Broker-Dealers and Registered Investment Advisors (RIAs), along with all financial services and wealth management organizations, face several books and records compliance challenges that impede business efficiency and that can lead to detrimental consequences on their businesses — but they shouldn’t have to.
This article was originally published on FutureVault.com.
We spend a fair of time in deep discussions with Broker-Dealers, RIAs, Financial Institutions, and Family Offices looking to adopt and implement secure digital document vault solutions for a variety of reasons.
One of those reasons — and a very good one at that — is to meet and demonstrate books and records compliance to the likes of FINRA and the SEC.
With several technical books and records compliance requirements, along with ongoing updates and amendments to existing rules provisioned by FINRA and the SEC, come many different challenges along the way.
And these challenges are quite concerning for firms as they question their firm’s capability to demonstrate compliance.
Note:While this article mentions and references FINRA and SEC books and records compliance, the challenges (and solutions) are applicable regardless of the regulatory authority.
6 Common Books and Records Compliance Challenges
Through a collection of ongoing feedback and direct conversation with compliance experts in the wealth management industry, below are six of the most common challenges and concerns when it comes to books and records and document management compliance.
1) Ensuring proper retention for all record types
Regulation outlined in SEC 17a-4, sections a-e, specify the requirements for preserving records. Organizations must ensure that they have the capacity to retain all relevant documentation and records for a minimum of at least six (6) years, adhering to these rules. Wealth management and financial services firms must capture and archive all transaction-related data, including structured and unstructured records such as invoices, contracts, statements, and so forth.
According to Rule 17a-4, firms must keep records of transactions on indelible media, and index them, making them immediately accessible for two (2) years, followed by a minimum of six years of accessibility. It’s also important to note that duplicate versions of critical records must also be kept for the same duration.
Network drives, physical paper, and other legacy-based systems pose significant challenges, risks, and even financial burdens that make it difficult for firms and their staff to ensure retention periods are being met and evidenced.
2) Storing records in a non-rewriteable, non-erasable format (W.O.R.M. requirement)
In accordance with SEC 17a-4(f), electronically stored content must be preserved using a non-rewriteable and non-erasable format that requires W.O.R.M. storage.
W.O.R.M. (or WORM) stands for Write Once Read Many, indicating that any information saved in WORM-compliant storage cannot be modified, tampered with, or deleted. Compliance with SEC 17a-4 mandates this standard under FINRA regulations to guarantee that all records related to business operations remain unalterable.
On October 12, 2022, the commission passed a proposed amendment that provides a modern alternative option for storing and handling books and records on WORM or immutable media. The alternative involves saving regulated records with an audit-trail capability.
This amendment to Rule 17a-4(f) requires a broker-dealer who employs an archive or electronic records management system to ensure that the system satisfies either the audit-trail requirement or the WORM requirement.
If the audit-trail option is chosen, the broker-dealer must utilize a records management system that preserves regulated records in a way that allows for the recreation of the original regulated record in case of corruption, modification, or deletion.
3) Scattered and disparate systems being used to manage and archive documents
The continued and prevalent use of disparate systems poses several challenges in and of itself, including an inability to effectively discover and retrieve records or even at all.
Compliance with Section 17a-4(j) requires the capabilities of firms to discover and retrieve records. Nonetheless, records may become misplaced among various systems because not all content is identifiable or retrievable without appropriate tools. The inability to search and access critical documentation and records poses a significant risk of non-compliance and leads to poor operational processes.
Physical paper records and documents pose another risk; appropriately storing and retaining physical office records for the required two-year period as specified in SEC 17a-4(l).
Here’s what we see as one of the biggest concerns, and quite frankly, far more often than we should; different (multiple) recordkeeping and document systems being used for the different types of documents at the different levels of an organization.
What exactly do we mean by this?
