Broker-Dealer and Investment Adviser Compliance Programs

Transcription

1 Lori A. Richards Principal, PricewaterhouseCoopers Financial Services Regulatory Practice Broker-Dealer and Investment Adviser Compliance Programs Regulatory Requirements, Common Minimum Elements, Other Paradigms Spring 2010

2 Broker-Dealer and Investment Adviser Compliance Programs: Regulatory Requirements, Common Minimum Elements, Other Paradigms Lori A. Richards Principal, PricewaterhouseCoopers Financial Services Regulatory Practice Investment advisers and investment companies are required to have compliance programs pursuant to rules of the Securities and Exchange Commission, and broker-dealers are required to have compliance programs pursuant to rules imposed by FINRA. These rules have certain common features -- effectively creating "minimum elements" for broker-dealer and investment adviser compliance programs. The separate regulatory requirements governing advisers' and broker-dealers' compliance programs are summarized here, as well as these common "minimum elements." Finally, the Federal Sentencing Guidelines suggest an additional and complimentary paradigm for compliance programs, and those aspects are summarized here. I. Regulatory Requirements Governing the Compliance Programs of Investment Advisers and Investment Companies Every investment adviser and investment company (fund) registered with the SEC is required to adopt and implement written policies and procedures reasonably designed to prevent violation of the federal securities laws. The policies and procedures should be designed to prevent violations from occurring, detect violations that have occurred, and correct promptly any violations that have occurred. In addition, advisers and funds must review those policies and procedures annually for their adequacy and the effectiveness of their implementation, and designate a chief compliance officer (CCO) to be responsible for administering the policies and procedures (under Rule 206(4)-7 of the Investment Advisers Act and Rule 38a-1 under the Investment Company Act, together called the "Compliance Rule"). 1 Advisers' compliance programs must be reasonably designed to prevent violations of the Advisers Act. Funds' compliance programs must be broader in scope, and be reasonably designed to prevent violations of the Investment Company Act and the Advisers Act, as well as the Securities Act, the Securities Exchange Act, the Sarbanes-Oxley Act of 2002, Title V of the Gramm-Leach-Bliley Act (governing disclosure of nonpublic personal information), and the Bank Secrecy Act (anti-money laundering requirements), and rules thereunder. The SEC stated that the compliance policies and procedures should address the particular practices and risks present at each adviser. At a minimum, to the extent that they are relevant to the adviser, the policies and procedures must cover: 1 References and quotations in this section are to the SEC's release adopting the Compliance Rule: "Compliance Programs of Investment Companies and Investment Advisers," (Release Nos. IA-2204 and IC-26299), December 17, PricewaterhouseCoopers 1

3 Portfolio management processes, including allocation of investment opportunities among clients and consistency of portfolios with clients' investment objectives, disclosures by the adviser, and applicable regulatory restrictions; Trading practices, including procedures by which the adviser satisfies its best execution obligation, uses client brokerage to obtain research and other services ("soft dollar arrangements"), and allocates aggregated trades among clients; Proprietary trading of the adviser and personal trading activities of supervised persons; The accuracy of disclosures made to investors, clients, and regulators, including account statements and advertisements; Safeguarding of client assets from conversion or inappropriate use by advisory personnel; The accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction; Marketing advisory services, including the use of solicitors; Processes to value client holdings and assess fees based on those valuations; Safeguards for the privacy protection of client records and information; and Business continuity plans. There is no mandated set of policies and procedures, given the varied and individual nature of each adviser's different models, business relationships and affiliations. The SEC noted that each adviser, in designing its policies and procedures, should first identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm's particular operations, and then design policies and procedures that address those risks. The SEC stated that an adviser's CCO should be competent and knowledgeable regarding the Advisers Act and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm. Thus, the compliance officer should have a position of sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures. A fund's CCO must report directly to the fund's board of directors. Advisers and funds are required to conduct a review of their policies and procedures annually to determine their adequacy and the effectiveness of their implementation (funds are required to review the policies and procedures of service providers). For advisers, the review should consider any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures. Although the rule requires only annual reviews, the SEC urged advisers to consider the need for interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments. For funds, the fund CCO must provide a written report on the operation of the fund's policies and procedures and those of its service providers to the fund's board of directors. The report must address, at a minimum: (i) the operation of the policies and procedures of the fund and each service provider since the last report, (ii) any material changes to the policies and procedures since the last report, (iii) any recommendations for material changes to the policies and procedures as a result of PricewaterhouseCoopers 2

