OCIE Issues Risk Alert on Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P

On April 16, 2019, the SEC’s Office of Compliance Inspections and Examinations (OCIE) published a risk alert identifying some of the Regulation S-P compliance issues it observed in recent examinations of SEC-registered investment advisers and broker-dealers. Regulation S-P is the primary SEC rule regarding privacy notices and   safeguard policies of investment advisers and broker-dealers. OCIE’s risk alert is intended to assist firms in providing compliant privacy and opt-out notices, and in adopting and implementing effective policies and procedures for safeguarding customer records and information, under Regulation S-P.

The most common deficiencies or weaknesses observed by OCIE included the following:

• Privacy and opt-out notice delivery failures. Failure to provide initial or annual privacy notices and opt-out notices or failure to provide notices accurately reflecting a firm’s policies and procedures.
• Lack of policies and procedures. Failure to adopt written policies and procedures in whole or in part, including failure to include policies and procedures related to administrative, technical and physical safeguards.
• Policies not implemented or not reasonably designed to safeguard customer records and information. Failure to implement or adopt policies reasonably designed to (1) ensure the security and confidentiality of customer records and information, (2) protect against anticipated threats or hazards to the security or integrity of customer records and information, and (3) protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to customers.

Specific issues observed by OCIE staff related to, among other things, the following:

• inadequate policies and procedures to safeguard customer information on personal devices;
• inclusion of personally identifiable information (PII) in electronic communications;
• inadequate training and/or ongoing monitoring of policy implementation;
• use of unsecure networks to transmit customer PII;
• failure to follow policies and procedures with respect to outside vendors;
• failure to identify all systems on which firms maintained customer PII;
• insufficient incident response plans;
• unsecure physical locations;
• dissemination of login credentials; and
• retention of access rights by former employees.

OCIE’s announcement and a link to the risk alert.

SEC Staff Seeks Comment on the Application of the Custody Rule to Digital Assets and Issues Associated with Trades That Do Not Settle on a Delivery versus Payment Basis

On March 12, 2019, the staff of the SEC’s Division of Investment Management issued a letter to the Investment  Adviser Association (IAA) seeking industry input on the application of Rule 206(4)-2 under the Investment Advisers   Act of 1940 (the Custody Rule) to digital assets, as well as on issues arising from custodial trading practices that are not processed or settled on a delivery versus payment (Non-DVP) basis. In general, the staff is seeking to determine whether revisions to the Custody Rule could be helpful in addressing these topics.

Under the Custody Rule, it is a fraudulent, deceptive or manipulative practice for an investment adviser to have custody of client assets unless the  adviser complies with certain requirements or  an  exception applies. In  2003, the SEC amended the Custody Rule’s definition of “custody” to include, among other things, arrangements under which an adviser is permitted to withdraw client funds or securities maintained with a custodian upon the adviser’s

instruction to the custodian. In a footnote to the adopting release for the 2003 amendments, the SEC discussed what is commonly referred to as the “authorized trading” exception. The SEC stated that an adviser’s authority to issue instructions to a broker-dealer or a custodian to effect or to settle trades does not constitute “custody.” Custodians,     the SEC explained, are generally under instructions to transfer funds (or securities) out of a client’s account only upon corresponding transfer of securities (or funds) into the account—i.e., a “delivery versus payment” arrangement which minimizes the risk that an adviser could misappropriate client funds or securities. As the SEC staff noted in its recent letter to the IAA, the footnote did not address authorized trading of securities that do not settle on a delivery versus payment basis. The SEC staff stated that questions surrounding Non-DVP trading should be considered by the SEC, adding that amendments to the Custody Rule are on the SEC’s agenda. The staff, through the Division’s Analytics    Office, has launched an information gathering initiative on Non-DVP practices. 

As to digital assets, the SEC staff—noting the rapid growth in the digital asset market—seeks to inform its consideration of how digital assets’ characteristics impact the application of the Custody Rule.

The staff encourages input from all interested parties. Comments should be submitted to IMOCC@sec.gov with “Custody Rule and Non-DVP Trading” or “Custody Rule and Digital Assets,” as applicable, inserted in the subject line. The staff did not provide a deadline for comments.

The SEC staff’s letter to the IAA, which includes various questions on the foregoing topics.

NEW RULES

NFA Adopts Swaps Proficiency Exam Requirement for Associated Persons

On March 25, 2019, the National Futures Association (NFA) adopted rule amendments and a related interpretive    notice that impose a swaps proficiency exam requirement on associated persons (APs) of NFA member futures commission merchants, introducing brokers, commodity pool operators and commodity trading advisors engaged in Commodity Futures Trading Commission (CFTC) regulated swaps activity, as well as APs of swap dealers and major swap participants. The NFA seeks to ensure that APs engaging in swaps activities can satisfy a minimum proficiency standard that tests both their market knowledge and their knowledge of regulatory requirements involving swaps activities. The NFA’s proficiency requirements will be administered through an online learning program, including individual training modules covering specific topics and related examinations.  Currently,  NFA  registration  rules require APs engaged in futures and foreign exchange activities to satisfy proficiency requirements, but there are no analogous requirements applicable to swaps-related activity.

The compliance date to satisfy the swaps proficiency requirements is January 31, 2021. Because there is no grandfathering provision, swap APs must satisfy the requirements by that date in order to continue engaging in swap activities.

The NFA’s notice to members regarding the swaps proficiency requirements is available.

IRS Releases Final Regulations on Income from Investments in Certain Foreign Corporations

On March 18, 2019, the Internal Revenue Service and the Treasury Department released final regulations that   treat certain income imputed to a regulated investment company (RIC) from an investment in a controlled foreign

corporation (CFC) or passive foreign investment company (PFIC) as qualifying income for purposes of Subchapter M of the Internal Revenue Code of 1986, as amended (the Code).

In order to qualify as a RIC under Subchapter M of the Code, a fund must, among other things, derive at least 90%    of its gross income from dividends, interest, payments with respect to certain securities loans, gains from the sale of stock, securities or foreign currencies, income from certain publicly traded partnerships and other income derived   with respect to the fund’s business of investing in stock, securities or currencies (collectively, Qualifying Income).

Under certain circumstances, U.S. holders of shares in a CFC or PFIC are required to include in their taxable income certain income of the CFC or PFIC regardless of whether the CFC or PFIC distributes that income (Income Inclusions).

In 2016, proposed regulations were issued under which Income Inclusions would be treated as Qualifying Income only to the extent that the CFC or PFIC made a distribution out of its earnings and profits. In response to comments received on the proposed regulations, the final regulations eliminate the distribution requirement and provide that

(1) Income Inclusions are treated as “dividends” for purposes of the Qualifying Income requirement to the extent that the CFC or PFIC makes a distribution out of its earnings and profits and (2) Income Inclusions derived with respect       to a RIC’s business of investing in stock, securities or currencies are “other income” derived with respect to the RIC’s business of investing in stock, securities or currencies. As a result, the final regulations treat Income Inclusions even     if not matched by a distribution as Qualifying Income as long as the Income Inclusion was derived with respect to the RIC’s business of investing in stock, securities or currencies.

Taxpayers may rely on the final regulations for taxable years that begin after September 28, 2016. The final regulations are available.