Name: The Top 5 Tasks You Need on Your Compliance Calendar in 2025
Uploaded: 2025-04-23T16:30:38.437Z
Duration: 1 h 5 min 16 s
Description: The Top 5 Tasks You Need on Your Compliance Calendar in 2025

Transcript for "The Top 5 Tasks You Need on Your Compliance Calendar in 2025": Hello, everyone, and welcome to today's comply course, the top five tasks you need on your compliance calendar in 2025. Today, our speakers are Med Dano, VP private fund advisory consulting regulatory services, and Kate Clark, legal content writer. So I'll turn it over to them. Great. Thank you so much, Julia. Pleasure to join you today and and, all of you on the call and for the opportunity to present with you, Kate. So as we dive in here, the sheer volume of regulatory requirements imposed on firms and the potential implications for missed deadlines or late filings makes the creation and maintenance of a compliance calendar not only prudent, but, a best industry practice, that is now nearly ubiquitous. As a result, without a specific regulatory mandate, the compliance calendar has become the centerpiece of most firms' compliance programs, helping chief compliance officers who often wear multiple hats to stay organized, proactive, helping them to, ensure that they meet deadlines and, that their programs stay on track. In general, the calendar should include regulatory filing deadlines, deadlines for, regulatory notices or disclosures, regular meetings with, LPACs as applicable, periodic testing of policies and procedures, regular, audits or reviews among other things. But before long, most had a jam packed schedule and nevertheless find themselves wondering what am I missing, on this calendar. So Comply has scoured enforcement cases, regulatory actions, alerts, priorities to come up with its list of the top five tasks that you must have on your compliance calendar for 2025. And while reasonable minds could certainly argue and, get out there and lobby for other topics to be added to the this list, I don't think that anyone would argue that these top five are not absolutely imperative. So let's dive in and take a look at our agenda. So the top five, without further ado, maintaining your manuals. We'll talk about frequent filings, managing your marketing, mitigating material nonpublic information risks, and brushing up on books and records. So let's move to our first topic. So the compliance program rule, requires that investment advisers adopt written policies and procedures that are reasonably designed to prevent, detect, and correct violations of securities laws, and that those policies and procedures be reviewed at least annually for adequacy and effectiveness. So rules, FINRA rules thirty one ten and thirty one twenty impose similar requirements on on broker dealers. So I want to examine those touchstones of adequacy and effectiveness here. And as I do, we can go on to the next slide. So adequacy means, generally, the policies and procedures address all applicable regulatory requirements imposed on the firm based on its business model as well as conflicts of interest in other areas presenting risk. As a result, ongoing monitoring of regulatory developments is key to safeguarding the adequacy of a firm's policies and procedures. But ramping up new controls, to meet the requirements of major new regulatory initiatives ahead of the deadlines for compliance takes time and planning. I've identified at least six steps, in that process determining the applicability of new regulatory requirements, determining what functions will be impacted within your firms, evaluating the capacity or capabilities of current systems and staff, what new tools or resources may be necessary, if any. Firms will wanna plan for the development of new policies and procedures tailored to how new requirements intersect with their practices. The, they wanna determine how the firm is gonna test those new controls, going forward and ensure that those new testing ongoing tests are incorporated into policies and procedures and plan time to roll out the new policies and procedures, and systems as applicable, including training for new, or for supervised persons. So the point is to ensure a smooth transition for compliance with material regulatory initiatives, firms must work backwards from that compliance, date and add each of these incremental steps to its calendar building insufficient, buffers for likely delays as well. So then that brings us to effectiveness. To evaluate the effectiveness of a firm's policies and procedures, firms should plan to conduct, regular testing over the course of the year, particularly in compliance areas that are deemed to be high risk based on the firm's practice. And in this way, the firm's review of policy and procedures is not compressed into a very tight, narrow, time frame, and compliance issues can be detected earlier and corrected to prevent harm. So the recommended practice is that firms, scour their policies and procedures. Typically, real low tech way is to do a find in word, for words like review, monitor, test, and list those all out, inventory those, and then provide concrete timelines where policies and procedures maybe are a little more ambiguous. Like, we are going to test this area periodically. What does periodically mean to you? Let's give it some real concrete deadlines there and then add those to your compliance calendar. Importantly, in this regard, in a 2020 risk alert, the SEC announced that examiners had found mere material deficiencies at firms, including failures to review significant areas