Digital assets (including cryptocurrencies, coins, and tokens). • OCIE’s examinations of digital asset market participants, such as broker-dealers, trading platforms, and investment advisers, will focus on the risks digital assets present to retail investors. Among other things, OCIE will continue to monitor the offer and sale, trading, and management of digital assets. Where digital assets are securities, OCIE will also examine market participants for regulatory compliance including, among other things, portfolio management of digital assets, trading, safety of client funds and assets, pricing of client portfolios, compliance, and internal controls.
Cybersecurity. • OCIE will continue to focus examinations on, among other things, proper configuration of network storage devices, information security governance generally, and policies and procedures related to retail trading information security. OCIE will also evaluate cybersecurity practices at investment advisers with multiple branch offices, and those that have recently merged with other investment advisers. These examinations will specifically evaluate governance and risk assessment, access rights and controls, data loss prevention, vendor management, training, and incident response.
Anti-money laundering (AML).
• In 2019, OCIE will continue to examine broker-dealers to ensure that they have policies and procedures in place that are reasonably designed to identify suspicious activity and illegal money-laundering activities.
In particular, OCIE will focus on whether broker-dealers are meeting their obligations to file suspicious activity reports and robustly and timely conducting independent tests of their AML program.Select areas and programs of FINRA and MSRB.
• FINRA - OCIE will focus its examinations on FINRA’s operations and regulatory programs as well as the quality of FINRA’s examinations of broker-dealers and MAs that are also registered as broker-dealers.
• MSRB - OCIE will focus its examinations of MSRB on evaluating the effectiveness of MSRB’s policies, procedures, and controls in light of MSRB’s broad mandate to regulate municipal securities transactions.Our Take
Registered investment advisers, broker-dealers, registered funds, and other market participants should carefully evaluate their existing policies and procedures in light of OCIE’s identified 2019 examination priorities. However, OCIE is clear that these priorities are not exhaustive and registrants should not become myopic.
“(T)he scope of any examination is determined through a risk-based approach that includes analysis of the registrant’s operations, products offered, and other factors. This risk-based approach often results in examinations that address key aspects of the SEC’s regulatory oversight, such as the disclosure of services, fees, expenses, conflicts of interest for investment advisers, and trading and execution quality issues for broker-dealers.” Registrants are reminded that OCIE’s efforts “remain firmly grounded in its four pillars: promoting compliance, preventing fraud, identifying risk, and informing policy” and they should conduct their annual review of their compliance policies and procedures from a similar broad and risk-based vantage point.
Kelley Howes serves as vice chair of law firm Morrison & Foerster’s Investment Management Group. She can be reached at [email protected].