Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program

Transcription

1 23 Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program By Craig D. Moreshead and Kelli A. Haugh Craig Moreshead is Vice-President at NCS Regulatory Compliance and manages compliance services for investment adviser clients including registrations, policies and procedures, and examinations. As an attorney with in-depth knowledge of federal securities regulations, Mr. Moreshead specializes in regulatory issues related to hedge fund and private equity managers. Previously, he worked for a large financial services company, where he provided compliance counsel to the registered investment adviser and fund family, broker-dealer, and business executives regarding compliance with federal and state regulatory requirements. Kelli A. Haugh serves as a Vice President for investment adviser services at NCS Regulatory Compliance. In this capacity, Ms. Haugh provides compliance and regulatory advice to investment advisers of all sizes on a broad range of topics. She holds a Certified Securities Compliance Professional designation and Series 65 license, and has been published in The Monitor, an Investment Management Consultants Association periodical. Ms. Haugh is a member of the Florida bar. She is currently practicing under the law offices of Dew, Foxman and Haugh, PLLC. With the appointment of a new Chairman and leadership changes at its Division of Enforcement, 2017 has been a year of transition for the Securities and Exchange Commission ( SEC ). Notwithstanding these shifts, the SEC has continued its focus on protecting retail investors both in its examination priorities and its enforcement efforts. In its 2017 Annual Report, the SEC s Division of Enforcement cited the protection of retail investors as a reason their resources are being directed to issues raised by investment adviser activity. The fact that investment advisory issues were included in the top three types of standalone SEC enforcement actions in fiscal year 2017 further underscores the SEC s focus on advisers. 1 This article focuses on four key regulatory developments for investment advisers in 2017, including updates to Custody Rule requirements, Form ADV amendments, advertising developments, and the DOL fiduciary rule. Other key developments discussed are pay to play, private equity conflicts, robo-advice, fund share class selection, and cybersecurity. Going forward into 2018, advisers can expect increased scrutiny from the SEC into their investment advisory practices, likely with emphasis in these particular areas. Advisers should therefore consider how these regulatory developments could affect their business and strengthen their compliance processes and business practices to prevent compliance deficiencies. Overview of Updates to the Custody Rule In its Risk Alert outlining the most frequent compliance deficiencies resulting from examinations of advisers, the SEC noted as a common deficiency the failure of advisers to recognize that they may have custody as a result of certain authority over client accounts. 2 Rule 206(4)-2 ( Custody Rule ) under the Investment Advisers Act of 1940 ( Advisers Act ) defines custody as holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them. Custody includes arrangements under which an adviser has the ability to withdraw client funds or securities maintained with a custodian upon the adviser s instruction to the custodian , Craig D. Moreshead and Kelli A. Haugh

2 24 Practical Compliance & Risk Management For the Securities Industry January February 2018 The SEC s Risk Alert noted that the failure to recognize custody, in some cases, resulted from having (or related persons having) powers of attorney authorizing them to withdraw client cash and securities. 4 Indeed, the confusion in the industry as to whether letters of authorization permitting advisers to disburse funds to third parties constituted custody was pervasive enough to prompt a request to the SEC for interpretive guidance. In a February 2017 SEC No-Action Letter ( IAA No-Action Letter ), the SEC clarified that any authorization granted to an adviser that permits the adviser to transfer client assets held with a qualified custodian to a third party upon its client s instruction constitutes custody. 5 Thus, advisers who have the ability to transfer client assets to third parties pursuant to a standing letter of authorization are subject to all Custody Rule requirements, including the obligation to obtain an annual surprise audit of the assets over which the adviser has custody. However, the SEC allowed advisers to avoid the surprise audit requirement provided the adviser complies with all of the following requirements: The client provides a signed written instruction to the custodian that includes the third party s name, and either the third party s address or the third party s account number at a custodian to which the transfer should be directed. The client provides written authorization to the adviser to direct transfers to the third party either on a specified schedule or from time to time. The custodian verifies the instruction (a signature review or other method to verify the client s authorization) and provides a transfer of funds notice to the client promptly after each transfer. The client retains the ability to terminate or change the instruction to the client s custodian. The adviser has no authority or ability to designate or change the identity of the third party, the address, or any other information about the third party contained in the client s instruction. The adviser maintains records showing that the third party is not a related party of the adviser or located at the same address as the adviser. The custodian sends the client, in writing, an initial notice confirming the instruction and an annual notice reconfirming the instruction. Notably, authorizations that do not grant an adviser discretion regarding the amount of the transfer, the payee, or the timing of transfers do not constitute custody. In related guidance, the SEC contemporaneously published an update to Question II.4 of its Custody Rule FAQs related to transfers of client assets between the client s own accounts. 