of their businesses and that they did not perform key testing or other actions as required by written policies and procedures. So we can go to the next slide. This just has some quotes emphasizing the importance of what we just talked about. We can go to the next slide, and this is our first poll, of the day. When was the last time you updated your policies and procedures or WSPs? Within the last six months, within the last year, within the last five years, over five years ago, or unsure? Please do not be swayed, by my prefacing comments there. Honest answers would be great. Next slide. Just to to summarize, this area. In order to keep your compliance, calendar current and ensure that you plan for change and major regulatory initiatives such as FinCEN's expansion of the AML CFTC rules for IAs, the SEC's amendments to Reg SP among among others. You have to remain plugged in, to ongoing developments. And one really good way to do that is to subscribe to and receive updates from the SEC, from FINRA, other regulators as appropriate, as well as membership organizations can be very helpful, as you see listed there as applicable. And you have to be members of some of these, but extremely helpful guidance from these organizations, as well as law firms and reputable compliance consultancies such as Comply. As mentioned, you wanna work backwards, from the compliance date of any new material change to ensure a smooth transition and plan sufficient time for formal mandatory and documented training of staff on any new requirements, any new firm policies and procedures. And to the extent that a particular team or group within your firm is disproportionately or differently impacted, consider separate specific training for that, group and ensure to track receipt of employee certifications regarding trainings and acknowledgments of new policies and procedures. And let's move on to our next topic, and I'll turn things over to you, Kate, for a bit. Hey, Meg. Thank you, for that intro. Another very important topic here, frequent filings. As compliance professionals, we know that filings are something that you cannot avoid, or avoid at your own peril. So if we could move on to the next slide, we'll be discussing, some of the fumblings that we see. Some of the common deficiencies are listed here on the right, inaccurate disclosures on your form ADV, inaccurate, untimely, amendments to your form ADV and inaccurate or untimely form filings in general. These two examples, to the left of the slide are just two examples of many, that plague the industry. The, form d filings, must occur within fifteen days after the first sale of your securities, or, yeah, your securities in an offering. Failure to do so, as seen here, was a major problem for many entities. Similarly, the SEC charged 11 institutional, investment managers with failing to file forms 13 f, which must be filed each quarter within forty five days of the end of the calendar quarter. So that's one of the recurring deadlines, that just happened to be overlooked, by many different entities. That those charges in particular resulted in $3,400,000 in penalties. So a pretty serious boo boo, I would say, for missing, a recurring deadline. If we could move on to the next slide, we'll be discussing how to avoid those sorts of problems and, the three topics that, I mentioned previously. Actually, Kate, before we before we walk through, this slide, I just wanted to add, on the last slide, one important area with ADV filings, deficiencies. We saw a number of firms over the last couple of years. I think 22 firms that had, custody rule related violations, with the SEC, and a number of those had to do with their responses to questions on form ADV and updating those responses regarding the delivery of audited financials. So, obviously, you could you could do everything right, but you still need to mark your calendars to make sure you go back and update those responses as, as they change. So Yep. Great call out on that. Your form ADV, yes, the amendments occur every year, but it is not necessarily a set it and forget it, type of filing. You really need to be revisiting your form ADV anytime there's, any sort of material change that your, firm experiences. That could be anything from, growing your assets under management, if you add or remove advisors, you take on a new type of client, you're offering a new product or service. All of those are material changes that, must be updated on your form ADV. And to sort of circle back to what Med was discussing, anytime you're adding or removing or making any sort of change, take a look at your policies and procedures or your WSPs. Are those changes accurately reflected, in those materials as well? It would be a shame if your, form ADV did not match your policies and procedures. That is you're already doing the work, so let's make sure that it is clearly and accurately reflected on your form ADV. Similarly, in terms of getting your disclosures right, give yourself plenty of time. Get all of the documentation that you'll need beforehand. Many items will require some sort of verification or legal review. You need to get the right eyes on any sort of filing that you're making. If it's your first time filing, any sort of filing, give yourself plenty of lead time when you don't know exactly how long the task will take you. It would be a real shame for you to be cutting corners, being inaccurate, not, including the correct information simply because you got the timing wrong. Another great source of, information are the instructions. I know