Business Practices Flashcards
1
Q
Unethical vs. Fraudulent
A
For something to be fraudulent, it will exhibit a willful intention to deceive someone about a material fact. Must deliberately mislead someone. Ex: Purposely falsifying data on registration statement.
An unethical practice is traditionally done without intent. An untrue statement is considered unethical and “not” fraud.
2
Q
Misleading Statement
A
Exaggerating the performance or inaccurately stating the issuer earnings, or projected earnings of a security to induce someone’s interest. Misleading statements can be potential fraud.
3
Q
Define Guarantee
A
Guaranteeing is a big no no. it’s defined as to guarantee principal, interest, or dividends.
4
Q
When is the use of the title Investment Council permitted?
A
In circumstances where acting as an advisor is the main part of their business. The advisor using this title must have a large part of the business consist of supervisory services. Also, is they provide continuous advice regarding a clients investments based on client needs.
5
Q
Can Advisers use acronyms like RIA for registered investment adviser?
A
No it is strictly prohibited
6
Q
Omissions of material fact
A
Withholding a material fact is a fraudulent act. Examples are: Acquisition, Industry changes, changes in competition, changes in management and risks associated with particular investments.
7
Q
Inflated language
A
Using inflated language can be misleading. Ex: “can’t miss” or a “sure winner” are not acceptable
8
Q
Is Spreading Rumors unethical or fraudulent?
A
Fraudulent and is prohibited. Creating rumors to cause changes in the price of a security can result in prosecution at both federal and state levels.
9
Q
Does the Administrator approve of securities for sale?
A
No. An gent or IAR cannot state that the Admin approves a security for sale. They also cant misrepresent the nature of their own registration or their firm.
10
Q
If being registered as an agent doesn’t constitute approval by the Admin, what does it mean?
A
It just means they satisfied the conditions set out by the state
11
Q
Bona Fide knowledge
A
Agent or IAR cannot state that a security is about to be listed without having Bona Fide knowledge
12
Q
When must a prospectus and disclosure documents be provided? And what must be on the front cover?
A
No later than the due date of the confirmation of the transaction. If a security is registered federally and at state level, there must be a legend on the front cover and state that the securities have not ben approved or disapproved.
13
Q
If a security is ONLY registered under the State, what are the three things that the cover legend must say?
A
- The security or offering has not been approved, disapproved, endorsed or recommended by the state Admin
- The investor should make an independent decision whether it meets their investment objectives and risk tolerance
- The Admin has not confirmed the accuracy, truthfulness, or completeness of the disclosure
14
Q
Where should the Risk Disclosure be located on the Prospectus and what must it define?
A
- The prospectus should provide a detailed list of material risk factors associated with the offering. This list should immediately follow the cover page
- Risks associated with the offering should be prioritized in order, with the most significant first
15
Q
Risk Factor Captions
A
Should stand out by italicizing, bolding, or underlining items to help the reader to quickly comprehend the nature of each particular risk
16
Q
Advertising must be accurate, balanced and complete. What are potential problems?
A
- Nonfactual data
- Material based on conjecture
- unfounded or unrealistic claims or assertions
17
Q
What are other forms of advertising?
A
Brochures, fliers, pictures, graphs or other displays
18
Q
Advertising
A
Communication that goes to more than once person and offers new or additional services. Admin can require filing with the State but cannot make this request of exempt or federal covered securities or persons
19
Q
When are Testimonials and Endorsements permitted?
A
If there is a written agreement with the promoters and the communications are supervised
20
Q
In terms of Testimonials and Endorsements with advertising, when is the promoter exempt from a written agreement?
A
If the promoter is affiliated with the adviser or is the promoter receives $1,000 or less in compensation (de minimis). The following disclosures must be provided:
- Client status
- Compensation status
- Conflicts of Interest
21
Q
Advertisements may not:
A
be misleading or false, state that reports will be free, unless they are free, and represent a chart or graph that determines buy and sell times, or contain any untrue statement of material fact, or be false and misleading.
22
Q
How may recommendations be provided?
A
With fair and balanced communications regarding any associated risks
23
Q
Are Third Party ratings allowed in Advertising?