4 the annual review, and (iv) any material compliance matters since the date of the last report. A "material compliance matter" is a compliance matter "about which the fund's board reasonably needs to know in order to oversee fund compliance." The fund CCO must meet with the fund board's independent directors at least once each year. II. Regulatory Requirements Governing the Compliance Programs of Broker-Dealers Every broker-dealer that is a member of FINRA is required to establish, maintain, review, test and modify written compliance policies and written supervisory procedures reasonably designed to achieve compliance with applicable FINRA rules, MSRB rules and federal securities laws and regulations (under FINRA Rule 3130 ("Annual Certification of Compliance and Supervisory Processes").2 Broker-dealers must designate one or more CCOs. The CCO is to be "a primary advisor to the member on its overall compliance scheme and the particularized rules, policies and procedures that the member adopts." FINRA notes that the CCO should "have an expertise in the process of (1) gaining an understanding of the products, services or line functions that need to be the subject of written compliance policies and written supervisory procedures; (2) identifying the relevant rules, regulations, laws and standards of conduct pertaining to such products, services or line functions based on experience and/or consultation with those persons who have a technical expertise in such areas of the member's business; (3) developing, or advising other business persons charged with the obligation to develop, policies and procedures that are reasonably designed to achieve compliance with those relevant rules, regulations, laws and standards of conduct; (4) evidencing the supervision by the line managers who are responsible for the execution of compliance policies; and (5) developing programs to test compliance with the member's policies and procedures." FINRA notes that its rule is not intended to limit or discourage the participation of other employees both within and outside the firm's compliance department in any aspect of the firm's compliance programs or processes. The chief executive officer (CEO) of the broker-dealer firm must annually certify that the firm has such written compliance and supervisory procedures, and that the CEO has conducted one or more meetings with the CCO in the last 12 months to discuss such processes. The certification requirement is intended to require processes by each member firm to establish, maintain, review, test and modify its compliance policies and written supervisory procedures in light of the nature of its businesses and the laws and rules that are applicable to the firm, and to evidence such processes in a report reviewed by the CEO that executes the certification (a separate FINRA rule (Rule 3012) imposes certain supervisory obligations on broker-dealer firms, including the obligation to have written supervisory procedures, and to supervise specific aspects of the firm's and registered representatives' activities). The certification must include a representation that the firm has processes in place to: a) Establish, maintain and review policies and procedures reasonably designed to achieve compliance with applicable FINRA rules, MSRB rules and federal securities laws and regulations; 2 References and quotations in this section are to FINRA's Rule 3130 "Annual Certification of Compliance and Supervisory Processes" and FINRA's Supplemental Material to the rule. PricewaterhouseCoopers 3