it's remedial, form ADV. The instructions are 36 pages long. There is a ton of great information in there. You are most likely not the first person to have a question about form ADV, and the answers for many of your questions may be in there. Don't be afraid to consult your relevant SEC rules. Call a consultant, if you have other friends in the industry or colleagues who can assist you. You know, really make sure you're using your resources, to the fullest extent. But, really, those instructions contain a lot of information. You may also want to make sure and in many cases, it's imperative that, you're getting the right people involved. I, for one, am not a tech person. If there's any sort of technical related filing, get your IT people involved or your cybersecurity team, get the right people, to help you on this. You don't have to go it alone. So that is very important also for keeping your sanity, but make sure, that you give yourself enough time to review both their work, and your work in response to what they have done. That is really well done when you can, track and know your deadlines. Make sure your deadlines are on your calendar. Make sure your internal deadlines are on your calendar. Those are very easy ways to sort of get that slam dunk on your recurring, filings that you have to do every month, every quarter, every sixty days. The that's not where you should be, you know, stumbling. You really need to make sure that those are on your calendar. You also need to be aware of certain trigger events, events that may not be happening frequently at your firm. Certain states require you to file and make disclosures to, your clients if there's some sort of data breach. I'm hoping that's not a regular occurrence at your firm. So you're not necessarily aware of the trigger events by which you need to file, and who needs to be involved. So make sure that you at least have those in your policies and procedures, so you can refer back to and make sure the correct people know what those trigger events are. You really should have some sort of open dialogue at your firm where you can get the correct people involved. They all understand their own responsibilities. You don't want any bottlenecks in terms of, oh, I thought this individual was going to provide me the information. I thought this department was responsible for filing. You really need to take those steps and streamline your process and understand who's responsible for what and within what time frame. So I believe that about covers my thoughts on this, Ned. Yeah. Kate, I I, I'd love your I love your comments and suggestions. I I I definitely would not say that, you know, referring to the instructions is, you know, remedial or elementary because, we all do it every day. I think it's, it's also important to note that that there are frequently asked questions regarding IAD and form ADV as well as the instructions that can be very, very helpful. Firms, encounter changes, add new services, new products, you know, among other changes, and they will encounter situations that they haven't encountered before and may not be entirely clear about what the disclosure, regulation, you know, requirements are. So, absolutely, I love that, recommendation. Also leaning on IT, I mean, you definitely wanna know who your allies are in the firm, who gets it, who gets the importance of this, and can help you to to get things done, get the accurate data and information that you need in a timely fashion. Definitely wanna know who those folks are. You know, when I was thinking about regulatory filings and you're talking about the timing and being aware of those trigger events, I hadn't thought about until you said that the new, or the upcoming, you know, amendments to Reg SP, requiring, you know, certain incident response notifications, and there are certain time frames and content requirements there. And, yeah, firms need to know folks need to know what those triggers are and what those time frames are as well. So, really valuable insights in this slide. Appreciate it. We can go into the next slide and the next topic, which is managing your marketing, and we can go right onto the next slide. So marketing practices have been have always been, really a hot topic for regulators. On the investment adviser side, the very first anti fraud rule, passed over sixty years ago and adopted, under the brand new, newly minted investment advisers act, addressed marketing or addressed investment adviser advertising. Of course, in 2021, you know, the SEC overhauled and basically replaced that advertising role and, as well as the cash solicitors role for the first time ever, creating a comprehensive single, complex, new marketing rule, with the 2022 compliance deadline. So the rule is principles based, rather than prescriptive. It incorporates new standards based on fairness and balance. It was purposefully drafted to be evergreen, so it should be relevant regardless of advances in technology or communications platforms. I often, joke when talking, on this topic that look. If the next big iteration of social media involves, you know, you being able to project a hologram of yourself in my living room, to communicate a message, this rule is gonna cover that communication. So, and the and that's because the prior one was very specific in terms of means. This one is not. Marketing practices have been included in SEC's, the SEC's examination priorities each year since adoption of this new rule, And that scrutiny has led to numerous enforcement actions, against firms for, you know, a