Compliance Solutions FOR BROKER-DEALERS. Archiving the financial services world. message archive search message archive search message archive search

Transcription

1 message archive search message archive search message archive search Compliance Solutions FOR BROKER-DEALERS FINRA & SEC Requirements and Global Relay Solutions for Electronic Communications Recordkeeping & Supervision Archiving the financial services world SEC Rule 17a-4 FINRA Rule 4511 FINRA Rule 3110

2 WELCOME AND THANK YOU for your interest in Global Relay s Broker-Dealer messaging compliance services. We are confident that you will find that our Broker-Dealer compliance solutions exceed your expectations. COMPLIANCE is more than just the preservation of records to ensure that your firm can survive regulatory, audit and evidentiary scrutiny. It s a matter of Reputation, Integrity, and Control. The stakes are high and they are tied to the prosperity of your firm. The compliance burden should no longer be thought of as solely a back office or IT matter. It should involve proactive decision-making on the part of senior management to choose a high quality compliance solution to efficiently retain, protect, manage and ensure authenticity of records and to implement safeguards and internal supervisory controls against inadequate data management practices. Selecting a message archiving solution should be thought of as an investment in your firm s future, both in terms of risk reduction and overall firm image. GLOBAL RELAY S TECHNOLOGY SOLUTIONS reflect best practices standards that have become the benchmark for message management. Our Broker-Dealer technologies, Global Relay Archive and Compliance Reviewer, are specifically engineered to provide a total regulatory and legal compliance solution for firms subject to the regulatory compliance requirements of the SEC, FINRA, CFTC, and SROs such as CHX and the CBOE. Our services provide reliable, cost-effective and scalable message management and compliance solutions that: are implemented within hours, with no software or hardware requirements or other capital outlays are continuously and seamlessly updated to meet current technological, legal and regulatory needs provide end-user tools, including mobile apps for iphone, ipad, Blackberry and Android KNOW YOUR VENDOR As the developer, owner and operator of our technology, we have provided message archiving solutions since 1999 without a single incident of data loss. Each year, we engage KPMG to perform independent testing and validation on our business, operational and security controls and report upon findings. KPMG also conducts independent security penetration testing procedures on our Internet-facing systems and applications. This comprehensive third party validation, available upon request, is a unique differentiator in the hosted messaging industry. Further, our Broker-Dealer compliance solutions are more than best-of-breed technology. We are a dedicated team of professionals with the highest synergy of business, technical and legal expertise. With 24x7x365 IT support, full-time in-house compliance lawyers, and professional Audit & ediscovery and Data Services teams, we help our customers on a daily basis troubleshoot and resolve key IT and business issues, as well as play a mission critical role in your equation for achieving corporate excellence. We will provide your firm with a superior balance of technology, service, support, training, and affordability to efficiently assist you in meeting regulatory, audit, corporate governance, discovery requests and other business needs. YOUR COMPLIANCE SOLUTION will be tailored, without extra cost, to fit the needs of your firm, whether it is an independent business with outsourced or a single server environment, or a multinational enterprise with disparate and messaging systems (i.e. multiple servers/multiple platforms). Call Global Relay at or visit us at and let us demonstrate how our bestof-class solutions will make the difference in winning you as a customer. Yours truly, Shannon Rogers President & General Counsel

3 TABLE OF CONTENTS Global Relay Archive Assisting Broker-Dealers in Meeting Their Electronic Recordkeeping, Supervision, and Data Protection Requirements Services at a Glance Recordkeeping Requirements Supervision Requirements Legal Compliance Filings & 3rd Party Downloader Global Relay Technical Solutions for SEC Rule 17a-4, Records to be Preserved by Certain Exchange Members, Brokers and Dealers FINRA Rule 4511, Books and Records General Requirements FINRA Rule 3110, Supervision Global Relay Archive: Controls and Features Compliance Reviewer: Controls and Features For More Information Please refer to the following Global Relay publications: Global Relay Services Guide: a complete overview of all Global Relay compliance, message archiving, support, and professional services. Global Relay Compliance Solutions Guidebooks: additional publications detailing how Global Relay addresses the message archiving and compliance needs of: SEC Regulated Firms (Investment Advisors, Hedge Funds & Private Equity) CFTC Regulated Firms FCA (UK) Regulated Firms Canadian Financial Firms (IIROC & MFDA) Health Care (HIPAA) Public Companies (Sarbanes-Oxley) Enterprises Available upon request KPMG Report on Global Relay s Business, Operational and Security Controls: provides assurances and transparency into the high standards of Global Relay s internal controls, and how these truly differentiate Global Relay SOC audit reports on Global Relay s two mirrored east/west coast data centers Also Refer to the Following FINRA Documents, Which Can be Found Online: FINRA Manual: Release No Electronic Storage of Broker-Dealer Records: FINRA Regulatory Notice Consolidated Supervision Rules: new_rulebooks/f/i/finranotice_14_10.pdf 1

4 SERVICES At-A-Glance Global Relay Archive Securely captures and preserves , instant messaging (AOL, MSN, Yahoo!, GoogleTalk), mobile messaging, Bloomberg, Thomson Reuters, CME/Pivot, ICE/YellowJacket, social media (LinkedIn, Twitter, Facebook), web pages and more. Check with Global Relay if you need to archive a message type that is not listed here. Compliance Reviewer Complete message supervisory system that is configured to enforce and monitor your supervisory policies and procedures. Audit and ediscovery Solutions are readily accessible within Global Relay Archive, providing efficient online tools for collaboration, case management and responses to legal data requests. Global Relay Search Provides users with 24/7 anywhere access to their messages via BlackBerry, iphone, ipad, Android, Outlook and the Web. Global Relay Message Global Relay s flagship messaging and unified collaboration communications service, designed to address the messaging, federation, compliance, privacy and security needs of firms in regulated industries. Global Relay Message is currently in Beta. Global Relay services are presented in three pillars : message archive search Global Relay Message Secure, fully compliant messaging platform Services Secure with spam and virus filtering, shared calendars and contacts Continuity Message Hub Federate your Microsoft OCS/Lync with Thomson Reuters Messaging In-house, Hosted Exchange, Zimbra, Notes, Google Apps and more web Access messages anytime, anywhere Search across all message types Easily Reply, Reply All, Forward and Recover messages SAML enabled 2