5 b) Modify such policies and procedures as business, regulatory and legislative changes and events dictate; and c) Test the effectiveness of such policies and procedures on a periodic basis, the timing and extent of which is reasonably designed to ensure continuing compliance with FINRA rules, MSRB rules and federal securities laws and regulations. These processes must be evidenced in a written report reviewed by the CEO, and provided to the broker-dealer firm's board of directors and audit committee (or equivalent bodies). The report must document the firm's processes for establishing, maintaining, reviewing, testing and modifying compliance policies, which are reasonably designed to achieve compliance with applicable FINRA rules, MSRB rules and the federal securities laws and rules thereunder. FINRA notes that the report should include the manner and frequency in which the processes are administered, as well as the identification of officers and supervisors who have responsibility for such administration. FINRA states that the report need not contain any conclusions produced as a result of following the processes outlined in the report. In addition, the CEO of the broker-dealer firm must annually certify that the CEO has conducted one or more meetings with the CCO in the last 12 months to discuss such processes. FINRA notes that in these meetings, the CEO and CCO should: (1) discuss and review the matters that are the subject of the certification; (2) discuss and review the member's compliance efforts as of the date of such meetings; and (3) identify and address significant compliance problems and plans for emerging business areas. III. Common Minimum (Required) Elements of Both Adviser and Broker-Dealer Compliance Programs The rules governing investment adviser and fund compliance programs (the "Compliance Rule, outlined above) and the rules governing broker-dealer compliance programs (FINRA Rule 3130, outlined above) have certain features in common. 3 These common features effectively create "minimum elements" for broker-dealer and investment adviser compliance programs. These "minimum elements" are: 1. A designated CCO Advisers and funds must have a single CCO, Broker-dealers may have more than one CCO (with defined areas of responsibility). 2. A knowledgeable CCO Broker-dealer CCOs should have "expertise in the process of compliance," Adviser and fund CCOs should be "competent and knowledgeable" regarding the Advisers Act (and for fund CCOs, knowledgeable regarding the federal securities laws). 3 There are also some significant differences, such as the required annual certification and the specific reference to "testing" in FINRA rules, which have no corollary in the Compliance Rule for advisers and funds (though testing is a best practice and urged by the SEC staff). In addition, the Compliance Rule does not mandate that advisers create a written annual report of the compliance review, as is required for funds and broker-dealers, though the creation of a written record is desirable to document that the review was performed. PricewaterhouseCoopers 4

6 3. The CCO must have authority within the organization Adviser CCOs "must have sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures," Fund CCOs must report to the fund's board of directors, Broker-dealer CCOs must be principals, and are "primary advisors" to the firm on its overall compliance scheme and the particularized rules, policies and procedures of the firm. 4. The compliance program must be effectively designed to achieve compliance with certain securities laws and regulations applicable to the firm Advisers' compliance programs must be designed to prevent, detect and correct promptly any violations of applicable provisions of the Advisers Act. Fund compliance programs must be designed to prevent, detect and correct promptly any violations of applicable provisions of the Advisers Act, Investment Company Act, the Securities Act, the Exchange Act, as well as the Sarbanes-Oxley Act of 2002, Title V of the Gramm-Leach-Bliley Act (governing disclosure of nonpublic personal information), the Bank Secrecy Act (ant-money laundering requirements), and any rules adopted under these statutes. Broker-dealers' compliance and supervisory programs must be reasonably designed to achieve compliance with applicable provisions of the federal securities laws and rules, FINRA rules, and MSRB rules. 5. The effectiveness of the compliance program must be reviewed regularly, at least annually This review should include "tests" of the effectiveness of the compliance program. Specific tests performed depend on the particular activities and risks at the firm. 6. The compliance program must be dynamic Advisers "should consider the need for interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments." Broker-dealers must modify policies and procedures "as business, regulatory and legislative changes and events dictate." 7. The compliance program must "report up" on the effectiveness of compliance policies and procedures Advisers must perform an annual review of their compliance programs. To allow the firm to fulfill this obligation, the CCO will need to "report up" on the operation of the compliance program. Fund CCOs must deliver a written report describing material compliance issues to the fund's board of directors, and must meet with fund board independent directors at least once each year to "speak freely about any sensitive compliance issues of concern to any of them." Broker-dealer CCOs and CEOs must meet at least once a year to discuss and review the compliance certification, the firm's compliance efforts, and identify and address significant compliance problems and plans for emerging business areas. A written report on the firm's process to establish, maintain, review and test its procedures must be provided to the Board and audit committee. PricewaterhouseCoopers 5