Oftentimes, one platform or system might be used to manage and access head office, enterprise, and compliance documentation. Another system might be in place for advisors to manage their business documents and to receive documents from the head office or their Broker-Dealer. And a third or even fourth platform might exist to support the delivery, access, retrieval, and management of critical client documentation such as tax documents, estate plans, and account statements.
This leads to significant issues in the long term, making it incredibly difficult to stay compliant or demonstrate compliance, let alone the many red flags from an operational, experience, and workflow perspective.
4) Inability to efficiently evidence documents and conduct internal/external audits
The above challenges that we’ve already discussed can make it next to impossible to efficiently provide evidenced documentation, especially on-demand, and within appropriate timelines.
When you combine that with poor internal and external audit practices or rather an ability to sufficiently provide materials and required documentation to auditors in a timely manner, then you’re only setting yourself up for a poor audit review and running the risk of auditors flagging your business, or worse, delivering fines.
To avoid fines, loss of certification, loss of credibility, and damaging press coverage, organizations must be able to conduct periodic internal and external audits with FINRA to prove that they are SEC-compliant.
The timeliness of an audit, and the ability to deliver evidenced documentation on demand, in one centralized location, with no issues whatsoever, signals to auditors and authorities that your firm has polished processes and importantly, demonstrates compliance.
The opposite is also true; slow responses and slower-than-expected delivery of critical evidence (documents) often signal to auditors that something might be going on behind the scenes and can be seen as a risk to regulatory authorities.
5) Data and document ownership and access control
Really what we are referring to here is that the custodian partner (oftentimes multiple custodian partners) cannot — or rather should not — be the owner where client documents reside.
Broker-Dealers, RIAs, and every advisor is ultimately responsible for these documents and must maintain those records confidently.
Way too many firms operate under the impression that client data and documents are safe in the hands of the custodian. While there is some truth to this, the fact of the matter is that Broker-Dealers, RIAs, and every advisor is ultimately responsible for these documents and must maintain those records confidently.
Not only is having ownership over documents on a platform of your own a good habit, practice, and experience for your clients, it falls in line with the requirements of regulatory authorities.
For firms that have multi-custodial relationships (partnerships), having complete control and flexibility over client documentation (statements, account opening documents, tax documents, etc) will provide you with a ton of confidence and support from an operational lens.
6) Use of non-secure and non-compliant document exchange tools
Last but certainly not least on our list of challenges and concerns, we continue to witness and see widespread use of non-secure and non-compliant file-sharing tools and practices still being used almost daily by firms, their advisors, and key staff members.
Surprisingly, or maybe not so much, email continues to be a massive culprit, likely due to familiarity, that puts client information, data, and documents at risk when shared and exchanged using this method.
We’ve all heard of horror stories where advisor and/or client emails get leaked and sensitive information is shared to recipients other than those the email was intended for.
Beware, be safe!
Overcoming Books and Records Challenges to Meet SEC 17a-4 Compliance
The challenges and concerns mentioned above are no joke. They can land firms in boiling hot water and can lead to:
- Massive fines
- Mistrust from existing clients
- Reputational risk in the industry
- Suspension or loss of licenses
Thankfully, cloud-based solutions exist to help organizations overcome these challenges to meet and demonstrate compliance with confidence, along with providing massive value by improving operational efficiency and by delivering an enhanced digital client experience.
Let’s take a look at precisely how firms can overcome the challenges mentioned above.
1. Automate the retention and disposition of all record types to ensure SEC 17a-4 compliance
Modern cloud-based digital document vault solutions can makes it easy for all types of firms to confidently meet and satisfy the different retention requirements through automated configuration. Being able to back up and retain all your information ensures not only SEC 17a-4 compliance, but overall security while giving you a full picture of your enterprise, advisor, and client data and documents as a whole.
This includes vendor-related documentation, advisor documents and statements (commission reports), email-based communications, client statements and quarterly performance reports, tax documents, account opening documentation, emails, any structured data (ex: spreadsheets) or unstructured data (ex: scanned pdfs, images, text-based docs), and so forth.