5 SUMMARY OF REQUIREMENTS Recordkeeping Significance of Rules In recognition of the explosive growth of , instant messaging, and now social media as principal business communication tools, the Securities and Exchange Commission (SEC) has adopted stringent amendments to the Securities Exchange Act of 1934 Rules 17a-3 and 17a-4 that mandate the preservation and retention of all business related electronic correspondence. These requirements are designed to protect investors from misrepresentation and fraud and to prevent record tampering. Additionally, FINRA Rule 4511 cross references SEC Rule 17a-4 in setting requirements for electronic record format, medium and retention periods. Who Must Comply Generally, these Rules are applicable to all persons engaged in trading securities or acting as a broker, including Broker-Dealer firms and registered representatives subject to the SEC and FINRA. Note that SEC Rule 17a-4(b) (4) requires preservation of all correspondence of a Broker-Dealer relating to business as such, which should include the preservation of all electronic communications of a firm s registered representatives, as well as all associated persons to the business. Requirements In connection with electronic communications, firms must: (i) SEC Rule 17a-3 and 17a-4 preserve records of transactions and general securities business, including originals of all communications (incoming, outgoing and internal) related to their business as such ; store electronic records in a non-rewriteable, non-erasable format, the quality of which must be verifiable; store original and duplicate copies of records in separate locations; create and store original and duplicate indexes of electronic records; have an auditing system in place for all electronic records and store audit results; retain records for specified periods (3 to 6 years), the first two years in an easily accessible place; appoint an independent third party to access and download electronic records, upon the request of regulators; and promptly furnish legible, true, complete and current copies of records to regulators. (ii) FINRA Rule 4511 make and preserve books and records as required under the FINRA rules, the Exchange Act and applicable Exchange Act rules; preserve for a period of six years those FINRA books and records for which there is no specified retention period under FINRA rules or applicable Exchange Act rules; and preserve books and records in an SEC 17a-4 compliant format and media. Repercussions of Non-Compliance Firms cannot afford to have a casual attitude toward message management, as the repercussions of non-compliance include internal and/or regulatory disciplinary actions, civil liability, costly penalties, damaged corporate reputation and loss of goodwill. The imposition of fines for electronic communications recordkeeping violations can range into the millions. Global Relay s Solution Global Relay engineered Global Relay Archive to meet SEC and FINRA recordkeeping requirements. Global Relay Archive is a message archiving and compliance system that captures and archives authentic and complete electronic records of all electronic communications of a firm in a secure but accessible system. 3

6 SUMMARY OF REQUIREMENTS Supervision Significance of Rules In response to the ever increasing role of electronic messaging in business, regulators have imposed rules requiring firms to supervise business related electronic communications. Broker-Dealers have historically been subject to NASD Rule 3010, which required the supervision and review of incoming and outgoing correspondence. As part of the FINRA rulebook consolidation process, FINRA has replaced NASD Rule 3010 with new FINRA Rule The new rule, effective December 1, 2014, expands the obligation to supervise and review business related correspondence to include internal communications between employees of the same firm. It also incorporates existing guidance from Regulatory Notice 07-59, including standards for risk-based review of correspondence and internal communications. Who Must Comply Generally, these Rules are applicable to all persons engaged in trading securities or acting as a broker, including Broker-Dealer firms and registered representatives subject to the SEC and FINRA. Requirements In connection with electronic communications, firms must: develop written supervisory policies and procedures for the review of all business-related incoming, outgoing and internal communications; identify, review and address incoming and outgoing communications ( correspondence ) containing customer complaints, instructions, funds and securities, and content of a subject matter that requires review under FINRA rules and securities laws (and conduct risk-based reviews to determine whether additional supervisory policies are necessary for their business); identify and review internal communications of a subject matter that requires review under FINRA rules and securities laws, including communications between research and non-research departments, communications with the public that require pre-approval, identification and reporting of customer complaints, and identification and prior written approval of account name changes or designations regarding customer orders (and conduct risk-based reviews to determine whether additional supervisory policies are necessary for their business); capture, acknowledge, and respond to all written customer complaints; educate and train employees on procedures governing correspondence, and log such training; maintain an audit trail and record of supervisory reviews which includes: the identities of both the author and reviewer(s) of the message, the date of review, and any actions taken; monitor and evaluate supervisory procedures to ensure compliance; prohibit individuals from supervising their own activities; and ensure their supervisory system is not compromised by conflicts of interest. Note: FINRA Rule 2210 includes retail and institutional communications, and correspondence in its requirements regarding communications with the public. FINRA Rule 3130, Annual Certification of Compliance and Supervisory Processes, requires firms to designate a CCO who, together with the CEO, must annually certify to having a process in place to establish, maintain, review, modify, and test policies and procedures reasonably designed to achieve compliance with applicable rules and laws of the SEC and FINRA. Note also that FINRA Rule 3120 (replacing NASD Rule 3012) requires FINRA members to set up an independent supervisory control system to evaluate, test and modify compliance policies and procedures. Global Relay s Solution Compliance Reviewer is engineered to provide Broker-Dealers with a turnkey supervisory system with advanced monitoring, filtering, audit, and ediscovery features. It provides a flexible, easy-to-use, multi-tier supervisory system that can mirror the reporting structure of any size firm, no matter how complex. Firms can supervise and review all electronic communications, including , IM, Bloomberg, Thomson Reuters, social media, and mobile messaging, in a single unified platform. 4

7 LEGAL COMPLIANCE FILINGS & 3RD PARTY DOWNLOADER SEC Rule 17a-4 Global Relay provides a complete best practices compliance solution with respect to the electronic recordkeeping requirements of the SEC, FINRA, CFTC, and SRO s such CHX and CBOE. Our solution includes a Broker-Dealer Legal Compliance Documentation package that simplifies and expedites compliance with SEC Rule 17a-4 and FINRA Rule This package provides: a. SEC Rule 17a-4(f)(2) Documentation and Instructions Two customized legal documents and corresponding compliance instructions relating to each legal document: 1. Legal Direction and Authorization for Third Party Downloader (SEC Rule 17a-4(f)(3)(vii)) This legal document appoints Global Relay as your impartial third party with independent access to, and the ability to download, the archived electronic records of your firm, if required upon request by the SEC or FINRA (this is the third part of the Regulatory Compliance Letter below). 2. Regulatory Compliance Letter (SEC Rule 17a-4(f)(2)(i) and 17a-4(f)(3)(vii)) This legal document provides the required Notification and Representation attesting to Electronic Storage Media Compliance and the Third Party Downloader Undertaking Letter. This Regulatory Compliance Letter satisfies the following regulatory requirements: Electronic Storage Media Notification (SEC Rule 17a-4(f)(2)(i)) Notification to the regulators that your firm is using Global Relay Archive for electronic communications compliance; Attestation to Electronic Storage Media Compliance (SEC Rule 17a-4(f)(2)(i)) Global Relay attests that Global Relay Archive meets the SEC/FINRA compliance requirements set forth in SEC Rule 17a-4(f)(2)(ii)(A)-(D); and Third Party Downloader Undertaking (SEC Rule 17a-4(f)(3)(vii) This letter identifies Global Relay as your impartial Third Party Downloader with independent access to, and the ability to download the archived electronic records of your firm, if required by the SEC or FINRA under SEC Rule 17a-4. b. Global Relay s Compliance Solutions for SEC Rule 17a-4(f)(2)(ii)(A)-(D) In the Representation Letter prepared by Global Relay on your firm s behalf (refer to section a(2)), your firm must attest that it is using a recordkeeping system that satisfies the electronic storage media requirements of SEC Rule 17a-4(f)(2)(ii), conditions (A)-(D). Accordingly, Global Relay provides a summary description of the technology utilized by Global Relay Archive, as it is important that you have a basic understanding of how Global Relay Archive assists your firm in meeting these SEC requirements. Global Relay s technology summary relates to the following: SEC Rule 17a-4(f)(2)(ii)A - Non-rewriteable Non-erasable Storage; SEC Rule 17a-4(f)(2)(ii)B - Message Write Quality & Accuracy Verification; SEC Rule 17a-4(f)(2)(ii)C - Message Serialization of Original and Duplicates; SEC Rule 17a-4(f)(2)(ii)D - Index and Record Downloading. c. Additional Information The Broker-Dealer Legal Compliance Documentation, as described above, is prepared by Global Relay s in-house lawyers. Any questions may be directed to legal@globalrelay.net. 5

8 RECORDS TO BE PRESERVED BY CERTAIN EXCHANGE MEMBERS, BROKERS AND DEALERS SEC Rule 17a-4 Solution Global Relay Archive is specifically engineered to comply with SEC Rule 17a-4, the corresponding Release No Final Rule: Books and Records Requirements for Brokers and Dealers Under the Securities Exchange Act of 1934, and Release No Electronic Storage of Broker-Dealer Records, which set out SEC recordkeeping requirements for incoming, internal and outgoing electronic communications related to a Broker- Dealer s business. The requirements are met as follows: Rule 17a-4 Compliance Requirement Global Relay s Compliance Solutions Preservation Period and Accessibility (a) (b)(4) Every member, broker and dealer subject to Rule 17a-3 shall preserve for a period of not less than 6 years, the first 2 years in an easily accessible place, all records required to be made pursuant to Rule 17a-3(a) (1), (2), (3), and (5). Every such broker and dealer shall preserve for a period of not less than 3 years, the first 2 years in an accessible place: [Lists 11 types of records] in particular, Item 4: originals of all communications received and copies of all communications sent by such member, broker or dealer (including inter-office memoranda and communications) relating to his business as such. Preservation - Global Relay Archive is a cloud-based archiving system for the long-term preservation of, access to, and retrieval of electronic communications. All messages are preserved in Global Relay s two mirrored SOC audited data centers for the length of the retention period specified by the Broker-Dealer firm, ensuring compliance preservation periods are met. Messages are preserved in a non-rewriteable, non-erasable format with write-verification. Access Global Relay Archive exceeds the SEC access requirement by providing easily accessible online access to all archived messages for the entire length of the Broker-Dealer s required 3-6 year retention period (or longer, if determined by the firm). Types of Electronic Communication Global Relay Archive captures and archives a complete set of a Broker-Dealer s incoming, internal and outgoing electronic communications. This ensures compliance with paragraphs (a) and (b)(4) of Rule 17a-4, which require Broker-Dealers to preserve originals of all communications received and copies of all communications sent related to their business as such. Global Relay Archive securely captures, indexes and archives all major message types used in finance. See Global Relay Archive: Controls & Features, Section 1 for a detailed list of supported message types. Other important items to note: Social Media In FINRA s Regulatory Notices Social Media Websites, and Social Media Websites and the Use of Personal Devices for Business Communications, FINRA has stated that social media communications that relate to business as such fall under the recordkeeping requirements of SEC Rule 17a-4. It is the content of a communication that determines whether it must be retained, not the method or medium by which it is distributed. Global Relay Archive for Social Media supports LinkedIn, Twitter and Facebook, automatically capturing and archiving social media communications in context. Mobile Messaging Text and PIN messages related to a firm s business as such much be captured and preserved alongside and other electronic communications. Global Relay Mobile Device Management for Compliance is a state-of-the-art archiving, supervision and ediscovery solution for smartphones that captures text/sms, PIN, call logs, location information, and other data directly from mobile devices. It currently supports Blackberry (BES and non-bes) and Android devices and is ready to support ios devices when Apple publishes the necessary API access. Websites Global Relay Archive for Web preserves websites, blogs and forums and accurately replicates complex interactive elements like Flash, Javascript/ AJAX, video and audio, ensuring that Broker-Dealers can capture these important elements of their business. Legacy Data - Global Relay can import firms existing messaging data into Global Relay Archive, integrating this legacy data with all new messages going forward. Global Relay performs all conversion, quality assurance, import and reconciliation of legacy data in the migration to Global Relay Archive, providing a clean and defensible chain of custody. Firms simply provide their legacy data in an agreed upon standard mail format. 6

9 Rule 17a-4 Compliance Requirement Global Relay s Compliance Solutions Preservation Period and Accessibility (a) (b)(4) (continued) Users Again, Rule 17a-4 requires Broker-Dealers to preserve records relating to their business as such. The industry interpretation of this phrase suggests inclusion of not only records of registered representatives, but also of all associated persons to the business. Note as well that new FINRA Rule 3110 requires firms to supervise the business related activities of each associated person. Spam The industry interpretation of relating to its business appears to exclude spam. Global Relay Archive can filter spam from search results in the event it makes it past a firm s mail server filtering solution. As well, Global Relay offers optional Anti-Spam & Virus Hosted Filtering that can either tag spam so it is not displayed in users inboxes, or quarantine it for review prior to it being deleted (or redirected to the User). Encryption Global Relay Archive uses end-to-end encryption to protect the privacy and confidentiality of archived data. TLS/SSL encryption is employed to ensure the privacy and security of data in transit. Data at rest is protected using dual AES and RSA encryption algorithms. Each incoming message is AES encrypted with a unique, randomly genrated encryption key. Each message s AES encryption key is then encrypted with a 2048 bit RSA public key. The RSA public key is then encrypted with a passphrase encrypted private key. All three keys are kept in separate stores. The encryption (and decryption) process is transparent to users. Audit Trails During the lifecycle of a message, all actions on a message by any user, auditor, or the system itself are logged in an unalterable audit trail that documents the full lifecycle of every message (e.g. when it was imported, the retention term set, by whom it was reviewed and when, etc.). These audit trails verify the integrity of each message and can be viewed by authorized users. Storage Media (f)(1) The records required to be maintained and preserved pursuant to Rule 17a-3 and Rule 17a-4 may be immediately produced or reproduced on micrographic media or by means of electronic storage media (as defined in this section) that meet the conditions set forth in this paragraph and be maintained and preserved for the required time in that form. Global Relay Archive uses electronic storage media that satisfies the applicable conditions set forth in paragraph (f) of SEC Rule 17a-4 (described in more detail in Global Relay s solution for paragraph (f)(2)(ii)(a) below). All messages can be produced immediately online, printed, downloaded, forwarded, and/or restored to a user s inbox. They can also be exported to a standards-based format (e.g. PST). Notification (f)(2)(i) The member must notify its designated examining authority (FINRA) at least 90 days prior to employing electronic storage media. Global Relay s legal compliance documentation package includes the 90-day notification letter to the SEC and FINRA. See Legal Compliance Filings & 3rd Party Downloader for details. Legal Attestation Letter (f)(2)(i) The member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2). Global Relay s legal compliance package includes the required representation letter to the SEC and FINRA attesting that Global Relay Archive assists in meeting the electronic storage media conditions of paragraphs (f)(2)(ii)(a)-(d) of SEC Rule 17a-4. See Legal Compliance Filings & 3rd Party Downloader for details. Record Format (f)(2)(ii)(a) Preserve the records exclusively in a non-rewriteable, non-erasable format Global Relay Archive preserves permanent copies of all messages and attachments in a tamperproof non-rewriteable, non-erasable format with write verification. Archived messages are stored in Global Relay s two mirrored east/west coast SOC audited data centers. Message Write Verification (f)(2)(ii)(b) Verify automatically the quality and accuracy of the storage media recording process Global Relay Archive automatically verifies the quality and accuracy of the storage media recording process as messages and attachments are written to tamperproof storage. Write-verification is done through data comparison. As messages are processed, Global Relay Archive automatically compares the post-processed message with the original message before the original message is deleted. Global Relay Archive also uses a 30-day buffer as an added level of redundancy in the write-verification process. 7

