OCIE’s latest risk alert focuses on six areas:

• protection of investors’ assets
• supervision of personnel
• practices relating to fees, expenses, and financial transactions
• investment fraud
• business continuity
• the protection of investor and other sensitive information.

Who Needs to Know
Broker-Dealers and Investment Advisers.

Why It Matters
Broker-dealers and investment advisers should take heed of OCIE’s guidance and assess their compliance policies and procedures accordingly. Compliance should consider, in consultation with their counsel, documenting special reviews undertaken to address this particular risk alert to show continued vigilance during the pandemic.

On August 12, 2020, the SEC’s Office of Compliance Inspections and Examinations (OCIE), issued a risk alert highlighting COVID-19 compliance risks and considerations for broker-dealers and investment advisers. Through its exams, operations and outreach efforts with SEC registrants, OCIE has observed the impacts of COVID-19 on registrants and their resulting operational resiliency challenges.

OCIE’s latest risk alert highlights six categories of OCIE’s observations and recommendations for broker-dealers and investment advisers: (1) protection of investors’ assets; (2) supervision of personnel; (3) practices relating to fees, expenses, and financial transactions; (4) investment fraud; (5) business continuity; and (6) the protection of investor and other sensitive information.

Observations and Recommendations

1. Protection of Investor Assets. OCIE remains focused on the integrity of investor assets. Its risk alert notes that there is a greater risk of theft or loss of investor assets during emergency situations, including the current COVID-19 pandemic, which has caused some firms to modify normal procedures in processing investor deposits or asset instructions. OCIE suggests that firms review their policies and procedures around these issues, including steps for verifying the identify of investors and the authenticity of disbursement instructions. It also suggests that firms consider disclosing to investors that checks or assets mailed from physical office locations may experience delay due to COVID-19 issues.
2. Supervision of Personnel. OCIE’s risk alert emphasizes that firms retain their obligations to supervise personnel and investment activities even after shifting to a teleworking environment or making other changes in response to COVID-19. OCIE encourages firms to review and modify as necessary their supervisory and compliance policies and procedures around these issues. It also specifically calls attention to the impact of limited on-site due diligence reviews and other resource constraints associated with reviewing third-party managers, investments, and portfolio holding companies.
3. Fees, Expenses, and Financial Information. The risk alert notes that the recent market volatility and the resulting impact on investor assets and the related fees collected by firms may have increased financial pressures on firms. OCIE warns that the extreme pressures caused by COVID-19 may increase the risk for misconduct or error regarding financial conflicts of interest, and erroneous or improper fees and expenses charged to investors to compensate for lost revenue. OCIE recommends that firms review their fees and expenses policies and procedures, and consider enhancing their compliance monitoring during this time. OCIE’s concerns regarding fees and expenses echo those from its June 23 Risk Alert on Observations from Examinations of Investment Advisers Managing Private Funds, discussed in more detail in our previous Client Alert. Also, since 2014, Troutman Pepper has helped spearhead a biennial fees and expenses survey published by PFM, in which fund managers share how they deal with fees and expenses. An update to this survey will be published this fall. Listen to a podcast on the previous study results.
4. Investment Fraud. OCIE’s risk alert warns firms of the potential for increased fraud, including fraudulent offerings, during crisis situations such as the current COVID-19 pandemic. It urges firms to be vigilant for these risks, particularly when conducting due diligence or allocating investments. The risk alert also reminds registrants of their obligation to provide advice that is in the best interest of each investor, which requires a reasonable understanding of both the investor and the proposed investment. For more information on firms’ duty to act in the best interest of their clients, see our prior Client Alert on investment advisers’ fiduciary duty obligations, and see the following articles on broker-dealer’s standard of care under Regulation Best Interest: “ The Foundation Of A Regulation Best Interest Compliance Program,” “ Patchwork Of Broker Conduct Regs Complicates Compliance,” and “ Firms Should Stay Course Amid New Broker Standard Suits.” In particular, firms should be on the lookout for investments in companies purporting to have cures, vaccines, or curative drugs for COVID-19 infections, or access to personal protective equipment, testing, or other preventatives.
5. Business Continuity. OCIE notes that as COVID-19 triggered rapid changes to society and the workplace, firms should review their policies and procedures around business continuity planning to ensure they can operate effectively during emergency events. In particular, OCIE encourages firms to evaluate their work-from-home policies and procedures in light of COVID-19. The alert also suggests that firms give thought to security and support for firm facilities (which may be largely vacant), including, for example, additional security to protect servers and systems data. For a more detailed discussion on business continuity during the pandemic, see our prior article on the Do’s and Don’ts of Working from Home.
6. Protection of Sensitive Information. OCIE observed that a teleworking environment may increase risks of mishandling or accidental loss of investors’ personally identifiable information. OCIE’s risk alert attributes the heightened risk of losing confidential information to the greater number of servers and personal devices (i.e., computers, tablets and mobile devices) across which the information may be transmitted. This breadth of devices and broader dissemination of information increases opportunities for electronic fraud or theft, such as by phishing schemes. Because of this heightened risk, OCIE recommends firms undertake a review of their security systems, policies and procedures to evaluate any weaknesses or consider possible enhancements. For more information see our article from the February 27, 2020 issue of The Legal Intelligencer entitled “Report Provides Guidance on How Companies Should Address Cyber Risks.”

In addition to the observations and recommendations discussed above, the risk alert also includes links to a number of resources regarding the SEC’s response to COVID-19 and related activities. Broker-dealers and investment advisers should take heed of OCIE’s guidance and assess their compliance policies and procedures accordingly. Compliance should consider, in consultation with their counsel, documenting special reviews undertaken to address this particular risk alert to show continued vigilance during the pandemic.