Despite all the confusion today, there are a few basic things AdvisorVault has learned over the years about 17a-4 that will help keep costs as low as possible yet reduce the risk for small FINRA firms.
AdvisorVault, the experts on solving the data archiving demands of SEC rule 17a-4, announces a new guide for small FINRA firms.
AdvisorVault has been saying for years that data compliance is a necessary evil, and money spent trying to appease regulators does nothing for the bottom line and surely adds nothing to “operational efficiencies”. Also, firms can go years without ever being audited, but worse, when it does happen, no one knows what to expect when the regulator shows up. Sadly, it’s a crapshoot for compliance officers when they’re eventually asked to reproduce a sample set of electronic records from up to seven years back – which may not even be reviewed at all.
Read More: GlobalFintechSeries Interview with Chuck Klein, Chief Executive Officer & Founder at IMM
AdvisorVault has been lecturing firms, especially small ones, that they should constantly seek ways to keep data compliance costs as low as possible yet keep regulators happy. This is no easy task given all the confusion today, however, the best start is to understand the basics about SEC rule 17a-4. This doesn’t mean downloading and reading the whole 65-page document with its dozens of updates and amendments but, instead, understanding how to choose the most efficient technology while passing the electronic records request – the test a regulator will do during the audit where they’ll ask for a sample data set from the archive, whatever that may be.
Lots of Questions, Few Answers:
Many know that small firms don’t have in-house compliance or tech staff, and when they’re trying to navigate data compliance, new questions come up all the time. For instance, what kind of hard drives does one need to store data? Is the cloud compliant? Can everyone in the company simply store all their files in Dropbox? How about OneDrive? Is data in the cloud indexed? What about Office 365 or Gmail? Do they archive emails for 17a-4? If a small firm moved its office virtual, who does the disaster recovery? Does the cloud provider have to give them their business continuity planning procedure or is there another third party add-on? Do small firms even have to archive data in the cloud?
Unfortunately, there are few answers readily available, and FINRA is no help in this area; they are far behind, as they don’t have the in-house expertise to guide members in “best practice for electronic records retention,” yet they’re the first ones through the door handing out fines. Further, their on-site auditors aren’t up to date either: they still tell firms they must use worm disk for data storage. Where, in reality, that was changed in 2003 when rule 17a-4 was amended by the SEC to allow the use of software to retain data, independent of a hard disk. Essentially this means vendors of 17a-4 can archive data simply by allowing a specified expiry or retention period to block record deletion or alteration within their software programming. Then, after the expiry is reached or the retention period has lapsed, data can be deleted from the archive, thereby freeing space for reuse. A win-win for everyone, otherwise there will be piles of useless worm disks wasting space and money. Yet few firms are aware of this.
The Basics of 17a-4:
Nonetheless, despite all this confusion, there are a few basic things AdvisorVault has learned over the years about 17a-4 that will help keep costs low as possible yet reduce the risk. First, when it comes to data security, there is no mystery in proving to FINRA that a firm is keeping hackers off their system. It’s a simple matter of apply proper permissions and strong password policies to anything accessed from outside such as VPN connections, servers, and cloud systems. For example, making sure there’s a single user with admin permissions only and the password for this user is complex with frequent changes will keep regulators happy, no need to call in James Bond. Also, there’s this confusion among FINRA firms that putting data in the cloud automatically makes it non-compliant, that’s not true – in fact, FINRA has now migrated all their systems to the cloud themselves.
The reality is FINRA doesn’t care where data is stored. Their only concern is that it’s properly retained, which means: (1) a designated third party makes secondary copies of this data, (2), retains it for seven years in its original format, and (3) can reproduce this data if requested – the three essentials of rule 17a-4. AdvisorVault customers are moving to the cloud all the time and keeping compliant. They are going with Office 365, with OneDrive, Google Drive or Dropbox, then AdvisorVault simply plugs into whatever they choose and transfers it over to its 17a-4 compliant system, therefore acting as its customers D3P at the same time.
Another big mistake AdvisorVault often notices is firms thinking they need to archive everything or risk failing the audit. Again, rule 17a-4 is vague on this by saying firms must retain all communications including books and records, which leaves lots of interpretation these days; meanwhile, vendors take advantage of this confusion, trying to inflate their bottom line by selling archiving products that aren’t needed. It’s essentially a scare tactic, says AdvisorVault. For instance, there’s this crazy idea going around that all social media used by reps must be archived such as Twitter posts, Facebook and LinkedIn pages; essentially it’s believed that every website a rep decides to put their smiley face on should be backed up. It’s not the case. One can simply avoid this quagmire by creating an IT communication policy that clearly outlines what compliance is allowing people to communicate, then just say it’s only going to be email – and Bob’s your uncle.
Finally, when small FINRA firms are trying to keep data compliance costs as low as possible to avoid those nasty fines, there must be seamless checks in place to make sure no gaps appear as the firm grows. For example, when a new employee is added, any files that they create will automatically be captured in the 17a-4 archive, this applies to their email as well. Incidentally, the best way to accomplish this is using the cloud because archiving software can automatically detect new sites, folders, or email accounts within cloud services such as SharePoint OneDrive, Office 365, and the G Suite products. This is another great reason to move an office to the cloud since this option isn’t available with in-house email or file storage systems.
Read More: Bank Of The Future: How Banks And Fintechs Are This Decade’s Unlikely Duo
