relief from the surprise examination requirement.

    To the extent the clarifications under the no-action letter cause an RIA to recognize that it has custody on account(s) not previously recognized, the change does not require an amendment to the RIA’s Form ADV prior to the next required annual update.

    Many qualified custodians are already in the process of revising their policies and procedures and internal forms. RIAs should consider reaching out to custodians to see what changes they are making and whether any information or certifications are available.

    First-Party Transfers

    In its update to Question II.4, the SEC staff of the DIM clarified their interpretation of what constitutes specifying a client’s accounts.

    Question II.4 continues to state that the SEC staff does not interpret an RIA’s authority to transfer client assets between various client accounts at the same qualified custodian (First-Party Journal Entries) as having custody, assuming the RIA meets certain conditions. Similarly, transferring client assets between the client’s accounts at a different qualified custodian (First-Party Transfers) does not constitute custody. The conditions in both cases require the client to authorize the RIA in writing to make such transfers, specify the client accounts maintained, and provide a copy of that authorization to the qualified custodians.

    The update to Question II.4 clarifies the SEC staff’s view on “specifying” to require the written authorization to the sending custodian for First-Party Transfers to include both the name and account numbers on the sending and receiving accounts (including the routing numbers or names of the receiving custodian). This authorization is not required to be sent to the receiving custodian. Furthermore, client names and account numbers are not required for First-Party Journal Entries as the qualified custodian already has access to both the sending and receiving account information.

    Action Steps

    RIAs should review their agreements to determine situations where they may have authority for First-Party Transfers. For those situations, RIAs should work with their clients and qualified custodians to ensure they have authorizations with particular client-specific information in place.

    Summing it Up

    According to the Office of Compliance Inspections and Examinations of the SEC, the Custody Rule is one of the five most frequent compliance topics identified in examinations of RIAs. The above detailed clarifications should help RIAs understand the SEC’s positions in certain circumstances and benefit them in preparation for that eventual examination. In the interim, RIAs may want to consider speaking to their clients and custodians to confirm their understanding, and revising their policies and procedures as necessary. The SEC typically provides a reasonable period to come into compliance, but at the very least, specifically in connection with the no-action letter, RIAs should be prepared to respond appropriately to Item 9 of Form ADV in their next annual updating amendment filed after October 1, 2017.

    We would be pleased to provide further information related to this subject. For more information, contact Craig B. Evans, Director, Audit & Accounting at cevans@kmco.com or Eric C. Sakelaridos, Senior Accountant, Audit & Accounting at esakelaridos@kmco.com. 

    Newsletter subscription

    You may also like:

    How Comprehensive is Your Cyber Security Plan?

    Today’s business leaders face many challenges and rapid changes with respect to information and cyber security. When one considers the wide range of vulnerabilities – ranging from threats, malicious intruders, and thieves to disgruntled employees and industrial espionage – managers and business owners need to make sure they have an information security plan that enables their organizations to detect, prevent, and address security incidents in a timely and effective manner.

    A clear and concise information security plan allows management and employees to see where they are expected to go, focus their efforts in the right direction, and know when they have accomplished their goals. Unfortunately, plenty of organizations lack an information security plan, or at least one that is up-to-date. Some even claim to have a plan but really don’t. As a result, there’s a lack of focus and inconsistency in the actions taken across the organization, not to mention a greater likelihood of something bad happening. If organizations continue to view information security planning as impractical or unnecessary, then they are less likely to effectively manage information and cyber security risks.

    What should be Included in an Information Security Plan?

    An information security plan can position an organization to mitigate, transfer, accept, or avoid information risk related to people, processes, and technologies. A well-designed plan also helps the organization adequately protect the confidentiality, integrity, and availability of information. The business benefits derived from an effective information security plan are significant and can offer a competitive advantage. These may include complying with industry standards, avoiding a damaging security incident, sustaining the reputation of the business, and supporting the commitment to ownership, customers, partners, and suppliers.

