By Lori Weston, Director of Product and Strategy, STP Investment Services

As a compliance officer responsible for administering your firm’s compliance program, you are keenly aware of your firm’s compliance risks. The SEC requires advisers to implement compliance programs designed to mitigate these risks. As news of SEC enforcements continue to be reported, you’re likely evaluating whether your firm’s compliance program could withstand similar regulatory scrutiny. If you find yourself thinking, “that’s not us,” it may be time to dig deeper. Your firm may have compliance vulnerabilities that aren’t obvious, yet could pose significant regulatory risks.

Artificial Intelligence: How AI Creeps into Compliance

Whether your firm promotes its use of AI or prefers to avoid it, there are AI-related compliance traps you need to consider.

Unknowingly Vulnerable

Many firms believe they are safe from AI-related compliance risks because they have elected not to use it. However, AI can enter through third-party vendor relationships, creating hidden vulnerabilities. In today’s interconnected business landscape, your firm may be unintentionally exposed to AI.

The Hidden AI Risk of Third-Party SaaS Providers

Your firm may unknowingly use AI-driven solutions embedded within third-party SaaS tools, like portfolio management or CRM software. Such tools may contain machine learning models that interact with sensitive client data, creating potential privacy and cybersecurity risks. Compliance officers should understand their vendors’ use of AI, especially when sensitive client information is processed, and perform regular oversight of the vendor’s protocols to protect client information.

AI Use by Employees

Employee actions may also create AI exposure for firms. For instance, an advisory rep might use AI-powered analytics for client reporting or recommendation engines for portfolio management. Meeting regularly with your staff to review the tools they use and their preferred practices can help identify otherwise unknown AI exposure. If your firm allows the use of AI, make sure to conduct due diligence of the tools used. Verify the accuracy of outputs and prevent recommendations based on flawed or biased models. Review your policies to ensure they reflect your firm’s practices and train staff so they understand what is permissible and what is not.

Disclosure Scrutiny

Even firms that openly embrace AI face compliance risks, particularly with disclosures. Regulators demand transparency and failure to accurately disclose your firm’s operational use of AI or exposure through vendor partnerships can lead to compliance violations. Review your Form ADV Part 2A disclosure, marketing materials, and social media posts to confirm that your firm’s use of AI is accurately represented. Recently, the SEC has penalized firms for exaggerated claims around AI, known as “AI washing.” Proper documentation and accurate disclosure of AI usage within your organization is critical given AI’s infancy.

Off-Channel Communications: When Texting for Convenience Crosses the Compliance Line

Mobile devices enhance productivity but can also create compliance risks, especially when employees use personal devices for business communications.

Regulatory Requirement

The Advisers Act requires advisers to maintain communications related to “any recommendation made or proposed to be made and any advice given or proposed to be given.” However, capturing these communications becomes challenging when they occur on non-approved systems, which are considered to be “off-channel.” Add to this the difficulty of determining whether a particular communication qualifies as advice, proposed advice, a recommendation, or a proposed recommendation, and it becomes obvious why firms adopt strict policies that prohibit conducting any company business off-channel.

Innocent Texts Can Lead to Compliance Violations

Consider an example where an employee texts a client to confirm an appointment location. This might seem harmless, but it opens a line of communication that could lead to uncaptured texts containing advice or recommendations.

Another scenario might involve employees discussing a client’s investment strategy. If they later text each other regarding a proposed recommendation, their communication may be required to be retained. Off-channel communications, even among staff, can create compliance risks.

The Scale of the Problem

In the past three years, the SEC has imposed nearly $2 billion in fines regarding recordkeeping failures of electronic communications. Firms of all sizes have been affected. With the prevalence of apps like WhatsApp and SMS in our daily lives, off-channel communications have become a serious compliance issue.

Training and Enforcement

While many firms have policies around off-channel communications, consistent training and enforcement is often lacking. Without regular training, staff may default to non-compliant messaging methods for convenience. The SEC has emphasized that firms should actively enforce these policies through rigorous training and ongoing monitoring.

Monitoring Communications: The Other Side of Compliance

Capturing communications is just part of your firm’s compliance responsibility. Monitoring these communications is equally critical, falling under an adviser’s obligation to supervise staff, monitor for client complaints, and uphold its fiduciary duty to clients.