6 Prior to the updated guidance, most in the industry understood that transfers made by advisers between a client s own accounts, either at the same or different custodians, did not constitute custody. In its update, however, the SEC clarified that these types of transfers would be considered custody unless the client provides the sending custodian a signed authorization listing the sending and receiving account numbers. Absent the requisite authorization, advisers are required to comply with the Custody Rule, including an annual surprise audit. Implementing Compliance Processes on Custody Considering that most advisers typically do not have control over the language in custodians forms, many do not realize that they have the types of authorizations that cause them to have custody over their clients assets. This holds true even if the adviser does not act upon such authorization. Advisers should consider the following three practices to avoid inadvertent Custody Rule violations related to the transferring of client assets: 1. Review all client custodial forms (or similar documents) for any language that grants the adviser the ability to transfer client assets. Determine whether the authorizations apply to transfers to third parties upon standing instruction from the client (e.g., client preauthorization is not required prior to each transfer), and if so, whether the language in the form complies with the conditions set forth in the IAA No-Action Letter. Advisers should also review the forms for language granting the adviser authorization to transfer client assets between clients own accounts, and if so, whether the form requires the sending and receiving account numbers to be listed. Compliance policies and procedures can be updated to include processes for reviewing all new custodial forms and authorizations, if any.

3 Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program 25 Many custodians have updated, or are in the process of updating, their forms to include language that allows advisers to comply with the conditions of the IAA No-Action Letter and updated Custody Rule FAQs. The SEC acknowledged that advisers need a reasonable time to comply with the new guidance; however, considering that it has been almost a year since the SEC published its updated guidance, most advisers should already have processes in place to comply. 2. Arrange for an annual surprise audit and comply with all other requirements of the Custody Rule if the conditions set forth in the SEC s updated guidance cannot be met. Advisers that do not meet the conditions that would otherwise exempt them from having custody or the annual surprise audit are required to enter into an agreement with an independent public accountant to conduct the surprise exam. Since the first audit must occur within six months of assuming custody over client assets, it is important that advisers enter an agreement with the independent public accountant as soon as possible after determining they have custody. Alternatively, these advisers must remove all authorizations triggering custody. 3. Remove all transfer authorizations that are not being used. It is common for advisers to not realize that they have custody due to maintaining outdated authorization forms. In reviewing all authorizations on file for all investment advisory clients, firms should remove any authorizations to transfer client assets that are not being used. Even if an adviser does not act on a transfer authorization, the firm will nonetheless be subject to the Custody Rule and related SEC guidance. Eliminating any unused transfer authorizations will help mitigate the risk of assuming inadvertent custody. Form ADV Part 1 Amendments Effective October 1, 2017, the SEC adopted amendments to the Form ADV Part 1 concerning three key areas: 1) additional information regarding advisers, including information about their separately managed account business, 2) a method for private fund adviser entities operating as a single advisory business to register using a single Form ADV ( Umbrella Registration ), and 3) clarifying technical amendments to certain Form ADV items and instructions. 7 Disclosures on Separately Managed Account Clients The Form ADV now requires advisers to report information on their separately managed account clients ( SMA clients ), which are all investment advisory clients except 1) registered investment companies, 2) business development companies, and 3) pooled investment vehicles, including private funds. Given the limited exclusion as to what constitutes an SMA client, most advisers will be affected by these additional disclosure requirements. Specifically, advisers are required to report the approximate percentage of their regulatory assets under management attributable to SMA clients by certain asset types, including exchange and non-exchange traded equity securities, U.S. government bonds, sovereign bonds, derivatives, registered investment companies, pooled investment vehicles, cash and cash equivalents, among others. In its 2017 Annual Report, the SEC s Division of Enforcement cited the protection of retail investors as a reason their resources are being directed to issues raised by investment adviser activity. Advisers with at least $10 billion in regulatory assets under management attributable to SMA clients are required to include this information based on both midyear and end of year values. Otherwise, only end of year values must be reported. Further, advisers with at least $500 million in regulatory assets under management attributable to SMA clients are also now required to report their use of borrowings and derivatives in separately managed accounts. Those with at least $10 billion in regulatory assets under management attributable to SMA clients must report midyear in addition to end of year information.

