Recently, the Securities and Exchange Commission (“SEC”), in tandem with the Commodity Futures Trading Commission (CFTC), jointly adopted Final Rules requiring certain entities to implement programs to detect red flags and prevent identity theft. These rules were developed in response to the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”) which shifted responsibility for identify theft rules and enforcement of such rules from the Federal Trade Commission to the SEC and the CFTC for those entities under their respective jurisdiction. Specifically, the SEC’s rules will apply to those entities under its jurisdiction, including broker-dealers, investment companies, and investment advisers; while the CFTC’s rules will apply to futures commission merchants, commodity trading advisors and commodity pool operators. However, both the SEC and CFTC rules will only apply to “financial institutions” and “creditors” as those terms are defined in the Fair Credit Reporting Act that offer and maintain “covered accounts.”

Recently, the Securities and Exchange Commission (“SEC”) issued an Order Instituting Administrative and Cease-and-Desist Proceedings against ZPR Investment Management, Inc. (“ZPR”) and Max E. Zavanelli (“Zavanelli”) alleging that ZPR and Zavanelli made false and misleading advertisements in several financial magazines and in monthly newsletters to clients and prospective clients. The SEC goes on to specify that ZPR, through Zavanelli, omitted material information about the firm’s historical performance results (specifically that their period to date performance was underperforming its benchmark index) and claimed compliance with Global Investment Performance Standards (“GIPS Standards”) when in fact they were not in compliance. If convicted, ZPR and Zavanelli face civil penalties, cease-and-desist orders, and other remedial actions. This case is an important reminder that although the rules governing advertising by investment advisers are sometimes difficult to navigate, compliance with such rules is mandatory and regularly enforced by the SEC.

According to Rule 206(4)-2 of the Investment Advisers Act of 1940 (the “Act”), the Securities and Exchange Commission (“SEC”) defines “custody” as “…holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.” This definition gives a broad interpretation as to what constitutes custody, and leaves several grey areas for advisers to try to elucidate. Recently Charles Schwab published an article on one such area, stating that advisers who have access and login credentials to their client’s online accounts are generally deemed to have custody, if the custodian’s website permits the withdrawal and transfer of funds (regardless of whether the adviser is making such transfers or if the client allowed/disallowed such activities). In taking this a step further, what would be the outcome if an adviser did not have a client’s login credentials, but did the adviser utilize a “screen sharing” application, whereby both the client and the adviser have the ability to view the client’s online account, and each have access to make withdrawals/transfers to that account simultaneously?