A
No, unless the nature of the ratings is disclosed
24
Q
Under what conditions is performance information allowed for Advertising?
A
Must meet the following conditions:
- Net performance is included with any advertised gross performance
- Specified time periods provided
- Results include all portfolios with similar investment policies, objectives and strategies
- Performance of subsets of portfolio must include entire portfolio
- Hypothetical Performance may only be used if the advisor has adopted and implemented policies to ensure the performance is relevant based on intended audience
25
Is one on one communications Advertising?
No
26
Where must marketing practices be provided to?
Advisers must provide information regarding marketing practices to the Admin or SEC
27
In terms of Customer Interactions, what may a BD or IA NOT do?
* Employ any device, scheme, or defraud a client
* Engage an any act, practice, or course of business which operates as fraud
* Engage in dishonest or unethical practices
28
Suitability
If suitability cannot be determined, the recommendation cannot be made
29
Selling Dividends and why they are bad for investors
Encouraging a client to purchase a security just prior to the payment of a dividend. The security price is reduced by the dividend upon payout and the investor may suffer a loss in taxes owed on the receipt of the dividend.
30
If there is no Discretionary Authority, does each transaction have to be approved?
Yes by the client. Unauthorized trading could occur when an agent is attempting to churn the customers account to gain commissions. Unauthorized trading violations can also occur when attempting to do what is in the best interest of the client
31
How is Trading Authorization provided?
By giving Power of Attorney (POA) to the 3rd party
32
Limited Power of Attorney
Allows the 3rd party to place trades, but not remove assets
33
Full power of Attorney
Allows 3rd party to place trades and remove assets
34
Durable POA?
Remains legally enforceable if the client becomes retarted
35
Non-Durable POA
Ceases if client becomes retarted
36
How many days can Discretionary transactions occur?
10 days under **verbal discretion.** Within the first 10 days of the first transaction, the advisory firm must have written authorization on clients file
37
Action (Buy or Sell), Asset (Name), or Amount
If a customer gives agent instructions to buy a stock, but doesn't specify all 3 A's, they need written discretionary authority with manager approval to place trade
38
How long does an agent have to place a trade if the client specifies the 3 A's verbally?
It's only good for the business day
39
For Brokerage Accounts, when must discretionary trades be approved?
Must be approved by Principal **promptly** after each trade. All discretionary accounts must be reviewed at frequent intervals to review suitability.
40
Prudent Man Rule
Directs advisers “to observe how persons of prudence, discretion and intelligence manage their own affairs, not in regard to speculation, but in regard to the permanent disposition of their funds, considering the probable income, as well as the probable safety of capital to be invested.” Applies to IA's
41
Uniform Prudent Investor Act (UPIA)
Federal act guideline for fiduciaries that manage client assets. Fiduciaries include: Trustees, executors or IA's. The act specifically addresses trustees. It states that trustees must only make investment decisions based upon the needs of the beneficiaries.
42
What are the 5 adjustments to the standards of Prudent Investing?
* Portfolio must be measured by its total return
* Must be correlation between risk and reward based upon the clients risk tolerance
* Fiduciaries can invest in anything appropriate to clients objectives and risk tolerance
* Fiduciaries are expected to diversify client investment risks
* Fiduciaries can delegate investment functions to others, as long as safeguards are in place
43
Churning
Encouraging or completing a greater number of transactions considered unreasonable given the clients needs and is prohibited. The trades are excessive in size and frequency and the primary objective is to generate additional commissions or fees. Even if they're profitable, doesn't mean it's okay
44
Cash Account
Account which customer pays for each trade in full. They are the typical accounts customers open
45
What information is required to open a Cash Account?
Customers name, SSN, physical address and date of birth. **Only need Principals signature**
46
Margin Account
Customer borrows money or securities from a BD to partially pay for trades. More risky than Cash Accounts.
47
What is needed to open a Margin Account?
NASAA states that a signed **margin agreement** is needed **promptly** after the initial transaction
48
What do Margin Agreements contain?