When it comes to maintenance of required records, including electronic communications, focus on three key elements: (1) robust policies outlining permissible electronic communication channels; (2) regular, ongoing training to all staff regarding the firm’s adopted policies; and (3) a records retention vendor that can capture and maintain communications transmitted via permitted systems. An outsourced compliance provider can help you use these tools most effectively.

Marketing Rule Mishaps: Navigating Modernized, Yet Complex, Regulations

The SEC’s Marketing Rule, introduced in 2022, replaces outdated advertising regulations, allowing more flexibility in marketing. However, it also introduces new requirements that many firms find challenging to implement.

Endorsements and Testimonials

Endorsements and testimonials, common in digital marketing, are permitted when accompanied by specific, prominent disclosures, including whether the individual providing the endorsement is a client or investor, and whether any compensation was given for the endorsement. Failure to meet all disclosure requirements can lead to significant penalties. The risk is particularly high for firms that rely on social media or influencer marketing, where paid endorsements are common.

Awards and Rankings

Advertising awards and rankings also come with numerous disclosure requirements, including whether the firm or individual that received the award paid to participate. Even if your firm’s award or ranking is legitimate, failure to include prominent disclosures regarding the circumstances of earning that award can result in enforcement action.

Advertising Performance

Advertising performance can attract potential clients, but it poses compliance risks, which are exacerbated when hypothetical performance is advertised. Under the Marketing Rule, advisers who advertise performance must present both gross and net results calculated over the same period using consistent methodologies. Hypothetical performance, which is generally considered an advertisement even when presented to only one individual, must be relevant to each recipient’s financial goals, limiting its broad distribution..

Compliance Consulting Protects Your Business

Compliance risks can be hard to spot, from unseen AI vulnerabilities to everyday communication errors and inadequate marketing disclosures. Working with a compliance consulting firm gives you access to a team of experts who are well-versed in regulatory matters and adept in applying the rules to your firm’s specific situation. A proactive consultant protects your firm from compliance risks and allows you to focus on client service and business growth.

Investing in compliance is not just about avoiding penalties; it’s a way to safeguard your firm.

Lori Weston is a seasoned compliance professional with a dynamic career spanning over fifteen years in the financial services industry. Lori currently serves as STP’s Director of Product & Strategy. She was most recently employed by ACA, where she played a pivotal role in developing innovative compliance programs tailored to meet the needs of investment advisers.  Prior to ACA, Lori was Managing Director at Foreside, where she served as Managing Director and Compliance Consultant to more than 80 registered investment advisers. Lori began her compliance journey at Lincoln Financial, where she supported independent registered investment advisers, laying a strong foundation in their compliance practices.

By Kelvin To, Founder and President, Data Boiler Technologies

After a month in Europe meeting with regulators, trading venues, market participants and other stakeholders, I have many takeaways pertaining to the Consolidated Tape (CT) and related market structure reforms. Analogies from my mix of train rides and air flights traveling across 14 countries and 18 cities, how the CT can provide seamless experience that fit different purposes? I invite you to join me on this journey by clicking here to download the full whitepaper.

The following is an abstract summary:

•      Tight spread constant refreshing EBBO as advertised price to draw big crowds and infuse trust

•      Deciphering the Consolidated Tape in layperson terms, its economic viabilities and market impacts

•      Dynamics among the protectionists, opportunists, regulators, overlooked, and the underrepresented

•      Save costs, grow the overall pie, reduce vulnerabilities, and support sustainable economic development

Amid the creation of a Savings and Investments Union initiative upon the incomplete Capital Markets Union, the EU needs substantially more than a name change. It needs to convince the world to place their trust and money in the EU market. Given Brexit and the UK taking divergence paths with the EU, international competitiveness and growth is at the heart of the UK FCA.  In the race of market data reform, the US is leading the world with the Securities Information Processors (SIPs) introduced back in 1975 and the most recently approved rule (effective December 9, 2024) to improve Transparency of Better Priced Orders, a.k.a. accelerated implementation of Market Data Infrastructure Rule.

