SEC Fires Off Warning on Privacy Regulation

The Securities and Exchange Commission is warning advisors and broker-dealers in a just-released Risk Alert to review their policies and procedures regarding Regulation S-P, the privacy rule, as a host of deficiencies are being spotted in exams.

The Office of Compliance Inspections and Examinations provides a list of compliance issues related to Reg S-P, the primary SEC rule regarding privacy notices and safeguard policies of investment advisors and broker-dealers.

Reg S-P requires BDs and advisors to provide a “clear and conspicuous notice” to customers that accurately reflects the firm’s privacy policies not less than annually, and to deliver a clear and conspicuous notice explaining their right to opt out of some disclosures of non-public personal information about the customer to nonaffiliated third parties.

(Related: Will Trump Memo Slow Down SEC’s Reg BI?)

The agency charged Voya Financial Advisors Inc. last September with violating Reg S-P or the Safeguards Rule and the Identity Theft Red Flags Rule.

In the Tuesday Risk Alert, OCIE details the most common deficiencies or weaknesses cited in exams.

Examiners observed registrants that did not provide Initial Privacy Notices, Annual Privacy Notices and Opt-Out Notices to their customers. “When such notices were provided to customers, the notices did not accurately reflect firms’ policies and procedures,” the alert states.

Also, advisors and broker-dealers also did not have written policies and procedures as required under the Safeguards Rule.

For instance, policies and procedures were cited that did not appear to be reasonably designed to safeguard customer information on personal devices.

OCIE staff observed “registrants’ employees who regularly stored and maintained customer information on their personal laptops, but the registrants’ policies and procedures did not address how these devices were to be properly configured to safeguard the customer information,” the alert states.

Policies and procedures were also found that did not address the inclusion of customer personally identifiable information (“PII”) in electronic communications.

OCIE examiners observed registrants that did not appear to have policies and procedures reasonably designed to prevent employees from regularly sending unencrypted emails to customers containing PII, according to the alert.

Inadequate training was also observed. Firms’ policies and procedures that required customer information to be encrypted, password-protected, and transmitted using only registrant-approved methods “were not reasonably designed because employees were not provided adequate training on these methods and the firm failed to monitor if the policies were being followed by employees.”

— Related on ThinkAdvisor:

• Will Trump Memo Slow Down SEC’s Reg BI?
• New Jersey Unveils Proposed Fiduciary Rule