SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to...

20
Inclusion of any advertisement in any NSCP publication is at the sole discretion of the NSCP Board of Directors, and in no way represents an endorsement of the advertiser or the advertised product by NSCP. © 2006 National Society of Compliance Professionals, Inc. C URRENTS A Publication of the NATIONAL SOCIETY OF COMPLIANCE PROFESSIONALS NSCP Inside (Continued on page 2) Hard Rules for Soft Dollars 6 Safeguarding Customer Info 11 Non-Cash Compensation 17 SEPTEMBER / OCTOBER 2006 Regional Roundtables 15 The Second Annual Review for Investment Advisory Firms By J. Christopher Jackson J. Christopher Jackson is Senior Vice President and General Counsel for Hansberger Global Investors, Inc. The views expressed herein are solely those of the author and not those of his employer. Mr. Jackson would like to recognize the contribution made to some of the items discussed herein of Susan Moore-Wester, Chief Compliance Officer of Hansberger Global Investors, Inc. New Members 16 Before too long, it will be “that time again” for all investment advisory firms registered with the SEC under the Investment Advisers Act of 1940, as amended (the “Act”) to once again undertake the “annual review.” Some firms are ahead of the game in the sense that they conduct monthly and/or quarterly reviews that they can then “bake into” the annual review at the end of the year without too much difficulty. Other firms may take the position that while Rule 206(4)-7 of the Act mandates that investment advisers undertake an annual review, the rule does not require that the annual review be memorialized in any formal way. This, in turn, raises the fundamental question as to whether advisory firms with no U.S. registered investment companies should memorialize – in any formal sense – their annual review of their firms. There are other questions that are raised in the annual review context plus some guidance has been proffered by the SEC primarily in the form of speeches by SEC staff. This brief article will explore some of these more fundamental questions and then finish with the proverbial “top ten list” of lessons learned and items to be avoided on the second annual review. But first, a bit of background. On December 17, 2003, the SEC finalized the Compliance Rule for Investment Advisers and Investment Companies. 1 The Final Compliance Rule, with the compliance date of October 5, 2004 contains the recently promulgated Rule 206(4)-7 under the Act dealing with the need for each registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent, detect and correct violations of the Act, designate a chief compliance officer and impose the requirement of the conducting of an annual review. 2 Registered investment advisers were required to complete their first annual review within eighteen months after the initial adoption of their compliance policies and procedures. 3 If, for example, the policies and procedures were approved on October 5, 2004, then the first annual review was required to be completed on or before April 5, 2006. 4 Investment advisory firms have two options with respect to the timing of their next annual review. Reviews can either be completed within twelve months of the first annual review, or in the example above, by April 5, 2007 or within a “reasonable period” after April 5, 2007, which is referred to as the “tax year approach” of ending the twelve month cycle on April 5 and finalizing the review within a reasonable time period thereafter. 5 Fundamental Issue – To Memorialize or Not Memorialize the Annual Review Prior to setting forth some lessons learned from the first go round with the annual review, a fundamental question arises as to whether an investment advisory firm, with no U.S. registered investment company clients, should memorialize its annual review. Here are some of the reasons why memorializing the annual review is a must in many advisory firms’ opinions. First, it records the fact that the annual review was undertaken and can lay out the methodology, findings and undertakings in an orderly and succinct fashion. Second, it can be used with members of senior management to educate them on the state of compliance within their own firm, identify weaknesses as well as strengths, provide an indication of resource needs and allocation – not only in the compliance area, but firm-wide, particularly in the areas of operations, trading, administration and internal audit. Third, the annual review (or an executive summary thereof) which is memorialized in the form of a report can be a useful tool with existing and potentially new clients. Fourth, a written annual review can be used by

Transcript of SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to...

Page 1: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

Inclusion of any advertisement in any NSCP publication is at the sole discretion of the NSCP Board of Directors, and in no way represents an endorsement of the advertiser or the advertised product by NSCP.

© 2006 National Society of Compliance Professionals, Inc.

CURRENTSA Publication of the NATIONAL SOCIETY OF COMPLIANCE PROFESSIONALS

NSCP

Inside

(Continued on page 2)

Hard Rules for Soft Dollars 6

Safeguarding Customer Info 11

Non-Cash Compensation 17

S E P T E M B E R / O C T O B E R 2 0 0 6

Regional Roundtables 15

The Second Annual Review for Investment Advisory Firms

By J. Christopher Jackson

J. Christopher Jackson is Senior Vice President and General Counsel for Hansberger Global Investors, Inc. The views expressed herein are solely those of the author and not those of his employer. Mr. Jackson would like to recognize the contribution made to some of the items discussed herein of Susan Moore-Wester, Chief Compliance Officer of Hansberger Global Investors, Inc.

New Members 16

Before too long, it will be “that time again” for all investment advisory firms registered with the SEC under the Investment Advisers Act of 1940, as amended (the “Act”) to once again undertake the “annual review.” Some firms are ahead of the game in the sense that they conduct monthly and/or quarterly reviews that they can then “bake into” the annual review at the end of the year without too much difficulty. Other firms may take the position that while Rule 206(4)-7 of the Act mandates that investment advisers undertake an annual review, the rule does not require that the annual review be memorialized in any formal way. This, in turn, raises the fundamental question as to whether advisory firms with no U.S. registered investment companies should memorialize – in any formal sense – their annual review of their firms. There are other questions that are raised in the annual review context plus some guidance has been proffered by the SEC primarily in the form of speeches by SEC staff. This brief article will explore some of these more fundamental questions and then finish with the proverbial “top ten list” of lessons learned and items to be avoided on the second annual review. But first, a bit of background.

On December 17, 2003, the SEC finalized the Compliance Rule for Investment Advisers and Investment Companies.1 The Final Compliance Rule, with the compliance date of October 5, 2004 contains the recently promulgated Rule 206(4)-7 under the Act dealing with the need for each registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent, detect and correct violations of the Act, designate a chief compliance officer and impose the requirement of the conducting of an annual review.2 Registered investment advisers were required to complete their first annual review within eighteen months after the initial adoption of their compliance policies and procedures.3 If, for example, the policies and procedures were approved on October 5, 2004, then the first annual review was required to be completed on or before April 5, 2006.4 Investment advisory firms have two options with respect to the timing of their next annual review. Reviews can either be completed within twelve months of the first annual review, or in the example above, by April 5, 2007 or within a “reasonable period” after April 5, 2007, which is referred to as the “tax year approach” of ending the twelve month cycle on April 5 and finalizing the review within a reasonable time period thereafter.5 Fundamental Issue – To Memorialize or Not Memorialize the Annual Review Prior to setting forth some lessons learned from the first go round with the

annual review, a fundamental question arises as to whether an investment advisory firm, with no U.S. registered investment company clients, should memorialize its annual review. Here are some of the reasons why memorializing the annual review is a must in many advisory firms’ opinions. First, it records the fact that the annual review was undertaken and can lay out the methodology, findings and undertakings in an orderly and succinct fashion. Second, it can be used with members of senior management to educate them on the state of compliance within their own firm, identify weaknesses as well as strengths, provide an indication of resource needs and allocation – not only in the compliance area, but firm-wide, particularly in the areas of operations, trading, administration and internal audit. Third, the annual review (or an executive summary thereof) which is memorialized in the form of a report can be a useful tool with existing and potentially new clients. Fourth, a written annual review can be used by

Page 2: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

2NSCP Currents September/October 2006

“How to Avoid Getting Sued by Your Customer”

An interactive power pointpresentation, explained toyour group by a ruthless

and experienced customer attorney.

Steven L. Miller, Attorney(800) 350-2098

www.BrokerLawSpeaker.com

Please send inquiries to: [email protected]

Atlanta Austin Houston New YorkTallahassee Washington, DC

Sutherland.Because you take

compliance seriously.

IA SECOND ANNUAL REVIEW (Continued from page 1)

the advisory firm with the SEC staff on the firm’s next examination. The SEC places a lot of emphasis on process, whether that process deals with best execution, performance advertising, or the annual review requirement. There are, of course, countervailing arguments to putting anything in writing, least of all the annual review, for fear of providing to the SEC or another regulator a “road map” to the various issues or compliance-related matters that a firm has or currently confronts.6 Firms, particularly smaller investment advisory firms, may be able to document an annual review by simply assimilating a number of tests conducted in key areas of the firm, which cover their policies and procedures without having to place them in the context of a formal annual review report. Advisory firms are well reminded to keep in mind Rule 204-2(a)(17) of the Act, which came in as part of the Final Compliance Rule, and which requires investment advisers to maintain books and records documenting the adviser’s annual review (during the past five years).7 Thus, any reports produced memorializing the annual review process will form part of an advisory firm’s required books and records.Lessons Learned There were, no doubt, countless “lessons learned” in the conducting of the first annual review by investment advisory firms. Among those lessons are the following ten: Lesson 1 – Don’t wait too late to prepare for the next Annual Review. This seems like such an obvious point to make that it goes without saying, but the reminder is important because of the potentially vast array of policies and procedures that need to be tested, reviewed and addressed in order to assess their effectiveness. Large firms typically need to take a more methodical, structured approach due to the number of employees and multiple business lines involved. It is important for all firms to conduct a post-mortem of the first annual review. This point goes to successive annual reviews as well.