10 Rule 17a-4 Compliance Requirement Global Relay s Compliance Solutions Message Serialization (f)(2)(ii)(c) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media. Global Relay Archive sequentially serializes and time-date stamps each message at the time of import. Any message can be retrieved within seconds by serial number. All messages are replicated in near real time between Global Relay s two mirrored east/west coast SOC audited data centers such that there are always multiple copies of every message preserved. Index & Record Download (f)(2)(ii)(d) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self regulatory organizations of which the member, broker, or dealer is a member. Global Relay Archive full-text indexes all archived messages and preserves both messages and their related indexes for the length of a firm s specified retention period. Global Relay is able to make such data readily available for online access and viewing by authorized users (such as the SEC/FINRA). As well, messages may also be downloaded as EML, forwarded, printed, and restored to user s inboxes. Message Availability (f)(3)(i) At all times have available, for examination by the staffs of the Commission and self-regulatory organizations of which it is a member, facilities for immediate, easily readable projection or production of micrographic media or electronic storage media images and for producing easily readable images. Message Availability - Global Relay Archive stores all messages in their original format. Messages can be retrieved and viewed immediately online using advanced search and ediscovery tools. See 3(a)(iii) of Compliance Reviewer: Controls and Features - for details on search functionality. Users can access Global Relay Archive via web browser, Outlook plug-in, and proprietary mobile apps for iphone, ipad, Blackberry and Android. Online Auditor Access - Global Relay Archive has a special user role for audit purposes called the Ghost Reviewer. Global Relay can set up an account for a third party auditor or regulator which only gives that party access to a customer defined subset of messages (e.g. a folder set up for the audit). The auditor or regulator can then review all of the messages online without his or her actions showing up in the audit trail. Attorney-client privileged, restricted and personal messages can be blocked to prevent viewing by auditors and regulators. Use of the Ghost Reviewer is dependent on the discretion of the individual auditor or regulator, as permissioned by the firm. Message Facsimile (f)(3)(ii) Be ready at all times to provide, and immediately provide, any facsimile enlargement which the Commission or its representatives may request. Again, all messages can be retrieved and viewed immediately online using advanced search and ediscovery tools. Messages may also be downloaded as EML, forwarded, printed, and restored to users inboxes. Note that the term facsimile enlargement is generally associated with information stored on microfilm or microfiche. Message Duplication (f)(3)(iii) Store separately from the original, a duplicate copy of the record stored on any medium acceptable under Rule 17a-4 for the time required. All archived data is replicated between Global Relay s two mirrored east/west coast SOC audited data centers such that there are always multiple copies preserved in geographically dispersed locations. All copies are preserved for the length of a firm s specified retention term. Index Accuracy (f)(3)(iv) Organize and index accurately all information maintained on both original and any duplicate storage media. All messages are full-text indexed with complete metadata, including Subject, From, To, Cc, Bcc, Distribution Lists, and more. There are also some unique but useful metadata fields such as X-headers and IP address. Global Relay Archive supports full-text indexing for the majority of captured attachments, including metadata from image files. All attachments which can be converted to text can be full-text indexed. Index Availability (f)(3)(iv)(a) Each index must be duplicated and the duplicate copies must be stored separately from the original copy of the index. Again, as within the (f)(3)(iv) solution above, Global Relay stores all archived data in two mirrored east/west coast SOC audited data centers, between which there are always multiple copies of every archived message. Index Lifecycle (f)(3)(iv)(c) Original and duplicate indexes must be preserved for the time required for the indexed records. Global Relay Archive employs retention schedules for all original and duplicate indexes and messages. Indexes are retained for the same time period as messages and attachments. The SEC three and six year retention requirements for records set out in paragraphs (a) and (b) of this Rule 17a-4 can be applied to the indexes within the Archive. Note that all retention terms can be extended and Litigation Holds can be applied. 8