4 26 Practical Compliance & Risk Management For the Securities Industry January February 2018 Additional Information on Form ADV Part 1 In addition to information relating to SMA clients, the updated Form ADV Part 1 includes a variety of new questions. For example, advisers are now required to report all publicly available social media platforms that they use, excluding social media accounts of employees and platforms where they do not control the content. Firms are also now required to report additional The fact that investment advisory issues were included in the top three types of standalone SEC enforcement actions in fiscal year 2017 further underscores the SEC s focus on advisers. information regarding their 25 largest branch office locations, an increase from the previous requirement of 5. Additional information is also requested regarding wrap fee programs, Chief Compliance Officers (CCOs) who are outsourced, and private funds, among others. Certain questions on the types of clients were eliminated and replaced with requests for information based on regulatory assets under management attributable to client types as opposed to the percentage ranges based on total client numbers previously requested. Umbrella Registration An umbrella registration is a single registration filed by a filing adviser 8 and one or more relying advisers 9 who advise only private funds and certain separately managed account clients that are qualified clients (i.e. a client that satisfied the definition of qualified client under Rule 205-3) and collectively conduct a single advisory business. Since 2012, multiple private fund adviser entities operating a single advisory business have been permitted to file a single Form ADV on behalf of the filing adviser and relying advisers in reliance on the ABA No-Action Letter. 10 Most private fund advisers are organized for tax, legal, or regulatory reasons as separate legal entities operating a single advisory business. The SEC has now added Schedule R to Form ADV Part 1A to facilitate and simplify the registration and filing process for multiple private fund adviser entities. The conditions adopted effective October 1, 2017 for umbrella registration are the same as the conditions set forth in the ABA No-Action Letter except for the Form ADV disclosure conditions that have now been displaced by Schedule R. In summary, these conditions are: 1) the filing adviser and each relying adviser advise only private funds and clients in separately managed accounts that are qualified clients and whose accounts pursue objectives and strategies substantially similar to the private funds, 2) the filing adviser has its principal office and place of business in the United States, 3) each relying adviser, its employees and the persons acting on its behalf are subject to the filing adviser s supervision and control, 4) the advisory activities of each relying adviser are subject to the Advisers Act, and each relying adviser is subject to examination by the SEC, and 5) the filing adviser and each relying adviser operate under a single code of ethics and a single set of written policies and procedures implemented in accordance with rule 206(4)-7 under the Advisers Act and administered by a single CCO. Getting Ahead of the Annual Updating Amendment Most advisers will encounter the new Form ADV Part 1 questions with their next Annual Updating Amendment filing, due within 90 days of their fiscal year end. Given the substantial amount of additional data requested, advisers should start gathering information required to be responsive to the new questions, particularly information related to their SMA clients. As noted above, most advisers will be required to complete information on SMAs due to the very broad categorization of the types of clients that constitute SMA clients. Advisers need to be prepared to break down their regulatory assets under management by types of clients and types of securities. Therefore, firms should start gathering this information to ensure a timely Annual Updating Amendment filing. It is also very important that advisers prepare and report accurate information on their Form ADV. The SEC has stated it would use technology and data analytics to identify risks to retail

5 Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program 27 investors 11 and further noted in its Adopting Release that it believes the separately managed account information will improve its ability to conduct risk assessments and risk-based examinations effectively. 12 In this respect, material inaccuracies can not only result in compliance deficiencies, but it can also create a misleading representation of the risk that should be attributable to your firm. Developments in Advertising SEC Risk Alert on Most Common Advertising Deficiencies On September 14, 2017, the SEC s Office of Compliance Inspections and Examinations (OCIE) staff published a Risk Alert (the Advertising Alert ) describing the most common advertising deficiencies. 