number of things, making claims regarding, the use of AI, which were just actually inaccurate, fraudulent, among other things, including charges against several investment advisers last year in 2024 for posting hypothetical performance, on their websites without adopting certain policies and procedures that were reasonably designed to ensure that, that, that hypothetical performance was relevant to the likely financial situation and investment objectives of the intended audience. By the way, that's an impossible standard when you're posting hypothetical performance to a publicly available website. We'll talk a little bit more about that in a moment. There have been three risk alerts, so far, including one issued in April of twenty twenty four. In addition to the excerpted, observations from that alert that we see listed here on this slide, the SEC noted that many, many firms had not, tailored appropriately, their written policies and procedures to their particular marketing practices. In other words, they were basically, regurgitating the requirements of the rule, which the SEC does not like. We'll We'll take a look at a couple of these bullet points here real quick be before we move on. And these were included in the the last SEC risk alert on the marketing rule, including untrue statements of material fact or omitting a material fact necessary to make the statement made in light of the circumstances on which under which it was made, not misleading. This, boiled down to one particular example that, the SCC noted, which was an advertisement in which an adviser claimed to be free of all conflicts of interest. No adviser is free of all conflicts of interest. Another is including a material statement of material fact that, the adviser does not have a reasonable basis for believing it will be able to substantiate upon demand by the commission. Some examples were publicizing, receipt of awards that were not actually received. Last bullet point there, including information that would reasonably be likely to cause an untrue or misleading implication or inference, to be drawn. One example there was basically an adviser that had put in an advertisement, we're different. We're different because we're required to act in our client's best interest. And the SEC said, no. All advisers are required to act in their client's best interest. That's the fiduciary duty, requirement. So that you know, without that additional information, made for a misleading, claim. FINRA, also had, issued their 2025 regulatory oversight report, which provides some insight into the findings from regulatory operations program and talked about inadequate supervision of of, firm social media influencers, as well as false misleading and inaccurate information in mobile apps and others, very important information there. So if it's applicable to you, it definitely would recommend that you check out both of these releases. With that, we'll move on and talk about our next, polling question, which is what aspects of the marketing rule do you find most challenging in the process of reviews, hypothetical performance, managing of, disclosures, managing the various marketing channels, or other, whatever that may happen to be. We can go on to the next slide. I noticed that there was no all of the above as an option, and some people may find that to be the case. Maybe that's other. But, yeah, it is a challenging rule, in terms of definitely struggled. Hypothetical performance is a big one, if it's applicable to your firms. But yeah. So so let's let's think about what what counts as marketing. Under this new rule, an advertisement is defined as any direct or indirect, and I wanna come back to that, communication, to more than one person, unless it contains hypothetical performance, and then even to one person, that offers advisory services regarding securities to prospective clients or an investor in a private fund managed by the adviser or any new service to a current client or private fund adviser. And because we collapse two rules into one here, any testimonial or endorsement for which an investment adviser pays compensation. That definition, casts a very, very broad net. It captures traditional advertisements, certainly, such as, tear sheets, PowerPoint presentations provided to more than one person, websites, social media posts, and more, as well as arrangements to provide anything of value in exchange for a recommendation or referral to the investment adviser. I told you I wanted to come back to indirect communications, and it's important for a number of reasons. That's that's new under this new rule. So it includes the the definition includes any direct or indirect communication that meets these other requirements. So what what it what counts? What's an indirect communication? It can occur in a number of circumstances, and I'll talk about just a couple here. The SEC noted that whether a supervised person of your firm, an employee, who posts on their personal account a discussion regarding the firm's services, if that is an unauthorized post, that could nevertheless be considered an advertisement of the firm, which is a scary thought. And the SEC said it depends on the facts and circumstances, and they called out two in particular whether the firm has adopted reasonable policies and procedures to prohibit unauthorized persons from posting about the firm, its services, its clients, and and other, things, and provided training to its staff regarding those policies, procedures, and prohibitions, received certifications from that training. So