11 Rule 17a-4 Compliance Requirement Global Relay s Compliance Solutions Audit System (f)(3)(v) The member, broker, or dealer, must have in place an audit system providing for accountability regarding inputting of records required to be maintained and preserved pursuant to Rules 17a-3 and 17a-4 to electronic stage media and inputting of any changes made to every original and duplicate record maintained and preserved thereby. All messages stored in Global Relay Archive are captured automatically, with no user intervention. All user actions on a message within Global Relay Archive are logged in an unalterable audit trail, which documents the full lifecycle of every message (e.g. when it was imported, the retention term set, by whom it was viewed and when, etc.). Audit trails are retained for the life the message to which they relate. They are appended to each message and can be viewed by authorized users. See Global Relay Archive: Controls and Features, Section 2 for a complete description of the archiving process and quality controls. Note also that all of Global Relay s internal business, operational and security controls, including the message processing procedures that ensure that all archived data is quality, accurate and complete, are annually validated by KPMG. The KPMG Report can be provided upon request. Audit Availability (f)(3)(v)(a) Audit Lifecycle (f)(3)(v)(b) Messages and Index Availability (f)(3)(vi) At all times, a member, broker, or dealer must be able to have the results of such audit system available for examination by the staffs of the Commission and the self-regulatory organizations of which the broker or dealer is a member. The audit results must be preserved for the time required for the audited records. The member, broker, or dealer must maintain, keep current, and provide promptly upon request by the staffs of the Commission or the self regulatory organization of which the member, broker, or Broker-Dealer is a member all information necessary to access records and indexes stored on the electronic storage media; or place in escrow and keep current a copy of the physical and logical file format of the electronic storage media, the field format of all different information types written on the electronic storage media and the source code, together with the appropriate documentation and information necessary to access records and indexes. As detailed directly above, Global Relay Archive immediately provides a full, unalterable audit trail accessible to any authorized user. The KPMG Report described above also provides valuable proof of Global Relay s internal controls. Global Relay Archive employs retention schedules for all audit results. Audit results are retained for the lifecycle of the message they pertain to. The SEC three and six year retention requirement for records set out in paragraphs (a) and (b) of this Rule 17a-4 can be applied to the audit trails within the Archive. All messages stored within Global Relay Archive can be made promptly available to the SEC and FINRA, provided the member firm has authorized such access, or, as the default alternative, that the Regulator has invoked its third party downloader rights and requested messages through the third party downloader. Global Relay can act as a firm s third party downloader (see 17a-4((f)(3)(vii)). As well, Global Relay Archive has a special user role for audit purposes called the Ghost Reviewer (see 17a-4(f)(3)(i)). Note also that firms can access all of their data online 24x7x365 and have their data exported to a readable, standards-based format (e.g. EML, PST) if necessary. All data is preserved in RFC-2822 EML format in the Archive, ensuring firms will always have access to their mission critical data. Legal Third Party Download Provider (f)(3)(vii) All Broker Dealer firms that use electronic storage medium for preservation of records must have at least one third-party who has access to and the ability to download information from the Company s electronic storage media to an acceptable medium under this Section (f) of SEC Rule 17a-4, upon an SEC request. This is an extremely important, yet undervalued requirement. In addition to the Notification letter and Representation letter in accordance with paragraph (f)(2) (i) of this SEC Rule 17a-4, Global Relay s legal compliance package includes the documentation for Global Relay, as the member firm s electronic storage medium vendor, to serve as the impartial third party downloader for SEC purposes. Member firms, grant Global Relay the specific legal rights pursuant to a Direction and Authorization to be signed by the Broker Dealer firm in order for Global Relay to access the member firm s messages via Global Relay Archive, if requested by the SEC or FINRA in specific circumstances. Upon receipt by Global Relay of the signed Direction and legal Authorization, Global Relay will file a third party downloader undertaking to the SEC or FINRA. Record Production (j) Annual Review Every member, broker and dealer subject to this section shall furnish promptly to a representative of the Commission legible, true, complete, and current copies of those records of the member, broker or dealer that are required to be preserved under this section, or any other records of the member, broker or dealer subject to examination under section 17(b) of the Act (15 U.S.C. 78q(b)) that are requested by the representative of the Commission. Online Auditor Access See Global Relay solution for 17a-4(f)(3)(i). Data Export - Firms can have records exported to a standards-based format (e.g. PST, EML). All data can be made available via secure FTP transfer, DVD or hard drive. Global Relay s professional audit and ediscovery team has a 24-hour turnaround time for data exported for audits or litigation. Legible, True, Complete and Current As explained in paragraph (f)(3)(v), Global Relay s internal business, operational, and security controls, including the message processing procedures that ensure that all archived data is quality, accurate and complete, are annually validated by KPMG. The KPMG Report can be provided upon request. An annual review may be performed by the member firm with the assistance of our in-house legal counsel to ensure that the member firm maintains best practices compliance in connection with SEC regulations. 9

12 BOOKS AND RECORDS GENERAL REQUIREMENTS FINRA Rule 4511 Solution FINRA Rule 4511 requires member firms to implement a recordkeeping system for records for which there is no specified retention period under the FINRA Rules or applicable SEC rules. Global Relay Archive is specifically engineered to comply with FINRA Rule 4511 to provide recordkeeping solutions regarding all incoming, outgoing, and internal messages relating to a member firm s business. The FINRA Rule 4511 requirements are met as follows: Rule 4511 Compliance Requirement Global Relay s Compliance Solutions General Books and Records (a) Each member shall make and preserve books and records as required under the FINRA rules, the Exchange Act and the applicable Exchange Act rules. FINRA Rule 4511 requires that records must be preserved in accordance with all applicable legislation. In particular, the format, medium, and retention period for recordkeeping must comply with the specific standards set out in SEC Rule 17a 4. Global Relay Archive implements a best practices solution for the recordkeeping requirements of Rule 4511 and SEC Rule 17a-4. See SEC Rule 17a-4 Solution for a complete description. Preservation Period (b) Members shall preserve for a period of six years those FINRA books and records for which there is no specified period under FINRA rules or applicable Exchange Act rules. Global Relay Archive employs retention scheduling to manage the lifecycle of archived messages, ensuring compliance preservation periods are met. The SEC Rules 17a-3 and 17a-4 six year and three year respective retention requirements can be met (or extended as required). Global Relay Archive provides easily accessible online access to messages for the entire length of a Broker-Dealer s required retention period. Format and Media Requirements (c) All books and records required to be made pursuant to the FINRA rules shall be preserved in a format and media that complies with SEC Rule 17a-4. Global Relay Archive stores all archived messages in a non-rewriteable, non-erasable format with write-verification in accordance with SEC Rule 17a-4. 10

13 SUPERVISION FINRA 3110 Solution Global Relay s Compliance Reviewer is seamlessly incorporated into Global Relay Archive and offers extremely robust supervision and review tools that are specifically engineered to enable firms to build compliant supervisory systems for the review of electronic communications under FINRA Rule 3110 (replaces NASD Rule 3010) and FINRA Regulatory Notice Consolidated Supervision Rules, which require the review of incoming, outgoing and internal communications related to a member firm s business. The requirements are met as follows: Rule 3110 Compliance Requirement Global Relay s Compliance Solutions Supervisory System (a) Each member shall establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules. A member s supervisory system shall provide, at a minimum, for the following: (1) The establishment and maintenance of written procedures as required by this Rule. (5) The assignment of each registered person to an appropriately registered representative(s) or principal(s) who shall be responsible for supervising that person s activities. Supervisory System Global Relay s Compliance Reviewer allows Broker- Dealers of any nature, size, structure and customer base to develop, implement, and maintain a rules-based supervisory system to monitor the electronic communications of associated persons. Global Relay s legal and IT departments are tightly integrated to ensure technology is updated as required to meet compliance requirements for new and amended rules as they are introduced. Global Relay s Training team assists firms with developing and implementing supervision policies within Global Relay Archive that are designed to achieve compliance with applicable laws and regulations. Establishment & Maintenance of Procedures The first step for member firms is to develop written policies and procedures for supervising electronic communications. Once established, Global Relay s Compliance Reviewer may be set up with a rules-based system that allows compliance personnel to enforce and monitor these policies and procedures. Global Relay s Training team is available to assist firms in implementing appropriate rules and workflows within Global Relay Archive to meet policy requirements. Assignment Global Relay Archive provides granular customizable user roles and access rights that can be used to route the electronic messages of registered persons to appropriate reviewers. For example, a reviewer who is responsible for monitoring the messages of a specific office can be given access only to the messages of those users they are assigned to review. This can be done across the firm to divide supervisory responsibilities. Additionally, a CCO or other senior reviewer(s) can be given access to the firm s entire Archive in order to supervise the activities of junior reviewers. Review of Corespondence and Internal Communications (b)(4) Each member shall establish, maintain, and enforce written procedures to supervise the types of business in which it engages and the activities of its associated persons that are reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules. The supervisory procedures required by this paragraph (b) shall include procedures for the review of incoming and outgoing written (including electronic) correspondence and internal communications relating to the member s investment banking or securities business. The supervisory procedures must be appropriate for the member s business, size, structure, and customers. Member firms are required to establish supervisory procedures for the review of each associated person s incoming, outgoing and internal written communications related to investment banking and securities business. Compliance Reviewer enables firms to: 1. Implement Procedures Firms can cost effectively implement procedures to detect and prevent compliance violations through a rules-based system that can be customized to meet the written supervisory policies of firms of all business lines, sizes, and structures. This may include a multi-tier supervisory system that allows senior compliance personnel to supervise the activities of junior reviewers. Firms can reasonably supervise the communications of associated persons by using random sampling, lexicon and advanced flagging rules, and/or manual searches to identify messages that may violate FINRA rules or internal policies. See Section 3a of Compliance Review: Controls and Features for details. 2. Identify Reviewers Member firms can appoint any number of Reviewers to monitor electronic communications. Each Reviewer is assigned specific users or groups to monitor in order to ensure each associated person is supervised by an appropriate registered representative or principal. As well, this division of supervisory responsibilities ensures confidentiality by preventing inappropriate viewing of messages. 11