13 The Advertising Alert is a very important and helpful resource for advisers in the following two respects: 1) it aggregates in a single document the SEC s positions on the most common advertising violations, including performance advertising, one-on-one presentations, and past specific recommendations, and 2) it reaffirms longstanding staff positions as the current authority on key advertising issues. The Advertising Alert reflects issues identified in deficiency letters from over 1,000 adviser examinations. The Alert also summarized OCIE s observations regarding the Touting Initiative, which was launched in 2016 to examine the adequacy of disclosures when touting awards, promoting ranking lists or professional designations. Performance Advertising: Not surprisingly, one of the most commonly cited violations relates to advertising misleading performance results. Although SEC guidance regarding performance advertising has been relatively static, advisers continue to push the envelope touting performance that does not adhere to SEC requirements or industry best practices. In contravention of the SEC s seminal No-Action Letter on performance advertising, the Clover Letter, 14 advisers were found to have presented performance results without deducting advisory fees and lacking disclosures around the limitations inherent with benchmark comparisons. Advertising hypothetical and backtested performance continues to be a high-risk proposition for advisers and an area that should be avoided. One-on-One Presentations Advisers continue to distribute so-called oneon-one presentations which show performance gross-of-fees. In violation of longstanding SEC guidance, 15 advisers failed to include clear disclosure in such one-on-one presentations that the returns did not reflect the deduction of fees, that such fees would reduce client returns, and an explanation of the impact that advisory fees could have on the value of the client s portfolio. Claim of Compliance with GIPS While compliance with performance standards, such as the Global Investment Performance Standards ( GIPS ), is voluntary, firms that claim compliance with such standards must be able to demonstrate adherence to the performance standard s guidelines. Claims of GIPS compliance can provide a level of credibility to a firm s performance results and can assure prospective clients that the firm s historical track record is complete and fairly represented. Accordingly, the SEC scrutinizes claims of GIPS-compliant performance by advisers and has cited firms for claiming compliance with a performance standard (such as GIPS) when it was not clear that the firm complied with the performance standard s guidelines. 16 Past Specific Recommendations Rule 206(4)-1(a)(2) prohibits advisers from distributing any advertisement which refers to past specific recommendations which were or would have been profitable. The Rule s prohibition does not prohibit an advertisement which sets out a list of all recommendations (or offers to furnish such a list) made by the adviser during the preceding year, provided that the advertisement or list contains certain specific disclosure about the recommendations. The primary concern underlying this prohibition against advertising past specific recommendations is that the adviser could cherry pick and highlight profitable recommendations and omit unprofitable ones. The SEC continues to see advisers including selective specific past recommendations in advertisements without complying with Rule 206(4)-1(a)(2). In the Alert, the SEC also commented that advisers including past specific recommendations failed to satisfy the TCW Group No-Action Letter (permitted advertisement of five or more best performing holdings along with

6 28 Practical Compliance & Risk Management For the Securities Industry January February 2018 an equal number of worst performing holdings provided several representations are satisfied) 17 or the Franklin Management No-Action Letter (permitted advertisement of past specific recommendations selected using objective, nonperformance based criteria consistently applied subject to certain representations). 18 Compliance Policies and Procedures The SEC also found that many advisers violated Rule 206(4)-7 by failing to adopt and implement policies and procedures relating to certain advertising issues, including: i) the process for reviewing and approving advertising materials prior to their publication or dissemination, ii) determining clear parameters for which accounts were included or excluded from composite performance calculations, and iii) confirming the accuracy of performance results. SEC Examination Observations from Touting Initiative OCIE launched the Touting Initiative in 2016 to examine the adequacy of disclosures provided by advisers to clients when touting awards, rankings, and/or identifying professional designations in marketing materials. Through this initiative and as discussed in the Advertising Alert, OCIE staff have observed advisers publishing misleading advertisements containing references to thirdparty awards or rankings that failed to disclose material facts about such awards or rankings. Such material facts include the truth that payments were made in exchange for the ranking, or the reality that the ranking or award is many years old and no longer applicable. In addition, brochure supplements were found to contain references to professional designations that had lapsed or that lacked adequate description regarding the minimum qualifications required to attain such designations. New RIA Performance Record-Keeping Requirements The SEC adopted amendments to Rules 204-2(a) (7) and (a)(16) effective October 1, 2017 requiring advisers to maintain additional records related to the calculation and distribution of performance information. Any performance information provided to clients after the effective date must comply with the new records retention requirements. The purpose of the new performance record-keeping requirement is to enable SEC examiners to evaluate adviser performance claims in client communications. Summary of Changes The amendments to Rule 204-2(a)(16) require advisers to maintain records supporting performance claims in communications that are distributed or circulated to any single person, directly or indirectly, instead of the original criteria of ten or more persons. The amendments to Rule 204-2(a)(7) require advisers to maintain originals of all written communications received and copies of written communications sent by an adviser relating to the performance or rate of return of any managed accounts or securities recommendations. Concern Over Preservation of Records for Litigation One of the drivers for the rule change was the case In the Matter of Michael R. Pelosi. 