Signed hypothecation agreement, signed credit agreement, and may contain a loan consent agreement
49
Hypothecation Agreement
Permits BD to use some of customers securities as collateral for a bank loan in order to finance the margin account debt
50
When must a customer receive a margin risk disclosure document?
At or before opening the account and on an annual basis
51
What information is required at a minimum for a an Option Account to open?
* Investment objectives
* employment status
* estimated annual income
* estimated net worth
* estimated liquid net worth
* marital status and dependents
* age
* investment experience
52
After the Options account form is approved, where must the RR take the form?
To the Registered Options Principal
53
When must a customer receive a copy of the Characteristics and Risks of Standardized Options or Options Disclosure Document?
At or before the time when the option account is approved
54
Once the account is approved, how long until the BD obtains the signed Options Account Agreement?
15 days
55
What type of option account is not always approved?
Uncovered option writing. Not all option accounts are approved for all types of option trading
56
Trust Accounts
The grantor, or creator of the trust, will include a statement of intent in the trust agreement to specify the needs of the beneficiaries in their decisions
57
In the absence of instructions for the Trust Account, How should the trustee make decisions?
Use their best judgement
58
Revocable Trust
Allows the grantor to retain control over the assets in the trust and change beneficiaries
59
Irrevocable Trust
Terms cannot be changed and the grantor gives up control of the assets once trust is created
60
What rights do customers have in terms of being provided information?
Customers have the right to receive certain information upon request and if not provided in a timely manner is prohibited
61
What are Unreasonable Delays?
BD's and IA's are engaging in unacceptable business practices if there are unreasonable delays in payment of customer free credit balances upon request or delays in placing purchased securities into customer accounts
62
Commingling
Mixing client and firm securities and is prohibited. May use omnibus account where advisory firms aggregate all client securities into one account.
63
Is it okay to borrow and lend to customers?
NO. Unless the customer is a bank. NASAA does not allow borrowing from friends or family but FINRA does
64
Can Agent's and IAR's share in profits or losses with customers?
Agents and IAR's may not share directly or indirectly in profits or losses without prior written agreement and approval of firm
65
What does FINRA say in accordance to sharing?
Must be proportionate to contributions to the account
66
What does USA say about sharing with customers?
Must be approved but don't address proportionate sharing. Under no circumstances may an agent, IAR or firm share in client losses as a way pf guaranteeing the client against loss, nor may clients be guaranteed a profit on any transaction
67
Unsolicited Trade
Trades executed upon customer request. Agents must follow instructions of client but client must be informed if trade is unsuitable
68
If a trade is Unsolicited, what has to be included on the Order Ticket?
Documentation regarding communication of suitability concerns must be placed in the clients file and order tickets must say **Unsolicited.**
69
In terms of Sales Charges. what is unethical?
* Not communicating sales charges
* Representing a fund as a no-load if there is a sales charge or is there is a 12b-1 fee greater than .25%
* Breakpoint Sales - Intentionally not disclosing a discount
* Selling Dividends
* Making a recommendation of classes of mutual funds that are not suitable. Ex: recommending only Class B shares
70
When selling or recommending investment products at a bank, what must an adviser do?
Must make clear distinctions between bank products and investment policies
71
Guidelines must be followed when selling or recommending securities:
* Investment services must be in separate area from where deposits are taken. Firms name must be clearly displayed and services should be clearly identified and SIPC logo should be displayed
* Supervisory personnel of Investment Firm and reps of state securities authorities are permitted access to financial institutions premises to inspect the books and records
* Management of investment firm must ensure the networking arrangements designates the responsibilities of all parties
* At, or prior to, the opening of the account, the firm must disclose orally and in writing, the securities recommended, purchased or sold in a transaction are:
* NOT insured by the FDIC
* NOT deposits and are not guaranteed
* Subject to investment risks and MAY lose value
This is known as NOT, NOT, MAY which is an interagency statement. Must obtain a written acknowledgement of these disclosures during account opening.
72
Is Charging for Services allowed?