    A comprehensive information security plan takes a holistic look at key people, processes, and technologies and ensures potential vulnerabilities could be detected and addressed in a timely manner. Industry experts have identified the following 10 areas that need to be addressed within an effective information security plan:

    1. Key business processes – Clear understanding and documentation of business critical processes and potential information and cyber security implications in case such processes are disrupted or jeopardized.
    2. Identification of critical data – What are the organization’s highly sensitive and confidential data elements, where are they stored, who has access rights, and how is the data secured?
    3. New technology initiatives – Anytime a new technology project such as a new phone system or a new server rollout is being planned, consider and plan for the security implications of such projects.
    4. Cloud computing services – As the trend continues toward shifting applications onto the cloud, be aware of each vendor’s cloud security environment and how your information is being managed and backed up, and how it will be restored, if needed.
    5. Internal threat considerations – Recent studies have identified employees as the main source of information security breaches within organizations. An effective information security plan should establish policies and procedures for the proper use of systems and provide ongoing employee training and validation processes.
    6. Personal and mobile computing devices – Bring Your Own Device (BYOD) policies are becoming increasingly popular in mid-market organizations, however, there need to be rather strict policies, procedures, and control software protocols in place to minimize the risks associated with use of such devices.
    7. Legacy system issues – Many organizations are still using core business systems dating back 20-30 years. Such systems, which often hold vast amounts of organizational knowledge, were designed prior to widespread use of the Internet. As such, many have significant information security vulnerabilities associated with their core architecture. Management needs to devise effective information security policies to best safeguard all data assets embedded in such systems. And although upgrading these systems if considered a major initiative in many instances, it will nevertheless have a significant impact on improving your organization’s information security posture.
    8. Collaboration and remote access applications – Many users are accustomed to leveraging file sharing applications and accessing their systems remotely via technologies such as remote desktop and VPN. Management should have strict policies and guidelines for using internal and/or externally-hosted file sharing and collaboration applications and also have the proper information security mechanisms enabled from both design and validation perspectives for all remote access arrangements.
    9. Monitoring and validation – Even with the most comprehensive information security plans and procedures, it’s important to conduct periodic vulnerability assessments to identify potential weaknesses and utilize penetration testing practices to validate information security capabilities.
    10. Risk management approach – Every organization has a unique approach toward managing risks. Organizations with a lower emphasis on risk management are higher probability targets for today’s sophisticated information thieves and cyber criminals. So make sure your information security plan includes risk management tactics that work for your business and keep you protected.

    Sassan S. Hejazi can be reached at shejazi@kmco.com or 215.441.4600.

    Newsletter subscription

    You may also like:

    Empower Your Team: Employees Play a Critical Role in Protecting Your Company’s Data

    Cybersecurity is an ever-present concern for business leaders with valuable data to protect and multiple potential entry points to secure against being infiltrated by hackers, says Sassan Hejazi, Ph.D., Director of the Technology Solutions Group at Kreischer Miller.

    “The companies that are most prepared have upgraded their protections on hardware devices and infrastructure, as well as implemented protocols to safeguard their materials,” Hejazi says. “However, even these proactive organizations face vulnerabilities.”

    Cybercriminals tend to be quite resourceful and are constantly in search of new ways to wreak havoc on systems and networks everywhere. Your employees need to be aware of this constant threat and should be armed with knowledge and tools to help protect your company against an attack.

    “A continuous awareness mechanism that begins at the top and cascades all the way down to new hires is the best solution,” Hejazi says. “Enable employees to not only identify security threats, but also to act as a deterrent towards such threats.”

    Smart Business spoke with Hejazi about the tools available to reduce your risk of a cyberattack and the value of continuous employee training.

    What steps are most effective in any cybersecurity initiative?

    The measures you implement to secure your company need to be built around user awareness and training. Technology changes on an ongoing basis as upgrades are made to both hardware and software and new tools and applications are developed. Educate employees so they know how to respond if they get a questionable email request. Ensure that they understand the risk of transferring data from your company network to a home network, where the employee or family members could inadvertently expose sensitive files to the outside world by visiting unsafe websites.

    Keep in mind that even if these files are stored on the same computer the employee uses in the office, that computer is now being accessed through a potentially unsecure network. Also, laptops can be stolen. Take steps to encrypt important information so that even if it does fall into criminal hands, it will be difficult to decode.