7 IV. The Federal Sentencing Guidelines and Compliance Programs As described above, compliance programs are mandated in the securities industry for advisers, funds and broker-dealers. Outside the securities industry, many other types of organizations have also created and are operating compliance programs. These compliance programs are designed to achieve compliance with a wide range of laws and regulations, including with respect to employing personnel, manufacturing and selling food and drugs safely, antitrust, protecting the environment, reporting financial results, paying taxes, and providing health services. The Federal Sentencing Guidelines provide additional guidance on the structure and the process of compliance programs. The Guidelines provide guidance to federal courts in sentencing. The Guidelines suggest that having an effective compliance program may mitigate an organization's punishment. Applicable to all industries, and adoption of the Guidelines concerning compliance programs in 1991 led to the growth in professional compliance programs in corporations and organizations of all types. For securities firms, the Guidelines suggest an additional and complimentary paradigm for compliance programs, and are fully consistent with best practices in the securities industry. The Guidelines state that, to have an effective compliance and ethics program, an organization shall "promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law."4 The provisions with respect to compliance programs include: Oversight of compliance: including by the board, oversight committees, supervisors, and the compliance officer; Standards, policies and procedures: including a code of ethics or code of conduct, and operating and compliance policies and procedures that implement the standards; Exercise due diligence in delegating responsibilities: not delegating significant responsibility to individuals who have engaged in misconduct, or conduct inconsistent with an effective compliance and ethics program; Communication, education and training: to ensure that all employees and agents clearly understand their obligations, including all those who have responsibilities under the policies and procedures; Monitoring and auditing: including processes to detect violations, like surveillance, exception reporting, internal investigations and hotlines; Enforcement and discipline: encouraging compliant actions and appropriately sanctioning non-compliant actions; and Federal Sentencing Guidelines, Chapter 8, 8B2.1 Effective Compliance and Ethics Program, available at PricewaterhouseCoopers 6

8 Response, prevention and evaluation: responding to indications of problems to prevent further similar misconduct, and periodically risk-assessing the program to ensure that it's addressing compliance risks effectively. 5 The Guidelines state that individuals with operational responsibility for the compliance and ethics program shall report periodically to high-level personnel, and as appropriate, to the governing authority or appropriate sub-group on the effectiveness of the compliance and ethics program. Further, the Guidelines state that compliance professionals shall be given adequate resources, appropriate authority, and direct access to the governing authority or appropriate subgroup. In 2004, the Guidelines were modified to place more focus on prevention and detection of violations and conformity with ethical standards, and made high-level personnel more responsible for implementing and overseeing a compliance program. The amendments also put more emphasis on the having an effective compliance program. *** The federal securities laws and FINRA rules effectively create certain "minimum elements" for broker-dealer and investment adviser compliance programs. These are: 1) a designated CCO; 2) a knowledgeable CCO; 3) the CCO must have authority within the organization; 4) the compliance program must be effectively designed to achieve compliance with certain securities laws and regulations applicable to the firm; 5) the effectiveness of the compliance program must be reviewed regularly, at least annually; 6) the compliance program must be dynamic; 7) the compliance program must "report up" on the effectiveness of compliance policies and procedures. Finally, the Federal Sentencing Guidelines suggest an additional and complimentary paradigm for securities industry compliance programs, fully consistent with best practices in the securities industry. Lori A. Richards Principal, Financial Services Regulatory Practice lori.richards@us.pwc.com 5 The Federal Sentencing Commission proposes to clarify this section by providing guidance on what actions constitute reasonable steps, namely: the organization should take reasonable steps to provide restitution and otherwise remedy the harm resulting from the criminal conduct; self-report the matter and cooperate with authorities. The revised guidance would also state that the organization should assess and, if necessary, modify its compliance program to ensure that it is more effective, and, if the organization chooses to modify its compliance program, the organization may retain an independent monitor to ensure adequate assessment and implementation of modifications. The Sentencing Commission is also seeking comment on whether to encourage direct reporting to the board by responsible compliance personnel by allowing an organization with such a structure to receive mitigation of its ultimate punishment, even if high-level personnel are involved in the criminal conduct. See Sentencing Guidelines for United States Courts, 75 Fed. Reg (Jan. 21, 2010). PricewaterhouseCoopers 7

9 2010 PricewaterhouseCoopers LLP. All rights reserved. "PricewaterhouseCoopers" refers to PricewaterhouseCoopers LLP, a Delaware limited liability partnership, or, as the context requires, the PricewaterhouseCoopers global network or other member firms of the network, each of which is a separate legal entity. This document is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.