Yes. It is an acceptable practice for BD's to charge separate fees for services provided to clients such as interest or dividends, securities transfers, appraisals, and custody. However, these charges must be reasonable and not inequitable
73
Splitting Commissions
Agents may not do this with anyone who's not an agent of same or affiliated BD, and both reps must be registered in the state
74
Some things to remember about Commissions
* If a BD is charging higher than normal commission this must be disclosed
* If a BD or agent is receiving other compensation relating to client transactions, this must be disclosed
* Discounting commissions and waiving fees is acceptable, except where a fixed sales charge applies, like mutual funds
75
How can a Conflict of Interest be handled?
By disclosing it to the client. Client can decide whether the conflict is serious enough to change investment decision. Failure to disclose is prohibited.
76
What is a Control Relationship?
This means the BD is affiliated with the Issuer of the security in the transaction, such as selling stock in the BD's parent company to an investor. BD must disclose this since it's a conflict of interest and must be done verbally prior to transaction. If done verbally, there must be a follow up written disclosure at or before the transaction (settlement date).
77
Can a Broker Dealer act as a Broker and Dealer in the same transaction?
LOL. no
78
Other Conflicts of Interest that must be disclosed:
* Investment companies providing incentives or rewards to agents for selling their products
* BD;s publishing favorable research reports after being involved in securities underwriting
* Securities professionals having a financial interest in any security being recommended
* Offering products of affiliated BD's or investment companies
79
Trading Practices
Arrangement of a purchase or sale
80
Quotes
Broker Dealers indication of the price at which it is willing to buy or sell a security
81
What is necessary to disclose with Quotes?
* Must make sure it's accurate and not misleading
* When the BD gives a quote, they must honor it at that price and amount
* Conditions on its quote must be clearly expressed
82
Offers “At the Market." If broker dealer is only active participant, what are some sketchy things that could happen?
Price set by supply and demand. If it's a less traded security and the BD is only active participant in the market, they are controlling securities price. Saying that the transaction was done “at market” would be fraudulent
83
Market Manipulation
Creating the impression that a security is actively trading or using false market quotations. This is unethical and fraudulent
84
Wash Trade
Simultaneous purchase and sale of same security by same person, giving the appearance of active trading without a change in ownership. Or, repeatedly buying shares of stock from one broker and selling with another broker, giving impression of higher volume activity
Side Note: If you have a washed sale, you cannot deduct the loss on the stock
85
Arbitrage
Simultaneous buying and selling of a security at 2 different prices in 2 different markets, resulting in profit without risk. This is acceptable
86
Matched Sales
When two or more parties are involved in a pattern of buying and selling a security to give the appearance of active trading. There is only once manipulator in a wash trade, but two or more with match sale.
87
Painting the Tape
Series of purchases, or series of sales, rather than paired buys and sells. Intent is to give false appearance of a trend in a stock's price and lure other investors into the same trading activity.
88
False Transaction Reports
Perpetrators distribute false reports of transactions, a less expensive, but still illegal method of manipulation
89
Insider Trading
No violation if there was no trade. May not reveal inside information unless it's to a supervisor or principal and must be reported to compliance department
90
Chinese Walls
Stops material inside information from flowing between certain departments
91
Can you imply to a client that inside information will benefit them?
No. Inside information can't be used to persuade client to do trade. This is considered a false statement and is in violation of anti-fraud
92
Trading ahead
Firms are not allowed to trade in their own accounts based on information that is received from their own underwriting and research
93
Selling Away
An agent representing a BD in a security transaction may not sell investments the BD does not offer, without disclosure to the firm. Can result in disciplinary action by Admin and BD. Agents may not even know they are Selling Away when it may be an unregistered security transaction. They must inform the BD
94
Outside Securities Account
An agent must notify BD when opening any account through another firm or financial institution, in which securities transactions are made. Statements from non-employing firm must be made available to employing firm. These do NOT apply to purchases of Mutual funds and variable annuities or to firms that handle these products. Firms may allow or disallow this
95
Failure to make Bona Fide Offering
This is a violation. Some BD's use their position to keep a portion of new issues that are high in demand for their own accounts, thereby earning additional profits over and above their underwriting compensation. This is unethical
96
Parking
Involves purchasing stock in another persons account, which the agent later takes out of account for personal benefit
97
Acceptable Business Practices
* Arbitrage - can be confused with wash trade, but is acceptable
* Short Selling
* Attempting to overcome a client's objective if recommendation is suitable
* Failing to pay in full for a transaction in a Margin Account
* Recommending a speculative investment as long as it's suitable
98
Brochure Rule
Investment Adviser must provide clients with Brochure. May be copy of advisers ADV Part 2 (both 2A and 2B)
99
What 6 things must be provided in Part 2B (Brochure Supplement)
* Education
* Business history
* Disciplinary history
* Outside business activities
* Compensation
* Supervision
100
Annual Update of Form ADV
For IA's, the USA requires the firm to file an updated form ADV with the state within 90 days of IA firms fiscal year end
101
If there are material changes to Form ADV, when must customers receive it?
