The California Consumer Privacy Act (CCPA), a broad statute which imposes new data privacy obligations on certain companies that do business in California, will become effective on January 1, 2020. Fund managers and other investment advisers (“Advisers”) and certain of their affiliates that are currently subject to data privacy laws pursuant to the Gramm-Leach-Bliley Act (GLBA) or the UK General Data Protection Regulation (GDPR) may have additional obligations to consider and prepare for as the CCPA compliance deadline approaches.
Recommendations for employers before new law goes into effect on January 1, 2020
While acknowledging the challenges in applying the securities laws to digital assets, the Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA), in a joint statement on July 8, 2019, reaffirm that those rules equally apply to digital assets, and promise they will continue to engage the industry in finding solutions.
Read the full public statement HERE.
SEC Risk Alert regarding safety of customer records and cloud vendor diligence.
As part of its cybersecurity sweep, the SEC has examined risks related to the storage of customer records and information by investment advisers on cloud-based storage platforms and issued a Risk Alert, “Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features.” The sweep focused on vendor due diligence and oversight and registered advisers’ monitoring of data and customer information safety. Among other information, OCIE sought vendor contracts (including service level agreements); vendor reviews; risks assessments of cloud service providers, including data encryption, data loss prevention, books & records exposure, identity and access management; and policies and procedures and their alignment to technology standards.
The Risk Alert identified as the main compliance issues related to cloud-based storage (i) Misconfigured network storage solutions (inadequately configured security settings to protect against unauthorized access; lack of policies and procedures addressing the security configuration); (ii) Inadequate oversight of vendor-provided network storage solutions (lack of, or inadequate, policies, procedures, contractual provisions that security settings on vendor-provided network storage solutions were configured in accordance with the firm’s standards); and (iii) Insufficient data classification policies and procedures (firms’ policies and procedures did not identify the different types of data stored electronically by the firm and the appropriate controls for each type of data).
The Risk Alert encourages investment advisers to review their practices, policies, and procedures with respect to the electronic storage of customer information and to consider any necessary improvements, and to actively oversee vendors. The SEC included helpful recommendations for cyber/cloud risk management, including the implementation of policies and procedures designed to support the initial installation, on-going maintenance, and regular review of the network storage solution; guidelines for security controls and baseline security configuration standards to ensure that each network solution is configured properly; and vendor management policies and procedures that include, among other things, regular implementation of software patches and hardware updates followed by reviews to ensure that those patches and updates did not unintentionally change, weaken, or otherwise modify the security configuration.
Please contact your counsel at Pillsbury’s Investment Funds Group if you need help with reviewing and enhancing your cloud storage and related policies.
This is a reminder about the upcoming annual compliance deadlines that may or may not apply to you.
Please click HERE to open a summary chart of the filing deadlines.
Please feel free to contact us if you have questions or need assistance with any of these filings.
Pillsbury IFIM Group
In a press release issued by the Securities and Exchange Commission on December 20, 2018, the SEC’s Office of Compliance Inspections and Examinations (OCIE) announced its 2019 Examination Priorities.
This year’s examination priorities, although not exhaustive, are divided into 6 categories:
- Compliance and risk at registrants responsible for critical market infrastructure;
- Matters of importance to retail investors, including seniors and those saving for retirement;
- FINRA and MSRB;
- Digital assets;
- Cybersecurity; and
- Anti-money laundering programs.
Read the OCIE 2019 Examination Priorities in full HERE.
This is a reminder that the 2019 IARD account renewal obligation for investment advisers (including exempt reporting advisers) starts this November. An investment adviser must ensure that its IARD account is adequately funded to cover payment of all applicable registration renewal fees and notice filing fees.
Key Dates in the Renewal Process:
November 12, 2018 – Preliminary Renewal Statements which list advisers’ renewal fee amount are available for printing through the IARD system.
December 17, 2018 – Deadline for full payment of Preliminary Renewal Statements. In order for the payment to be posted to its IARD Renewal account by the December 17 deadline, an investment adviser should submit its preliminary renewal fee to FINRA through the IARD system by December 14, 2018.
December 28, 2018 – January 1, 2019 – IARD system shut down. The system is generally unavailable during this period.
January 2, 2019 – Final Renewal Statements are available for printing. Any additional fees that were not included in the Preliminary Renewal Statements will show in the Final Renewal Statements.
January 21, 2019 – Deadline for full payment of Final Renewal Statements.
Please contact us if you have questions.
The California legislature recently passed a bill that would require public companies whose principal place of business is in California (as indicated in their Form 10-K) to have at least 1 woman on its Board of Directors by the end of 2019. Thereafter, by the end of 2021, these companies would be required to have a minimum of 1 female director if they have a board of 4 or less, 2 female directors if they have a board of 5, or 3 female directors if they have a board of 6 or more. There would be a monetary fine for non-compliance of $100,000 for a first violation and $300,00 for a second or subsequent violation (per-seat).
The bill is currently under consideration by Governor Jerry Brown, who has until September 30th to decide whether to sign the bill.
Covered businesses will need to update policies and procedures for responding to customer inquiries about collection, use, sale and disclosure of customers’ personal information or face stiff enforcement actions.
- The California Consumer Privacy Act of 2018 provides consumers with broad rights to control use of their personal information by covered businesses.
- Covered businesses will need to review and revise their existing privacy policies to make the required disclosures and to provide two methods for customers to inquire about use of their personal information.
Read this article and additional Pillsbury publications at Pillsbury Insights.
The rapid growth of cryptocurrency markets, digital asset products and initial coin offerings (ICOs), and the alarmingly high number of fraudulent ICO attempts among them, has prompted the SEC to engage the public in some creative investor education.