The goal is continued improvement with the belief that the status quo can spell disaster. Be brutally honest in assessing the points the firm did well and those in which improvement is needed.8 Lesson 2 – Avoid the Improper Staging of the Annual Review. If your firm advises or sub-advises U.S. registered investment companies, the investment company will want your firm’s annual review completed in enough time before the investment company must complete its annual review. For that reason, and depending upon all of the circumstances surrounding the advisory firm’s business and the importance of the investment company clients, some advisory firms may wish to consider doing a stub period annual review to ensure their annual reviews are completed and delivered to investment company clients so that those clients can then utilize them in completing their own annual reviews. This is a good point to keep in mind when your firm is being considered for an advisory or sub-advisory appointment with an investment company. Address this point up-front as part of the due diligence process in order to ensure your firm will avoid any timing issues going forward. Lesson 3 – Better Use of Transactional, Periodic and Forensic Testing Methods for High Risk Areas. Higher risk areas of an investment advisory firm may include portfolio compliance, soft dollars, performance advertising, trading as well as best execution. It is important to tie your firm’s testing to its risk matrix, compliance manual and actual legal requirements in order to ensure that adequate tests have been undertaken and completed within the time frame of the annual review period. It is important as well to implement a year-round schedule of testing. Seek to devise a system of the those tests that need to be conducted on a daily, weekly, monthly, quarterly, semi-annual and annual basis and then follow up to ensure the tests have actually been completed and allow yourself time to review the results of the testing and analyze those results. Lesson 4 – Follow Through on Remediation of Items Identified

Page 3: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

3 NSCP Currents September/October 2006

(Continued on page 4)

Your Trusted Source forLegal and Complaince News

in the Securities IndustryLegal and Complaince NewsLegal and Complaince NewsLegal and Complaince NewsLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince NewsLegal and Complaince NewsLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince NewsLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

Your Trusted Source forLegal and Complaince News

in the Securities Industry

• Brokerage• Investment Management

• Regulatory Alerts• Money Laundering• Corporate Finance

For a free trial go towww.compliancereporter.com/freetrial1

during the Last Annual Review. The annual review process and the annual report will inevitably contain items to follow up on for improvement involving various areas of your fi rm. You should consider your annual review and particularly the fi ndings resulting from your annual review the same as you would a defi ciency letter received of the SEC resulting from a routine examination of your fi rm. Make sure you follow up and document each and every item set forth for remediation from the prior annual review. Additionally, if your most recent annual review uncovered items that your fi rm is doing and does not have adequately covered by policies and procedures where needed, you need to fi x those areas now in time for the next annual review.

Lesson 5 – Avoid “Stale” Policies and Procedures. Ideally, all of your fi rm’s policies and procedures bear a date (whether new, reviewed or revised) that is one year or less from the date of the previous review ensuring that at least on an annual basis all such policies are reviewed for a variety of items including, but not limited to, relevance to today’s situation, changes in the business, the personnel assigned to monitor and ensure compliance with the policy and procedure and any changes in the law, rules or regulations which may affect the particular policy and procedure. When you are revising or crafting a new policy and procedure, seek to draft in such a way that they can be easily tied to your fi rm’s risk matrix and be tested. Defi ne the business unit and who is responsible for the policy and make sure you know what it is you are testing. Finally, do not forget that a good archival system is imperative in order to keep copies of prior policies and procedures.

Lesson 6 – Create a Standard Template for Individual Reviews. Consider the need for a uniform and systematic approach for the reviews of your fi rm’s policies and procedures. What might such an approach involve? You might, for example, come up with a standard form of template for each review that covers the following areas: the topic reviewed, responsible business

unit/third party service provider, scope of review, source documents, people interviewed (if any), fi ndings, summary and conclusions, recommended changes and updates, reviewer and date of review and completion date and fi nal activities. By adopting a uniform approach it will help crystallize your thinking and hopefully result in your not missing anything key that should come from your review. Your individual reviews should result in a fi nding with respect to the adequacy of the policy and procedure and the effectiveness of the policy and procedure.

Lesson 7 – Employ a Workable Defi nition of “material compliance matter.” Rule 38a-1 of the 1940 Act contains a defi nition of a material compliance matter.9 While the defi nition set forth under the 1940 Act provides a useful reference, no such defi nition of a material compliance matter exists under the Act. Thus, it is important that your fi rm reach a good understanding of what amounts to a material compliance matter. Objectively is key in coming up with such a defi nition. Criteria for consideration might include whether a situation results in a rule violation, a policy and/or procedure violation or results in a certain dollar amount at issue. It is important to think this through very carefully and fi rms may be well advised to seek the advice of their counsel in this regard. Lesson 8 – Write the Annual Report for the Firm, but keep in mind the likely audience will be more vast. The audience for the annual report will likely include the fi rm’s board of directors, the fi rm’s management, the fi rm’s proprietary fund boards, sub-advised fund boards, clients and potential clients and regulators. Therefore, an executive summary of the annual report is a good idea. Knowing what you experienced with respect to your fi rst annual review will be of great help to you and your fi rm on the next go-round and enable you to better prepare for what requests may be made of your fi rm. Lesson 9 – Do not assume that the Annual Report will be covered

Page 4: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

4NSCP Currents September/October 2006

IA SECOND ANNUAL REVIEW (Continued from page 3)

by the Attorney Client Privilege or Attorney Work Product Doctrines. Depending upon how the annual report is crafted and by whom and at whose direction, an attempt could be made by a firm to seek to shroud the annual report resulting from the annual review in the attorney client privilege or under the attorney work product doctrine. While this is a point better taken up with your firm’s counsel, it is important to note the SEC’s view in the context of Rule 38a-1 of the 1940 Act: “All reports required by our [SEC’s] rules are meant to be made available to the Commission and the Commission staff and, thus, they are not subject to the attorney-client privilege, the work-product doctrine, or similar protections.”10

Lesson 10 – Leverage the Annual Review and Annual Report. Use the Annual Review Process and the Annual Report generated as an opportunity to:(i) form the basis of any needed or useful follow-up communication to the firm, (ii) for training of new and existing employees and (iii) as reinforcement of the “Tone at the Top.” The annual review process can lend to the savvy chief compliance officer a myriad of potential uses in furthering the overall compliance needs of the firm.View from the SEC The SEC’s staff has also “weighed in on” the annual review and annual report process. John Walsh, the Chief Counsel for the SEC’s Office of Compliance Inspections and Examinations in a recent speech suggested that Chief Compliance Officers as well as executives raise ten questions in evaluating their annual reviews. Those questions are as follows: “Did we meet all regulatory deadlines on time and with full compliance? In our review did we identify any unique compliance risk exposures created by our personnel, organization, affiliations, or the way we do business, that are not faced by other comparable firms? After our review, can we

demonstrate how specific compliance policies and procedures or WSPs [written supervisory procedures] address our specific risk exposures, without any ‘gaps’ between risk and response? Do our written policies and procedures or WSPs accurately reflect our real practices? Are our real practices better or worse than what we have written down? During the review, did we bring in outsiders to look at any of our policies, procedures, or WSPs? If yes, why? If not, why not? What compliance tests did we run that analyze information over time to detect unusual patterns, to test and verify our procedures, or to verify the accuracy of specific disclosures we have made? What were the worst red flags we identified during our review, and what did we do about them? Do we have any serious compliance issues that remain open, that have not yet been closed or resolved? Has anyone been unresponsive, or even tried to block compliance from doing its job, either during this process or during the course of the year? What can senior executives do, on the business or legal side, to follow-up on the review in a productive and helpful way, and to ensure that it has a lasting and positive impact on the organization?”11

Conclusion Much can and will continue to be learned from the annual review process. The real key to mastering this area will be for your firms to develop, build and utilize a systematic approach to this important process and ensuring the flexibility to adapt the process to changes in your firm’s business and products, to new products and business lines and to rules and regulations.

1. Compliance Programs of Investment Companies and Investment Advisers; Final Rule, 17 CFR Parts 270, 275, and 279, F. Reg. Dec. 24, 2003 74714-74730(“Final Compliance Rule”).2. Final Compliance Rule at 74730. While this article deals primarily with Rule 206(4)-7 of the Act, it is important to note the adoption of new Rule 38a-1 of the Investment Company Act of 1940, as amended, (the “1940 Act”) which carries with it similar requirements as set forth in Rule 206(4)-7, along with the added undertakings, insofar as the

subject matter of this article is concerned, of actually producing an annual report reflecting the annual review.3. Final Compliance Rule at 74723.4. Final Compliance Rule at 74723.5. See IM Insight; January 23, 2006. (Confirmed by IM Insight with Robert Plaze, SEC Associate Director in the Division of Investment Management.) 6. Gilbert Hahn, General Counsel of Marvin & Palmer put it this way: “If it [the Annual Review] is to become a roadmap for the Commission, however, it is best that firms take the SEC’s examiners by the ‘scenic route’… That means putting together a report that mentions the breaches (which every firm has), but emphasizes the modifications to policies and procedures…” See IA Week, Feb. 13, 2006.7. Rule 204(a) (17) of the Act. The rule states as follows: “Any records documenting the investment adviser’s annual review of those policies and procedures conducted pursuant to [section] 275.205(4)-7(b).8. In terms of what the review and any resulting report, if one is produced, should cover, one can “take a page from the Final Compliance Rule dealing with investment companies. With respect to investment companies, the SEC had the following to say: “The report must address, at a minimum: (i) The operation of the policies and procedures of the fund and each service provider since the last report, (ii) any material changes to the policies and procedures as a result of the annual review, (iii) any recommendations for material changes to the policies and procedures as a result of the annual review, and (iv) any material compliance matters since the date of the last report.”9. Final Compliance Rule, Rule 38a-1(e)(2). A “Material Compliance Matter means any compliance matter about which the fund’s board of directors would reasonably need to know to oversee fund compliance, and that involves, without limitation: (i) A violation of the Federal securities laws by the fund, its investment adviser, principal underwriter, administrator or transfer agent (or officers, directors, employees or agents thereof), (ii) A violation of the policies and procedures of the fund, its investment adviser, principal underwriter, administrator or transfer agent, or (iii) A weakness in the design or implementation of the policies and procedures of the fund, its investment adviser, principal underwriter, administrator or transfer agent.”10. Final Compliance Rule, Ftn. 94.11. Speech – John H. Walsh, Associate Director – Chief Counsel, Office of Compliance Inspections and Examinations, U.S. Securities and Exchange Commission, Remarks before the NRS 21st Annual Spring Conference – April 18, 2006 (the “Walsh Speech”).

Page 5: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

5 NSCP Currents September/October 2006

Registration Fee ScheduleIf received by NSCP... by 10/03 On Site*NSCP Member of Record . . . . . . . . . . . . . . . . . . . . . . $900 $1,200Nonmember associated with NSCP member . . . . . . . $1,000 $1,300Each additional person from same firm . . . .. . . . . . . . $850 $1,150Nonmember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $1,250 $1,550Guest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $150 $150* Credit card only for on site registrations.Don’t miss out! Visit www.nscpmeetings.com for details as they unfold!