    It’s wise to implement practices that cover things likes printed files. These documents should not be left on the printer for any length of time, nor should they be left at someone’s desk where the information could also be exposed. Most security breaches occur due to human error. Even if it’s an unintentional lapse, it can still create a significant problem.

    How can social engineering play a part in protecting your company?

    Many middle-market companies have outsourced their IT duties, often through a help desk function that can be accessed by employees. It’s important that someone be designated as the contact point to address these concerns, even if it’s not a full-time person who is on site every day. You don’t want a cyberattack to occur that could have been prevented had there simply been an IT person in place to field a question.

    Online courses are another effective tool to teach employees about smart technology practices. You can subscribe to courses and develop an ongoing curriculum for your employee that addresses updates and changes as they occur.

    Another successful strategy is penetration testing. Create a scenario such as a fake phishing email, send it out to a select group of employees and see who responds. It’s always better if an employee “flunks” this test and learns a valuable lesson in the process rather than respond to a real phishing email and expose your network. You can also have a “stranger” walk into your office pretending to be a visitor and evaluate how your team handles the situation. Do they question it or assume that the person is OK and go back to whatever it was they were doing?

    Take opportunities to not only protect, but verify that your protection measures are effective. You don’t need top-of-the-line IT protection if your company has limited financial resources. Develop a plan in which systems are updated on a regular basis and training and awareness is an integral part of your safety program. Costs have come down in recent years, so you should be able to find an option that is right for your business. ●

    Sassan S. Hejazi can be reached at shejazi@kmco.com or 215.441.4600.

    Newsletter subscription

    You may also like:

    GIPS Guidance Statement on Broadly Distributed Pooled Funds

    Provision 0.A.9 of the GIPS Standards requires that firms make every reasonable effort to provide a compliant presentation to all prospective clients. A prospective client is defined as any person or entity that has expressed interest in one of the firm’s composite strategies and qualifies to invest in the composite strategy.

    For stand-alone accounts, meeting the requirements of provision 0.A.9 is relatively straightforward. The question, which led to the development of this guidance statement, is – how does a firm satisfy this requirement for broadly distributed pooled funds (BDPFs)? BDPFs are funds where there is typically no contact between the investment advisor of the pooled fund and the prospective pooled fund investors. Mutual funds are examples of BDPFs.

    To answer the question, a team was established to develop a guidance statement for BDPFs. Early discussions involved the consideration of requiring firms to provide compliant presentations to all prospective BDPF clients. This concept was eventually scrapped because of the difficulty and potential confusion this could cause. Factors weighing into this decision included the following:

    • Many investment managers have a separate firm set up to handle management of BDPFs. The name of this firm is often not the same name as the firm claiming GIPS compliance.
    • Composites can be single fund composites or can contain other accounts. Multi-account composites might not be appropriate to present to BDPF investors.
    • Under GIPS, firms can choose (in many, but not all, circumstances) to present gross or net returns. Many countries require that funds’ returns be shown net. For GIPS purposes, net returns reflect the deduction of trading and investment management fees, but generally not the deduction of administrative expenses (such as custodial, legal, audit, and other similar fees). Many countries’ rules (such as those of the SEC in the U.S.) require fund returns to be net of everything.

    The final version of this guidance statement has some differences from the exposure draft, which was issued in the first quarter of 2016. The final version of the guidance statement, which is effective starting on January 1, 2018, includes the following key provisions:

    Applicability:

    The Guidance Statement on Broadly Distributed Pooled Funds applies to publicly available pooled investment vehicles that meet the following three criteria:

    1. The pooled fund is broadly distributed.
    2. There is no or minimal contact between the firm marketing the pooled fund and prospective pooled fund investors.
    3. The firm has the ability to influence the pooled fund’s official documents or marketing materials.

    Note: This definition was enhanced from the exposure draft in response to comment letters requesting greater clarity.

    Four Required Disclosures:

    The following items are required to be included in a document that will reach prospective pooled fund investors prior to or concurrent with their purchase of the fund. That document may be either an official pooled fund document required by local regulators, or fund specific marketing material prepared by the firm. The guidance statement notes that applicable law and regulations must be met, even if they differ from the requirements of the guidance statement.