You’ll want to ensure that the system your firm decides to move forward with leverages Optical Character Recognition (OCR) technology to allow for the effective filtering, searching, and retrieval of critical data, information, and documents. Even scanned (via the mobile application) or uploaded images can be processed by OCR for text extraction, allowing for the complete search of text within image-based files. This helps to ensure the discoverability and retrieval of critical data and documents.
2. WORM Storage to prevent alteration or deletion of documents
Making the content immutable after the initial write is critical to prevent any tampering or deletion so it is truly locked in and compliant with SEC 17a-4.
Modern cloud-based document vault solutions adhere to WORM storage requirements by ensuring that documents are delivered and stored in their final form, and as a result, documents delivered to clients (as an example) by advisors or administrative users cannot be deleted, removed, or altered in any way.
In the case with automated document distribution via APIs and integrations, it’s critical to ensure that these documents, too, are delivered and retained within the Vault in an unalterable format to ensure that they too cannot be deleted, removed, or tampered with once delivered in order to meet WORM storage requirements.
3. Audit trail functionality on every document
As an amendment to the WORM storage capability, platforms and solutons that offer document-level audit trail capability provide an efficient and cost-effective solution to ensure 17a-4 compliance.
Important data captured and recorded by the audit trail would include:
- the user’s name (and ID) who performed the action;
- the type of action performed (upload, download, share, view, etc.,); and
- a timestamp of when the activity took place
Audit trails make it easy to conduct internal and external audits by providing evidence of the activity associated with documentation and data being reviewed and that is necessary to demonstrate compliance with SEC17a-4 regulation.
Not only do audit trails demonstrate compliance, but they also provide an additional layer of transparency, accountability, and peace of mind.
4. Document and data export capabilities
Having the capability to easily search, filter, locate, and export documents and/or folders individually and in bulk can provide a massive assurance for the retrieval and collection of required documentation on demand, as necessary.
5. Single source of truth for all enterprise, advisor, and client records
One of the most critical areas to address and for firms to reap massive operational efficiencies beyond compliance is moving away from the use of disparate and disconnected systems to one centralized, unified system for all records; enterprise, advisor, and client documents.
The right system will make it easy to connect the various stakeholders across all levels of the organization, while making it incredibly easy to centralize all critical documents under one roof.
6. Secure and compliant document exchange tools
Modern secure document exchange tools exist to helps firms, advisors, and clients protect sensitive information exchange by ensuring that all exchanges take place in a structured, secure, and compliant environment; for both efficiency and security purposes.
Consider platforms and systems that make it easy (and secure) to:
- Streamline document collection and assmebly
- Forward communication and documents to a secure location
- Secure share documents via encrypted links
- Automate the distribution of critical documents
- Deliver and distribute documents in bulk
7) Streamline audits with secure permissions to auditors
The systems you and your firm are looking at should make it easy to provide secure permissions to trusted third-parties, which may, at times, include an SEC auditor.
By providing secure access to you books and records system, you’re essentially making it easy not only for your firm, but for the auditor(s) to do their job and conduct the audit.
By providing a centralized environment for auditors to conduct examinations, firms can confidently demonstrate compliance and respond to document requests in real-time, on demand.
Conclusion
Maintaining proper books and records compliance is crucial for businesses of all sizes and types.
Not only is it required by law, but it also plays a vital role in establishing trust and credibility with clients. By keeping accurate and up-to-date records, businesses can demonstrate their commitment to transparency and accountability, as well as their ability to operate efficiently and effectively.
With the advent of cloud-based digital solutions such as digital document Vaults, firms can automate and streamline record-keeping processes, reduce the risk of errors, omissions, and non-compliance, while also improving overall productivity and cost-efficiency.
In today’s fast-paced and highly regulated environment, staying compliant with books and records regulations is no longer optional. It’s a necessary part of doing business that can help ensure long-term success and growth.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.