Client Service October 16, 2023

How to Stay Safe From Evolving Cybersecurity Threats

Experts discussed the SEC’s new cybersecurity rules and the importance of having an action plan at PLANADVISER’s Cybersecurity livestream.

Reported by


To minimize the impact of potential cyberattacks, organizations should work with investment managers on complying with the Securities and Exchange Commission’s new cybersecurity rules, should adopt prevention measures against threats and should be prepared to respond if an attack happens, experts said at the “Best Practices for Cybersecurity Protection” session of PLANADVISER’s Cybersecurity livestream on October 12.

Percy Lee, an associate at Ivins, Phillips & Barker, Chartered, discussed the SEC’s new cybersecurity rules, which apply to public companies, registered investment advisers, investment companies and broker/dealers.

Never miss a story — sign up for PLANADVISER newsletters to keep up on the latest retirement plan adviser news.

“These rules have generated a lot of conversation since they were introduced last year, some backlash, so the rules have been delayed for now [for certain organizations],” said Lee.

There are two sets of new SEC cybersecurity rules. The first set of rules governs publicly traded companies and was finalized on July 26, despite industry pushback. This rule takes effect this year, with initial disclosure requirements effective December 18, with later dates for smaller reporting companies.

The second set of rules governs registered investment companies and investment advisers and would require them to adopt cybersecurity policies and report digital incidents. This rule was proposed in 2022 and remains on the SEC’s rulemaking agenda but the specific timeline for finalization remains unknown.

“According to the rules, which were brought forward by the SEC in July, registered investment advisers, investment companies and broker/dealers would have to adopt written cybersecurity procedures and report cyber security incidents,” Lee said.

Although these investment advisory rules do not apply to retirement plan fiduciaries in general, he recommended that producers ask their investment managers about their compliance.

“As far as the SEC rules goes, it’s important to understand … that’s for public companies now, but obviously I think that’s going to make its way to even private firms that aren’t traded,” said Nick Brezinski, director of information security and network at CAPTRUST.

Brezinski urged firms to adopt good cybersecurity practice now to get to a “good spot” before the SEC settles on its requirements, and Roger Grimes, a data-driven defense “evangelist” at KnowBe4 Inc., agreed.

“I think it’s always good for any organization to think about what the rules are that apply to you and how you would respond if you got hit by some cybersecurity incident,” Grimes said. “Just a ton of people have been hit by ransomware over the last couple of years.”

Grimes proposed that firms have a plan in place for if a cybersecurity incident were to hit. He recommended to the virtual audience that they know who to reach out to, whether it be a communications team or a group of consultants.

“You don’t want to be making those sorts of decisions in the midst of the crisis,” he said. “It’s nice to have a thoughtful plan ahead of time. If the worst happens, you can approach it in the best way.”

Grimes said institutional investors, plan sponsors and advisers should:

  • Be cautious of social engineering such as fake emails and websites;
  • Mend unpatched software;
  • Regularly update software, firmware and routers; and
  • Use multifactor authentication and different passwords for every site as preventative measures.

“Those four things,” he said. “If you can do them, it will probably mean that you’re very unlikely to get compromised.”

Compliance October 16, 2023

SEC Exam Priorities Require Advisers to Account for Client-Specific Needs in Recommendations

The regulator also listed expensive, complicated and illiquid investment recommendations as coming under increased scrutiny in 2024.

Reported by

The Securities and Exchange Commission published its 2024 exam priorities for investment advisers and broker/dealers Monday. The document highlights next year’s areas of focus for the SEC.

The exam priorities repeatedly noted certain areas. Advice rendered relating to complex, expensive or illiquid products will come under scrutiny, as will an adviser’s policies and practices related to tailoring advice to the specific needs and characteristics of the client, especially for retail investors, elderly investors and retirement assets.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

Products

Certain products were identified by the regulator as being of special interest. “Derivatives and leveraged exchange-traded funds” were listed explicitly as examples of complex investments, and “variable annuities and non-traded real estate investment trusts” as examples of high cost and/or illiquid investments, both areas of focus. Recommendations concerning these products must be accompanied by proper disclosure and informed consent and must be made in the client’s best interest.

Jennifer Klass, a partner in K&L Gates LLP, explains that with these products, advisers must focus on a “combination of disclosure and appropriate training and knowledge, as well as ensuring they are offering those products to the right clients.”

The SEC noted that recommendations of “unconventional strategies, including those that purport to address rising interest rates” would be examined. It also highlighted “proprietary” products—those owned by the adviser—and “microcap securities” as additional product recommendations it will scrutinize.

Cryptocurrencies and digital assets had their own section in the notice, and the industry in general has been a target of SEC enforcement and has been described by Chairman Gary Gensler as “rife with fraud and scams and hucksters.”

Klass says that cryptocurrency is a focus of the SEC, and “it has been for some time, especially since the current chair, Gary Gensler, took over.” The SEC is particularly focused on the proper custody of crypto and “ensuring clients understand the product and risks.”

The notice explained the importance of an adviser being sure the investor understands the digital asset in which he is investing and that the adviser should take particular care to inform a client “when the investors are retail-based (including older investors) and investments involve retirement assets.”

Client Profiles

The regulator emphasized that advisers must account for the profile of each client and not render irrelevant or general advice.

The SEC called out the specific needs of the elderly, especially as they relate to complex or expensive products. According to the notice, advisers need to tailor their advice to those needs, and SEC exams “may also focus on recommendations to certain types of investors, such as older investors and those saving for retirement or college,” whose time horizons can vary considerably.

Klass notes that advisers should have a “framework around senior investors and make sure products are appropriate for them.” This includes their investment needs, but also “whether they are competent to understand the investments or if other people need to be involved in the process.”

The distinctions between investors are a key component of Regulation Best Interest, and advisers must have policies to consider the “initial and ongoing suitability” of a recommendation, seek best execution, evaluate costs and risks, and identify and mitigate conflicts of interest, the notice stated.

Compliance Policies

The new marketing rule will also be a focus for SEC examiners. Specifically, the SEC will be looking to see that advisers can substantiate fact-based claims in marketing materials and whether marketing activities are reported properly on Form ADV.

Many other items were briefly discussed or listed in the notice as an area of SEC focus. These included proper disclosures; policies for proprietary trading; training procedures; record integrity; the valuation of private holdings; and business continuity policies.

«