that would be an indirect communication of the investment adviser would count as an advertisement if these criteria were not met. Also, third party content can, become the responsibility of the adviser under the rule, you know, content that is created by others and included in advertisements created by the investment adviser. For example, common, example, including a link to third party content, you know, the firm is considered to have adopted that content as its own. We'll often see those disclaimers. We're not you know, we've included these just for informational purposes. We're we didn't create this third party material. We're not responsible for the content or its accuracy. Do your own research. That no longer flies. People keep trying to keep dropping that disclosure in. But if you're including content or links to content in your marketing materials that you've created, you're responsible for its accuracy. Another example is that an adviser can entangle itself in third party content, third party communications if it is involved in its creation or otherwise curates that content to adjust the messaging. For example, Affirm, generally speaking, is not responsible for third party posts on its social media accounts, likes or dislikes, thumbs up, thumbs down, unless it manipulates that information. For example, deleting unfavorable comments but retaining the favorable ones, or ensuring that comments are reordered in such a way that the favorable comments always appear on top and the less you know, the disfavorable comments are buried. If you've done that, if you've curated that that content, even though it's third party post, you've now entangled yourself in that content such that it is considered your own under the rule. So let's take a look at hypothetical performance. In the adopting release, to the marketing rule, the SEC stated its opinion, that while potentially helpful for some sophisticated clients with tools and resources to understand the assumptions, underlying hypothetical performance, the limitations of using hypothetical performance, it is considered, and I quote, unquote, a high risk it has a high risk of misleading investors. That's directly from the adopting release. So if your firm will use hypothetical performance, it is likely to invite scrutiny, from the SEC, particularly if your regulatory filings, your ADV, for example, shows that your clients tend to be retail investors. As mentioned, the SEC has brought numerous enforcement actions against firms for posting hypothetical performance on their sites with over $200,000 in combined civil penalties, over that, that year. Hypothetical performance, just so we know what we're talking about, includes, model portfolios, back tested performance as well as, targeted or projected performance, what I like to call wishful thinking performance. So it's important to note that, you know, one cannot determine whether hypothetical performance is compliant with the rule simply by reviewing the marketing alone. And that's because compliance with the rule depends on the audience. It depends on the advanced legwork that has been done to ensure that the hypothetical performance is relevant to the likely financial circumstances and investment objectives of the intended audience. So, again, that can never be satisfied. Those requirements can never be satisfied, with a broad dissemination tool such as a website or social media post, publicly available social media post. What about testimonials? Testimonials and endorsements, I should say. So subject to certain exceptions, there are four general requirements that must be met, if the firm compensates a person to provide a testimonial or endorsement. First is required disclosures, and I'll come back to that in a moment. The second is that the person providing the testimonial or endorsement must not be an ineligible person, as defined by the rule, and that includes just certain bad actors. The adviser must provide, oversight, and a written agreement must be entered into between the adviser and the person providing the testimonial or endorsement. So going back to the disclosures, the rule includes both content requirements as well as format requirements for disclosures, testimonial, or, endorsement disclosures, with two buckets. The first bucket being content that must be provided in a clear and prominent fashion, and that is whether the person providing the testimonials is a as a client or not, whether the firm, compensated them in a brief statement of of material conflicts resulting from the relationship as well as, again, other other disclosures that provide a little more detail but do not necessarily have to be provided clearly and prominently. So, the summary, I guess, the takeaway here before we move on to our next topic is that while marketing, materials, including social media posts, should be reviewed and approved contemporaneously, that is prior to their use, Firm should also add regular compliance, reviews or testing over the course of the year to their calendars. For example, since the new investment adviser marketing role includes, testimonials and endorsements for which the firm pays compensation, including noncash compensation directly or indirectly, firms really should query their representatives and conduct some testing about lead generation, and whether or not anything other than cash, anything of value is given for those client referrals so that you can try to identify relationships that should fall under the requirements of the rule but haven't been, identified in that way and