Compliance and the Consumerization of IT

Possible Regulatory Risks in Certain Forms of Electronic Communication

Both new and existing communications platforms could accidentally or purposefully be used to circumvent the Investment Advisers Act Books and Records Rule (and analogous SEC, CFTC and international rules). These rules – which serve to create transparency for, and accountability to, customers and the investing community – require regulated entities to keep accurate, unaltered copies of communications relating to securities advice, transactions, performance and marketing, including when that information is delivered in electronic form. Records must also be protected against untimely destruction, and indicate the identity of the sender and recipient of each communication.

To underline the seriousness of these concerns, the OCIE recently undertook an examination initiative for investment advisers which was designed to obtain an understanding of the various forms of electronic messaging used by those firms and their personnel, and the risks of such use. As a result, the OCIE has offered new recommendations, through a newly issued risk alert, on how regulated investment advisers can ensure compliance with the Books and Records Rule and the Investment Advisers Act Compliance Rule with regard to electronic communication tools. 

One of the best ways to do this, in full conformance with the OCIE’s risk alert guidelines, is to choose a communications platform that facilitates regulatory compliance from the get-go. And many do not.

Consider platforms like Signal, for example, which allow anonymous communication, or Snapchat, which automatically destroy content after a set period of time. Likewise, services like text, SMS or instant messaging also frequently allow permanent message destruction at the option of the sender, and may not allow third-party viewing or backups of the information. Even though these platforms are known for their security features, these platforms may not fully meet compliance requirements, and so regulated companies may want to reconsider if deploying or using those solutions within their environments.