Recommended Action

Note that FINRA will be comparing firms’ liquidity planning. Will this be done in examinations and/or sweep letters? At least ensure that your plan meets the elements laid out in Regulatory Notice 15-33.

Are you testing data and formulas? When was the last time you looked at financial reporting data integrity? Does some of your reporting rely on multiple system feeds, manual entries or spreadsheets? Consider vendor solutions that can consolidate this data and remove manual processes. If you have been using the same vendor for years, perhaps consider newer and more adept solutions (ones that can manage financials across market platforms).

Attend FINRA’s  Cybersecurity Conference:

I’m a fan of consistency, if applicable. For business continuity planning and cybersecurity,

 a firm will take many similar actions for both. When possible, use the same action. This helps not only when updating policies, but when carrying out drills or unfortunately, responding to an event.

Review every system for testing capabilities prior to production. Testing environments can be expensive, so how do you test without a testing environment? Can you test in controlled productions? In terms of unauthorized access, consider a technology solution to ensure that access is regularly updated. Relying on a manual process, such as managers reviewing access annually, is risky.

Take heed of global warming and update your natural disaster business continuity plan. Do you review your plan for terrorism threats? Terrorist tactics continue to evolve, and those changes should be incorporated into your plan. Your systems and personnel should be categorized correctly to identify mission critical functions during any emergency.

A Brief History of AML Categorization in FINRA Annual Priorities Letter:

2018 - Operational and Financial Risks

2017 - Operational Risk

2016 - Supervision and Risk Management

2015 - Sales Practice

2014 - Business Conduct

2013 - Business Conduct

2012 - Not listed as a priority

Notice that AML changed from a conduct risk to an operational risk. AML is no longer viewed as a sales problem, but a systems problem (controls and monitoring). Keep this in mind when reviewing and updating your program. Also consider the specific training required for technologists and operational employees, that is different than salesperson training.

What action has your firm taken to address the new beneficiary rule? And if you are the Head of AML, why would you accept a rubber stamp independent test? With personal liability on the line, and of course the firm's interest in mind, encourage your firm to invest in quality independent testing.

Confirm that the stated fees in your policies and procedures are the actual fees you charge. If compliance is not responsible for short sale fees, coordinate with operations.

Recommended Action

Order and trade management systems for all fixed income securities need to be automated. Manually entering trades into systems that may or may not connect to the back office are no longer acceptable. TRACE data by nature is more difficult to report. Firms need to automate fixed income orders and trades, not only for data integrity, but also for best execution reviews.

Your equity order management system (OMS) surveillance can no longer be the firm’s only trade surveillance tool. Manual data, accurate data and data transparency are all significant obstacles to creating a cross market surveillance system. While Fintech and Regtech vendors are working to address this cross market requirement, it has proven difficult to create software with the ability to ingest, digest and produce reliable surveillance from cross market activity. Firms should continue to monitor Regtech solutions that can handle cross market surveillance concerns.

FINRA continues to develop and improve on its surveillance systems that create alerts. Firms can expect to see more regulatory inquiries, and they should be able to detect these alerts prior to FINRA’s detection.

As with all other market integrity categories, the theme is market surveillance. FINRA expects firms to discover potentially fraudulent behavior before they do.

If there’s a market correction, you don’t want to be caught with your “shorts down.” Check your short sale procedures. Review your automated controls and ensure that they’re effective. Demonstrate that you have tested and reviewed your process and systems.

Ensure that you’ve done your annual review. Have you actually tested your policies, or just drafted them? In our recent experience, trader limits as well as annual market access testing, are weaknesses for many firms. In the case of a market disruption, lacking market access controls could be detrimental to a firm's financial stability.

How often does your best execution committee meet? Do your best execution reviews contain relevant information that can be deciphered, or are exceptions like finding a needle in a haystack? If you utilize a vendor, when is the last time they tested the system? Are they able to respond in a timely manner to questions on exceptions or data? Make sure that you’re monitoring and supervising your best execution reporting vendor.

Update your AML program and training to include reporting of illicit activity involving the senior investor exploitation. If you already specify certain types of suspicious activity within your policies/training, include ‘defrauding senior investors.’ Most importantly, ensure that your monitoring section references potential AML responsibilities. Review the FINRA 2017 examination and priorities letter and ensure you’ve implemented the referenced controls in your compliance program.

Understand how cryptocurrencies, their exchanges and their futures operate, behave and interact. Determine your firm’s activity. Are your customers investing in cryptocurrencies directly through your firm? Are your sales people advising your customers on the purchase and sales of cryptocurrencies? Is your firm capital protected in case of severe volatility of cryptocurrency futures? Have you monitored and reviewed funds being sold to determine whether they include cryptocurrencies?

Review margin disclosures. Have they perhaps “fallen off” documents or are the outdated? Test your margin surveillance to ensure its correctly calibrated.

Ensure trade and operations surveillance are coordinated to identify improper use of SBLOCs, as well as concentration levels.

Bottom line, don’t swindle your customers. Sell good products at reasonable prices and disclose how your firm profits. Senior investors, complex products, DOL fiduciary rule, fee disclosures and reasonableness are all reviewed under FINRA suitability regulations.

If you haven’t automated employee trading and outside business activities, you need to! It’s street practice, regulatory expectation and less expensive than manual reviews. Good practice is to require outside business activities to be reviewed by employees annually, but also supervisors should review all past approvals annually.

Just as you did before, monitor your high-risk brokers and activities and surveille speculative and complex products.