    1. Description of the pooled fund’s investment strategy
    2. Indication of the pooled fund’s risk – can be qualitative or quantitative
    3. Pooled fund returns – calculated and presented as required by local laws. If local laws do not prescribe a calculation/presentation methodology, then firms must calculate net returns (net of all fund expenses), and follow presentation guidelines proscribed by the Guidance Statement that are similar to the GIPS Advertising Guidelines.
    4. Currency used to express performance

    Note: The ability to make these disclosures in a fund-specific marketing document was not provided in the original Exposure Draft. This is a welcome change as some countries have rigid rules on what can and cannot be in the official offering document.

    Recommendations:

    The Guidance Statement recommends, but does not require, that the following items be disclosed:

    1. Benchmark returns and a description of the benchmark
    2. Disclosure of sales charges and loads, and whether they have been deducted from the presented pooled fund returns
    3. The GIPS Pooled Fund Claim of Compliance as follows:

    “XXX, the firm managing this pooled fund, claims compliance with the Global Investment Standards (GIPS®). For more information about the GIPS standards, please visit www.gipsstandards.org.”

    Safe Harbor Provision:

    This is a major change from the Exposure Draft, which did not contain such a provision. The Guidance Statement indicates that certain legal and/or regulatory regimes may require firms to provide prospective pooled fund investors with materials that include the four required items of this Guidance Statement. The CFA Institute will review these and determine if they qualify for inclusion under the safe harbor provision. If this is the case, then firms that fall under these legal and/or regulatory regimes will be considered to have met the requirements of Provision 0.A.9 and this Guidance Statement. The CFA Institute will maintain a list of legal and/or regulatory regimes that qualify for safe harbor treatment.

    Although the safe harbor list has not been published yet, one would expect it to include the Securities and Exchange Commission rules for ‘40 Act funds.

    Summing it Up

    The Guidance Statement provides clarification on how firms can meet the requirements for Provision 0.A.9 for BDPFs. The final Guidance Statement can be found on the GIPS website.

    In addition, a summary of the key differences between the Exposure Draft and the Final Guidance Statement can be found here.

    Firms that claim compliance with the GIPS Standards and that manage funds should:

    1. Determine if their funds are BDPFs.
    2. For identified BDPFs:
      1. Check if the fund is offered under a jurisdiction that is on the safe harbor list.
      2. For funds not offered under safe harbor, make sure the offering document or fund-specific materials contain the four required disclosures.

    We would be pleased to provide further information related to this subject. For more information, contact Thomas A. Peters, Director, Audit & Accounting at tpeters@kmco.com. 

    Newsletter subscription

    You may also like:

    Managing Tech in the Broker-Dealer Industry

    Customer service is key in driving the growth of business. In the highly-regulated broker-dealer industry, a focus on better customer service is often the distinction between competing firms.

    The ongoing Fintech revolution in the financial services industry has opened up innovative options for representatives to be more accessible to their customer base. The use of evolving technology in communication channels; e.g., text messaging and various mobile app messaging, and social media such as Facebook, LinkedIn, and personal blogging, is part of the daily routines of millions of participants in the global economy. As a result, many companies have increased their usage of these tools to reach current customers and potential new customers.

    It is important to note that while these tools may be new, the rules still apply. Acting in its capacity as regulator of 3,800 broker-dealers, ensuring investor protection, Financial Industry Regulatory Authority (“FINRA”) has established certain applicable rules. FINRA Rule 3110(a)(1) requires “a firm’s supervisory system to provide for the establishment and maintenance of written supervisory procedures.” Broker-dealer policies and procedures need proactive updating to reflect constantly-evolving technology in communications with customers.

    Firms have a duty to ensure supervisory requirements are met when embracing new technology in communication channels or social media. FINRA Rule 3110(a)(2) requires a firm to designate an appropriately-registered principal “with authority to carry out the supervisory responsibilities for each type of business in which the firm engages for which registration as a broker-dealer is required”. Factors to consider under FINRA Rule 3110(a)(4) include whether the on-site principal is “qualified by virtue of experience and training to supervise the activities and associated persons in each location” and “has the capacity and time to supervise the activities and associated persons in each location”.  Given the rapid pace of technology growth, a firm’s designated principal should be acutely aware of any developments impacting daily operations.

    Additionally, FINRA Rule 3110(b)(4) requires a firm to establish supervisory procedures “to review incoming and outgoing written (including electronic) correspondence and internal communications relating to its investment banking or securities business.”

    The necessity for these requirements is evident through review of FINRA’s latest release in April 2017 of recent disciplinary actions involving misconduct. One scenario discussed related to the use of non-firm communication methods to communicate with a customer, “making exaggerated and promissory claims about securities.” Technology may change, but the mission of protecting the investor stays the same.

    Supervisory controls will be a focal point of the upcoming 2017 annual regulatory FINRA examinations and will focus on firms’ testing of controls around compliance in day-to-day operations, including the assessment of “record-retention omissions.” Details can be reviewed here.

    Firms should proactively consider the impact that these communication tools may have on policies and procedures. Examples of actions to take include the following:

    • Review and revise Written Supervisory Procedures (WSP) to ensure that the WSP’s contain specific policies for the usage of these communication tools, and procedures for the review of these communications.
    • Ensure the recordkeeping of retail and institutional communications is maintained for the retention period required by SEA Rule 17a-4(b).
    • Ensure the recordkeeping of correspondence is maintained in accordance with the requirements of FINRA Rule 3110.09 and Rule 4511. Correspondence is defined as “any written (including electronic communication” that is distributed or made available to 25 or fewer retail investors within any 30 calendar-day period.”
    • Ensure that the firm is able to produce these records, when required.
    • Consider the need for training of firm personnel on these communication tools, even if this training is a reminder of what may have already been communicated.
    • Consider whether the firm would like to have its representatives certify that they understand and are complying with the established policies for these communication tools.
    • Consider whether the use of these tools has an impact on the firm’s information technology security risks, and how the firm would respond in the event of a breach through any of these communication tools.

    The goal continues to be the protection of the customer, ensuring that the broker-dealer industry operates transparently and ethically.

    We would be pleased to provide further information related to this subject. For more information, contact Frank L. Varanavage, Manager, Audit & Accounting at fvaranavage@kmco.com.

    Newsletter subscription

    You may also like:

    Cyber Security and the Investment Industry

    Cyber security has been a buzzword in business for a number of years. It is especially buzzworthy in the investment industry, where investor protection is of paramount importance.

    The New York Department of Financial Services (NYDFS) made recent headlines with its first-in-the-nation cyber security regulation, which went into effect in March. The regulation requires a set of minimum standards regarding the establishment and maintenance of a cyber security program for banks, insurance companies, and other financial service institutions regulated by the NYDFS, with protection of consumers’ private data in mind.

    The NYDFS is not alone in its focus on cyber security. Earlier this year, the U.S. Securities and Exchange Commission (SEC) announced that cyber security would once again be on the 2017 priority list for the Office of Compliance Inspections and Examinations (OCIE). The Financial Industry Regulatory Authority (FINRA) also included cyber security on its 2017 priorities list.

    The regulatory agencies have good reason for shining a spotlight on the issue. In recent years, a large investment adviser agreed to pay a $1 million penalty to settle charges related to failures to protect customer information and other investment advisers have also agreed to penalties for violations of Rule 30(a) of Regulation S-P (known as the “Safeguards Rule”).

    Going forward, OCIE and FINRA examinations will likely place a greater focus on cyber security compliance procedures and controls, as well as testing the implementation of those procedures and controls. Two specific rules the regulatory agencies will likely focus on are Regulation S-P and Regulation S-ID:

    Regulation S-P (17 CFR §248.30)

    • Policies and procedures play a critical role in cyber and information security. The SEC will now require organizations to adopt cyber security policies and procedures within their risk management programs that specifically address areas such as technology governance, system change management, risk assessments, technical controls, incident response, vendor management, data loss prevention, and staff/end user training.

    Regulation S-ID (17 CFR §248.201-202)

    • This SEC rule applies to the detection, prevention, and mitigation of identity theft. The SEC will now require organizations to proactively monitor, detect, and respond to cyber security incidents and breaches.

    In addition to Regulations S-P and S-ID, the Securities and Exchange Act of 1934 requires firms to preserve electronic records in specific formats. These regulations, amongst others, will be crucial aspects of OCIE and FINRA examinations.

