COVID-19 has unleashed a very challenging new world upon all of us. One reality of this new world is the need to work remotely, which is a minor adjustment for some, and an entirely new universe for others. For those in the financial services industry, market volatility, the increased communications frequency with panicked investors, along with the ever-present regulatory complexity, can make this transition exponentially more complex.
To that end, the focus of this post is to recap our talk with regulatory experts Elin Cherry, CEO of Elinphant, LLC, and from Smarsh, Marianna Shafir, Regulatory Advisor, and Robert Cruz, VP of Information Governance, on how firms can continue to meet their supervisory obligations with a workforce now located across multiple locations. We will also provide an update on guidance provided to date by regulators including the U.S. Securities and Exchange Commission (SEC), Financial Industry Regulatory Authority (FINRA), and the Financial Conduct Authority (FCA) in the UK.
(For brevity, we will exclude the accompaniment provided by a trombone player, a heavy metal guitarist, a small yappy dog and a hungry child who joined the discussion. New world, indeed.)
FINRA Regulatory Guidance
Our discussion began with an update on regulatory communications, which seem to be changing by the hour, starting with FINRA’s continuity planning regulatory notice.
Marianna led the discussion by summarizing March 9 guidance, encouraging members to dust off their business continuity plans as the coronavirus continues to spread. The new guidance, 20-08, emphasized that FINRA expects a member firm to establish and maintain the supervisory system that is reasonably designed to supervise activity of each associated person while working from an alternative or remote location during the pandemic.
With respect to oversight, member firm scheduled on-site inspections or branch offices may be temporarily postponed during the pandemic. This is with FINRA understanding that the ability to complete this annual regulatory obligation in 2020 may need to be reevaluated depending on the duration and severity of the pandemic. In addition, firms may find it necessary to test broad use of remote offices or tele-work arrangements prior to activating its BCP, including the ability to connect the critical firm systems, the adequacy of remote connections via residential internet, access networks and any potential need to secure premium or dedicated service for a connection. Firms should also remember to inform FINRA if they make such arrangements and be on the lookout for additional cybersecurity events such as phishing.
In fact, further on cybersecurity, Marianna pointed out FINRA’s comments that risks of cyber events may be increased due to the use of remote offices or tele-work arrangements. FINRA urged broker-dealers to remain focused on their clients and increase the number of those who they call, or use their online accounts given market volatility. Broker-dealers are encouraged to review their BCP plans regarding communications with customers and ensure customer access to funds and securities during the significant business disruption, the notice stated.
Elin Cherry added that it is important for firms to monitor FINRA’s frequently asked questions which will likely be updated on a daily basis.
SEC Regulatory Guidance
Marianna began the discussion on SEC guidance that was announced on March 13th. The SEC announced relief covering board meetings, certain filing and delivery requirements for certain investment funds and advisors. The SEC noted that the impact of the coronavirus may delay or prevent funds and advisors operating in affected areas from meeting certain regulatory obligations due to restrictions on large gatherings, travel and access to facilities, the potentially limited availability of personnel and similar disruptions.
The relief is designed to enable funds and advisors to meet those obligations and to continue their operations while recognizing that there may be temporary disruptions outside of their control. The SEC will consider additional relief from other regulatory requirements.
Elin added that she sees the SEC working really hard to be reasonable and make sure that firms can continue business as usual during this timeframe.
The key takeaway from FINRA and SEC is that they are aware of the issue. They are understanding if firms are not meeting their deadlines and regulatory obligations. It’s really about exercising reasonable efforts.
FCA (UK) Regulatory Guidance
FCA published guidance also emphasized that firms are expected to take reasonable steps. This is a consistent phrase used by all regulators to ensure that firms are prepared to meet the challenges the coronavirus could pose to customers and staff. This is reflected in business continuity plans, clear and transparent communications, as well as strong support and service to customers during this period. The FCA was also more specific on reporting obligations, highlighting call reporting.
Firms should make the FCA aware if they’re not able to meet call reporting recording requirements and take mitigating steps. If firms do experience difficulties with submitting their regulatory data, the FCA expects them to maintain appropriate records during this period and submit the data as soon as possible. Where firms have concern, they should contact the FCA as soon as possible.
Activating Your Regulatory Contingency Plan
Elin noted that compliance isn’t the first thing that businesspeople think about, on the best of days. But right now, even more so. Taking lead from the regulators about applying reasonable steps has never been more important. These steps can include the following:
- Update lists of each remote worker location
- Ensure that work-related electronic communications must be transmitted through your approved electronic systems
- Confirm that each BD & adviser has notified a registered supervisor and receive approval when working from the remote location
- Technology governance plans should be updated to address new applications possibly overlooked in communication review and archiving processes
- Consider your vendors capacity in current market volatility
Each of these points is expanded upon in Elin’s most recent contribution to the Smarsh blog, Brokers Contigency Planning for Remote Workforce Critical in Age of Coronavirus.
To sum up, for those looking at this new remote world for the first time, our experts offered the following:
Elin Cherry: “The key is to get the controls implemented, so you have to take a reasonable approach during these times. We’ve seen that the regulators are being reasonable, so we can’t just ignore the rules and regulations. Take a reasonable approach and get things done as quickly as possible under the circumstances. And I would say to look at everything you have to get done and then prioritize into where are the biggest risks for the firm and take care of those first. Most important is really in this case, to keep business going and also have your controls in place.”
Marianna Shafir: “All the regulators from the regulator guidance are saying, ‘Be prepared to follow your BCP, and, you’re going to face challenges with your BCP.’ Revise and update your BCP. There are going to be new avenues you’re going to have to take, and so these firms must now not only revise their procedures and patterns, but also maintain all compliance and legal norms. The main takeaway from this is you’re not the only firm going through this, every firm is going through this and it is just the new norm.”
Robert Cruz: “As someone who has spent most of my career in a virtual or remote work situation, I know that some people will find this very comfortable, and as we emerge from this, move firms toward an outcome where they must adjust to having more individuals staying in a remote status. And on the other end of the spectrum, there are those for whom this will be entirely foreign. Firms will need to make sure that they reach out to those individuals, provide them with help and support, get the folks who are accustomed to give some guidance to those that aren’t as comfortable and develop familiar remote working environments.”
You can watch the full Smarsh webinar here.
Additional COVID-19 Regulatory Resources