The flagship JW Marriott Hotel on Pennsylvania Avenue will be the site of NSCP’s 2006 National Mem-bership Meeting on October 18, 19 and 20. You may view the Preliminary Agenda as it stands or download a registration form at http://www.nscpmeetings.com. This is three days of education, CLE credits and networking with other compliance professionals from across the country. Other conferences are a day shorter, cover fewer topics, feature fewer speakers, lesser accommodations, no receptions, no Dine Around – and cost twice as much. If you haven’t been to NSCP’s National Meeting yet, it’s time to take a look! The meeting site is the JW Marriott Hotel at 1331 Pennsylvania Avenue, Washington, D.C., which offers NSCP National Meeting Attendees an up close and personal view of the Nation’s Capitol. The hotel is conve-nient to Reagan National Airport and just ten minutes away from AMTRAK’s Union Station. Wednesday, October 18th starts with registration and continental breakfast for all attendees and faculty. Our traditional two Basic-level workshops, Fundamentals of BD and IA Compliance, have now been split according to firm size, creating four workshops for both small and large firms. The General Session, “What’s New and What’s Hot,” includes the top industry talent of Tod Sawicki, Kathy VanNoy-Pineda, Selwyn No-telovitz and John Walsh. This year, we have organized lunch by geographical designations in an effort to build community Round Tables. A description of the Round Tables by NSCP Board Member Judy B. Werner will be appearing in the September/October issue of NSCP Currents, scheduled for early publication. Following lunch will be three sessions of concurrent workshops that will complete the afternoon. At 5:30, Kirkpatrick & Lockhart Nicholson Graham LLP will host a reception which is open to all attendees, guests, and faculty. The day finishes up with the popular Dine Around at 6:45. Both the KLNG Reception and the Dine Around provide the perfect opportunity to meet and speak with others in your field of expertise. Thursday, October 19th begins with an address by our Keynote Speaker Lori Richards, Director, SEC Of-fice of Compliance Inspections and Examinations. Two General Sessions will follow, IA Regulatory Devel-opments and BD Regulatory Developments. Lunch follows these panels, then three sessions of concurrent workshops. Thursday evening is completed by a multi-sponsor reception with full bar and hors d’oeuvres at 5:45 PM. New General Session NSCP is pleased to present a new concluding General Session on Friday, October 20: “The Year of Certi-fication: From a CEO and CCO Perspective.” This panel will address the experiences of those who are “on the line” for CEO and CCO certifications under the recently enacted SEC Rules. For two years, NSCP has hosted panels addressing what you should do to make the process go right. This year, we will present a panel featuring two CEOs and CCOs to ad-dress what really happened and whether the process did go right from the perspective of the Boss, the CEO, and the CCO who signed the certifications. The Panel will be moderated by Michael K. Wolensky, a partner in Schiff Hardin LLP’s Atlanta office. This will be an interactive panel with ample opportunity to ask your questions. The panelists will share what worked and what did not, what they will and will not do next year, and the best practices they have drawn from the experience. We believe you will find it invaluable in enhanc-ing and planning the certification process at your firm. The final concurrent workshops conclude at 12:25, and boxed lunches will be made available from 11:30 onward so that you can eat and catch your flight.

DC is where it’s happening...

Page 6: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

6NSCP Currents September/October 2006

I. Introduction On July 18, 2006, the SEC issued the final version of its most recent interpretive release on soft dollars (the “Release”).1 The Release seeks to clarify the scope of Section 28(e) of the Securities Exchange Act of 1934, which provides a “safe harbor” from claims of breach of fiduciary duty for money managers that use client commissions to purchase “brokerage and research services” from broker-dealers. Over the years, a patchwork of regulatory guidance has engendered significant confusion over the scope of the safe harbor.2 The Release affirms, modifies and synthesizes the SEC’s prior interpretations of the scope of the safe harbor, and it is largely consistent with the SEC’s initially proposed interpretive release of October 2005.3 The Release provides an analytic framework for determining whether the use of a product or service falls within the safe harbor of Section 28(e): • First, the money manager must determine that the product or service qualifies as eligible “research” – advice as to the value of securities or recommendations to invest in securities, or analyses or reports concerning investment information – or eligible “brokerage” – effecting securities transactions or performing incidental functions. • Second, the money manager must determine that the eligible product or service actually provides “lawful and appropriate assistance” in the performance of investment decision-making responsibilities and also make reasonable allocations according to use for mixed-use products. • Third, a money manager must make a good faith determination that the amount of client commissions paid is “reasonable in light of the value of

Hard Rules for Soft Dollars

By Mark D. Perlow and Helen C. Kuo

products or services provided by the broker-dealer.” II. Research Services The Release defines eligible “research” under the safe harbor as “advice,” “analyses,” or “reports” that reflect the “expression of reasoning or knowledge” and relate to the subject matter categories set forth in Section 28(e)(3)(A) or (B). While many predicted that the novel requirement that eligible “research” express reasoning or knowledge (or have “intellectual content”) would significantly narrow the scope of the safe harbor, in application the definition is quite similar to previous SEC positions. The similarities and some key differences are illustrated through an analysis of specific examples.a. Research reports Eligible “research” continues to include traditional written reports on the performance of specific companies or stock. “Research” within the safe harbor may also include the following: 1) discussions with research analysts insofar as they relate to advice regarding the advisability of investing in securities; 2) meetings with corporate executives to the extent that such meetings may provide reports about issuers; and 3) seminars or conferences which provide substantive content about the subject matters described in Section 28(e)(3)(A) or (B), such as issuers, industries, and securities. Travel, meals and entertainment expenses associated with meeting corporate managers or attending seminars and conferences, however, are expressly not eligible for the safe harbor. To establish compliance with these aspects of the definition of eligible “research,” money managers, although it is not expressly required, should document such meetings as well as those in attendance (for instance, research analysts and corporate managers). The purpose of such records is to demonstrate that the meetings produced

eligible “advice,” “analyses” or “reports” and that the money manager was receiving reasonable value for the use of client commissions. b. Narrowly marketed and specialized publications The Release stated that mass-marketed publications, defined as being “intended for and marketed to a broad, public audience,” are not eligible for the safe harbor and are more accurately characterized as overhead expenses. This interpretation runs counter to the practice of many managers. However, the SEC noted that narrowly marketed and specialized publications that are not mass marketed, such as financial or economic publications, trade magazines and technical journals, may qualify as eligible “research” under the safe harbor. Indicia of publications that are not mass-marketed include those that are 1) marketed to a narrow audience; 2) directed to readers with specialized interests in particular industries, products, or issuers; and 3) of high cost. Conversely, mass-marketed publication are typically widely circulated, intended for and marketed to the public, and are relatively low cost. The publication’s availability and its method of distribution are not dispositive in determining whether it is mass-marketed: the key factor is the marketing focus of the publication. For many publications, it will be clear from appearances whether they are mass-marketed. For borderline publications, money managers should document that publications purchased with client commissions are not mass-marketed, for instance by maintaining invoices and marketing materials for the publication in a single file.c. Market data and research “Market research,” defined as “advice,” “analyses,” and “reports” regarding the market for securities, may be eligible as “research” under the safe harbor. “Market research” includes 1) pre-trade and post-trade analytics of

Mr. Perlow is a partner, and Ms. Kuo is an associate, in the San Francisco office of Kirkpatrick & Lockhart Nicholson Graham LLP.

Page 7: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

7 NSCP Currents September/October 2006

(Continued on page 8)

execution quality; 2) advice on order execution and strategies (including market color and buyer and seller availability); 3) software that provides market research; and 4) products that depend on market information to generate market research, including research on execution venues and strategies. Similarly, market data, such as stock quotes, last sale prices, and trading volumes may also qualify as eligible “research” because they are “reports” concerning securities. Other types of raw data such as company financial data and economic data may also qualify as eligible “research” under Section 28(e). On this point, the SEC has differed from the approach of the U.K. Financial Services Authority (“FSA”), which excludes from its provisions “data that have not been analyzed or manipulated to reach meaningful conclusions.” Money managers with operations in both jurisdictions may find that it is difficult to comply with both standards, and to some extent could be constrained by the FSA’s narrower definition. To the extent that market data and research are not used to provide assistance in making investment or brokerage placement decisions, they would not qualify for the safe harbor. For instance, if market data is also used for pricing, it should be treated as a mixed use item.4 Therefore, compliance personnel should document the allocation of commissions for such mixed use products and services in order to demonstrate that the portion paid for soft dollars provides “lawful and appropriate assistance” in making investment decisions.d. Trade analytics As noted above, the SEC has clarified its position on trade analytics: they are a type of “market research” that is eligible for the safe harbor. In the proposing release,5 the SEC stated that trade analytics were not eligible “brokerage,” but was silent as to whether they qualified as “research.” By facilitating the purchase of trade analytics, the SEC encourages money managers to analyze the performance of their brokers. To comply with the Release, money managers should

document the use of trade analytics for assistance in the investment decision-making or trade placement process, for instance through minutes in meetings of the brokerage committee. To the extent that trade analytics are used for purposes that do not qualify for the safe harbor, they should be treated as a mixed-use item and the allocation of their use to products and services within the safe harbor should be documented.e. Order management systems In the Release, the SEC also clarified its position on Order Management Systems (“OMS”): certain components of OMS may be eligible for the safe harbor as “market research.” As with trade analytics, the SEC stated in the proposing release that OMS were not eligible “brokerage,” but was silent as to whether they qualified as “research.” In the final Release, the SEC also acknowledged that OMS components that provide connectivity to executing brokers and that contain software used to transmit orders to the broker or to devise algorithmic trading strategies are eligible “brokerage” (see discussion below). OMS have many components, several of which cannot be treated as providing assistance to the investment process or trade execution, most notably modules used for compliance or order management. The Release also indicates that mechanisms that deliver research are ineligible.6 Thus, OMS should be treated as at most a mixed use item. Money managers should first determine which modules of OMS are eligible as research or brokerage. Compliance professionals then can make mixed use allocations based on either the prices of modules, if available, or based on the percentage of time used on each function.f. Proxy voting services Some proxy voting products and services can be used to support the investment process: for instance, reports on the corporate governance practices of issuers can be used to make an investment decision and thus can be deemed to provide “reports and analyses” on issuers, securities, or the advisability of investing in securities. However, research that helps managers

determine how to vote proxy ballots is ineligible. Similarly, administrative products and services associated with the mechanical aspects of voting (e.g., casting, receiving, counting, voting, recording, and reporting votes), as the SEC states, are expressly not eligible research. Proxy voting services should be treated at best as mixed-use items and may be eligible for the safe harbor to the extent that they assist the manager in making investment decisions. However, as a practical matter, a presumption remains that their use is mostly ineligible for the safe harbor. For managers that will seek to claim research uses for their proxy voting services, it is vital to document the usage of the services for investment purposes, for instance in investment committee meeting minutes or in the investment files of the relevant investment professionals. g. Ineligible items The Release also offered examples of other items that are not eligible as “research” because they do not reflect “advice,” “analyses” or “reports” within the meaning of the statute: • operational overhead (e.g., telephone lines; rent; office furniture and equipment; business supplies; salaries, including for research staff; accounting fees and software; Web site design; Internet service; legal and accounting expenses; self-regulatory organization fees; personnel management; marketing; utilities; membership dues; professional licensing fees; and software to assist with administrative functions; equipment maintenance and repair services)• computer hardware, computer terminals and accessories; and computer peripherals and delivery mechanisms for research, including telecommunications lines and cables Money managers should consider implementing procedures designed to prevent these items from being purchased with client commissions, particularly since many of these items may be closely linked to items that are eligible “research.” The SEC has

Page 8: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

(Continued on page 8)

8NSCP Currents September/October 2006

Visit our Web site formore information.

