orldox GX3 Cloud for Financial Services Worldox GX3 Cloud Compliance Outline The Best of both Worlds. / Whenever. Wherever.

Transcription

1 Award-winning Document Management / Whenever. Wherever. orldox GX3 Cloud The Best of both Worlds. Worldox GX3 Cloud Compliance Outline for Financial Services May 2013

2 Table of Contents Table of Contents... 1 Compliance Overview... 3 Opening Statement... 3 Compliance for Broker Dealers and Broker Dealer Members a Storage Requirements... 4 WORM and WIP Storage... 4 Verification... 4 Serialization... 5 Downloads... 5 Immediate Access... 5 Facsimiles and Scanning... 5 Duplicate Storage... 6 Organization and Indexing... 6 Audits... 6 Duplicate Indexes CFR Part 240 Retention Requirements Year Retention Period... 6 Record Preservation... 7 Accessibility... 7 Reports and Examinations... 7 Unusual Activity... 7 Rules 31a-2 and for Investment Companies and Investment Advisors... 8 Electronic Format... 8 Storage Requirements... 8 WORM and WIP Storage... 8 Prevention of Data Loss, Alteration and Destruction... 8 Legibility... 9 Limited Access... 9 Document Sharing and Printing... 9 Data Center and Local Storage Facilities

3 2-Year Record Retention Record Format and Conversion Conclusion

4 Compliance Overview In an effort to ensure strict recordkeeping and document management within financial institutions, the SEC and FINRA require financial services firms to follow compliance requirements for documents and s, such as: - SEC Rules 17a-3 and 17a-4 for Broker-Dealers 1. See Compliance for Broker Dealers and Broker Dealer Members. - SEC Rule 17 CFR 240 retention requirements 2. See 17 CFR Part 240 Retention Requirements. - SEC Rules 31a-2 and for Investment Advisors 3. See Rules 31a-2 and for Investment Companies and Investment Advisors. These compliance regulations were created to protect investors and prevent fraud and illicit changes to files. Opening Statement With the introduction of Worldox GX3 Cloud solution, World Software and its managed hosted provider Rackspace are responsible for technology to ensure documents are non-modifiable and non-erasable by the user. This document sets out to address most of the rules associated with protecting and storing documents. As rules and compliance regulations do change periodically, we recommend you confirm that World Software s procedures and processes meet the requirements for your individual practice. This document is meant to be an outline of major rules we have researched and may not be all inclusive, or final guidance for the advisor or broker

5 Compliance for Broker Dealers and Broker Dealer Members 17a Storage Requirements WORM and WIP Storage WORM (Write Once Read Many) Storage. Once written, data cannot be changed. WIP (Work in Progress). Unfinished documents waiting to go to production. Worldox stores finalized records in a manner that prevents the records from being overwritten, erased or otherwise altered utilizing Worldox proprietary technology that is intrinsic to the system. Although the hardware storage medium used (e.g., magnetic disk) is inherently rewriteable, the integrated codes intrinsic to the system prevent users or administrators from overwriting records that are flagged for WORM behavior. The codes used by Worldox ensure that the flagging of a document for WORM behavior is a permanent, one-way operation once flagged as WORM, there is no way for the user or administrator to modify that version of the document or to change the document back to non-worm behavior. To facilitate revisions to a document that has been marked as WORM, the user may check out a local Work in Progress copy of the document. When the user checks the WIP copy of the document (with changes) back into the live document repository, the new contents are automatically saved as a new version and that new version has WORM behavior. All previous versions are retained in their exact original form. Verification (17a-4(f)(2)(ii)(B) Verify automatically the quality and accuracy of the storage media recording process. The intent of this rule is to provide some level of confidence that the record has actually been stored. The Worldox solution has been in place for over two decades helping law firms and financial service firms file and find their records and documents. Worldox technology monitors the successful writing of these records and upon successful save, date stamps and writes detail to the Worldox audit trail which can be accessed at any time to review historical status. If for some reason the network connection was severed during a save, the record would maintain locally and continue to rewrite the record until successful. Desktop notifications of offline records/documents will occur also. 4