Within 120 days of fiscal year end. If there are no material changes, no updated brochure is necessary
102
When must Federal Covered Advisors file an updated Form ADV?
Within 90 days of IA's fiscal year end
103
Do Wrap Accounts use fees or commission?
Flat fee for all advisory services and transactions
104
How are Wrap Account fees calculated?
Based on Assets under management and may factor in the number of transactions if investor is active
105
Do Wrap accounts require a Brochure?
Yes. How fees are charged and calculated must be disclosed in the wrap account brochure and must be delivered to clients under brochure rule
106
What is the case for material changes with Wrap Accounts?
Brochure must be filed immediately and an amendment or sticker that specifies changes must be provided to investors.
107
When must Non-material changes in Wrap Accounts be filed?
Must be filed with Admin within 90 days of Advisors fiscal year end
108
What is required to send to customers if Advisers charge wrap fees?
Part 2A - Appendix 1 instead of the normal Part 2A. Appendix 1 discloses the features and expenses specific to wrap account arrangements
109
Initial Delivery. The IA must deliver the brochure to each advisory client:
* At least 48 hours prior to client signing an advisory contract
* At the time of entering into an advisory contract, if the advisory client has the right to terminate the contract without penalty within 5 business days after entering into the contract
This delivery requirement does not apply to contracts with investment companies, such as mutual funds, or contracts for “impersonal” advisory services
110
How often does an IA have to offer a Brochure to clients?
Annually. The IA must annually offer delivery or offer in writing to deliver, without charge, a copy of its brochure upon written request of the client. If client does make request, it must be mailed within **7 calendar days**
111
When is a delivery offer not required for brochures?
With Investment Companies or contracts for impersonal advisory services requiring a payment of less than $500 annually
112
For Investment Advisory Contract, USA requires these to be in writing and disclose:
* Services to be provided
* Advisory fees charged and the formula
* Adviser will not share in customer profits
* Term of contract and how it may be terminated by either party
* Any prepaid fee to be returned in the vent of contract termination or non-performance
* Whether there's discretionary authority
Specific disclosure will be made when the adviser has a self-interest in any transactions being made
113
Assignment
Contract must state the adviser may not assign the contract to another person without clients written consent
114
What must a contract contain if an IA is structured as a Partnership?
A provision stating that it must notify the customer of any change in membership of the partnership, within a **reasonable time** after change
115
Exculpatory Provisions Prohibited
Advisory contracts may not contain clauses “forgiving” the adviser for violations of the USA. Also known as hedge clauses and are considered invalid
116
What is Performance based Compensation?
IA's are generally prohibited from being compensated based on capital gains or capital appreciation in a customers account. One exception is if customer meets financial requirements. May charge PBF's to qualified clients
117
Qualified Client
Defined as a customer with 2.2 million net worth (not including primary residence) or 1.1 million under advisers management
118
Does NASAA require disclosures for Performance Based Fees?
Yes in writing before any advice is rendered. The advisor must disclose that this fee arrangement may cause the adviser to make riskier investments, that payment is made on unrealized appreciation and how that's calculated, the time frames used to measure performance and any indexes used in comparison for performance measurements
119
Soft Dollar Arrangements
Alternative way for IA's to pay for products and services received from a BD using client commission revenue. They are considered assets of the client
120
How may Soft Dollars be used?