14 Rule 3110 Compliance Requirement Global Relay s Compliance Solutions Review of Corespondence and Internal Communications (b)(4) (continued) Reviews of correspondence and internal communications must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper. 3. Electronically Supervise Compliance Reviewer provides an intuitive iconbased review system that allows reviewers to tag messages to document supervisory activities (e.g. Reviewed, Non-Compliant, Escalated). Reviewers may also add comments to messages to justify the assigned tag or record actions taken. The date of the Reviewer s action and his or her username is recorded. A first level Reviewer may escalate any non-compliant message to a senior compliance officer ( Super Reviewer ) for further evaluation. 4. Review Time Frames A schedule for automatic message flagging and review may be implemented and customized to enforce policy time deadlines for review. Senior compliance personnel can schedule supervision reports to run automatically at specified intervals (e.g. weekly) to ensure junior reviewers are completing reviews within appropriate time frames. In particular, The Supervisor Review report provides a quick snapshot of each Reviewer and the status of his or her various assigned message queues. 5. Monitor and Evaluate Procedures As outlined above, Global Relay Archive provides detailed supervisory reports that can be generated on demand and/ or automated with daily, weekly, or monthly delivery to further enhance the supervisory review process. These reports provide statistics on record surveillance and monitoring activity that can be used for audits and periodic reevaluations by member firms. Compliance personnel have the flexibility to make 24x7x365 online adjustments to flagging rules and review structures in order to constantly update and improve monitoring procedures. As well, Global Relay Archive provides tools and resources to assist firms in refining flagging rules and reducing false positives. These include keyword flagging reports, the ability to calculate the number of hits against each flagging rule on an ad-hoc basis, and unlimited access to our in-house Training team. 6. Document Review Process - All review activities related to a message - including viewing, tagging (as Reviewed, Non-Compliant, etc.), escalation, and reviewer comments - are documented in the unalterable audit trail appended to each message. As well, Global Relay Archive provides detailed reports on supervisory activity that provide valuable proof of review during audits. Incoming & Outgoing Correspondence (b)(4)(a) Internal Communications (b)(4)(b) Customer Complaints (b)(5) The supervisory procedures must require the member s review of incoming and outgoing written (including electronic) correspondence to properly identify and handle in accordance with firm procedures, customer complaints, instructions, funds and securities, and communications that are of a subject matter that require review under FINRA rules and federal securities laws. The supervisory procedures must require the member s review of internal communications to properly identify those communications that are of a subject matter that require review under FINRA rules and federal securities laws. The supervisory procedures required by this paragraph (b) shall include procedures to capture, acknowledge, and respond to all written (including electronic) customer complaints Compliance Reviewer provides customizable flagging rules that allow member firms to identify and handle correspondence of the types listed in Rule 3110(b) (4)(A). Firms can create multiple specialized flagging rules tailored to identify messages containing specific types of content requiring review under FINRA rules and federal securities laws. For example, a rule can be created to target messages that may contain customer complaints. Another may be created to target messages that contain customer instructions. As well, rules can be tailored to meet the unique supervision requirements of different groups or departments. Compliance Reviewer provides customizable flagging rules that allow member firms to identify internal communications of the types listed in Rule 3110(b)(4)(B). As explained in paragraph (b)(4)(a) above, firms can create multiple specialized flagging rules, including separate rules for internal communications and incoming/outgoing correspondence. For example, a rule can be created to target messages between a firm s research and non-research departments. Compliance Reviewer, through keyword flagging, can provide notification of customer complaints delivered to the member firm by . A record of such complaints submitted can thereby be created and maintained (either by the name of the registered representative or other associated person, or by matter). Messages can be produced on demand for FINRA, as well as forwarded to the registered representative or staff member listed in the complaint. 12

15 Rule 3110 Compliance Requirement Global Relay s Compliance Solutions Transaction Review (d) Risk-Based Review of Correspondence Supplementary Material.06(a) Each member shall include in its supervisory procedures a process for the review of securities transactions that are reasonably designed to identify trades that may violate the provisions of the Exchange Act, the rules thereunder, or FINRA rules prohibiting insider trading and manipulative and deceptive device By employing risk-based principles, a member must decide the extent to which additional policies and procedures for the review of: (a) incoming and outgoing written (including electronic) correspondence that fall outside of the subject matters listed in Rule 3110(b)(4) are necessary for its business and structure. Many transactions are conducted using electronic messaging systems such as Bloomberg, Thomson Reuters, and public IM. These messages may be original source documents or contain correspondence relating to transactions. Compliance Reviewer s customizable flagging rules can be configured to assist firms in identifying messages that may indicate a transaction violates Exchange Act or FINRA rules such as insider trading. Compliance Reviewer is a rule-based system that allows member firms to employ risk-based principles to efficiently supervise the large volumes of electronic communications sent and received every day. Random sampling, lexicon, and advanced flagging rules are all fully customizable to allow firms to effectively review incoming, outgoing and internal communications of any subject matter, including those that fall outside of FINRA regulations (e.g. subject matter that may violate internal HR policies). Training & Documentation Supplementary Material.06(a)(1-3) If a member s procedures do not require that all correspondence be reviewed before use or distribution, the procedures must provide for: (1) the education and training of associated persons regarding the firm s procedures governing correspondence; (2) the documentation of such education and training; and (3) surveillance and follow-up to ensure that such procedures are implemented and followed. Due to the large volume of electronic messages sent and received every day and the importance of timely communication with customers and counterparties, most firms will not require that all correspondence be reviewed before use or distribution. Firms must therefore: 1. Train Employees Member firms must educate and train associated persons on their procedures governing correspondence. Global Relay will assist in this process by providing support for employee education and training with respect to Global Relay Archive and Compliance Reviewer. As well, Global Relay Archive s user interface is intuitive and simple, virtually eliminating any learning curve. 2. Document Training Global Relay Archive provides an audit trail of all Reviewer actions, whether the employee is being trained or is carrying out an actual review. In addition to documenting all system actions and surveillance, evidence of any training is automatically logged and available as required. 3. Conduct Surveillance and Follow-Ups As explained in Rule 3110 (b) (4), member firms can appoint appropriate reviewers to monitor employee communications based on customizable flagging rules. Senior compliance personnel or other administrators may then monitor reviewer actions to ensure reviews are executed according to policy. Risk-Based Review of Internal Communications Supplementary Material.06(b) By employing risk-based principles, a member must decide the extent to which additional policies and procedures for the review of: (b) internal communications that are not of a subject matter that require review under FINRA rules and federal securities laws are necessary for its business and structure. See Risk-Based Review of Correspondence Supplementary Material.06(a). Evidence of Review Supplementary Material.07 The evidence of review required in Rule 3110(b)(4) must be chronicled either electronically or on paper and must clearly identify the reviewer, the internal communication or correspondence that was reviewed, the date of review, and the actions taken by the member as a result of any significant regulatory issues identified during the review. Merely opening a communication is not sufficient review. For every message review, the reviewer, date of review, and review status (e.g. Reviewed, Non-Compliant) is documented in the unalterable audit trail appended to each message. Actions taken by the member firm as a result of any identified regulatory issues (e.g. forwarding the message to senior management for review, replying to the original author of the message to inform him or her of the violation, etc.) are also documented in the audit trail. Reviewers may also include comments when reviewing a message to outline any actions taken. As well, if a reviewer does a bulk review on messages (e.g. tags multiple messages as reviewed without reading the entire message), this will be documented as a Header Review in the audit trail. 13