6 Serialization 17a-4(f)(2)(ii)(C) Serialize the original and, if applicable, duplicate units of storage media, and timedate for the required period of retention the information placed on such electronic storage media. Worldox serializes the records by assigning a unique document number to each saved record within Worldox. Worldox maintains a fully redundant data center. All records saved via Worldox GX3 Cloud are written to our geographically disbursed data centers. Firms can choose a local shadow option to keep a local copy of records on a small server within your office. Any desired retention policy can be set for these records saved via Worldox GX3 Cloud. Downloads 17a-4(f)(2)(ii)(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member. All records are searchable using Worldox s powerful search and index technology. Any record, record set or index can be exported to an external device such as CD, DVD or hard drive. Immediate Access 17a-4(f)(3)(i) At all times have available, for examination by the staffs of the Commission and selfregulatory organizations of which it is a member, facilities for immediate, easily readable projection or production of micrographic media or electronic storage media images and for producing easily readable images. At a client s written authorization, a third-party user account can be established to allow temporary access to the records for an examiner, for example. All activity for this third party will be written to an audit trail record. The client may also download requested records and the accompanying index to save to an alternative storage device to provide to an examiner. A letter of undertaking will be furnished by World Software upon a client s request. Requested data will be retrieved within hours. There is a $250 fee per incident. Facsimiles and Scanning 17a-4(f)(3)(H) Be ready at all times to provide, and immediately provide, any facsimile enlargement which the staffs of the Commission, any self-regulatory organization of which it is a member, or any State securities regulator having jurisdiction over the member, broker or dealer may request. It is the client s responsibility to ensure that the record is scanned properly and legibly when saving via Worldox. The client can batch print records from Worldox at any time. 5

7 Duplicate Storage 17a-4(f)(3)(iii) Store separately from the original, a duplicate copy of the record stored on any medium acceptable under Rule 17a-4 for the time required. Worldox maintains a fully redundant data center so all records are written to our geographically disbursed data centers. A local shadow option is also available to keep a local copy of records on a small server within your office. Any desired retention policy can be set for these records. Organization and Indexing 17a-4(f)(3)(iv)(A) Organize and index accurately all information maintained on both original and any duplicate storage media. To facilitate rapid searching and retrieval, indexes of all document meta-data (i.e. document name, author, client, dates, etc.) are maintained in both the primary and secondary facilities. Audits 17a-4(f)(3)(iv)(A) At all times, a member, broker, or dealer must be able to have such indexes available for examination by the staffs of the Commission and the self-regulatory organizations of which the broker or dealer is a member. At any time a member, broker, or dealer can print an index or audit trail information and make such a report available to an examiner. Direct examiner access can be made available either by written client s request or by legal order. Duplicate Indexes 17a-49f)(3)(iv)(A) Each index must be duplicated and the duplicate copies must be stored separately from the original copy of the index. Original and duplicate indexes must be preserved for the time required for the indexed records. All documents and indexes are mirrored in a second Worldox facility. The client sets the retention period of the documents via Worldox s retention module. Once set, retention rules may only be modified by a Worldox administrator. 17 CFR Part 240 Retention Requirements 6-Year Retention Period Every member, broker and dealer subject to a-3 shall preserve for a period of not less than six years after the closing of any customer's account any account cards or records which relate to the terms and conditions with respect to the opening and maintenance of the account. Providing the client has maintained a record of the account opening and closing dates, upon account closure at the client s discretion, they may search for applicable records within Worldox to mark such 6