Hugh M. Makens616.752.2117

[email protected] B. Hansen

[email protected]

Melvin G. Moseley, Jr.616.752.2177

[email protected]

www.wnj.com

SOFT DOLLARS (Continued from page 7)

brought a long series of enforcement actions against money managers that abused these categories.III. Brokerage Services The safe harbor of Section 28(e)(3) extends to “brokerage” as well as “research.” Specifically, Section 28(e)(3)(C) defines “brokerage services” as effecting securities transactions and performing functions incidental thereto, such as clearance, settlement, and custody. The Release establishes a new temporal standard for determining eligibility as “brokerage” under the safe harbor. Under this new temporal standard, brokerage is a process that begins at the time when the “money manager communicates with the broker-dealer for the purpose of transmitting an order for execution and ends when funds or securities are delivered or credited to the advised account or the account holder’s agent.” Therefore, certain post-execution activities, including the matching of trade information, communications relating to the trade, allocation instructions, settling instructions, and comparison services required by SEC or SRO rules are eligible “brokerage.” Communication services that relate to execution, clearing, and settlement (e.g., connectivity service, including dedicated lines between the broker-dealer and money manager or the OMS; trading software for routing orders or providing trading strategies) also are eligible for the safe harbor as “brokerage.” “Short term” custody – that incidental to effecting trades – is eligible, but long term custody – the long-term maintenance of securities positions – is not. Although the temporal standard is a novel approach to determining eligible “brokerage,” the Release expressly clarifies that many items that the temporal standard may exclude, such as pre- and post-trade analytics and OMS, may be eligible nonetheless as “research” under the safe harbor (see discussions above). Moreover, certain OMS functionalities relating to trading

software or order transmittal to direct market access systems may be eligible as “brokerage.” The Release also provides examples of overhead that do not qualify as “brokerage”: hardware such as telephones or computer terminals; software functionality used for administrative or recordkeeping purposes; products and services used to meet compliance responsibilities (e.g., establishing compliance mechanisms such as surveillance systems to detect overtrading and performing compliance tests over time); trade financing; and error correction trades or services. Money managers should adopt procedures to prevent the use of client commissions to purchase any of these enumerated ineligible overhead items. Money managers also should implement compliance procedures designed to assure that the “brokerage” products and services claimed under the safe harbor are eligible and are actually used for brokerage purposes. For example, procedures should review the use of software that provides trading strategies to assure that it is not also being used for administrative purposes. Communication services, order routing and transmittal services should be reviewed to assure that they are not being used to transmit research. Procedures could provide for review of invoices to assure that long-term custody of clients’ assets is not being paid for with client commissions. IV. Lawful and Appropriate Assistance The Release emphasizes that in order to qualify for the safe harbor, eligible “research” or “brokerage” must satisfy the statute and provide the money manager with “lawful and appropriate assistance” in making investment decisions. Notably, the safe harbor is only available if the manager uses the client commissions to purchase brokerage and research services for those client accounts for which he/she has investment discretion. Thus, money managers should have procedures in place to ensure that the eligible products and services purchased with client commissions are used only for discretionary accounts.

Page 9: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

9 NSCP Currents September/October 2006

V. Mixed Use Mixed use items are “research” or “brokerage” that are used both for purposes that are eligible for the safe harbor and for purposes that are not eligible. For instance, a manager that uses account performance analyses for marketing purposes as well as investment decision-making should only use client commissions to pay for the portion of the item allocable to investment decision-making under Section 28(e). The SEC reaffirmed its prior position that for mixed use items, money managers should: 1) make a reasonable allocation of the cost of the product according to use; 2) maintain adequate books and records concerning allocation so as to be able to show that it made the requisite good faith determination as to the reasonableness of the commissions paid relative to portion of the item that is allocable to brokerage and research under Section 28(e); and 3) use hard dollars to pay for portions of mixed use items that do not qualify for the safe harbor. Moreover, the Release provided that money managers should disclose the conflict of interest inherent in its making an allocation determination.VI. Good Faith Determination of Reasonable Value Money managers are required under Section 28(e) to make a good faith determination that any client commissions paid for eligible research and brokerage are reasonable relative to the value of such products or services received. The Release provides that a money manager should engage in a fact-based analysis of how employees use the product or service; managers may also infer costs from benefits and should consider the relative time and utility of the portion of the product that is being used for purposes covered under the safe harbor, and the degree of redundancy relative to other products being used for the same purpose. Money managers bear the burden of proof in demonstrating reasonable value. The Release provides that if a broker-dealer offers research at an unbundled price, then that price should indicate the market value of the research. Money managers would

be prudent to document that price in making their good faith determination of reasonable value. Of course, many research and brokerage services are not offered unbundled from execution services, which present the core difficulty in complying with this prong of the safe harbor. Many money managers address this problem by establishing brokerage or soft dollar committees that evaluate the eligibility and quality of research and brokerage services, keeping minutes of the meetings. Frequently, their deliberations are based on surveys of investment and trading professionals as to the quality of each broker’s services. Often, these committees set non-binding “brokerage budgets,” under which the trading desk is given approximate allocations of brokerage to direct to each broker based on the committee’s evaluations. Managers that establish such budgets should have procedures to review whether it is being approximately followed. Managers may also wish to compare differences in brokerage costs between similar trades where research is provided and where it is not. Although such a comparison is imprecise and difficult, it can help augment analysis and documentation of reasonable value. VII. Third Party Research Under Section 28(e), the broker receiving client commissions for “effecting” a transaction must also “provide” the brokerage or research services, which presents obstacles to the use of client commissions to purchase research from firms other than executing brokers. The SEC, recognizing the benefits to investors of permitting advisers to use client commissions to purchase third party research, has long allowed the executing broker ways of “providing” such research to money managers. In the Release, the SEC affirmed its position that third party research should be analyzed in the same manner as proprietary research for purposes of determining eligibility for the safe harbor. The Release also pointed out that third party research may provide the adviser with a broad array of specialized research and with research of greater depth than may be available from the

executing broker. Partly in response to comment letters reflecting a myriad of industry practices, the SEC broadened its interpretation of permissible client commission arrangements under the safe harbor of Section 28(e) and modified its interpretation of the terms “provided by” and “effecting” under that section.7 Specifically, the SEC broadened its view of what it means to be “provided by” a broker. An executing broker meets this element of the safe harbor for research by either: 1) preparing the research sought to be paid for with client commissions; 2) being legally obligated to pay for such research, or 3) by directly paying for such research (even if not legally obligated to pay) and taking steps to assure itself that the commissions that the manager directs it to pay for such research is used only for eligible brokerage and research. The Release enumerated the several factors to help determine if the executing broker-dealer has “provided” research when it is not legally obligated to pay the research preparer: 1) the broker pays the research preparer directly; 2) the broker reviews the description of the services to be paid for with client commissions and looks for red flags that they are beyond the scope of the safe harbor; 3) the broker agrees with the money manager to use client commissions only to pay for items that are eligible under the safe harbor; and 4) the broker develops and maintains procedures to document payments for research and pays for such research promptly. Documentation such as evidence of payments and the items purchased will help to demonstrate compliance. Although brokers are not required to have written agreements documenting a legal obligation to pay for third party research, soft dollar addenda or other agreements documenting such a commitment would greatly facilitate compliance for both brokers and their money manager clients.VIII. Commission Sharing Arrangements The SEC clarified the requirement that the broker-dealer receiving

(Continued on page 10)

Page 10: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

10NSCP Currents September/October 2006

585 / 387-9000

Professional Services For:

Investment Advisers

Investment Companies

Broker-Dealers

190 Office Park WayPittsford NY 14534

Just imagine...a truly targeted email review system.

All channels, All policies, All proven...

www.orchestria.com

commissions under the safe harbor also “effect” the transactions for which the commissions are paid, by significantly broadening what it means to “effect” a securities transaction. A broker-dealer can meet this requirement by executing, clearing, or settling the trade. In addition, a broker-dealer can meet the requirement by performing at least one of the four functions listed below and taking appropriate “steps to see that the other functions have been reasonably allocated” to another broker-dealer: 1) taking financial responsibility for customer trades until the clearing broker-dealer has received payment; 2) making or maintaining records relating to customer trades required by the SEC and SRO rules, including blotters and memoranda of orders; 3) monitoring and responding to customer comments concerning the trading process; or 4) generally monitoring trades and settlements by the executing broker. Brokers receiving commissions in soft dollar transactions should document that all brokers receiving a portion of the commissions are performing at least one of these functions. However, it may be difficult to document that another broker is monitoring client trades or client comments on trading (the last two items on the list). At the very least, brokers should consider including in any clearing agreement a clause that requires the research-producing broker to perform the specified functions or to ask for certification or an assurance letter from that broker that it is performing such functions.IX. Conclusion The more things change, the more they stay the same. In many ways, the “new” soft dollar rules are not so new. The general framework for analyzing eligibility for soft dollars remains the same – the safe harbor applies only when the money manager uses eligible “research” or “brokerage” under Section 28(e)(3) to provide “lawful and appropriate assistance” in making investment decisions after making a good faith determination that the amount

of client commissions paid is reasonable relative to the value of the product or service obtained. The Release seeks to set forth some clear standards for the safe harbor, but, outside a few key areas, they do not differ significantly in application from the SEC’s prior guidance. However, even though the rules are now clearer, compliances with the rules remains as difficult as ever. Moreover, because the Release is the SEC’s most definitive statement on soft dollars in twenty years, compliance with the rules is ripe as a target area for upcoming SEC examinations and enforcement proceedings. Therefore, compliance professionals would be wise to err on the side of caution, to learn from one another, and to keep abreast of evolving industry trends and regulatory developments.