16 Rule 3110 Compliance Requirement Global Relay s Compliance Solutions Delegation of Correspondence and Internal Communication Review Functions Supplementary Material.08 Retention of Correspondence and Internal Communications Supplementary Material.09 In the course of the supervision and review of correspondence and internal communications required by Rule 3110(b)(4), a supervisor/ principal may delegate certain functions to persons who need not be registered. However, the supervisor/principal remains ultimately responsible for the performance of all necessary supervisory reviews, irrespective of whether he or she delegates functions related to the review. Accordingly, supervisors/ principals must take reasonable and appropriate action to ensure delegated functions are properly executed and should evidence performance of their procedures sufficiently to demonstrate overall supervisory control. Each member shall retain the internal communications and correspondence of associated persons relating to the member s investment banking or securities business for the period of time and accessibility specified in SEA Rule 17a-4(b). The names of the persons who prepared outgoing correspondence and who reviewed the correspondence shall be ascertainable from the retained records, and the retained records shall be readily available to FINRA, upon request. Compliance Reviewer provides multiple supervisory roles to accommodate member firms who wish to delegate supervisory responsibilities while still complying with FINRA regulations that require supervisors and principals to ensure that delegated functions are properly executed. Personnel to whom first level reviews are delegated are assigned the Reviewer role, while supervisors and principals are assigned the Super Reviewer role, which allows them to supervise and report on their delegates activities to ensure reviews are carried out in compliance with the firm s policies and procedures. All actions on messages by both Reviewers and Super Reviewer are documented in each message s audit trail, providing evidence of overall supervisory control. Retention - Global Relay Archive employs retention schedules for all archived messages. The SEC three and six year retention requirement for records set out in SEC Rule 17a-4(b) can be accommodated. Note that all retention terms can be extended and Litigation Holds can be applied. Availability - All messages are readily available online 24x7x365 for the entire length of the retention term and can be produced for FINRA both online and in a standards-based format. Documentation of Authors & Reviewers -The names of both the person who prepared outgoing correspondence and the person who reviewed the correspondence are documented each message s metadata and audit trail. 14

17 CONTROLS AND FEATURES Global Relay Archive Global Relay Archive is an enterprise-class cloud-hosted electronic message archiving, supervision and ediscovery solution that addresses the demands of regulatory compliance, litigation, internal and external audits, business continuity, data management, storage and security. Global Relay Archive is developed, owned and operated in-house by Global Relay. It securely captures and archives all major types of electronic messages and stores them in a unified archive with federated search capabilities, allowing firms to search, view, review and manage all messages from a single inbox. 1. Message Types Global Relay Archive securely captures and archives all of a firm s incoming, internal and outgoing electronic communications, including all major message types used in finance: Public Instant Messaging (AIM, MSN, Yahoo!, GoogleTalk) Social Media (LinkedIn, Twitter, Facebook) BlackBerry and Android Messaging (Text/SMS, PIN, Call logs) Bloomberg Messaging (Instant Bloomberg, Bloomberg Mail) Thomson Reuters Messaging (Eikon, Thomson Reuters Messenger) Microsoft Lync/OCS CME (Pivot) ICE (YellowJacket) FactSet Jabber/XMPP Cisco WebEx LivePerson OpenFire Web Chatter (Salesforce) Yammer Global Relay Message Global Relay Archive may support message types not listed here. Please contact Global Relay to determine whether a specific message type is supported. a. Global Relay Archive for captures and attachments from virtually all platforms, including Exchange, Lotus Notes/Domino, Office 365, Google Apps, and more. is envelope journaled and delivered to Global Relay Archive via IMAP or SMTP. is archived with complete metadata, including BCC and Distribution Lists (both the Distribution List address and the List s individual members) b. Global Relay Archive for Instant Messaging (IM) supports all major public instant messaging platforms, including AIM, GoogleTalk, and Yahoo!, as well as enterprise platforms such as Microsoft Lync/OCS and Global Relay Message, Global Relay s compliant enterprise messaging, collaboration and trading platform designed for the financial sector. c. Global Relay Archive for Market Data supports IM platforms tied to market data systems, including CME/ Pivot, ICE, and FactSet, as well as Bloomberg and Thomson Reuters messaging (see sections (f) & (g)) d. Global Relay Archive for Social Media supports LinkedIn, Twitter and Facebook, automatically capturing and archiving social media communications in context on long-term tamperproof storage. Features of note include: 15

