Products September 23, 2015

Financial Engines Offers Advice to More 401(k) Participants

Participants no longer have to be enrolled in the managed account program to speak with an investment adviser.
Reported by


Financial Engines is making its investment adviser representatives available to more customers.

Now, all 401(k) participants with direct access to Financial Engines can pick up the phone and talk with a Financial Engines adviser at no additional charge—whether they use the company’s investment advisory services or not. Previously, access to the company’s advisors was a feature for those enrolled in the Financial Engines managed account program. 

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

Financial Engines’ advisers are experienced and licensed, and provide plan participants with personal, unbiased help with retirement plan accounts, income planning and a variety of financial topics. Participants can reach advisers via phone, webcam and live chat. Advisers are non-commissioned and do not sell investment products.

Financial Engines’ advisers can talk with participants about their specific situations, including analysis of their retirement plan and outside accounts, savings rate recommendations, and assistance with Social Security claiming strategies. In addition, they can help participants with a variety of other topics that can impact a participant’s financial wellbeing, including

  • How to respond to market volatility;
  • How to use target-date funds appropriately; and
  • Other financial wellness topics, including budgeting, creating a rainy day fund and deciding between Roth and traditional IRA programs.

“We’ve found that many 401(k) participants value the ability to talk with a financial professional, and that has informed our hybrid strategy that combines technology-enabled advice with a human touch,” says Kelly O’Donnell, a Financial Engines executive vice president. “Plan sponsors want their participants to have access to conflict-free advisers. This enhancement makes broader access to our advisers official so that more people—regardless of account balance and at no cost to them—can get the independent help they need.”

Compliance September 23, 2015

Adviser Settles with SEC Over Defunct Cyber Risk Policy

The amount of cyber risk exposure in the financial services industry can be downright frightening to think about, but details of a recent settlement reached between the SEC and a St. Louis-based financial planner contain important lessons for retirement specialists assessing their own cybersecurity policies.
Reported by

The Securities and Exchange Commission (SEC) confirmed a St. Louis-based investment adviser has agreed to settle charges that it failed to establish required cybersecurity policies and procedures.

According to SEC officials, the failures occurred in advance of a data breach that compromised the personally identifiable information (PII) of approximately 100,000 individuals, including but not limited to thousands of the firm’s clients. An SEC investigation found that R.T. Jones Capital Equities Management violated basic safeguard rules during a nearly four-year period when it failed to adopt any written policies and procedures to reasonably ensure the security and confidentiality of sensitive client information and protect it from anticipated threats or unauthorized access.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

According to the SEC’s order instituting a settled administrative proceeding, R.T. Jones stored sensitive PII of clients and others on its third party-hosted web server from September 2009 to July 2013. The firm’s web server was subsequently attacked in July 2013 by “an unknown hacker who gained access and copy rights to the data on the server,” rendering the PII of more than 100,000 individuals, including thousands of R.T. Jones’s clients, vulnerable to theft.

The specific failures cited in the settlement agreement are enlightening and suggest a lack of awareness or attention in following SEC’s required procedures. At a high level, R.T. Jones apparently failed to conduct any kind of periodic cyber risk assessments, implement a firewall, encrypt personally identifiable information stored on its server, or maintain a response plan for cybersecurity incidents.

There are all elements clearly called for by published SEC guidance, most recently through a compliance alert issued in April. That publication, which followed more extensive guidelines published in February, draws on a years-long effort by the SEC’s Office of Compliance Inspections and Examinations (OCIE) to improve the agency’s understanding of cyber risks in the investing industries. Among the key findings of the auditing effort, OCIE says, is that financial services firms appear more and more aware of the extensive cyber risk they face, but many are still unsure how to address a problem so potentially wide-reaching and dangerous to the health of their practices.

NEXT: No harm, but still a foul  

In a nod to the luckless R.T. Jones staff, SEC credits the firm with discovering the breach and promptly retaining “more than one cybersecurity consulting firm to confirm the attack, which was traced to China, and determining the scope.” Also to its credit, shortly after the incident, R.T. Jones proactively notified “every individual with PII that may have been compromised and offered free identity theft monitoring through a third-party provider.”

To date, the firm says it has not received any indications of a client suffering financial harm as a result of the cyber-attack, but this seems cool comfort indeed for SEC officials.

“As we see an increasing barrage of cyber-attacks on financial firms, it is important to enforce the safeguards rule even in cases like this when there is no apparent financial harm to clients,” says Marshall Sprung, Co-Chief of the SEC Enforcement Division’s Asset Management Unit. “Firms must adopt written policies to protect their clients’ private information and they need to anticipate potential cybersecurity events and have clear procedures in place rather than waiting to react once a breach occurs.”

Specifically, the SEC charged R.T. Jones with violating “Rule 30(a) of Regulation S-P under the Securities Act of 1933.” Without admitting or denying the findings, R.T. Jones agreed to “cease and desist from committing or causing any future violations of Rule 30(a) of Regulation S-P.” The advisory firm also agreed to be censured and pay a $75,000 penalty.

Sprung points advisers and individuals with questions about data security to a new investor alert, “Identity Theft, Data Breaches, and Your Investment Accounts.” Available on the SEC’s Investor.gov website, the publication offers concrete steps for investors to take regarding their information and accounts if they become victims of identity theft or a data breach. 

«