therefore don't meet the requirements of the rule. A big example is sort of those cross those informal cross referral understandings with accountants and other professionals where we're not really paying you, but the understanding is you scratch my back, I'll scratch yours. That counts among other things. Another example is to identify in all marketing materials that are under circulation at the time, every material fact or claim that's included in those materials, and then test whether or not the firm can substantiate them upon request. Can you promptly produce substantiate substantiation? And then another test I would recommend is randomly reviewing a sample of publicly available social media posts of your supervised persons in their personal accounts just to make sure that there's no firm related posts regarding firm services unless that person is authorized. And then to look at authorized post to make sure that if it was reviewed with a markup that those changes were made prior to the post being, live, among other things. So, with that, we'll turn things back over to Kate, and we'll take a look at our next topic. Right. So mitigating MNEI risks. Another very important, job as a compliance professional is making sure that you are aware of those risks and doing what you can to limit them and prevent them, from causing insider trading at your firm. So what is M NPI? That is your material non public information. So that's really any sort of information that could impact the market value of a particular security, that is not shared with the general public. So that could come from a variety of sources, straight from your best friend, the CEO's mouth, as a secret. It could come from any sort of individual within a company, regulatory agencies, credit agencies, other institutions, any sort of, person or entity that may have, this non public information. Many sorts of different facts could qualify, as that material non public information. So it's really hard to, create an exhaustive list of what might qualify, but some examples include, a potential merger or a merger that's underway, changes to company's leadership that could have a significant impact on the company, earnings reports that aren't meeting expectations, any sort of fact that is, like that is considered material. So what do we mean by material? Any sort of information that really could, change the value of a company stock up or down, good or bad, is considered material, in this sort of instance. Nonpublic, so that is information that has not been exposed to the general public by the company or is not widely available to, investors. So once you have that material nonpublic information, what do you do with it? You certainly don't trade with that information. You do everything in your power to prevent any sort of insider trading, And really making sure that, you have a good handle on that will be, discussed in the next slide. So, unfortunately, insider trading has, been around for a very long time and does not seem to be going away anytime soon. 2023, we had the creation, or updates to, SEC rule 10 b five one, which can be used in certain situations as an affirmative defense, to insider trading in very limited sorts of circumstances, such as when an executive, makes a trade as part of, like, a binding contract that existed before this MMPI or, in accordance with a plan that was created before, he or she had this MNPI. While that acts as an affirmative defense, again, there are limited instances, where that could really be helpful, or apply to on a grand scale. What you see here, on the slide are, like, more common, sorts of instances of, insider trading and wrongful use of MNI. In the bottom corner, you have shadow trading, which is when an individual has information about company a. And instead of trading, securities in company a, he he or she executes a trade in company b, you know, a competitor, another sort of company in that same, general realm. It's become a it it seemed like it was, you know, always the case, but now we have clear proof that shadow trading is actually, forbidden under this insider trading concept. There are other sorts of instances of insider trading and wrongful use of MMPI, as new technologies develop, and there are new sorts of, realities. People will find a way to adapt and use that insider information in not not the best ways. One particular case of note is the first, sort of case here highlighted due to work from home policies. Husband and wife may be working, you know, from home, in very close quarters. Wife works at a publicly traded company, is working on, documents related to a merger or a sale. Husband takes that information that he overhears, and then trades on it. That is a huge no no. And, unfortunately, while you may think that you can trust this individual, your company cannot. That there should have been certain, safeguards put in place to ensure that this insider information really was limited truly to, only the individuals that needed to know. That does not unfortunately extend to your husband or wife, in instances such as that. There are other examples of, you know, really pressing on a friend or family member for, that sort of insider information and trading on it. Whether your your portfolio goes up or down is sort of immaterial. It's the fact that the information was shared, and that there was a trade made based upon that information. There's been other cases where, executives' emails have been hacked leading up to a sales call. So, a bad actor has information, that he or she should not