18 i. Rich interface display When viewing social media communications inside Global Relay Archive, messages appear in their original format preserving all metadata, photos, formatting and links (as opposed to plain text without context). ii. Redline view Compliance Officers love this: When changes are made to a social media page, such as changes in Profile information, Global Relay Archive shows a unique redline view that pinpoints exactly what text was altered, added or removed on social media pages (not static screenshots without tracked changes). Note that Global Relay also offers plug-ins for archiving of enterprise social media platforms such as Yammer and Chatter (Salesforce). e. Global Relay Mobile Device Management for Compliance captures SMS, PIN, call logs, and location information directly from mobile phones. The solution currently supports Blackberry (BES and non-bes) and Android. It is ready to support ios when Apple publishes the necessary API access. f. Global Relay Archive for Bloomberg enables Bloomberg Messages to be automatically downloaded from the Bloomberg FTP site and consolidated in Global Relay Archive, while retaining complete and searchable metadata. g. Global Relay Archive for Thomson Reuters enables the compliant use of Eikon and Thomson Reuters Messenger by logging user-generated content such as instant messages, chat room conversations and more, along with complete metadata. Global Relay is the exclusive integrated archive partner for Thomson Reuters worldwide. h. Global Relay Archive for Web preserves websites, social media and forums while accurately replicating complex interactive elements like Flash, Javascript/AJAX, video and audio, ensuring that firms can capture these important elements of their business. 2. Archiving Process and Controls a. Preservation & Access Global Relay Archive is a message archiving system for long-term preservation, access and retrieval of electronic communications. It employs retention scheduling to manage the lifecycle of messages, ensuring compliance preservation periods are met. Following best practice standards, Global Relay Archive provides readily available online access to messages for the length of a firm s specified retention period. All messages are preserved on tamperproof storage in Global Relay s two mirrored east/west coast SOC audited data centers. b. Write-Verification All messages stored within Global Relay Archive are forwarded directly from a firm s server, messaging platform or social media site with no user intervention and preserved in their original format. With complete metadata Global Relay Archive automatically verifies the quality and accuracy of the storage media recording process through data comparison. As messages are processed, Global Relay Archive automatically compares the post-processed message with the original message before the original message is deleted. Global Relay Archive also has a 30 day buffer as an added level of redundancy in the write-verification process. c. Message Capture Global Relay Archive uses envelope journaling to capture and archive all incoming, internal, outgoing messages, including attachments, on a domain-wide or selective basis. Global Relay uses proprietary convertors, APIs, and SMTP/IMAP to capture and archive other message types, including IM, social media, and more. 16

19 d. Message Unification Global Relay Archive securely and automatically captures a wide variety of message types (See Section 1 for a detailed list), converts them into EML using Global Relay developed proprietary converters, and integrates them into a unified, searchable Archive. An overview of the technologies used to process specific message types is shown below: A Unified Archive for any Message Type Public IM OCS/Lync XMPP IM Trading / Market Data Social Media Mobile Device Management Files & Media Global Relay Customer Users Journal SSL/TLS IMAP / SMTP Logging App SMTP GR OCS SMTP Group Delivery AD XMPP / HTTPS XMPP > EML SMTP Message Converter XML HTTPS File Downloader XML > XCF XCF > EML / CME Social Converter REST/HTTPS OAuth API Downloader Database JSON > EML Mobile Converter Message Routing JSON / SSL App Downloader JSON JSON > EML File Converter Extractor File Downloader File Objects > EML Normalized Data Meta-data Message Store Search Index Meta-Data - Normalized Messages (EML) Global Relay Unified Archive, Mail Box Management & Discovery Tools e. Message Indexing All messages are full-text indexed with complete metadata, including Subject, From, To, Cc, Bcc, Distribution Lists, and more. There are also some unique but useful metadata fields such as X-headers and IP address. Global Relay supports full-text indexing for the majority of captured attachments, including metadata from image files. All attachments which can be converted to text can be full-text indexed. f. Message Retention Global Relay Archive employs retention scheduling to manage the lifecycle of electronic messages, audit trails and indices, ensuring compliance requirements are met. Retention terms in Global Relay Archive are defined by each firm s Records Retention Schedules, typically ranging from 3, 5, 7, or 10+ years. Data can also be retained indefinitely for as long as a firm remains a paying customer. Note that retention terms can be extended for data that is part of one or more Legal Holds. g. Message Availability Authorized users (including reviewers, regulators and lawyers) can access archived data 24x7x365 via web browser, Outlook, and proprietary mobile apps for iphone, ipad, Blackberry and Android. Messages can also be printed, forwarded, downloaded as EML and recovered to a user s inbox. Features of note include: 17

20 i. Advanced Search Features Proprietary search technology allows authorized users to conduct searches using structured queries based on any combination of various search parameters (all, date, date range, To, From, Cc, Bcc, Distribution List, Subject, keywords contained within a message or attachment, X-Header, alias, attachment file name, events, etc.). As well, Global Relay Archive supports Boolean (AND, OR, NOT), wildcard, word stemming, relational/proximity searching, events and exclusion filtering, tags, labels, priorities, and compound queries. Searching can be done across the entire Archive or across specific folders, groups and/or users, as well as across all message types or a specified subset of types. ii. Message Export Firms may export archived data to a standards-based format (e.g. PST, EML). All data held can be made available via FTP transfer, DVD and/or hard drive. Global Relay assists with approximately 30 ongoing data demands on a daily basis and regulatory audits per week. We have a 24-hour turnaround time for data exported for audits or litigation. Messages can be extracted by type, custodian and/or date. All exports include complete metadata such as BCC and Distribution Lists. iii. Online Access Global Relay Archive has a special user role for audit purposes called the Ghost Reviewer. Upon the direction of a firm, Global Relay can set up an account for a third party auditor or regulator which gives that party access to a defined subset of messages (e.g. a folder set up for the audit). The auditor or regulator can then review all of the messages online without his or her actions showing up in the audit trail. Use of the Ghost Reviewer is dependent on the discretion of the individual regulator or examiner. iv. Personal Archive Global Relay Search provides anytime, anywhere access to archived messages via web browser, Outlook plug-in, and mobile apps for iphone, ipad, BlackBerry and Android. All users in a firm can have real-time access to a personal Archive of their own historical messages that includes every message type in the firm s Archive. Powerful search functionality enables users to retrieve and restore any message in seconds 3. ediscovery Global Relay Archive captures messages for proactive litigation readiness and provides tools for internal and external counsel and other stakeholders to conduct ediscovery across a firm s electronic messages. a. Categorization, Evaluation & Case Management Search results can be iteratively calculated, conducted, refined and saved to achieve relevant subsets, then placed in online case folders to segregate and label data relating to an audit or legal action. Reviewers involved in ediscovery can access the case folders in order to participate in review workflows and evaluate information for relevance. Items can be tagged as responsive, nonresponsive, using priorities, reviewer-defined labels, and wizards. b. Collaboration Global Relay Archive provides collaborative tools for legal in-house and external counsel to conduct reviews. External counsel can be given online access to specific data related to a case in order to participate in review workflows. This external access can be disabled quickly and easily when it is no longer required. c. Privileged & Confidential Information Authorized users can mark messages as attorney/client privileged, personal, or restricted. One marked, these messages are easily identifiable and can be excluded from any production of data. Firms can also set up customized rules to automatically scan and flag data as privileged, personal or restricted on ingestion. d. Legal Holds Firms can enforce Legal Holds by users, groups of users, cases and/or across their entire Archive independent of corporate retention policies. e. Complete Metadata Global Relay has a particular strength in capturing and preserving the complete and unique metadata associated with each message type used in finance. This extensive metadata, which is dropped by many other archiving systems, is leveraged to provide advanced search capabilities. For example, Global Relay preserves all BCC and Distribution List data for archived s. 18