IT Compliance Regulations

The Securities and Exchange Commission set a new annual record with its filing of 147 enforcement actions against investment advisors and investment companies this year. In his blog, Adam Bullock of Smarsh reports that “broker-dealers also saw the impact of SEC oversight more in 2012 than in 2011, with 134 enforcement actions (a 19 percent increase year-over-year). The SEC totaled 734 enforcement actions, one short of the record set in 2011.” The penalties resulting from the record-setting 735 enforcements last year came in at $2.8 billion.

It is not surprising that compliance professionals in the financial services industry are increasingly focused on establishing policies to mitigate risks. Included in those policies are best practices for electronic recordkeeping that encompasses not only email, but also other forms of messaging like social media.

If Bullock is correct in his assumption that the SEC will continue the trend toward more enforcement activities in 2013, then beginning the year off with an exercise to prepare for a SEC examination might be time well spent.

According to Smarsh Founder and CEO, Steve Marsh, the company’s 2012 Electronic Communications Compliance Survey found that the top message types requested during SEC examinations were (in order) email, website pages (including RSS feeds, blogs, wikis),Bloomberg or Reuters messages, and instant messages (IMs).

One of the top concerns for compliance professionals is the growing use of smartphones and tablets. Mobile-specific communications, like text messaging, has potential to be outside the scope of current compliance practices. Of the compliance professionals that participated in the survey, 72 percent were concerned about new communication channels (including text messaging and social media) and 63 percent were concerned about new communication devices.

This year the SEC published guidelines for investment advisors that use social media that included Facebook, Twitter and LinkedIn. This recognition by the SEC that social media adoption is happening within the financial services industry signals a possible addition in typical message types during an exam in the future.

As Marsh says, “It is the content of the communication that determines its status as a business record, not the communication channel itself.”

Marsh’s Navigating the New Regulatory and Compliance Landscape: Electronic Recordkeeping offers a quick review of key SEC electronic recordkeeping requirements. The New Year might be good time to establish an annual review of messaging compliance practices and policies. If the SEC does come to call, Bullock notes that firms should expect just five to 10 days advance notice.