On the face of it, FINRA's recent $500,000 fine of Raymond James for violating a privacy rule may seem like small potatoes for a firm that reported $1.27 billion in net revenues last quarter.
Moreover, there was very little about the case that would be considered unusual to the recruiting and hiring conventions within the highly competitive brokerage business. That is, save for the outcome, which saw Raymond James agree to a censure and a fine to settle allegations that it violated the rule known as Regulation S-P.
"The practice is quite prevalent. The action by FINRA is not all that prevalent. In fact, FINRA has not really taken much action with Reg S-P," says Brian Hamburger, an attorney and CEO of MarketCounsel, a business and compliance consulting firm. "They seem to be treating Reg S-P as a traffic incident as opposed to something that they're really genuinely concerned about."
FINRA declined to comment for this story, though a source familiar with the regulator's activities indicates that it pursues a handful of cases each year involving registered reps who bring nonpublic customer information with them when joining a new firm. In those cases, the charges often turn on the failure of the reps to obtain consent from the clients whose accounts they are looking to transfer to the new broker-dealer, taking more information than the clients had authorized or moving that information through an insecure channel, such as unencrypted email.
Even if cases involving privacy violations under Regulation S-P remain a relative rarity, FINRA authorities appear to be taking a closer look at the movement of personnel within the broker-dealer sector, according to Thomas Lewis, an attorney at Stevens & Lee who is based in the firm's office in Lawrenceville, N.J.
"FINRA is getting more aggressive with reviewing transitions [of] advisors from one brokerage to another in regard to the information they're permitted to take," Lewis says.
The industry has made some efforts to set rules for itself. Nearly 1,400 firms have signed on to the Broker Protocol, a voluntary industry framework laying out guidelines for recruiting and handling trade secrets that dates back more than a decade.
But the protocol is a self-regulatory effort, and it stands apart from the enforceable Regulation S-P, which is generally seen as a stricter standard governing the movement of clients' data.
As a result, many firms have come to see Reg S-P as a competitive weapon, according to Hamburger. He says it's not uncommon for a brokerage that is losing advisors to a rival firm "to have tipped their hand" to FINRA in an effort to raise suspicions about how client information was handled.
"Effectively, these firms have been using Reg S-P as the new restrictive covenant," he says. That rule is viewed as "one of the few remaining tools to retain customer information," he adds.
Hamburger faults regulators for failing to flesh out the details of the privacy regulation to stipulate what information breakaway brokers are permitted to take with them when they change firms. The SEC, the original author of Reg S-P,
Usually, FINRA will initiate an investigation into the handling of client information when the broker-dealer losing personnel indicates that an internal review of the departing employee is underway on the U5 form that serves notice of a termination to the regulator, according to Lewis. If that box is checked, FINRA will almost certainly open an inquiry, he says.
"I think you can almost guarantee that you're going to get a letter from FINRA," Lewis says.
In situations like the Raymond James case, FINRA isn't likely to initiate a privacy inquiry unless it hears from the firm losing the advisors, he explains. "What we haven't been seeing is FINRA just unilaterally opening an investigation of certain transitions."
SAFEGUARDING CLIENT INFORMATION
In as part of this case, Raymond James submitted a letter of acceptance, waiver and consent without admitting or denying any wrongdoing. Those letters, known as an AWC in shorthand, have become a standard response to a regulatory probe that, if contested, could extend into a drawn-out legal dispute.
A spokeswoman for Raymond James, says that the firm takes the issue of client privacy "extremely seriously," and that it has "detailed practices in place to safeguard" personal information.
"Significantly, FINRA's recent action is not related to a data breach or other security event," the spokeswoman says. "Rather, client information was only shared between companies for business-related purposes as advisors transitioned from one firm to another. No information was compromised in a way that would allow for illegal use. Raymond James has established a plan to address the issues raised by FINRA."
The spokeswoman declined to elaborate on the changes the firm is making in response to FINRA's charges.
Raymond James had previously run afoul of Reg S-P in 2012, when it was hit with a censure and a $250,000 fine for disclosing clients' personal information.
Lewis contends that, in most cases, particularly involving large, established firms such as Raymond James, there likely isn't any malicious intent to misuse client information.
"I think what you'll find is [that] these reputable firms want to comply with the guidelines, they want to do it the right way, but sometimes mistakes occur," Lewis says. "Often times what happens is you have an advisor who steps over the line."
But amid mounting scrutiny of how firms are handling recruiting, hiring and transition issues, Lewis urges firms and individual to error on the side of caution as they move clients' accounts, and to adhere to the letter of both the industry's code of conduct and FINRA's rules.
"I think the takeaway is don't think that you can take more information than you're permitted under the protocol and Reg S-P," he says. "And if you do, you better be ready for the investigation."
Read more:
