[1] This Client Alert summarizes key takeaways from the conference for the benefit of our Firm’s broker-dealer and investment advisor clients.
Regulatory Reviews of Business Continuity Planning
On March 19, 2020, a member firm received a Business Continuity Plan (“BCP”) document request from the Office of Compliance Inspections and Examinations (“OCIE”). Why would the OCIE issue a BCP document request now, when it is certainly aware that firms are struggling to adjust to the current extraordinary and unprecedented business environment—including city-wide orders limiting workforce mobility, state-mandated business closures, furloughed and terminated employees, and remote access to business systems? Indeed, the regulators themselves are largely performing their functions remotely, and the SEC has instituted a temporary moratorium on on-site field work.
The answer to “why now?” is that the SEC wants to put the industry on notice that it is continuing to conduct exams. The SEC is signaling that it remains vigilant even as it shifts to examination methods that comport with a “black swan” health crisis.
The SEC is cognizant, however, of the constraints placed on firms as they cope with the Covid-19 outbreak. Noting that no existing BCP fully anticipated the broad and severely restrictive measures required to protect public health during this pandemic, Peter Driscoll, Director of the OCIE, advised that the SEC has instituted policies that afford firms relief in responding to SEC enquiries without enforcement consequences.
Firm executives and CCO’s should expect to receive BCP and other similar requests, but the SEC staff is now looking to engage in an “interview process,” a dialogue that will allow firms to discuss identified problem areas with the staff. Written responses and the production of firms’ books and records will not be required. Rather, through a series of Q&A’s, firms will be expected to describe how they have addressed business planning issues that have arisen and discuss the measures taken to protect the firm and its employees and clients.
Being prepared for conversations with the staff is critical. Firms should be ready to explain in reasonable detail the successes and failures of their current BCPs, the reasons why procedures and policies implemented in accordance with those plans did not perform as expected, and the facts and circumstances of how the pandemic has affected their ability to function and continue. We recommend that firms task a designated employee with maintaining contemporaneous notes or memoranda of BCP actions taken in response to this crisis and how firms’ responses evolve over time in order to communicate effectively and credibly with the staff. After the passing of this crisis, these notes and memoranda will be a critical record of how existing BCPs performed during this “stress test” and will become a basis for revising BCPs in order to addresses any plan weaknesses that were revealed.
FINRA Enforcement Actions: Lessons from the 2008 Financial Crisis
Robert Kaplan (Ascensus CCO) and Brian Rubin (Partner, Eversheds Sutherland LLP) discussed what FINRA’s Enforcement Actions in the wake of the 2008 Financial Crisis might portend for priority Enforcement Actions as the financial fallout from the Covid-19 pandemic continues to unfold.
Kaplan and Rubin highlighted FINRA’s attention to critical “warning signals” that could lead to FINRA inquiries and the issues that FINRA was particularly concerned about.
For firms that faced liquidity events during the Financial Crisis, FINRA scrutinized both firms’ management of those events and relevant communications with clients. In particular, FINRA looked at whether such communications were accurate and timely, whether risk disclosures were adequate, and whether any opinions offered by firms or firm representatives in client communications had a reasonable basis in fact.
Firms should expect that after the Covid-19 financial crisis, FINRA will take a strong interest in issues such as cross trading, preferential redemptions, and the fairness of prices and executions. We also expect to see a renewed focus on client disclosure and consent issues and firms’ supervisory policies, practices, and performance.
We recommend that firms stress the importance of adhering closely to firm policies and procedures and to all regulatory requirements as this crisis takes its course—departures from policies, procedures, and regulations will draw particular scrutiny. Firms should also be mindful that FINRA will look closely at whether a firm’s internal documents are consistent with employee conduct and with any defensive posture that a firm takes during an examination. Accordingly, in the event of a FINRA examination, a review of relevant documents is critical before deciding on and committing to a defensive strategy.
Practical Considerations for CCO’s
Responding to the current crisis and the regulatory environment likely to emerge after public health concerns recede will place a premium on a knowledgeable, skilled, and effective compliance function. CCO’s and senior management should pay careful attention to whether their firms’ compliance groups are adequately prepared to meet these challenges.
In particular, we recommend that CCO’s be satisfied that they can affirmatively answer the following questions:
- Does my compliance group have a team mentality that encourages interaction among its members and stresses transparency? Compliance departments with employees that operate in silos invite problems that escape notice and lead to misalignment in policy supervision and enforcement. Human interaction and clarity regarding supervision and enforcement are critical.
- Does my compliance group know when to escalate issues, both internally and externally? A well-functioning compliance group needs to be confident in its judgment, including the judgment that it cannot address a problem that has arisen without enlisting senior management or, as appropriate, outside counsel.
- Does my compliance group have the ability to identify and understand key facts? Does it have the knowledge base and analytical skill to put those facts in context, identify risks, and assess potential regulatory consequences? A compliance group needs to have both motivation and skill to stay on top of the myriad risks that arise in extraordinary circumstances like the Covid-19 pandemic. Senior management must be confident that the group is thinking proactively about potential issues in order to head off bigger problems.
- Does my compliance group have skilled communicators? A compliance group cannot properly fulfil its role if it cannot help employees understand why firm policies and procedures are important and help motivate employees to follow them.
- Does my compliance group practice good business hygiene? Following sound document retention policies and procedures becomes critical when problems do arise and can help persuade regulators of a firm’s interest in being regulatory-compliant.
Key Takeaways and Conclusions
The March 23, 2020 NSCP webinar highlighted that firms need to be both mindful of present compliance issues and alert to the possibility that regulatory enforcement may intensify as the public health dangers recede and the financial fallout from the crisis widens. Key takeaways from the webinar include
- Be prepared with facts regarding your firm’s responses to this crisis and with circumstances supporting requests for extensions to answer regulatory requests—initial communications with a firm’s SEC examination team leader or FINRA coordinator are critical, and regulators will be sympathetic given the emotional and physical tolls that this crisis is taking on everyone in the industry.
- Follow your current BCP to the best of your recovery team’s ability, even though it likely did not anticipate the magnitude or combination of the health and economic crises we are currently facing; identify and document gaps that emerge; prioritize gap remediation according to risk severity; and conduct “after action” evaluations to enhance BCPs once the initial crisis has passed, focusing on consequences to clients, employees, and critical departments.
- Task skilled members of your response team as early as possible with prioritizing gaps and drafting plans to address them, drawing upon regulatory guidance and disclosures by other firms and industries.
- Invest the time and effort now to ensure that your compliance group and crisis management team have the skill sets and experience necessary to meet the challenges currently facing them and that will arise in the weeks and months after the most immediate phase of the crisis has passed.
- Stress the importance of following your firm’s policies and procedures and of escalating problems that arise quickly and appropriately.
[1] See www.sec.gov/sec-corona-virus-covid-19-response for the SEC’s recent guidance and www.finra.org/rules-guidance/key-topics/covid-19 for FINRA’s.