19 Mr. Pelosi was charged with overstating his clients portfolio performance returns in quarterly and annual letters. Mr. Pelosi was then fined $60,000 and barred from associating with an investment company or adviser. Mr. Pelosi appealed the ruling, which was ultimately dismissed by the Commission because the record lacked an evidentiary basis from which to determine that the performance information was materially false or misleading. This outcome demonstrated to the SEC the disadvantages of not requiring advisers to maintain records forming the basis of performance calculations or performance communications. Impact of Rule Change The Rule amendments will have a significant impact on those firms that provide performance information to clients. This would include performance data distributed directly by an adviser through periodic statements or other client communications, or distributed indirectly by the adviser through the firm s custodian, broker-dealer or other third party on the adviser s behalf. It is important to note that Rule 204-2(a)(16) requires the retention of all account statements and all worksheets necessary to demonstrate the calculation of the performance or rate of return of all managed accounts. If an adviser, for example, sends a client a monthly report which shows

7 Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program 29 the account performance since inception 10 years ago, the adviser would be responsible for retaining the backup documentation and performance data calculations for that 10-year performance period plus 5 years from the date of production. The concern for advisers will be ensuring access to the information for the required time period. For advisers that rely on a third party for the performance calculation data, the adviser should confirm they will have continuous access to that data during the requisite time period. In light of the new performance recordkeeping requirements, advisers may want to reconsider whether to include performance reporting in client reports, or if possible, reduce the time-frame the performance period covers. Firms directly or indirectly distributing performance information and relying on third parties for performance calculation data should ensure access to the data during the retention period or should independently maintain the data as part of the firm s books and records. DOL Fiduciary Rule Timeline of a Long Strange Trip In 2017 the DOL Fiduciary Rule (the Rule ) experienced a roller-coaster ride of epic compliance proportions. Going into the year, financial institutions were feverishly working to develop policies and procedures and implement processes to comply with the Rule. At the end of 2016, the Department of Labor (DOL) had issued two rounds of FAQs and firms were working hard to digest the far-reaching impact of the Rule and develop new policies, procedures and processes to comply with it. Entering 2017 with this significant Rule on the horizon, broker-dealers, advisers, and other financial institutions poured immeasurable time and resources into compliance with the Rule. These efforts included development of new policies, procedures and processes, staff training and education, revision of client documentation, and refinement of advisory services and compensation structures. The Rule was originally scheduled to go into effect on April 10, On February 3, 2017, President Trump issued a memorandum directing the DOL to review the rule, and to rescind or revise it if it concluded that the Rule would adversely affect investors in terms of access to retirement products or advice, disruptions in the retirement services industry, or increase in litigation and prices for retirement services. On March 2, 2017, the DOL proposed a delay in the applicability date of the Rule to June 9, 2017 in order to complete a review of the Rule ordered as part of the Trump memorandum. On May 22 nd, DOL Secretary Alexander Acosta announced that the components of the Fiduciary Rule scheduled to go into effect on June 9 th would go effective on that date without further delay. On August 29, 2017, the Office of Management and Budget (OMB) approved the DOL s proposal for an extension of the Fiduciary Rule s transition period and delay of applicability dates from January 1, 2018 to July 1, As a result, the parts of the Rule not in effect as of June 9th (the Best Interest Contract Exemption; the Class Exemption for Principal Transactions in Certain Assets Between Investment Advice Fiduciaries and Employee Benefit Plans and IRAs; and the Prohibited Transaction Exemption for Certain Transactions Involving Insurance Agents and Brokers, Pension Consultants, Insurance Companies, and Investment Company Principal Underwriters PTE ) are delayed until July 1, Where Are We Now? There remains uncertainty whether the provisions delayed until July 1, 2019 will ever go into effect, and