Travel across Europe with a low budget takes careful planning and understanding of the nuances (market micro-structure). The same goes with building the CT, to make the impossible possible, e.g., making a CT subscription of €100 per user achievable. Every country I visited has these Americanized boardwalks that connect to my favorite old towns. They co-exist and grow the overall pie, which is the key point here.

I am not sure if it was the European pride or protectionism, rejecting the Americans in building the capital markets’ boardwalks (see this for our suggested mock-up “Schematic of EU Equity Data Aggregation and Consolidation”) to attract big crowds. On one hand, the issuers want these American big brands to invest in their companies. On the other hand, local Exchanges and small domestic participants are worried that order flow may be segmented away to erode their market shares. Selling data and connectivity is the bread-and-butter for typical Exchanges. Yet, such is the mentality of ‘we burn, you burn with us’ to [allegedly give CT crappy data, e.g., 100,000 messages at any given point in time, i.e., mussed up everything and ecosystem degradation to exacerbate gap between proprietary feeds and CT] is sadly a lose-lose approach.

Protectionism and self-interest blinded the eyes of the bigger picture. I am referring to the EBBO. This empirical study shows that “traders are more likely to select dealers (SIs) over exchanges when quoted bid–ask spreads are wide on exchanges and when the tick size is not binding in the exchanges order books.” For a win-win approach to enable prosperity for all EU Citizens, Europe needs a narrow bid-ask spread and constant refreshing of the EBBO, i.e., not over 100 messages at any given point in time to make the tape useful / suitable for BestEx analysis. 

It is totally practical as proven by the High Frequency Trading firms (HFTs) and self-aggregators (SAs). Exchanges are not doing anything extra but providing the same fastest data feed and connection as they provide to the HFTs and SAs (see MDIR ‘same manner same methods’ provision). It benefits the trading and investing communities, including the European trading venues because a usable tape and narrow spread EBBO advertised price can draw crowds to shop in the European markets.

There are legitimate reasons why pre-trade data in Consolidated Quote System of the US SIP is prioritizing speed over streaming of non-core non-essential data. It goes fast by traveling light, analogies to my having 1 backpack and 1 carry-on for my entire 1-month trip. Time lock encryption (TLE) and compressed streaming of “core data” and relevant regulatory data can help overcome the extra hop latency issue in data consolidation. Because it takes a longer time to decode the full depth of book, odd-lot and other nitty-gritty in the Proprietary Feed. The CT would NOT be at a disadvantage in net.

One does not need to know how many people are in the queues of every convenience store across all European markets if he/she may be shopping for milk within neighborhood distance. Top-of-book EBBO provides an indication and introduces price pressure that any neighborhood store should not be too far off from this pan-Europe best price. Again, using a mix of CT and selected Proprietary feeds save money.

I wonder why some local European firms may decide to choose an endogenous selection to trade on certain exchanges or with dealers, and then review the performance every 6 months instead of up their game in execution performance. One logical reason is they under invest in technologies and lack resources or are understaffed. Second, a lack of EBBO thus far causes their clients not to be aware of receiving inferior price. Third, they rely on a strong presence throughout Europe and stickiness relationships with clients rather than execution performance to do business. Fourth, they are afraid that the geographic dispersion and aggregation distance would cause their EBBO refresh rate to be ‘stale’ anyway, that I disagree.

The market shrinks because of protectionist policies that reduce serendipity. The viability of a CTP business model is dependent on its ability to fulfill different sell- and buyside subscribers’ needs. CTP central procurement should be able to save money also for SAs. CT must have non-display low latency subscribers to commingle with display options for outgoing data delivery. One size does not fit all. Attempts to use a single “cloud” service to satisfy both is naïve.

If a pre-trade equity CT is not using the same low latency methods and manner of delivery that Exchanges provide to the HFTs and SAs for incoming data to CTP, it essentially creates more data fragmentation (i.e., what you see on CT is not the same as what others see on Proprietary feeds). The US SEC recognizes the SIPs were not modernized alongside markets evolution and technologies development, therefore it requires the “same manner same methods” provision (see page 186 or footnotes 608 and 609 of MDIR).

I recommend forming an industrywide non-profit entity (NPE) and putting our technologies on top to bid for the CT. Broad representations in governance of the NPE (like NASD before it becomes FINRA) are substantially superior to rate setting by any one group.