1. “Commission Guidance Regarding Client Commission Practices Under Section 28(e) of the Securities Exchange Act of 1934,” SEC Rel. No. 34-54165 (July 18, 2006), 17 F. R. 241 (July 24, 2006). 2. The SEC issued prior releases on soft dollars in 1976, 1986, and 2001, and an Office of Compliance Inspections and Examinations report in 1998, based on an industry sweep examination. In addition, the SEC has brought numerous enforcement actions against firms for violations in their use of client commissions. The National Association of Securities Dealers issued a task force report in 2004, and the United Kingdom’s FSA issued a release on soft dollars in 2005. 3. The Release’s provisions are effective July 24, 2006, but market participants may continue to rely on the SEC’s prior interpretations of Section 28(e) until January 24, 2007. The SEC is seeking comments on commission sharing arrangements under Section 28(e) until September 7, 2006, and may supplement the Release based on comments received.4. The SEC also provided guidance on “mixed use” items. See discussion in section V. below.5. “Commission Guidance Regarding Client Commission Practices Under Section 28(e) of the Securities Exchange Act of 1934,” SEC Rel. No. 34-52635 (Oct. 19, 2005), 70 F. R. 61700 (Oct. 25, 2005).6. See Release n.124.7. Unlike the rest of the interpretative release, which is final, the SEC is seeking additional comments on its new interpretation of commission sharing arrangements and may revise it.

SOFT DOLLARS (Continued from page 9)

Page 11: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

11 NSCP Currents September/October 2006

Compliance Officer’s Primer onSafeguarding Customer Information

By Andrew C. Small

Mr. Small is General Counsel at Scottrade, Inc.in St. Louis, MO and a Member of NSCP’s Board of Directors.

The safeguarding of customer information has become a hot regulatory issue. The SEC staff has identified “identity theft” as one of its four exam priorities for 2006.1 John Walsh, Chief Counsel and Associate Director of the SEC’s Office of Compliance Inspections and Examinations, recently cautioned firms to “[p]ay attention to this [identity theft] issue, a presidential task force is looking at this. We’ll want to see robust protections in place.”2 Further reports have indicated that the SEC launched a sweep exam of broker-dealers, investment advisory firms and mutual fund companies on the identity theft issue.3 In addition to identity theft, there have been numerous stories about firms releasing confidential customer information because of mishandling or oversight. In light of the publicity surrounding this issue, one can expect that regulators will apply significant scrutiny to safeguarding of customer information well into the future. SEC Regulation S-P has required firms to safeguard customer information since 2000. Regulation S-P contains two major parts – a privacy rule and a rule on safeguarding customer information (the “safeguards rule”). The privacy rule focuses on privacy notices, opt-out rights and disclosure restrictions. The safeguards rule deals with the security of customer information. Until recently, the privacy rule received almost all of the regulatory and media attention. However, recent events have shifted interest to the safeguards rule. In the past, safeguarding of customer information has been viewed as a technology issue for IT departments to handle. With the SEC and other regulators looking more closely at the safeguarding of electronic information, Compliance Officers, whether they like

it or not, will be drawn into dealing with safeguarding issues. This article gives Compliance Officers a quick summary of the SEC’s safeguards rule, provides tips on developing/revising safeguarding policies and procedures and highlights some of the key questions that one should expect the SEC or other regulators to ask in a safeguards rule examination. SEC Regulation S-P Safeguards Rules Compliance Officers expecting the Regulation S-P safeguards rule to provide them with detailed instructions on how to safeguard customer records and information will be disappointed. The Regulation S-P safeguards rule restates the safeguarding provisions of the Gramm-Leach-Bliley Act of 1999 (GLBA).4 The SEC’s safeguards rule requires broker-dealers, investment companies, and SEC registered investment advisers to adopt written policies and procedures that contain administrative, technical, and physical safeguards to protect customers’ nonpublic personal information.5 Nonpublic personal information includes identity information such as name, address, phone number, social security number, financial information and credit scores.6 It also includes a customer’s portfolio information, including balances, positions, transaction history, and other information about a customer’s account. The other details provided by the safeguards rule specify that the required policies and procedures must be reasonably designed to: 1) insure the security and confidentiality of customer records and information; 2) protect against any anticipated threats or hazards to the security or integrity of customer records and information; and 3) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

As initially adopted, the safeguards rule did not require explicitly firms to have their policies and procedures in writing. The SEC closed this gap at the end of 2004. The SEC amended Regulation S-P to require explicitly that safeguarding policies and procedures be in writing by July 1, 2005.7 The SEC’s approach to the safeguarding of customer information gives firms the ability to decide for themselves what policies and procedures they need to comply with the safeguards rule. However, this principals-based approach presents the overworked Compliance Officer with the daunting task of deciding where to start the process. Instead of starting from scratch, Compliance Officers can look to the Banking Agencies’ and the FTC’s safeguards rules for additional insights on how to develop the necessary policies and procedures. While these agencies rules’ do not apply to broker-dealers, investment companies and SEC registered investment advisers, they do provide a helpful analytical framework and practical recommendations to help develop policies and procedures. The Banking Agencies issued joint regulations entitled Interagency Guidelines Establishing Information Security Standards (Bank Guidelines) around the same time the SEC came out with Regulation S-P.8 The Bank Guidelines go beyond policies and procedures and require banks, thrifts and credit unions (referred to collectively as “banks”) to develop and implement an “Information Security Program.” Like Regulation S-P, the Bank Guidelines do not dictate specific bright line safeguarding rules. Rather, the Bank Guidelines specify the processes that banks should implement to safeguard customer information on an ongoing basis. To develop an Information Security

(Continued on page 12)

Page 12: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

12NSCP Currents September/October 2006

Program, a bank must perform a five step analysis. First, the bank assesses the risks that may threaten customer information. This requirement assumes that the bank already has determined where and how its customers’ information is being stored and used throughout the firm or at a third-party service provider. Once this analysis is complete, the second step develops procedures to manage and control these risks. Third, the Program must be evaluated periodically and adjusted when necessary. Fourth, a bank must oversee third-party service providers to make sure that the third party is adequately safeguarding customer information. Lastly, a bank’s board is required to receive Information Security Program updates on a regular basis. The Bank Guidelines provide further details on each step in the process, which are summarized as follows: • Risk Assessment - A bank must determine what it has to safeguard by: a) identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information; b) assessing the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information; and c) assessing the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks. • Manage and Control Risks - The second step requires a bank to mitigate the identified risks by: a) designing information security programs to control the identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of the bank’s activities; b) training staff to implement the information security program; c) testing regularly the key controls, systems and procedures of the information security program; and d) developing, implementing, and maintaining, as part of its Information Security Program, appropriate measures to properly dispose of customer

information. • Adjustments to the Program – A bank must evaluate whether adjustments to the Program are necessary on an ongoing basis. The factors to take into consideration in evaluating the Program include relevant changes in technology, the sensitivity of the customer information, internal or external threats to the information, and the bank’s own changing business. • Overseeing Third Party Providers - If a bank either uses a third-party service provider or is considering a third-party service provider with whom it would share customer nonpublic information, the bank is required to: a) exercise appropriate due diligence in selecting these service providers; b) ensure its service providers agree in a contract to implement appropriate measures designed to meet the objectives of the bank safeguards rule; and c) monitor its service providers to confirm that they have satisfied their contractual obligations. As part of this monitoring, a bank should review audits, summaries of test results, or other equivalent evaluations of its service providers.• Board Oversight - The last element of the Information Security Program requires that an annual security report be provided to the bank’s board that summarizes the overall status of the Program. The report should discuss material matters related to its Program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations, management’s responses, and recommendations for changes in the Information Security Program.Implementing Policies and Procedures The Bank Guidelines provide an excellent roadmap for compliance with the safeguards rule that Regulation S-P itself does not provide. The FTC provides further guidance, including specific recommendations to assist firms in the development and implementation of effective security procedures.9 Several of the FTC recommendations that firms should consider adopting include:• Employee Procedures – Conducting background checks of employees who

have responsibilities for or access to customer information; training employees on safeguarding so that employees can avoid inadvertent or unauthorized disclosure of customer information (e.g. using laptops, PDAs, cell phones and Wi-Fi; e-mailing; disposing of customer data properly; avoiding deception by pretext calls);10 and segregating job duties and putting in place job controls.• Data Procedures – Maintaining information security throughout the life cycle of customer information, from data entry to data disposal by knowing where and how confidential customer information is processed and stored. Data procedures should include ensuring only authorized employees have access to customer information; storing records in a room or cabinet that is locked when unattended; ensuring that information stored on PCs, servers and other computer storage devices or systems is accessible only with a “strong” password and is kept in a physically-secure area. Data procedures should include procedures for creating backup records and keeping backup data secure by storing it off-line and in a physically-secure area. • Physical Access Restrictions – Restricting physical access to customer information to authorized individuals with specific provisions for building, area and workplace locations. • Technical Access Controls – Implementing appropriate access controls on customer information systems, including controls to authenticate and permit access only to authorized individuals and controls to prevent employees from providing customer information to unauthorized individuals who may seek to obtain this information through fraudulent means. • Traditional Information Security – protecting, through both procedures and technologies, against loss, destruction or alteration of customer data, including firewalls, back-up procedures and facilities, intrusion prevent/detection systems, server-based technical safeguards, system modification protocols and change management, application development standards, system logging and monitoring,

SAFEGUARDING (Continued from page 11)