if they do, in what form. What is certain is that effective June 9, 2017, advisers providing advice to traditional and defined contribution plans, such as 401(k) plans, as well as to plan participants and to those who save through IRAs, are treated as fiduciaries under the Fiduciary Rule and have an obligation to adhere to Impartial Conduct Standards. The Impartial Conduct Standards consist of three components: (1) Advice must be in the best interest of the client at the time the advice is given; (2) Compensation must be reasonable as described in section 408(b)2 of ERISA; and (3) Statements about recommended investments, fees and compensation, material conflicts of interest, and any other relevant matters are not misleading at the time they are made. To comply with these standards, firms should have implemented processes and suitability forms to help ensure and document compliance with the best interest standard. In addition, firms are advised to conduct a periodic analysis to

8 30 Practical Compliance & Risk Management For the Securities Industry January February 2018 demonstrate reasonable compensation in line with peers or industry benchmarks. There remain open questions around the Rule, including its impact on private funds. The DOL Rule does not explicitly address private funds, but does not expressly exempt them. Private funds with retirement plan assets, representing less than 25% of any equity class of a fund, have traditionally not been deemed ERISA fiduciaries for the plan assets they hold. Rollovers into a private fund from another investment, however, could still be subject to the Impartial Conduct Standards. Another consideration for private funds is that certain communications, sales pitches and interactions among an IRA or a plan with a private fund could be considered a recommendation potentially triggering fiduciary status. Until there is more clarity regarding the Rule s applicability to private funds, fund managers are cautioned to closely scrutinize communications and sales materials to ensure that they would not constitute recommendations under the DOL Rule. Although written policies and procedures are not required yet under the Rule, advisers impacted by the Rule should consider adopting policies and procedures as a best practice to help ensure compliance with the Rule. The DOL will continue their review of the Fiduciary Rule and the possibility remains that modifications could be adopted prior to the Rule s full implementation on July 1, Other Key Regulatory Developments in 2017 Pay to Play Sweep The SEC began the year by sending a strong message in the pay-to-play arena settling charges with ten firms for violating the SEC s pay-to-play rule. The SEC has clearly increased its focus on pay-to-play issues and demonstrated this year a diminished tolerance for such violations. Based on the cases, the SEC does appear to take certain factors into consideration when assessing a penalty for violations of the pay-to-play rule, including whether the contributor had contact with the government client or was involved in the solicitation of investments, whether the adviser s compliance program effectively discovered the violative contributions, and whether there was a pre-existing personal relationship with the candidate. Of course, where there is evidence of a quid pro quo or corruption there is no leniency. Private Equity Conflicts From there were eleven enforcement cases against private equity managers, most of which related to inappropriate fee and expense allocation practices. In 2017, the SEC continued to scrutinize conflicts of interest in the private fund space. In September and October 2017 alone there were three enforcement actions, one involving management fee offsets, another relating to broken deal expenses, and a third involving a senior partner who defrauded fund clients by secretly billing them for designer clothing, spa services, and family vacations to Cancun and Rio. Electronic Investment Advice In February 2017, the SEC announced as part of its exam priorities that it would focus on advisers and broker-dealers offering automated investment advisory services, including robo-advisors that primarily interact with clients through online platforms. The SEC has expressed concern that the existing regulatory structure may not be equipped to address the digital advice model that is expected to grow exponentially over the next several years. The regulatory focus on automated service platforms is expected to continue. Specific areas of concern are: i) disclosure standards and cost transparency, ii) know your client and suitability requirements, iii) algorithm design and oversight, iv) design of compliance programs to address unique challenges, v) trading practices, vi) data protection and cybersecurity, and vii) business continuity. Share Class Selection The SEC continued to focus on conflicts of advisory personnel who are also registered representatives of a broker-dealer, which influence investment recommendations in favor of share classes with higher loads or distribution fees. In August, the SEC took enforcement action against an adviser for failing to seek best execution and for failing to adequately disclose the conflict of interest to clients. 20 The adviser, dually registered as an adviser and broker-dealer, invested clients in share classes with 12b-1 fees instead of lower-fee share classes that were available without 12b-1 fees resulting in $1.93 million of revenue the firm would not have collected had clients been invested in the lower-fee shares.