have. So, again, you need to make sure that everyone fully understands your IT policies, your cybersecurity policies. You have good, sort of phishing, deterrence, things of that nature to really keep that information protected. There there have been other instances of, receiving an email in error, that contained that, MNPI, and trades being executed on that. There's the classic, you're out in public. You overhear, half of a conversation of, oh, our company is going to be bought out by another company. And while you're only hearing half of the conversation, that gives you enough information to make, trades, good or bad based on that information. And, of course, there's always the classic, tipper tippy. I am trying to win over your business. Here's, some insider information, so that you like me, you hire me. You know, we establish this good relationship. So those are all big boo boos. No fly zone. So if we could move on to the next slide, we'll discuss how you can mitigate that. Of course, not all of those examples will necessarily apply to you, your firm, But, again, it's important to be aware that the landscape is changing somewhat. There are those tried and true methods, but, again, there are always ways, that people innovate to share this information. And with that said, it's very important to mitigate that risk. One of the ways in which you can do so is collaborating with the correct people at your firm. Again, you don't have to go it alone. IT should be a very good friend of yours, when you're establishing ways to mitigate, your risk in this area. You would like to create strong access controls, data security measures, monitoring systems. You need to ensure that only the correct employees receive the correct information. You want to also keep the wrong people out. We've seen those instances where, CEOs emails get hacked or the CFO's, account is hacked. We we need to take steps to prevent that, at all costs and keep that private information private. You could also go about, leveraging your data analytics. Again, call on IT for some help in this area. You can use compliance consultants as well. They have the correct tools where they can detect, communications patterns between, advisors, and third parties where you think there may be a high risk. You can track, attempts to access data. Again, ensure that the right people are accessing the right materials, and that there is no unauthorized, access, either being attempted or being successfully completed. It there's also, various softwares and, consultants that will help you monitor treating activity, of your advisers, look for any sort of anomalies, that indicate that they may have MNPI and be using it improperly. Again, it's fine to have that MNPI, but you cannot trade on it. And you need to ensure that while it's tempting, everybody understands that. The the juice is not worth the squeeze. There are hefty fines, penalties, all sorts of regulatory, you know, penalties that can can really put a lot of, you know, pain into your day to day life. You can also take advantage of various AI tools. They can analyze communications again through your reps to third parties, any sort of you can enter any sort of, like, red flag phrases, and then they can monitor that. In a in a perfect world, it would be very easy to sort of track those communications. This can sort of keep track of any sort of suspicious activities or phrases or keywords that might be used. It's also possible to assess the the context of the data, access. Oh, these people are are looking at something that they really should not be, and that will also lead to unusual, trading patterns being discovered. So Yeah. Kate, I know some some recent or, well, relatively recent cases have highlighted certain keywords that can help keywords or phrases, things like tip, edge, my source, among others. So, yeah, optimizing your your sort of email monitoring software or platform to to pick up on those kinds of keywords or phrases would be would be imperative as well. I like your suggestion. Obviously, ongoing monitoring of firm trades as well as personal trading against the firm's restricted list, maintaining that restricted list. I think it's It's one thing to have the list. It's another thing to, actively be maintaining it and making the appropriate changes. So, yes, definitely. Yeah. I think, some firms will have some very specific policies and procedures as well that, you know, they they should then consider adopting in addition to those that are, broadly recommended to the industry. You know, for example, some firms will, require that calls be chaperoned. You know, researcher calls or analyst calls with company folks would be chaperoned. So monitoring or testing to make sure that that happens, whether it be on a sample basis or in the appropriate sample size among other things. So, and then just training, training on policies and procedures, making sure that everyone understands that, you know, the firm is completely bought in on these insider trading policies and procedures from the top all the way down, creating that that culture of compliance, that can help then, hopefully, make sure everyone is understands. We're on the same page. The expectation is you will not trade on in for inside information as well. So great tips. Yes. Well, thank you. Yeah. And I think we can move on to our next, topic with that. Yes. Brushing up on, books and records. So we can, we can go to the next slide. Just generally kind of teeing up this topic. We see a few few, quotes here from the regulators, but as you look that