Page 13: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

13 NSCP Currents September/October 2006

(Continued on page 14)

network security, and system security architecture. • Customer Education – educating customers about threats and cautioning them against transmitting sensitive data, like account numbers, via e-mail or in response to an unsolicited e-mails or pop-up messages. In addition to regulatory guidance and recommendations on how to develop a security program, real-world examples help to develop and improve policies and procedures. The following list details the types of data breaches that have occurred at firms, educational institutions, the military and local, state and federal government units since September 2005:11 • Lost or stolen laptops, desktop computers or other computer storage devices.• Employees stealing information or allowing access to confidential information. • Backup tapes lost in transit.• Hackers breaking into systems. • Information obtained by third-party fraud. • Internal security failures – pretext calling.• Phishing, Viruses, Trojan Horses and computer security loopholes. • Improper Disposal of Customer information.• Breaches at third-party service providers. As one might expect, many of the issues dealing with safeguarding of customer information are technical in nature. Technical jargon and IT speak can be confusing, or even intimidating, to many. However, as illustrated in the examples above, the majority of breaches do not deal with highly technical issues. These breaches deal with issues that Compliance Officers address on a day-to-day basis – errors, omissions and dishonesty. However, Compliance Officers still need to work closely with members of their IT departments to develop the firms’ safeguarding procedures. When it comes to certain compliance issues, the Compliance Officer is not always the subject matter expert. The trader, the portfolio manager, the product specialist or, in this case, the information

security analyst typically have a greater understanding of the complexities and nuances of their specialty areas. Still, it is the role of the Compliance Officer to focus on the big picture to keep the safeguarding process on track. If a Compliance Officer is not careful, the focus of safeguarding efforts may turn into an exercise in the implementation of security technologies instead of the realization of the firm’s true goal. The Banking Guidance, the FTC’s recommendations and the examples of real-life data breaches should give Compliance Officers the tools needed to develop customized safeguarding policies and procedures for their firms. Additional resources are available on the BankersOnline website. These resources include information security checklists, worksheets, risk assessment matrices, sample contract provisions and draft policies & procedures for safeguarding of customer information in a bank environment.12 Safeguarding Examinations The following list offers direction on possible requests for information and questions that your firm may receive from a regulator in the course of safeguards rule exam:• A copy of the firm’s written policies and procedures on safeguarding customer information. • A copy of all customer complaints dealing with safeguarding of customer information or fraud. • A copy of any risk assessment, audit, third-party tests and other reviews dealing with safeguarding of customer information or fraud. • A copy of your privacy policy and/or your customer agreement if it discloses how your firm says it will safeguard customer information.• A copy of informational materials (e.g. e-mails, statement stuffers) that informed customers about the risks of certain practices, including online activity, online security practices and Internet fraud.• A copy of each report that your firm uses to monitor for identity theft, wire fraud or unauthorized account activity.• A copy of the relevant provision from

Need to make compliance simpler?Deloitte can help.

©2004 Deloitte & Touche LLP.

www.deloitte.ca

For more information contact:

Karen ByrnesFirm Director, Regulatory Risk(416) 601-6268

Karen IrwinSenior Manager, Regulatory Risk(416) 601-6522

Lawrence, Kamin, Saunders &Uhlenhop, L.L.C.

Lawrence, Kamin, Saunders &Uhlenhop, L.L.C. specializes in securities and futures regulationand litigation and has representedmembers of the securities industryand futures industry for over 60years.

Lawrence, Kamin, Saunders &Uhlenhop, L.L.C.

208 South LaSalle StreetSuite 1750

Chicago, Illinois 60604(312) 372-1947www.lksu.com

Just imagine...a truly targeted email review system.

All channels, All policies, All proven...

www.orchestria.com

Page 14: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

14NSCP Currents September/October 2006

SAFEGUARDING (Continued from page 13)

each contract that the firm has with the third-party service providers with whom the firm has provided nonpublic customer information.• A copy of the due diligence report for each of the third-party service provider with whom the firm has provided nonpublic customer information.• A copy of all documentation that shows the last time that the firm reviewed, and if necessary updated, its information security practices and procedures.• A copy of employee training materials on safeguarding customer information and evidence that relevant employees have received training.• A statement identifying all known instances of security breaches at the firm.• A statement identifying the person who oversees the firm’s safeguards rule compliance and third-party service provider arrangements to ensure compliance with the firm’s policies.• A statement that describes whether supervisors monitor phone calls for compliance with security and privacy laws and policies.• A statement that describes the controls used to prevent employees from providing information to unauthorized individuals. • A statement that describes the access controls to the firm’s customer website. The above suggestions are by no means comprehensive. Like the other information provided, these ideas should be helpful in developing the necessary policies and procedures. A final note – this article is only meant to be a primer on the SEC’s safeguards rule. It does not encompass all aspects of safeguarding customer information. There are many other laws and issues relating to safeguarding of customer information that are beyond the scope of this article.13

1. Remarks Before the June 16, 2006 ALI-ABA Conference on SEC/NASD Compliance as reported in BD Week, June 26, 2006, pp 1-2.2. Id.3. SEC Scrutinizes Firms for Vulnerability to

Hackers, Investment News, June 26, 2006.4. Lofchie’s Guide to Broker-Dealer Regulation (2005 Edition), pp. 259-2605. The SEC safeguards rule does not apply to private investment companies (such as hedge, buyout, private equity, venture capital and other private funds), state registered or private investment advisers. The Federal Trade Commission’s Privacy Rules apply to these types of firms. 6. A “customer” is a “consumer” who has a continuing relationship with the securities firm. A “consumer” is an individual (or an individual’s legal representative) who obtains a financial product or service from the securities firm that is to be used primarily for personal, family or household purposes.7. At the same time, Regulation S-P was also amended to incorporate a provision in the Fair and Accurate Credit Transactions Act of 2003 (FACTA) that set forth requirements for securities firms dealing with the disposal of consumer credit reports and records.8. The agencies’ notice appears on pages 8616–41, Vol. 66, No. 22 of the Federal Register dated February 1, 2001.9. Financial Institutions and Customer Data: Complying with the Safeguards Rule at www.ftc.gov/bcp/online/pubs/buspubs/safeguards.htm 10. Pretext calling is a method of impersonation that fraudsters use to obtain biographical and account-related information. An Office of the Comptroller of the Currency Advisory Letter on identity theft and pretext calling is available at: http://www.consumer.gov/idtheft/pdf/id_advisory_letter.pdf#search=%22pretext%20calls%22. 11. A chronology of data breaches made public since September 2005 is available at: www.privacyrights.org/ar/ChronDataBreaches.htm 12. These resources are available at http://www.bankersonline.com/tools/tools.html under the category Information Security. 13. These include but are not limited to: 1) State breach notification laws; 2) the Fair Credit Reporting Act; and 3) FTC cases against firms for false claims and deceptive acts or practices (company privacy policies said that firms had employed certain safeguards but in fact the companies did not have these safeguards in place).

Visit our Web site formore information.

Hugh M. Makens616.752.2117

[email protected] B. Hansen

[email protected]

Melvin G. Moseley, Jr.616.752.2177

[email protected]

www.wnj.com

Save these 2007 Meeting

Dates!

West Coast Los Angeles January 29

Southern Atlanta

February 26

Canadian Toronto

March 26

East Coast NewYork

May 7

Midwest Chicago June 4

National Washington, DC October 17, 18, 19

Page 15: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

15 NSCP Currents September/October 2006

A Letter to the Membership: Roundtable OpportunitiesBy Judy B. Werner

Do you ever wish you knew some of your peers in your local area so you had someone to call for tips regarding a new business line your firm was considering? Do you wish you had the opportunity to get to know your local regulators better or hear their thoughts on current topics? Perhaps you should find or build a local networking group in your area. While there are roundtable groups that have been formed around the U.S. and Canada, I will focus on the group in my area – Philadelphia – since it has been both successful and long-standing. The Philadelphia Roundtable group was formed more than 10 years ago and currently has more than 150 members. The group holds meetings twice a year and many members also maintain contact throughout the year using the group listing that is circulated to the membership. When we are planning our meetings, we select a current hot topic and invite a panel of speakers selected for that topic. Most recently, we had a meeting to discuss ERISA and focused on new LM-10 requirements. We had an SEC branch chief, two Department of Labor speakers, a law firm partner specializing in ERISA matters, and General Counsel of the Investment Adviser Association (IAA (formerly ICAA)). At the meeting last fall, we discussed advertising and focused on GIPS requirements. The speakers at that meeting included an SEC branch chief, a law firm partner specializing in advertising matters, and a partner from Ashland Partners, a performance verification firm. While this group probably seems very impressive for a local grassroots organization, we did have a much smaller beginning. Amy Yuter, Senior Compliance Officer of Old Mutual Asset Management and a former NSCP board member, thought it would be useful to have a local network of her peers, so she looked at the NSCP member list to find

other members in her area and invited about ten compliance officers to her office for lunch. Then she picked a few topics to discuss, asked the local SEC office to send a representative to speak, and brought in a service provider to speak to the group as well. After the topics were covered, she asked the regulator to leave so that the group had the opportunity to speak freely about any topics. I believe anyone with strong leadership skills could use this model to start their own group. In the early years, the group met twice a year and members took turns hosting at their respective offices. When the roundtable was first formed, I thought that we had success getting regulators to speak because the group has a number of former regulators who were calling on friends to get SEC speakers, but that does not appear to be the case. I have discussed the possibility of this model working in other areas with the Philadelphia SEC office staff and was strongly encouraged that other SEC branches would welcome invitations to speak from other local roundtable groups. Not surprisingly, given the recent formation of the SEC CCOutreach Program, the branch offices are interested in opportunities to meet and speak with members of their local communities. Having strong leadership is essential to keeping a roundtable group going since it is easy to think someone else will do all of the work. In Philadelphia, we have been lucky enough to have Ms. Yuter, who is persistent and has always found someone to help out with the next meeting. I know that has not always been easy. This is a challenge that seems to have led to the demise of some grassroots groups, but if a group has someone (or even better a group of people) willing to take the lead, this can work. There has never been a membership fee to belong to our group or to attend meetings and we are always looking for new members. When we attend conferences, we mention the roundtable if we have the opportunity and review the attendee list to find new people in our area to invite to our meetings. Because we were successful

in finding new members, the group size expanded and it became more difficult to find a member to sponsor our meetings, since few of us had sufficient meeting space in our offices for the group. A few years ago, Ms.Yuter worked out an arrangement with Ballard Spahr Andrews & Ingersoll, LLP, her prior firm’s outside counsel, to host our meetings every six months. Ballard provides conference room space, lunch, presentation material copies, and a firm partner to speak on the selected topic for each meeting. This help from Ballard has made the commitment from our group member sponsoring the session much more manageable. The member who volunteers to sponsor the roundtable is asked to help select the topic for the meeting, manage the membership list until the next meeting sponsor is found, send invitations to the meeting, and collect responses from the members. During the roundtable session of each meeting, we ask another member to volunteer to complete the sponsor duties for the next meeting We are very grateful for all of the assistance that we receive from Ballard Spahr; but I think this is a mutually beneficial relationship, and they are pleased to have a group of clients and potential clients in their office for these meetings. I suspect that any law firm with an investment practice would welcome the opportunity to help a networking group with this type of meeting.