Purchase of investment related services, like research services, that benefit the client. These services must assist the money manager in carrying out investment decisions Adviser must review each soft dollar arrangement
121
Examples of Soft Dollar Uses
* Publications or services that provide info about value of securities
* Analyses concerning issuers, industries, securities, economic factors and trends, portfolio strategies and performance of accounts
* Electronic services that provide market data to an advisers analysts
* Computer software that assists in the investment decision making process
Cannot use clients assets to benefit themselves. Ex: Overhead expenses or training a new BD
122
What is Custody?
Having control of other person's assets and the Admin must be notified when taking control of assets
123
What requirements are necessary for IA's to take custody of customer funds?
Must maintain $35,000 net worth
124
Can assets under custody be Commingled?
Not with an Advisers account. Advisers may open 1 omnibus account in their name to hold customer funds. May be commingled with other customers.
125
Qualified Custodian
Assets must be held by one. Customer must be given written notice of the name of the qualified custodian and location of account.
Qualified Custodians are:
* FDIC insured financial institution
* Registered BD who holds clients assets
* Registered futures commission merchant who holds clients assets
* Foreign financial institution holding assets for clients
126
How often must statements be sent to customers?
**Quarterly**
127
What's the issue with Inadvertent custody?
It could cause the adviser to be in violation of custody rules if not handled properly. This happens if an adviser mistakenly receives a clients funds or if a third party check is mistakenly accepted
128
How many days does an adviser have to return funds to client in the case of Inadvertent Custody?
3 business days. They could also forward the check to the 3rd party. If they follow these instructions, they will NOT have taken custody
129
Agency Cross Transactions
IA facilitates the sale of the securities from one of their clients to another
130
Why does Agency Cross Transactions create conflict of interest?
Since the Adviser is acting as a broker for each side. The adviser must disclose **prior** to trade and obtain permission to trade
131
Blanket Authorization
Allows IA to execute agency crosses for clients without notifying the client prior to each trade
132
What are the four things needed to engage in agency crosses?
* Disclosure, in writing, of conflicts inherent in agency cross transactions
* Confirmations for each agency cross transactions must disclose or offer to disclose all compensation the IA has received or will receive
* An annual summary of agency cross transactions for their account
* Notification that the client may revoke a blanket authorization at any time
133
Can the advisor recommend an agency cross transaction?
No. Cannot recommend an agency cross transaction to both sides of the trade. Only 1 of 2 clients, either the buyer or the seller, must have approached the adviser about buying or selling; the adviser cannot initiate it.
134
Principal Transaction
IA is trading from own account to client
135
What is more serious, an agency cross transaction or a Principal Transaction?
Principal Transactions since its a conflict of interest and there are no blanket authorizations permitted. The adviser must get written authorization prior to each transaction.
136
What is the exemption for a Principal Transaction, referring to prior written approval?
There is an exemption to this requirement if the transaction is based on publicly distributed written material
137
What are Publicly Distributed Written Materials?
Refers to materials that are paid for by recipients and sent to at least 35 persons. These are NOT deemed to be Principal Transactions
138
Can an IA provide a report or recommendation to a customer from someone other than the adviser?
NO. It is unethical to provide a report or recommendation that is not from the adviser without disclosing it to customer. It is misleading to represent someone else's work as their own.
Side Note: Restriction does not apply with published research reports or statistical analysis to help with advice decisions by IA
139
Deemed to be Fraudulent
* Recommending unregistered, non-exempt securities
* Recommend an unregistered BD to handle transactions
* Activities that would defraud clients
* Unreasonable Fees
* Failing to disclose discounts
* Using hedge clauses (excupulatory provisions) in contracts
* Trying to limit client options of civil remedies or arbitration
140
When is using the internet not considered transacting business?
As long as the communication provides general information
141
For agents and IARs using internet communication, the following must apply:
* Affiliation with a BD or IA must be disclosed. The employing BD and IA must review and approve the content
* The BD or IA will authorize the use of information on the products and services included in internet communication
* The agent or IAR is acting within the scope granted by the employing BD and IA
* A legend must state that the BD, agent, IA or IAR must be registered or exempt from state registration requirements to transact business in a specific state
142
Why must there be an internal mechanism established for internet usage?