8 records for deletion. All records will be tamper-proof and archived. Worldox cannot control native format future compatibility of all record types for native application access. However, the Worldox viewer technology does keep all backward compatibility so all prior record formats could be viewed through the Worldox viewer. Record Preservation Every member, broker and dealer subject to a-3 shall preserve during the life of the enterprise and of any successor enterprise all partnership articles or, in the case of a corporation, all articles of incorporation or charter, minute books and stock certificate books (or, in the case of any other form of legal entity, all records such as articles of organization or formation, and minute books used for a purpose similar to those records required for corporations or partnerships), all Forms BD ( of this chapter), all Forms BDW ( a of this chapter), all amendments to these forms, all licenses or other documentation showing the registration of the member, broker or dealer with any securities regulatory authority. A Worldox document type can be set up for these document types with no expiration date. Accessibility Every member, broker and dealer subject to a-3 shall maintain and preserve in an easily accessible place: All account record information required pursuant to a- 3(a)(17) until at least six years after the earlier of the date the account was closed or the date on which the information was replaced or updated. Worldox is in two mirrored data centers. The Worldox GX3 cloud solution would allow access from anywhere with a small download and appropriate rights. Different periods of retention policies can be set. Reports and Examinations Every member, broker and dealer subject to a-3 shall maintain and preserve in an easily accessible place: Each report which a securities regulatory authority has requested or required the member, broker or dealer to make and furnish to it pursuant to an order or settlement, and each securities regulatory authority examination report until three years after the date of the report. A Worldox document type can be set up for these document types with a three-year expiration date. Unusual Activity Every member, broker and dealer subject to a-3 shall maintain and preserve in an easily accessible place: All reports produced to review for unusual activity in customer accounts until eighteen months after the date the report was generated, written advertisement never released to the public, and made available to SSR (Short Sale Restrictions), and all compliance, supervisory, and procedures manuals, including any written procedures for reviewing communications. 7

9 A document type or workspace can be set up for these document types with an eighteen-month expiration. Rules 31a-2 and for Investment Companies and Investment Advisors Electronic Format Funds and advisors may keep all of their records in an electronic format. Amendment to Rule 31a-2 and 204-2) All records including can be saved as tamper-proof within Worldox. Security can be applied to records so that only certain users or no users can modify them. Storage Requirements WORM and WIP Storage WORM (Write Once Read Many) Storage. Once written, data cannot be changed. WIP (Work in Progress). Unfinished documents waiting to go to production. Worldox stores finalized records in a manner that prevents the records from being overwritten, erased or otherwise altered utilizing Worldox s proprietary technology that is intrinsic to the system. Although the hardware storage medium used (e.g., magnetic disk) is inherently rewriteable, the integrated codes intrinsic to the system prevent users or administrators from overwriting records that are flagged for WORM behavior. The codes used by Worldox ensure that the flagging of a document for WORM behavior is a permanent, one-way operation once flagged as WORM, there is no way for the user or administrator to modify that version of the document or to change the document back to non-worm behavior. To facilitate revisions to a document that has been marked as WORM, the user may check out a local Work in Progress copy of the document. When the user checks the WIP copy of the document (with changes) back into the live document repository, the new contents are automatically saved as a new version and that new version has WORM behavior. All previous versions are retained in their exact original form. Prevention of Data Loss, Alteration and Destruction Reasonably safeguard the records from loss, alteration or destruction. (Rule 31a , Part 270, Part 275) The Worldox GX3 Cloud solution utilizes geographically dispersed data centers to protect against data loss or destruction. In addition, the firm may opt to maintain a local backup. 8