9 Key Regulatory Developments Over the Past Year and Their Impact on Your Compliance Program 31 Cybersecurity The SEC issued a risk alert in August summarizing observations from OCIE s Cybersecurity 2 Exam Initiative. 21 Overall, SEC staff noted an improvement in awareness of cybersecurity risks and implementation of certain best practices since the Cybersecurity 1 Initiative. The SEC did observe the following issues frequently observed in cybersecurity exams which firms should consider in order to strengthen their cybersecurity programs, including: i) policies/ procedures were not reasonably tailored (e.g. provided employees with only general guidance, very narrowly scoped, or vague), ii) policies/procedures were not enforced or did not reflect actual practices, and iii) inadequate system maintenance (e.g. failure to install software patches) and operational safeguards (e.g. stale risk assessments and inadequate remediation of high-risk findings from penetration tests and vulnerability scans). Conclusion Looking forward into 2018, investment advisers should evaluate the key regulatory developments from 2017 to help ensure that they re well-positioned to comply with those compliance priorities. The SEC has offered greater transparency into their examination focus areas with their Risk Alerts and other guidance. Advisers should leverage these resources to help improve their compliance programs and avoid potential compliance deficiencies. Advisers must also pay particular attention to the new requirements recently enacted, including the new disclosures on Form ADV, performance record-keeping requirements, and the SEC s updated custody guidance. ENDNOTES 1 U.S. Securities and Exchange Commission, Division of Enforcement, Annual Report, A Look Back at Fiscal Year 2017 (November 2017). 2 U.S. Securities and Exchange Commission, Office of Compliance Inspections and Examinations, Risk Alert: The Five Most Frequent Compliance Topics Identified in OCIE Examinations of Investment Advisers (February 2017). 3 Advisers Act Rule 206(4)-2(d)(2)(ii). 4 U.S. Securities and Exchange Commission, Office of Compliance Inspections and Examinations, Risk Alert: The Five Most Frequent Compliance Topics Identified in OCIE Examinations of Investment Advisers (February 2017). 5 Investment Adviser Association, SEC Staff No-Action Letter (Feb. 21, 2017). 6 Staff Responses to Questions About the Custody Rule, Updated as of February 21, Form ADV and Investment Advisers Act Rules; Release No. IA (August 25, 2016). 8 As defined in Form ADV, a Filing Adviser is an investment adviser eligible to register with the SEC that files (and amends) a single umbrella registration on behalf of itself and each of its relying advisers. 9 As defined in Form ADV, a Relying Adviser is an investment adviser eligible to register with the SEC that relies on a filing adviser to file (and amend) a single umbrella registration on its behalf. 10 See American Bar Association, Business Law Section, SEC Staff Letter (Jan. 18, 2012), available at ( 2012 ABA Letter ). 11 U.S. Securities and Exchange Commission, Division of Enforcement, Annual Report, A Look Back at Fiscal Year 2017 (November 2017). 12 Form ADV and Investment Advisers Act Rules; Release No. IA-4509 (August 25, 2016). 13 SEC Office of Compliance Inspections and Examinations, National Exam Program, The Most Frequent Advertising Rule Compliance Issues Identified in OCIE Examinations of Investment Advisers (Sept. 14, 2017), available at: gov/files/risk-alert-advertising.pdf. 14 See Clover Capital Mgmt., Inc., SEC Staff No-Action Letter (Oct. 28, 1986) (IM staff indicating that an advertisement that includes results that do not reflect the deduction of advisory fees, brokerage or other commissions, and any other expenses that a client would have paid or actually paid may be misleading). 15 See Investment Co. Institute, SEC Staff No-Action Letter (Sept. 23, 1988) (IM staff indicating that performance results presented on a gross basis in a one-on-one presentation with certain disclosures may not be misleading). 16 See, e.g., ZPR Investment Mgmt., Inc., Advisers Act Rel. No (Oct. 30, 2015) (SEC Opinion). 17 The TCW Group, SEC Staff No-Action Letter (Nov. 7, 2008). 18 Franklin Management, Inc., SEC Staff No-Action Letter (Dec. 10, 1998). 19 In the Matter of Michael R. Pelosi, Investment Advisers Act Release No (January 14, 2011). 20 In the Matter of Cadaret, Grant & Co., Inc., Investment Advisers Act Release No (August 1, 2017). 21 OCIE Risk Alert, Observations from Cybersecurity Examinations, August 7, This article is reprinted with permission from Practical Compliance and Risk Management for the Securities Industry, a professional journal published by Wolters Kluwer Financial Services, Inc. This article may not be further re-published without permission from Wolters Kluwer Financial Services, Inc. For more information on this journal or to order a subscription to Practical Compliance and Risk Management for the Securities Industry, go to pcrmj.com or call