Legal Risk Management Tips

Introduction

During the Thanksgiving season, many of us spend time reflecting on what we are most thankful for.  Immediately, my family, and those closest to me (including my clients), come to mind.  As we meditate and think about life’s various changes, often we are faced with contemplating the effects and challenges of aging. Certain vulnerabilities can surface, such as diminished capacity and financial exploitation, which require forward thinking and purposeful action.

In recent years, more and more financial institutions are electing to conduct a risk assessment as part of an annual compliance program check.  Not only does a risk assessment help in the development of policies and procedures, but also can serve as a mitigation tool to help identify and proactively address potential threats to lower risk exposure.  In this month’s Legal Risk Management Tip, we will explore the starting points for creating a risk inventory, provide tips and factors for evaluating risks, discuss tools and systems to use as risk management controls and summarize actions to help support your compliance program. 

So often we hear about regulatory compliance considerations governing cybersecurity.  But what about considerations from a legal perspective?  How do your vendors, who may not be subject to Regulation S-P and Regulation S-ID, help ensure they have adequate safeguards when servicing your firm? This month’s legal tip will focus on areas that we find are often overlooked within financial organizations’ cybersecurity program.  This includes contractual provisions to look for and request from vendors, due diligence questions to pose to service providers who have access to non-public information and information needed by counsel to respond to a cyber incident.

As our older population in the United States (i.e., persons 65 years of age of older) continues to increase, so does the servicing opportunities of the financial industry.  According to the U.S. Department of Health and Human Services, in 2013 one in seven Americans (or 14.1% of the U.S. Population) was over age 65.[1] By 2040, that number is forecasted to grow to 21.7%.[2]  

Last month, the Office of Compliance Inspections and Examinations (“OCIE”) of the U.S. Securities and Exchange Commission (“SEC”) issued its examination priorities for 2016.[1] This letter, issued annually as part of the SEC’s National Exam Program, allows registrants the opportunity to focus its compliance program efforts on those areas of particular interest to the staff.  This month’s Legal Tip will highlight some of the most notable areas that could impact the compliance programs of investment advisers, investment companies, broker-dealers, and advisers to private funds.  At the conclusion of this summary, will provide certain risk management tips for firms to consider when advancing their compliance programs in 2016.  

Ever since the financial crisis of 2008, we have witnessed an increase in registered investment advisory business growth.  Traditional brokers are “breaking away” to form their own independent businesses and existing registered investment advisers are joining forces with other advisers in order to accelerate growth opportunities in the marketplace.  Also, mergers and acquisitions are becoming more and more common place as a result of strategic transition and business succession planning.  Each of these scenarios has a series of regulatory compliance considerations the business must face, whether on the breakaway path or on the merger and acquisition side.  This month’s legal tip will focus on those considerations that businesses should keep in mind prior to implementing the transition plan.

The Form ADV is one of the most important documents compiled by an investment adviser.  Not only does it serve as the adviser’s client disclosure brochure to unveil important information related to the firm’s products and service offerings, fees, business practices and related conflicts of interest, but it also serves as a critical tool for the SEC’s regulatory program for measuring and analyzing risk for its registrants.