FINRA

Financial Services, Social Networking, and FINRA

Stephanie Jordan — Thu, 15 Sep 2011 04:41:01 +0000

Last month FINRA (Financial Industry Regulatory Authority) issued Regulatory Notice 11-39 to provide “guidance on social networking Web sites and business communications” for financial firms and brokers.

Regulatory Notice 11-39 is intended as a response to growing questions in regards to the application of January 2010 Regulatory Notice 10-06’s rules about communications with the public on social media sites as it pertains to recordkeeping, content requirements, and general compliance.

Stephen Marsh, founder and CEO of Smarsh, offered his take on the significance of last month’s announcement: “FINRA 11-39 is significant in that it adds more context and detail to FINRA’s approach to social media and personal devices which was originally laid out in 10-06. The biggest takeaway for broker-dealers is that it’s about the message – not the medium. If the message is business-related, then it doesn’t matter if it’s a tweet, a text from your personal BlackBerry or an email from your work computer – you must retain, retrieve and supervise it.”

According to a recent Smarsh survey, while 70% of respondents reported that their compliance policy addresses the use of email for business purposes, less than half have policies to address other forms of electronic communication, such as instant messaging (45%), text messaging (35%), LinkedIn (47%), Facebook (42%) and Twitter (34%).

“FINRA 11-39 is just the latest reminder to firms that they need to take a proactive approach to manage their compliance obligations and minimize the risks that come with these new communications channels,” says Marsh.

Even if your organization is not in the financial services industry, it is well to be aware of these best-practices as set forth by the agency and consider incorporating elements into your company’s communication policies.

Electronic Communications Compliance Gaps Found in Financial Services Industry, Especially for Social Media, Mobile

Stephanie Jordan — Wed, 25 May 2011 20:38:02 +0000

At FINRA’s 2011 Annual Conference this week, new survey results of compliance professionals in the financial services industry found extensive compliance gaps exist in electronic recordkeeping and supervision, particularly for new communication tools such as social media and mobile messaging.

Smarsh, the company behind the survey, believe the results reaffirm the challenges that compliance officers face in today’s demanding regulatory environment. The results of the survey revealed the growing burden of compliance on firms, with nearly 70 percent of respondents reporting that the resources (both time and money) spent on electronic communications-related compliance increased in the past year and 98 percent expecting those resources to increase or stay the same in the next 12 months.

“We conducted this research to better understand what compliance officers really think about their electronic communication compliance practices and examination experiences,” says Stephen Marsh, CEO and founder of Smarsh. “Whether it’s managing the obligations from new regulations like Dodd-Frank and FINRA Regulatory Notice 10-06 or dealing with the growing consumerization of IT, compliance officers must keep pace, or else leave their firms open to a myriad of risks.”

New Messaging Channels
When asked, respondents demonstrated an accurate understanding of their compliance obligations related to electronic communications; however, a gap exists between what they need to do to comply with these regulatory requirements and what they are actually doing. This disparity was particularly evident with new communications channels, including social media, where policies and systems to monitor and preserve messages from social networking web sites like Twitter, LinkedIn and Facebook were significantly less prevalent than those for email. For example, while three-quarters of respondents (75%) acknowledged their regulatory obligation to preserve and monitor social media communications, less than half (42%) had a policy in place and less than one-third (32%) actually retained and supervised those messages.

The company notes that the impact of this gap is reflected in the level of confidence respondents have when it comes to demonstrating compliance. Eighty-seven percent of respondents were mostly or completely confident in their ability to provide requested emails within a reasonable time frame. In contrast, less than half (46%) had minimal or no confidence in their ability to provide requested social media and mobile messaging data.

The full survey report is available for download.

Social Media Compliance

Stephanie Jordan — Mon, 28 Feb 2011 06:00:00 +0000

The popularity of social media and the demands it places on IT organizations can be looked at from a variety of angles: bandwidth, productivity, security, etc. But don’t forget to also think about how it affects compliance obligations. What are the requirements from a regulatory standpoint?

Last month marked the one-year anniversary of FINRA (Financial Industry Regulatory Authority) issuing rule 10-06 regarding social media and Web 2.0 communication for regulated companies. Even if FINRA rules do not apply to your organization, good practices can still be learned from them.

Just about everyone is witnessing consumer communications applications being brought into organizations by end-users. For heavily regulated organizations this is especially concerning because of compliance regulations. The use of social media sites and blogs for business was not directly covered by earlier rules, and as a result firms pro-actively approached FINRA staff asking for guidance. The response last year (known as Regulatory Notice 10-06) shows how the FINRA rules governing communications with the public apply to social media sites that are sponsored by a firm or its registered representatives.

Rule 10-06, among other things, confirms that firms are required to retain records of communications related to business made through social media sites. Archiving (and security) vendors either have or are working on technology that will integrate social media into archiving solutions. One such vendor is Smarsh. “We’re seeing a significant and growing number of customers adopt our social media compliance solutions, but there are still many companies that prohibit social media to avoid the perceived complexities of compliance,” observes Stephen Marsh, CEO and founder of Smarsh. “By attempting to prohibit social media, firms are both ignoring its tremendous business benefits and facing increased risk by failing to recognize that their employees are likely using these tools in some form.”