Due to the success experienced in a few places around the U.S. and Canada and the interest that NSCP believes their membership has in this type of networking, the organization would like to assist members in finding existing roundtables in their area and help with the start up of new roundtables where none exist currently. With this in mind, we are planning to make opportunities for attendees at the National Meeting in October to locate others in their area who would like to network with their local peers. We hope you will join us to make this effort a success.

Ms. Werner is Chief Compliance Officer at Gardner Lewis Asset Management, L.P. in Chadds Ford, PA and a Member of NSCP’s Board of Directors.

Page 16: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

16NSCP Currents September/October 2006

NEW MEMBERSDeborah Slocum Weaver C. Barksdale & Associates, Inc. Brentwood, TNCarl Pierleoni Guardian Trust Company, FSB New York, NYJacqueline Prekelezaj Arden Asset Management LLC New York, NYLinn Thompson Analytic Investors, Inc. Los Angeles, CACarlos Gutierrez JWIC Global Consultants New York, NYRodrigo Crafa Banco Bilbao Vizcaya Argentaria New York, NYRebecca Phillips Worsham & Simmons, LLC Atlanta, GAPhil Cecil INVESCO Institutional (N.A.), Inc. Atlanta, GAJerrold Kopsa M&T Securities, Inc. Cheektowaga, NYKevin Fisher Northwest Financial, LLC Herndon, VAJeff Childs ITG New York, NYJennifer Mogavero Head and Associates Portland, MEMax Grefig Provident Trust Company Waukesha, WILibby Liebig HarbourVest Partners, LLC Boston, MADavid Makowicz ING Clarion Real Estate Securities, L.P. Radnor, PAPeter R. Knapp Navellier & Associates, Inc. Reno, NVMonica Grady Armstrong Shaw Associates Inc. New Canaan, CTTerence Doherty Stikeman Elliot LLP New York, NY

Steve Youhn M Financial Group Portland, ORKenneth Ottenbreit Stikeman Elliott LLP New York, NYDonald G. Charles Asset Management Group of Bank of Hawaii Honolulu, HIJoanne Tsai Board of Investment Trustees, Montgomery County Government Rockville, MDMaria J. Boyer Middleburg Financial Corporation Leesburg, VACary Schatz AIG Retirement Services, Inc. Los Angeles, CAKathleen Olesinski Allegiant Asset Management Cleveland, OHKimberly Novak McCormack Advisors International, LLC Cleveland, OHMichael Isaac J.P. Turner & Company LLC Atlanta, GALynn L. Dyer John Hancock Financial Services Boston, MAPatricia Fries Cornerstone Management Inc./Financial Advisory Consultants Norcross, GAJose Flores Pioneer Investment Management, Inc. Boston, MATim Minneman Strategic Wealth Management, Inc. Mercer Island, WAChris Pahl AIG SunAmerica Woodland Hills, CAAndrea Mihlhauser Parkcentral Capital Management, L.P. Plano, TXKureyn Watson Linsco Private Ledger San Diego, CALeilani Sanders Hall AARP Financial Incorporated Washington, DC

Holly Cavalier McDonald Investments, Inc. Cleveland, OHRebecca Frost J.B. Hanauer & Co. Parsippany, NJRobert Carroll Golden Capital Management LLC Charlotte, NCPatrick Smetek Sunbelt Securities Houston, TXSonja Commer Snyder Capital Management, L.P. San Francisco, CANatalie Marshall Private Capital Management Naples, FLCheri Nakamura Prospect Asset Management, Inc. Honolulu, HITimothy A. Kelly Bank of America Charlotte, NCChristopher Kopka Thrivent Financial for Lutherans Minneapolis, MNMike Bauder Harbert Management Corporation Birmingham, ALMichelle Gottwald Chevy Chase Financial Services Bethesda, MDPaola Cicerone Signator Investors, Inc. Boston, MALinda Paullin-Hebdin Warner Norcross & Judd LLP Southfield, MIGeorge W. Mann, Jr. Cantella & Co., Inc. Boston, MAStephen T. Clayton Tremont Group Holdings, Inc. Rye, NYGina M. Hornbogen Results One Financial, LLC Elmhurst, ILRobert J. Smith Smith + Riley Baltimore, MDChris Riley Gryphon Networks Corp. Norwood, MA

Page 17: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

17 NSCP Currents September/October 2006

Non-Cash Compensation — Best Practices

By V. Aileen Farrales1. Introduction Conflicts of interest is an area in which regulators require heightened scrutiny by broker-dealer firms, and such conflicts are most evident when related to non-cash compensation matters. Non-cash compensation payments/arrangements from approved product sponsors to registered representatives (“RRs”) may create a potential conflict of interest for the firm and/or the RR. The conflict is created because the product sponsor hopes to induce RRs to sell their products. When a product sponsor pays for a RR to attend an event or accept any other type of non-cash compensation payment/arrangement, the RR may be lured to act in their own personal interests rather than those of his or her client. For RRs, issues related to non-cash compensation are complex and confusing to understand; therefore, it is critical for broker-dealer firms to clearly address their non-cash compensation policies in their written supervisory procedures and to educate its registered persons and home office staff on these policies and procedures. By providing more guidance to RRs and home office staff and having a clear structure to the broker-dealer’s non-cash compensation policy, in addition to implementing the policy and training its RRs, home office employees and product sponsors, firms can help minimize their exposure. With the position laid out by the NASD in NTM 06-06, Gifts and Business Entertainment, and NYSE proposing stiffer rules on entertainment spending, broker-dealers must pay close attention to their firm policy, review and approval processes as well as how their firms educate and train their RRs and home office employees. 2. Regulatory Requirements and Best PracticesRequirement: Recordkeeping Requirements

NASD Rules 2710(i)(2)(E), 2810(c)(2)(E), 2820(g)(3) and 2830(l)(3) state that “a member must maintain records of all compensation received by the member or its associated persons...” At a minimum, the records should include the name of the offeror, associated person, and the amount received (or approximate value). NASD Rule 3060(c) indicates that a record must be retained by the member for all payments or gratuities received by the member.Best Practices: Recordkeeping Requirements Firms should develop a policy requiring:• RRs to maintain a current log that identifies the date the gift/benefit was received/given from a product sponsor or client, a description of the gift/benefit, from whom it was received or given to, and the approximate value.• Examples of items that should be maintained on the log are tickets to a sporting event theater or comparable event, gift basket, bottle of wine or box of chocolates.• An exception to the recordkeeping requirement may be promotional non-cash items of nominal value from product sponsors (e.g., coffee mugs, t-shirts, pens, etc).• RRs must maintain their logs for 6 years, 3 years of which must be in an accessible location. Broker-dealers can confirm that such logs are maintained during its branch office inspections.Requirement: Gifts $100 and under NASD Rules 2710(i)(2)(A), 2810(c)(2)(A), 2820(g)(4)(A) and 2830(l)(5)(A) state that “gifts that do not exceed an annual amount per person fixed periodically by the Association and are not preconditioned on achievement of a sales target are permitted.” The current annual amount fixed by the Association is $100. NASD Rule 3060(a) indicates that a member or person associated with a member cannot, directly or indirectly, give or receive anything of value in excess of

$100.Best Practices: Gifts $100 and under The following should be taken into consideration for a firm to determine whether it will allow RRs to accept a gift from a product sponsor:• Gifts received should not exceed $100 in total value, per product sponsor, per calendar year. An example of an acceptable gift is a bottle of wine or box of chocolates as long as the value of the item does not exceed $100. Another example of an acceptable gift is gift certificates valued at $100 or less and cannot be redeemable for cash. The following should be taken into consideration for a firm to determine whether it will allow RRs to accept/give a gift from/to a client:• Gifts received/given should not exceed $100 in total value, per client, per calendar year. An example of a gift is a bottle of wine or box of chocolates as long as the value of the item does not exceed $100,• Gifts to clients for an occasion, such as a wedding or anniversary, may be acceptable as long as it does not raise the question of propriety and the occasion is appropriate. These gifts are not necessarily subject to the $100 limitation. Note: There are two possible scenarios RRs will find themselves in related to gifts and invitations from product sponsors:Scenario #1: A product sponsor wholesaler gives a RR tickets to a basketball game.Scenario #2: A product sponsor wholesaler invites the RR to the basketball game, in which both the RR and wholesaler attend the game together. In scenario #1, since the wholesaler is giving the tickets to the RR, the tickets are considered a gift; therefore, should fall under the $100 gift rule. In scenario #2, the wholesaler has invited the RR to attend a game with him/her; therefore,

V. Aileen Farrales is Compliance Manager at LPL Financial Services and can be reached at (858) 450-9606 or [email protected].

