How to Protect Your Practice From Cyberthreats

With all the focus recently on cybersecurity, can you give some insight into the main areas advisors should look at?

FINRA’s latest findings on cybersecurity best practices, available on its website, have some very helpful information. A few ideas, however, really jump out at me.

First off, FINRA emphasizes the need for risk assessments. You can’t begin to develop a cybersecurity policy or implement procedures until you know where your exposure is.

Second, FINRA notes that firms should create and test incident response plans.

It’s all well and good to have a written policy and procedure, but as with any emergency, you don’t know how people and systems will react in a crisis. Testing your response plan is a must, much like conducting fire drills.

Make sure also that your procedures address not only containment and eradication, but also making customers whole.

Another good point that FINRA raises is that firms need to make sure they perform strong due diligence on their vendors (and not just once, but on an ongoing basis) to address cybersecurity risks that arise from those relationships.

Finally, while staff training is vital, even well-trained staff members can inadvertently expose the firm to attack through, for example, the unintentional downloading of malware.

For complete details on the issues advisors should know to protect their practices, FINRA’s “Report on Cybersecurity Practices” provides a good starting point. To read the report, go to http://bit.ly/1M3CuKZ.

I recently got into some trouble with my employer for running an advertisement (which I thought had been approved) regarding IRA rollovers. While we can assist clients with IRA rollovers, we’re not permitted to recommend specific transactions to our clients in connection with an IRA rollover. I don’t understand this policy as I thought I would be doing right by the client to recommend what I consider to be better securities for my client’s IRA than in their 401(k). What should i have done?

Due to the inherent conflicts of interest that can arise when a registered representative recommends that a client roll over a 401(k) into an IRA sponsored by the rep’s broker-dealer, FINRA and the SEC have begun taking a closer look at IRA rollovers, particularly where registered reps recommend clients sell off securities in their 401(k) and purchase other investments.

FINRA has stated that, whether in advertisements or verbal marketing campaigns, it would be false and misleading to imply that a rollover to an IRA sponsored by the broker-dealer is a retiree’s only choice, or only sound choice.

As with all advertisements and other communications with the public, any communications with clients discussing IRA rollovers or their fees must be fair, balanced and not misleading.

For example, the brokerage firm may not claim its IRAs are free when the client will incur costs related to the account or the investments.

While the rules don’t prohibit broker-dealers or registered reps from recommending specific transactions in regard to IRA rollovers, because of the conflicts of interest and the sometimes burdensome communications rules, many broker-dealers will prohibit their representatives from making such recommendations altogether.

If a broker-dealer does prohibit such recommendations as part of the IRA rollovers of their customers, then the broker-dealer should have policies and procedures in place with adequate training of personnel that is reasonably designed to ensure  no recommendation occurs.

Similarly, if registered representatives are authorized to provide educational information only, a firm’s written supervisory procedures should be reasonably designed to ensure recommendations are not made.

Regulators have made it clear that they want investors to get the information they need to make an informed decision, and firms need to make sure their policies and procedures are reasonably designed to detect recommendations that are otherwise prohibited by the firm’s policy.

I’m a compliance officer for a brokerage firm. We’re beginning to look at alternative mutual funds. I’m wondering if there are any special rules on how they are marketed.

Based on industry data, sales of alternative mutual funds have seen significant increases recently.

Between 2008 and 2014, AUM in alternative mutual funds have grown by about $250 billion.

While there is no standard definition of alternative mutual funds, a fund will generally be considered an alt fund if its strategy involves nontraditional asset classes, nontraditional strategies or illiquid assets.

FINRA has said firms should refer to such funds based on their specific strategies, rather than combining them under one generic category of alt funds. Additionally, firms must ensure communications regarding alt funds accurately and fairly describe how the products work, and ensure descriptions are consistent with the representations in the funds’ prospectuses. You must also make sure clients to whom you recommend these funds are suitable for this type of investment.

Beyond that, I’m not aware of any specific ad or marketing guidelines specific to alt funds.

I left my previous firm over two months ago. I have a new job lined up but I’ve just found out that my previous employer has not filed the U5 yet and I can’t register with my new firm until it does. I’ve called several times and left messages but no one will return my calls. I would also point out that I didn’t leave on the best of terms and I’m worried that if I make waves they’ll put something negative on my U5, which will hold up my registration even longer. What can I do?

Under Article V, Section 3 of the FINRA bylaws, firms are required to file a Form U5 no later than 30 days after terminating an associated person’s registration.

You can file a complaint with FINRA and the firm may very well find itself on the receiving end of sanctions. However, you are correct that your former employer could be vindictive and put something negative on your U5.

Unfortunately, that happens more often that you’d think. However, the firm would be risking additional sanctions if it did so since it is required to be truthful and accurate in its filings.

Additionally, the firm could open itself  up for a defamation action. It’s amazing how often a firm, through its personnel, of course, will allow vindictiveness to blind it to the risks and costs of sanctions and lawsuits in an attempt to merely cause a former employee grief.

Nevertheless, even if you’re absolutely in the right, having to pursue a complaint or arbitration action doesn’t help you in the short term to get registered.

One option before you go the adversarial route might be to take yourself out of the equation and have your new employer reach out to your old firm and talk to it “employer to employer.”

Another option might be to reach out to FINRA’s Ombudsman’s Office to see if it could intervene.

If neither of those works, then you will have no choice but to file a formal complaint. 

Read more:

For reprint and licensing requests for this article, click here.
Practice management
MORE FROM FINANCIAL PLANNING