Some brokerages and investment advisory firms are just going through the motions when it comes to protecting investors from identity theft, an SEC probe shows.
Financial firms are failing to establish and follow through on policies and procedures designed to prevent hackers from stealing their clients’ and customers' personal information, according to a risk alert released Monday by the Securities and Exchange Commission.
The SEC warning was based on the findings of an examination sweep to monitor compliance with Regulation S-ID, or the Identity Theft Red Flags Rule. The regulation was promulgated in 2013 and applies to so-called “covered accounts,” which are defined as those a financial institution maintains for personal, family or household purposes that permit multiple payments or transactions.
The red flag rule requires brokerages and advisory firms to develop and implement an identity theft protection program. SEC exam staff found that some firms failed to determine whether the rule applied to any of their accounts or failed to conduct a reassessment after merging with another firm.
The shortcomings led to online and retirement accounts being omitted from compliance with the red flag rule, the alert states.
Another deficiency involved implementing a generic program that didn’t target red flags specific to a firm’s business model.
“For example, some firms created written programs that had generic language for identifying, detecting and responding to and updating red flags but the programs did not include any actual red flags identified by the firms,” the alert states.
The SEC also noted training deficiencies.
"Some trainings appeared to be insufficient because the training was limited to a single sentence telling employees to be aware of identity theft," the alert states.
The SEC is not only looking for specificity in compliance but also wants to see that firms are adapting their policies and procedures as they go through mergers or consolidations, said Ignacio Sandoval, a partner at Morgan Lewis.
For instance, they may reduce their branch offices but take on new online accounts, which creates possible new hacking vulnerabilities.
“The threats are dynamic,” said Sandoval, a former special counsel in the SEC Division of Trading and Markets. “They change over time. Firms need to be cognizant of these changes. You need to go back and rework your policies and procedures, retrain folks and reconsider what your program looks like.”
The risk alert comes as the SEC is warning firms to strengthen their cyber defenses. It also follows an enforcement case earlier this year in which the agency imposed $2.5 million in fines on J.P. Morgan Securities, UBS Financial Services Inc. and TradeStation Securities Inc. for red-flag program deficiencies.
TradeStation is one of the quantitative trading platforms for RIAs and advisors. Compare software options and features to boost investment strategies in this guide.
The SEC also is working on a cybersecurity proposal and has another one on its regulatory agenda.
“I think what comes out in the exam findings is going to inform rulemaking,” Sandoval said.
The firm's CFO and EVP of Wealth Management Solutions are the latest executives to exit the broker-dealer.
Clients are saying they would consider switching advisors if another professional offered estate planning services, according to a new Trust & Will survey.
CEO Laurel Taylor says the fintech's composable AI stack helps workers optimize dollars across Trump Accounts, 529s, 401(k)s, and other employee benefits.
The bank has swiped three private banking veterans from BNY as the city climbs the ranks of America's fastest-growing wealth hubs.
Employee accounts, crypto trials and job cuts frame a pivotal year for the Swiss lender.
Dan Biagini of American Equity says the steady decline of pensions, longer lifespans and a reset in interest rates are rewriting how advisors build retirement income
Direct indexing is on pace to outgrow ETFs and mutual funds. Northern Trust's Ken Lassner explains why the advisors who get it wish they had started sooner.