10 When a user deletes a document in Worldox, the file is not actually deleted. Instead, it is moved to the Salvage Bin. The file then resides in the Salvage Bin until retention rules determine that it can be purged from disk. Files can be recovered from the Salvage Bin at any time (i.e. if the file is needed for a compliance audit, or if a user inadvertently deletes a file that they need to restore). Note that the ability to restore files from the Salvage Bin may be restricted on a per-user basis. Files that are not covered by a retention rule will get purged according to a configurable setting in the indexer scheduler. All Work in Progress (WIP) documents have unique IDs and are locked while editing to prevent a peer write over. A detailed audit log tracks user activities associated with each record. Legibility Ensure that electronic copies of non-electronic originals are complete, true, and legible in the medium and format in which it is stored. (Amendment to Rule 31a , Part 270, Part 275) Worldox recommends financial service firms save in universally acceptable PDF format and verify for legibility in the case of scanned records. Limited Access Limit access to the records to authorized personnel, the Commission (including its examiners and other representatives), and (in the case of funds), fund directors (Rule 31a , Part 270, Part 275)) Advanced ethical walls can be deployed to limit access to certain areas of the document repository. At a client s written authorization, a third-party user account can be established to allow temporary access to the records for an examiner, for example. All activity for this third party will be written to an audit trail record. The client may also download requested records and the accompanying index to save to an alternative storage device to provide to an examiner. Document Sharing and Printing Funds and advisors may be requested by the Commission to promptly provide legible, true and complete copies of records in the medium and format in which they are stored, and printouts of such records; and means to access, view, and print the records. (31a-2, 204-2; Part 270, Part 275) Advanced ethical walls can be deployed to limit access to certain areas of the document repository. At a client s written authorization, a third-party user account can be established to allow temporary access to the records for an examiner, for example. All activity for this third party will be written to an audit trail record. The client may also download requested records and the accompanying index to save to an alternative storage device to provide to an examiner. Documents are loaded in their native applications such as Adobe, Microsoft Word, and Excel. All printing functions can be performed from within those applications. 9

11 Data Center and Local Storage Facilities Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed. (Part 270, Part 275) Worldox maintains a fully redundant data center so all records are written to Worldox s geographically disbursed data centers. A local shadow option is also available at the client s option to keep a local copy of records on a small server within your office. Retention rules may be set within Worldox to preserve records. Document retention is the Document Management System s mechanism for disposing of documents when they are no longer needed. In Worldox GX3 Cloud, you can: Enable the retention feature at your site. Enable specific profile groups/fields for retention rules. Create retention rules; these define which documents are eligible, how they are to be handled and when. Optionally, define secondary locations for archiving (optional). Perform retention runs to physically move or remove documents based on retention rules. (Test runs and previews can be done first, before actually moving or deleting files.) Find and restore archived files. The two retention actions possible in Worldox are to: Archive documents by moving them from primary storage into separate storage archives. Arrange for the system to delete files from the Salvage Bin based on retention rules only. A user may not delete files from Worldox. Only a pre-set retention rule may delete files. 2-Year Record Retention Funds and advisors who retain records electronically must preserve them in an easily accessible place for the first two years. 4 Maintained records can be easily accessed for two years or more. Record Format and Conversion Funds and advisors who choose to convert records into an electronic format must do so in the same fashion as they already keep electronically created or received records Final Rule: Electronic Recordkeeping by Investment Companies and Investment Advisers, 17 CFR Parts 270 and

12 It is the client s responsibility to ensure that all electronic records are maintained in a readable format (e.g. PDF format). The rules standards are flexible and permit funds and advisors to modify their electronic record retention practices to take advantage of advances in electronic storage technology.4 Clients will have 24/7 access to their documents. Worldox maintains the software and security of the records and Rackspace manages the physical hardware. Conclusion Worldox GX3 Cloud offers the same powerful document management solution that is being used in hundreds of financial organizations with the Worldox GX3 Professional on-premise solution. Worldox GX3 Cloud offers key benefits such as: 1. Eliminating onsite hardware and storage servers. 2. Reducing technical support requirements. 3. Handling all patches and updates including server upgrades in the cloud at no extra charge to you. 4. Server backup, co-located data, and redundancy are built in. 5. Access from anytime, anywhere with an available Internet connection. 6. Minimal upfront cost of acquisition; instead pay a consistent monthly fee. References U.S. Securities and Exchange Commission: SEC Final Rules, World Software Corporation 266 Harristown Road, Suite 201 Glen Rock, NJ