According to the Marsh, regulatory enforcement is expected to increase over the next year. Sweep letters issued from the SEC (The Securities and Exchange Commission) suggest further scrutiny of social media, and FINRA is increasingly requesting information about social media usage and oversight during examinations.

Another vendor also expanding its solutions to encompass social media compliance is FaceTime Communications, who recently announced it’s taken a new corporate name: Actiance specifically meant to reflect its “focus on ‘active compliance’ for next generation communications in the enterprise.”

Actiance launched new capabilities in 2010, adding support for Facebook, LinkedIn, Twitter and multiple UC and collaboration applications. “Our business has always been about providing active compliance and security, from our heritage in the world of instant messaging to our support of Unified Communications and social networking,” says Kailash Ambwani, CEO of Actiance. “As the Internet has changed and the communications profile of the enterprise has evolved, so has our platform.”

History has shown us that other types of industries benefit from the best practices of heavily regulated industries. It might be worth a read of the FINRA 10-06 guideline, just to be educated on their approach and expectations.

David Mario Smith of Gartner Research has stated that he believes that “by 2014, social networking services will replace email as the primary vehicle for interpersonal communications for 20 percent of business users.” Smith also predicted that new employees will enter the workforce with a predisposition to communicate via social networks, and that he expects most companies will build out internal social networks and/or allow business use of personal social network accounts.

He made that prediction prior to Facebook’s Social Inbox announcement. We have said this before: email is not going away, but make no mistake, social media is definitely requiring us to take a look at all the messaging pieces that require managing, securing and yes, compliance too.

Archiving Challenges and Priorities: Apply Lessons Learned from a Regulated Industry

Stephanie Jordan — Thu, 31 Dec 2009 19:11:26 +0000

Compliance with SEC and FINRA electronic communication mandates has driven significant growth in the message archiving market, and the sophisticated needs of this audience have, in turn, accelerated technological development. All indications for 2010 suggest the expansion of regulatory oversight to more businesses, as well as more sophisticated obligations for those already managing compliance initiatives.

Electronic communication compliance obligations are bound together by themes of risk management and mitigation, transparency and consumer protection. These issues span all industries, regulated or not, and virtually every business benefits from litigation or eDiscovery preparedness efforts.

With that in mind, what are some of the message archiving challenges and priorities in financial services for the year ahead, and what can businesses of all stripes learn from their most-regulated peers?

Test your system, produce your data. If your company needs to produce messages from the archive for compliance or litigation purposes, make sure that system performance measures up to expectations. Technology has in many ways changed the definition of “reasonable” when it comes to the time period allotted for data production. Test your archiving system or service provider, so that when necessary, you can confidently and efficiently produce requested data sets with specific search criteria from the archive.

Social media cannot be ignored. Social media’s emergence as a communication tool is providing great value and benefit to businesses, but does not come without legal or reputational risk. FINRA has created an internal task force on social networking that will “explore how regulation can embrace technology advancements in ways that can improve the flow of information between firms and their customers without compromising investor protection.”

The lesson here is simple: these tools are growing in popularity, they’re going to be used by your employees, and your company had better be prepared. At a minimum, implement a policy to govern usage of social media at your company.

Enforce and evaluate your policies. Policy by itself is virtually useless without enforcement. Oversight of employee usage of the corporate email system, instant messaging and social media channels is absolutely critical to manage and mitigate risk. Message archiving technology enables companies to monitor and automate policy enforcement with systematic precision.

In the coming year, FINRA members will need to be more prepared to demonstrate the effectiveness of their electronic messaging compliance policies. Solutions need to document oversight, providing a comprehensive audit trail of every action taken within the system. This serves as evidence of message review and illustrates policy enforcement. It also fosters accountability among multiple managers tasked with message review.

Are your system supervision procedures uncovering problematic employee behavior, and if so, what is being done to address it? The data from a comprehensive auditing system should be quantifiable and will lend empirical insight into whether a policy is working as designed. If not, fine-tune your policies with appropriate adjustments.

Finally, it should come as no surprise that the protection of consumer data has emerged as a top consideration for regulators, and applies to every facet of business operations. FINRA is looking for member firms to implement, enforce and evaluate policy dedicated to protecting consumer data at rest and in-transit. From the FTC Red Flags Rule and state laws, to the growing risk of financial and reputational damage that occurs with data breaches, organizations must implement policy and enforcement procedures to protect against inadvertent or malevolent disclosures of confidential customer data.

—

Stephen Marsh built Smarsh into a premier email archiving and compliance vendor, helping companies in the strictly-regulated financial services industry satisfy SEC and FINRA regulatory obligations. Prior to founding the company, Steve led product management and development efforts at CCBN, now a division of Thomson Financial, a market leader in investor relations communications services. He also gained experience working at both Fidelity Investments and Morgan Stanley Dean Witter.