To make certain that prior to direct communication with client in the state, the BD, agent, IA or IAR is first registered, or exempt, in the state
143
What must Firm's make sure of when using a link to 3rd Party Sites?
Firms often have links to 3rd Party sites. Must make sure 3rd party doesn't have false or misleading content
144
What are Firm's liable for when firms are preparing content to 3rd party sites?
This is called **“entanglement”** and are liable for misleading information. If firm endorses the 3rd party content, they have **adopted** the content and are liable for information provided. There must be a disclaimer if the firm is not involved with entanglement or adoption. In these cases, the 3rd party communications are not deemed to be communications of the firm and are NOT subject to monitoring. Firms do monitor 3rd party sites to make sure information is not misleading, just in case
145
What is the most critical area of compliance risk facing financial services?
Cybersecurity and it's defined as “the protection of investor and firm information from compromise through the use of electronic digital media”
146
What is a problem firms face from regulators in terms of cybersecurity?
Regulators approach enforcement from a risk management perspective, rather than rule-based
147
In terms of Cybersecurity, Regulators look at many key areas, such as:
* **Governance and risk assessment/risk managemen**t
* **Data access controls and date loss prevention -** data encryption and strong passwords. Making sure requests to transfer funds are authenticated. One specific area of concern is ensuring that any requests to transfer funds are properly authenticated. Most BDs and IAs have received at least one fraudulent fund transfer request
* **Technical Safeguards -** using anti-virus and antimalware software
* **Vendor Management -** cyber attacks as a result of access to firm's systems. Firm's should consider due diligence, such as security audits on vendors who have access to sensitive firm systems
* **Incident Response Planning -** Has the firm established and implemented policies and procedures for addressing a cyberattack when they occur?
* **Training -** Firms must have written policies and procedures for continuing training
* **Cybersecurity Insurance -** Firms are not required to have insurance but it is helpful
148
The FBI identified 3 main categories of cyberattack
* **Organized crime groups -** Primarily threaten the financial services sector
* **State Sponsors -** foreign governments that are interested in obtaining data from major manufacturers, government agencies and defense contractors
* **Terrorist Groups -** seeking to disrupt or destroy critical institutions and infrastructure
* Side Note: “hacktivists” groups that launch cyberattacks to make political points
149
Different forms of Cyber Attacks
* **Malware -** viruses, spyware, worms
* **Denial of Service -** intended to overload a computer system and make it unavailable. For example, an attack on a BD could cause harm by making it impossible for customers to access their accounts
* **Phishing -** attacks and tricks users into disclosing sensitive information through email
150
The Policies and Procedures for Protecting Customer Information must be designed to:
* Ensure the security and confidentiality of customer records and information
* Protect against any threats or hazards to the security or integrity of customer records and information
* Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer
This information may not be given to anyone else without the clients permission, unless required by law.
For example: An IA receives a subpoena in a divorce case for information about one of its clients, who is a party to the proceedings. The adviser must comply with the subpoena.
151
Must try to collect as much PII as possible including:
* Drivers license number
* Passport number
* Street Address
* Email Address
152
PII Defined
Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individuals identity, such as name, SSN, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linkable to an individual, such as medical, educational, financial and employment information
153
Identity Theft and Red Flags
Red flags rule states that firms should identify red flags, detect red flags, respond to red flags, and update their programs periodically. (Identify, Detect, Respond, Update) Some laws require covered entities to notify state agencies of data breached that exceed a certain threshold
154
What is the purpose of the Customer Identification Program?
To enable the BD to form reasonable belief that the individual is who they claim to be
155
How long do Customer Identification records need to be retained for?
5 years after record was made. SSN is not a form of ID
156
Can a firm use non-documentary identification to verify identity?
Yes. Common forms are contacting the customer, obtaining the information from a consumer reporting agency, and checking references from other financial institutions
157
Social Media
Firms must have access if used for business purposes
158
Affinity Fraud
Tool used by criminals to gain trust of victims by claiming to be members of the same identifiable group, such as religious affiliation, race, m=national origin, or profession. Social media makes this easy for con artists
