Prepared for NSCP 2014 National Conference Session #7b

Transcription

1 Firm/fine, settlement or jury award Date Reported reason Foreside Distribution $100,000 Piper Jaffray & Co $700,000 Citi $750,000 March 2010 Did not have custody or control over records of business-related electronic communications that its investment advisor clients sent or received. Accordingly, the firm could not easily access them without first requesting them from, and having such records subject to review by, each investment adviser client. Failed to establish and maintain a supervisory system along with written supervisory procedures designed to maintain and preserve all business-related electronic communications in an easily accessible place. Did not address the retention of electronic communications that registered representatives not employed by the firm send and receive May 2010 Failed to retain approximately 4.3 million s from November 2002 through December 2008 Failed to inform FINRA of its retention and retrieval issues, which impacted the firm's ability to comply completely with extraction requests from FINRA. It also may have affected the firm's ability to respond fully to requests from other regulators or from parties in civil litigation or arbitrations March 2012 The firm was moving from a backup tape-based retention system to a new journaling-based one but the new system s use of three component servers a mail server, a hub transport server and a journaling server experienced problems that went undetected. The new system used 58 mail servers in North America, and three of them did not function as expected, failing to properly transmit s to the archive for any of the individuals assigned to those mail servers during part or all of late 2008 through Failed to retain s sent or received by about 2,800 employees during this time; Finra estimates the number of s that weren t retained to be in the millions. Quality assurance failed to detect the problems before the upgrade or after it until

2 the fall of 2009, when customized configuration management software that effectively communicated with a central Citigroup Inc. directory was developed. Edgemont Capital Partners $30,000 U.S Financial Investments, Inc $25,000 ING $1.2MM Hallmark Investments, Inc. $15,000 October 2011 Contracted with a third-party vendor for purposes of retention, but did not implement an audit system regarding such storage and was therefore not aware that the third-party vendor did not adequately retain certain s, which resulted in the firm s failure to maintain certain s. January 2011 Did not store s in non-erasable, non-rewritable format; instead, the firm s vendor merely established a compliance folder on the firm s computer network where s were automatically forwarded, and the vendor apparently maintained spam s the firm received in a separate folder. This system also permitted firm employees to delete s from the compliance folder. February 2013 Failure to store s sent to or by registered representatives. Failure by ING Financial Advisers to store s sent to and from registered representatives with accounts hosted on an external server. Four firms failed to have a system to capture and store secondary addresses or so-called alias addresses. Four firms failed to store s sent to distribution lists, that were blind carbon copied to certain recipients and that were encrypted. Failure to store cloud s coming from a third-party software provider that were susceptible to being permanently deleted. Failure to change a system default setting that excluded s from review. March 2013 Failed to establish a reasonable supervisory system and procedures related to its retention and review of electronic communications. WSPs did not reflect the firm s intended practice of maintaining s in hardcopy format. The firm did not establish a system to confirm that all electronic communications were contemporaneously printed for retention. When the firm moved office locations it discovered that some of its business records, namely s maintained in hardcopy format, were destroyed by water damage. The firm first notified FINRA, in response to a FINRA Rule 8210 request,

3 that the records were destroyed; however the firm did not provide notification to the Securities Exchange Commission (SEC) and FINRA as SEC Rule 17a-11 required. LPL Financial $7.5MM May separate, significant system failures, which prevented LPL from accessing hundreds of millions of s and reviewing tens of millions of other s. Over a four-year period, LPL failed to supervise 28 million "doing business as" (DBA) s sent and received by thousands of representatives who were operating as independent contractors. LPL failed to maintain access to hundreds of millions of s during a transition to a less expensive archive, and 80 million of those s became corrupted. For seven years, LPL failed to keep and review 3.5 million Bloomberg messages. LPL failed to archive s sent to customers through third-party -based advertising platforms. Barclays Capital $3.75MM December 2013 From at least 2002 to 2012, Barclays failed to preserve many of its required electronic books and records including order and trade ticket data, trade confirmations, blotters, account records and other similar records in WORM format. Due to the issues being widespread and including all of the firm's business areas, Barclays was unable to determine whether all of its electronic books and records were maintained in an unaltered condition. Barclays failed to properly retain certain attachments to Bloomberg s, and additionally failed to properly retain approximately 3.3 million Bloomberg instant messages from October 2008 to May Met Life January 2014 From January 2007 to January 2012, Met Life distribution used an online portal

4 $30,000 Berthel Fisher $775,000 Morgan Stanley (State of Connecticut) $5 MM Deutsche Bank Securities $100,000 and content host to offer product information and training over the internet to registered reps on variable insurance products issued by its affiliated insurance companies. The portal contained an feature/capability that Met Life s wholesalers used to send variable product presentations and other materials to registered reps at other firms. The feature was also used to send invitations to online and inperson training sessions. System was most frequently used to inform registered reps t other firms that new sales material was available for download, and employees could add customized text to these messages. Met Life s compliance department was not aware that the system had capability and that it was being used to distribute materials and links. As a result, the firm failed to retain and review almost 10,000 unique s sent over the 5- year period. February 2014 At different times spanning a 6 year period from August 2007 to February 2012, failed to retain some s for certain domains. Neither Berthel Fisher nor its affiliate SM&R established or maintained WSPs concerning retention of s, nor did either firm effectively monitor the outside vendor charged with retaining s. Note fine related to overall Supervisory failures related to ETFs retention was a factor in the findings. June 2014 Failed to establish, enforce and maintain an adequate supervisory system, particularly with respect to supervisor access to employee ; the outsourcing of external surveillance to a third party; and ensuring individuals supervising the contractor personnel held appropriate licenses. Failed to maintain its records in a form readily accessible to the state s staff and failed to make the records readily available to the staff during an examination, and failed to keep certain compliance records true, accurate, and current. October system lexicon failed to detect client advisors communications concerning loans from customers, liens, personal bankruptcies, delinquent payments, bounced checks or other indications that a client advisor may have significant financial difficulties and/or violating applicable rules, laws and regulations

5 BNY Mellon, MBSC Securities, Pershing and Pershing Advisor Solutions $275,000 Commonwealth Financial Network $250,000 Deutsche Bank client advisor allegedly borrowed roughly $220,000 from a customer Once the system is revised, the Firm will review all of the incoming and outgoing electronic correspondence of its client advisors since January 2012 Results of the review, including a summary of any previously unreported required disclosure items or any findings of violations, will be reported to FINRA February 2014 Retention failure due to faulty configuration of the BlackBerry server in which s relating to Firms business were not properly journaled to the retention system and not retained consistent with SEC, FINRA and NASD rules Impacted s sent from a BlackBerry to an outside recipient that did not copy anyone in the organization May 2014 Commonwealth Financial Network failed to test its supervisory system during its software update and therefore did not identify that the tool used to review representatives outgoing s was no longer surveilling those s First month after upgrade, the firm failed to review outgoing s of one-half of the domains that maintained registered reps s; three months later all domains were affected Also, firm s IT department had ongoing contact with the vendor concerning remediation of the tool but failed to notify the firm s legal and compliance departments about the issues until more than 8 months after