    While the above list is a small subset of the regulations, it is important for businesses to understand that regulators are moving from cyber security controls as “best practices” to mandatory requirements for how businesses need to handle their cyber security posture. Investment advisers, broker-dealers, and other firms in the investment industry should expect cyber security preparedness to remain on the agenda.

    As more organizations adopt cyber security into their business process, the National Institute of Standards and Technology (NIST) has created a cyber security framework to aid organizations in addressing their cyber security posture. Firms may want to consider reviewing the NIST framework and comparing it to their own policies and procedures.

    We would be pleased to provide further information related to this subject. For more information, contact Craig B. Evans, Director, Audit & Accounting at cevans@kmco.com or Charles Sgrillo, Senior IT Security Specialist, Technology Solutions Group at csgrillo@kmco.com.

    Newsletter subscription

    You may also like:

    The Securities and Exchange Commission Shortens Settlement Cycle

    On March 22, 2017, the Securities and Exchange Commission (SEC) adopted an amendment to shorten the standard settlement cycle by one business day. Before this amendment, the execution, confirmation, clearance, and settlement would need to be completed in a three day cycle (T+3). This amended rule will apply to all transactions currently covered by the T+3 settlement cycle. These include transactions for stocks, bonds, municipal securities, exchange-traded funds, certain mutual funds, and limited partnerships that trade on an exchange.

    This change was the result of new technology, products, and growing trade volume. It is believed that the shortening of the settlement cycle will lead to increased efficiency and reduce risk for the end investor by reducing the exposure to broker-dealer default prior to settlement. It will allow for investors to have more timely access to funds after executing a sale. On the flip side, it will also require a quicker payment for securities purchased.

    With the implementation of the accelerated settlement cycle, firms should review their policies and procedures to see how the change in the settlement cycle will impact their operations.

    Broker-dealers will be required to comply with the amended rule beginning on Sept. 5, 2017.

    To assist broker-dealers, other securities professionals, and the investing public in their preparation for the implementation of a T+2 settlement cycle, the Commission has established an e-mail address – T2settlement@sec.gov – for the submission of inquiries to SEC staff.

    We would be pleased to provide further information related to this subject. For more information, contact Frank L. Varanavage, Manager, Audit & Accounting at fvaranavage@kmco.com. 

    Newsletter subscription

    You may also like:

    Kreischer Miller Presenting at 2nd Annual NYSSA GIPS Forum

    Second Annual NYSSA GIPS Forum

    May 17, 2017
    3:00PM – 8:30PM
    NYSSA Conference Center
    New York, NY

    To date, more than 1,200 firms have registered with the CFA Institute as claiming compliance with the GIPS Standards. This event will provide a forum in New York to discuss the most recent developments in the GIPS standards and share views on the challenges and opportunities of their implementation. The Forum will feature GIPS experts from the CFA Institute, GIPS committees, asset owners, and asset management firms and will rely on the active participation of the attendees for an exchange of ideas and to identify solutions for current implementation questions.

    Kreischer Miller director Thomas Peters will be speaking on a panel about the GIPS Technical Update at the Forum. We hope to see you there.

    More details about the Second Annual NYSSA GIPS Forum.

     

    Kreischer Miller Exhibiting at PMAR XV

    The Journal of Performance Measurement’s 15th Annual Performance Measurement, Attribution & Risk Conference
    PMAR XV

    May 9-10, 2017
    Hyatt Jersey City
    Jersey City, NJ

    Each year, the PMAR conference provides an opportunity for performance measurement professionals to learn about recent developments in performance, attribution, risk, and GIPS, as well as network with peers and gain new insights and solutions.

    Kreischer Miller will once again be exhibiting at this year’s PMAR Conference. Stop by and see us!

    More details about PMAR XV.

     

    Newsletter Signup

    Kreischer Miller

    100 Witmer Road,
    Suite 350
    Horsham, PA 19044
    215-441-4600

    Services

    About Us

    Resource Center

    Career Opportunities

    © Copyright 2024 Kreischer Miller IIG
    miller-designworks-logoWebsite Design & Development by