(Continued on page 18)

Page 18: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

18NSCP Currents September/October 2006

this would fall under the “occasional meal, ticket to a sporting event or the theater, or comparable entertainment” rule, which will be addressed in more detail below.Requirement: Occasional Meal, Ticket to a Sporting Event or the Theater, or Comparable Entertainment While NASD Rules 2710(i)(2)(B), 2810(c)(2)(B), 2820(g)(4)(B), and 2830(l)(5)(B) state that an occasional meal, a ticket to a sporting event or the theater, or comparable event or activity are acceptable, the rules do not specify limits on these events. The rules, however, state that an occasional meal, a ticket to sporting event or the theater should not be frequent nor so extensive as to raise any questions of impropriety and should not be preconditioned on achievement of a sales target. For example, dinner at a restaurant followed by a basketball game may be reasonable, while a limousine to and from home, dinner at an expensive restaurant and courtside seats to an NBA final game, may not be reasonable.Best Practices: Occasional Meal, Ticket to a Sporting Event or the Theater, or Comparable Entertainment Based on NASD’s position in NTM 06-06, which proposes to expand Rule 3060 to require member firms to adopt policies and procedures as it relates to business entertainment practices with employees of a customer, it is prudent for the firm to establish dollar amount guidelines within their internal policies for entertainment spending. According to NTM 06-06, members must have written policies and procedures that “determine and define forms of business entertainment that are appropriate and inappropriate, including the appropriate venues, nature, frequency, types and class of accommodation and transportation in connection with business entertainment, and either the dollar amounts of business entertainment or specified dollar thresholds requiring advance written supervisory approval.” The following is an example of guidelines that firms may wish to

provide to RRs and product sponsors as it relates to occasional meals, or any comparable entertainment.Meals, tickets to sporting events or theater, or any comparable entertainment from an approved product sponsor are allowed providing (please note these items should not be confused with the gift rule described earlier):• The value of a single occasion benefit should generally be limited to $300 per RR;• The aggregate value of all such items received from product sponsors should be limited to $1,000 per product sponsor, per calendar year; and• The firm’s policy should expand on who can and cannot attend these types of events. For instance, clients and/or prospective clients cannot be in attendance. By establishing dollar amount guidelines, RRs are held accountable when receiving non-cash compensation from product sponsors. Conversely, product sponsors will have a better understanding of what is expected from the broker-dealer. It also is important for broker-dealers to provide copies of their non-cash compensation policies and procedures to all product sponsors in which they have relationships in order to set expectations among the broker-dealer, product sponsor and RRs. Once all expectations are set, it will help all parties involved understand the importance of these rules and how to comply with them.Requirement: Training and Educational Meetings NASD Rules 2710(i)(2)(C), 2810(c)(1)(C), 2820(g)(4)(C), and 2830(l)(5)(C) allow “payment or reimbursement by offerors in connection with meetings held by an offeror or by a member for the purpose of training or education of associated persons of a member, provided that: (i) the record keeping requirement is satisfied; (ii) associated persons obtain the member’s prior approval to attend...and not preconditioned by the member on the achievement of a sales target...; (iii) the location is appropriate...; (iv) the payment or reimbursement is not applied to the expenses of guests of the associated person; and (v) the payment

or reimbursement by the offeror is not preconditioned by the offeror on the achievement of a sales target...”Best Practices: Training and Educational Meetings Broker-dealers should have written policies in place for product sponsors and RRs related to the approval process of any training/educational meetings that product sponsors host. If possible, the terms should be in the selling agreement. By providing guidance and clarification to RRs and product sponsors in this area, firms can allow for better communication and expectations from all parties. For instance, a product sponsor may want to invite a RR for a training/educational meeting; however, the invitation is extended to only one RR, the RR will be flying over four hours to the product sponsors’ headquarters for a three hour meeting agenda. This may not be appropriate according to NASD rules; therefore, it is prudent to have guidelines adopted and provided to RRs and product sponsors. Firms should consider the following when reviewing its current policies and procedures:• Make clear to the product sponsors that invitations to RRs cannot be extended prior to receiving written approval from the broker-dealer; • Conversely, RRs should understand that they should not accept an invitation from the product sponsor unless he/she has confirmed that his or her broker-dealer has approved the meeting. One way broker-dealers can communicate to its RRs is by posting a calendar on the firm’s website which will show all approved meetings to date;• Product sponsors cannot pay or reimburse for spouses/guests to attend these events or any associated costs with the event; and• Meeting agendas should be reviewed for content and how many hours are scheduled for the meeting.3. Firm Guidelines When establishing non-cash compensation policies and procedures, it is important to identify all departments involved with the review and approval process and formulate procedures that are agreed upon by all departments. This will allow for effective supervision and

NON-CASH COMPENSATION (Continued from page 17)

Page 19: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

19 NSCP Currents September/October 2006

enforcement of the firm’s policies and procedures. Firms should consider creating various forms to help streamline the review and approval process. Some examples of forms that can be implemented include:• Due Diligence Form: A standard form that the firm requires all product sponsors to complete and submit when seeking approval to invite its RRs to a training/education meeting hosted by the product sponsor. The form should request information such as date and location of the meeting, copy of the agenda, and an attestation that this is not pre-conditioned on a sales target and does not extend to spouses or guests.• Product Sponsor Reimbursement Form: A standard form which product sponsors complete and submit when sending a reimbursement check to the broker-dealer on behalf of a RR. (Note: The firm’s non-cash compensation policies should outline acceptable reimbursements by the firm). This form should provide clear instructions to the product sponsor as to where to send the check, the name of the RR and the reason for reimbursement (e.g., approved seminar, marketing expense, etc.). It can be helpful to also add the name of the wholesaler or representative from the product sponsor who made the non-cash compensation arrangement with the RR. In the event there is a questionable reimbursement item, the firm has a contact person with the product sponsor.• Direct Payment Form: A standard form in which product sponsors should complete and submit when paying a vendor directly on behalf of the RR. For instance, if a RR conducts a seminar (approved by the broker-dealer) and a product sponsor has agreed to help defray some of the costs associated with the seminar, such as lunch, the product sponsor may pay the catering company directly. In this case, this direct payment bypasses the broker-dealer and thus is not captured on its books and records. With this form, the broker-dealer will be in a better position to capture and identify these types of non-cash compensation payments.4. Sponsor Guidelines

A. Develop a Relationship with Sponsor Due to the complexities and conflicts of interest non-cash compensation rules pose, it is critical to make sure the broker-dealer, product sponsor and RR are on the same page. Expectations must be met from all parties, and compliance personnel should be hyper-sensitive to potential issues that may arise from non-cash compensation arrangements. The broker-dealer’s review process for reimbursements and training/educational meetings should be very diligent. If an issue arises, and the broker-dealer does not feel comfortable with a meeting hosted by the product sponsor or any type of non cash compensation arrangement with a RR, the broker-dealer should contact the appropriate person at the product sponsor and address the issue. At times, the product sponsor may not realize the type of non-cash compensation arrangements being made by their wholesalers; therefore, they must revisit their policies or give a warning to their wholesalers. 5. Other Factors to Consider Below are other non-cash compensation related areas that broker-dealers should address:CharitiesDonations to an organization that is charitable or philanthropic in nature can be made on behalf of a RR from the product sponsor; however, broker-dealers should have a mechanism in a place to capture this type of non-cash compensation arrangement.Outside Business Activities NASD Rule 3030, Outside Business Activities of an Associated Person, states that “no person associated with a member in any registered capacity shall be employed by, or accept compensation from, any other person as a result of any business activity, other than a passive investment, outside the scope of this relationship with his employer firm, unless he has provided prompt written notice to the member.” With that said, broker-dealer firms should remind their RRs if they are engaged in an approved outside business activity in which they help to solicit financial assistance on behalf

of the organization, it should be clear and distinct from his or her RR responsibilities. The following should be made clear to RRs in the firm’s policies and procedures:• The RRs involvement with an outside activity, such as a charity organization, must be disclosed and approved as an outside business activity by the broker-dealer.• RRs may not solicit such donations/contributions on behalf of the member firm.• RRs’ approved outside business activity must be clear and distinct from his or her RR responsibilities or duties.• The broker-dealer firm’s e-mail, stationery, and business cards cannot be used for use with the outside activity. An example of the above is when a RR is a member of the Red Cross. First, the RRs involvement with the Red Cross must be disclosed and approved by his or her broker-dealer. In the event the RR is asked to help in soliciting donations from local businesses, then the RR must use e-mail or stationery that does not involve or indicate the RR’s broker-dealer name. If the RR solicits donations via e-mail, then the RR cannot use the same e-mail address that he or she uses for his or her securities business. The RR must use a separate e-mail address for purposes of the outside activity.6. Conclusion The premise of non-cash compensation rules is to help ensure that non-cash compensation arrangements between product sponsors and the member firm are not so frequent or so extensive as to raise any question of propriety and cannot be preconditioned on the achievement of a sales target. Additionally, the area of non-cash compensation raises many issues related to conflicts of interest between a product sponsor and broker-dealer firm. Regulators are looking for the broker-dealer’s written supervisory procedures to ensure that the procedures provide for effective supervision and compliance with the rules. Additionally, training and communication to product sponsors, RRs and the home office is key to implementing an effective policy.

Page 20: SEPTEMBER / OCTOBER 2006 CURRENTS NSCP€¦ · NSCP Currents September/October 2006 2 “How to Avoid Getting Sued by Your Customer” An interactive power point presentation, explained

NSCP Currents September/October 2006

Richard T. ChaseLisa D. Crossley

Patricia M. HarrisonMichelle L. Jacko

Clifford KirschElizabeth M. Knoblock

NSCP CURRENTSis published by the

National Society of Compliance Professionals, Inc.22 Kent Road, Cornwall Bridge, CT 06754

(860) 672-0843 / [email protected]

NSCP Board of Directors

Charles R. LowryDavid H. Lui

Diane P. NovakHenry Sanchez, Jr.

Theodore J. SawickiTimothy M. Simons

Andrew C. SmallHolly Smith

Cathy TuckwellKathleen VanNoy-Pineda

Judy Babb WernerMichael K. Wolensky

Joan Hinchman, Executive Director, President and CEO

Editor & LayoutFrederick D. Vorck, Jr.

Editor Joan Hinchman

AR E YO U R E ADYTO DO BUS I N E S S IN A

PE R I LO U S WORLD ?

What you don‘t know about your clients, p ro s p e c ts and employees can hurt you, business and your country.

For more info r m a tion or a bro c h u re, call or vi s it our we b s it e

I n t e r n a tional crime, corruption and terrorism haves pawned a dangerous new era for businesses of all kinds.C o m p ly with stringent new government regu l a ti o n s ,

or be branded an accomplice t og l o bal tre a c h e ry and face seve re penalti e s.

I n fo r m a tion is your best defense.

The federal government has re s p o n d e d to these t h re a ts with the O f fice of Fo re i gn As s e ts Control ( O FAC ),and the new ly enacted USA PATR I OT Act. Both sets of rules impose an obligation on affected businesses tota ke affi r m a tive steps to ve r i fy the identities of theirc l i e n ts. The penalties of non-compliance are seve re .MIS can help you abide to the rules, avoid fines, ke e pyou in compliance and out of court.

McDonald Info r m a ti o n S e rvi ce, I n c .S E RVI NG ALL FAC E TS OF THE FINANC IAL SERVICES INDUSTRY

MIS BU I L D I NG215 14t h STR E E T, JERSEY CITY, NJ 07310

p. 201- 6 59-26 00 212-227- 4645 f. 201- 6 59-0130w w w. ca l l m i s . c o m