over, I'll just mention. So the securities laws, and rules adopted under the securities laws require that firms maintain certain records, and those records are going to be subject to inspection by the regulators. That includes, Securities Exchange Act rule 17 a three, seventeen a four, among others, on the BD side, Advisors Act rule two zero four dash two on the adviser side. One important note, though, is that while, for example, rule two zero four dash two lists a number of records that investment advisers are required to maintain as applicable, section two zero four of the Advisors Act makes all records, any record that is kept by the investment adviser subject to SEC, examination, whether it's required or not, which is a great argument for having, a good, disposal, discarding of records, policy in place as well as a maintenance maintenance of policies of records policy in place. So failure to maintain, required records, or to promptly produce them upon request can result in enforcement actions, against the firms. And most recently, best example of that, which we see, typified in these quotes from regulators here, deals with optional communications. This focus area, I think, is abating to some extent. I would fully expect that the SEC would still ask, and FINRA, ask questions about your controls around this area. I think the, flurry of enforcement actions and exorbitant fines, are probably coming to an end. But, you know, so rec you know, the records of client or customer communications that were delivered outside of approved channels led to these these enforcement actions being brought against firms. We're all familiar, with that. And, ultimately, these record keeping failures resulted in charges against, approximate numbers here. I wanna say around 70 firms in total, and I believe we are approaching 3,000,000,000 in penalties against the industry. So huge, huge potential ramifications for record keeping failures. I would also mention a lesser known case from a little more than a decade ago where the SEC, examiners became so frustrated with an investment adviser's inability or unwillingness to produce records upon request on a reasonable time frame that they were dinged, with an enforcement action. I wanna say it was, like, $20,000 in civil monetary penalties, but it can happen. I mean, you're required to keep these records on, on a regular basis so that they can be produced promptly, typically within twenty four to forty eight hours upon request by a regulator and failure to do so can have ramifications. So for a little more detail, we can go on to the next slide and I will turn things back over to you, Kate. Great. Thank you, Ned. So, again, it's essential to know the rules, know which rules apply to you, know what your obligations are under those rules. So at a high level, it sounds very simple and straightforward. If you make it, you need to maintain it for a certain amount of time. SEC rule two zero four dash two, applies to investment advisers that enumerates 19 different, sorts of records that you need to make and maintain, each with, at least one subpart. Many are very in-depth about the specific items that you need to make and maintain, SCC rule 17 a three and a four, apply to BDs, 17 a three. Again, like, two zero four dash two, there are many, many items that need to be made and preserved. I believe it's over 30, each with multiple subparts. So, again, make sure you understand your obligations. Read the rule, review the rule, read it again, make sure that each, policy and procedure, has the correct date for which you must maintain those items. There are various, time frames that apply, anywhere from three years, six years, or for the entire, existence of the broker dealer's lifespan. So with all those different sorts of timelines, it's essential to know, what timeline applies to the record that you are intending to keep. It sounds pretty straightforward, and yet there are still failures that are pervasive, across the industry. So, you know, you don't have to do it every day, but make sure you're looking to see what your obligations are that the individuals who are responsible for maintaining those records know what their obligations are. If you're relying on electronic rec records, ensure that the last two years are easily accessible and can be readily provided, to the regulators upon their demand, just as Ned was saying previously. If you have the records, you should be able to, know where they are, how to access them, and ensure that they are being, safely maintained, and not subject to any sort of, I guess, bad actors or doing your best to prevent any sort of, you know, bad actors from from creeping in. Let's see. FINRA rule forty five eleven, that's adopting those, SEC rules 17 a three and a four, and twenty two ten are the specific record keeping requirements, related to communications with the public. And that is a very large section that, we could talk about in-depth for quite a while. Make sure you if that rule applies to you, you read it, you understand it, and the correct people to whom that rule applies, understand their obligations as well. That imposes its own sort of, record keeping requirements related specifically to communications with the public, because FINRA cares about ensuring that, the communications with the public are fair, accurate, not misleading, and, just in general, correct. So, those are the four or excuse me, five big rules up there, that you should really be paying attention to. As new rules are passed, many times, at the bottom of the rule, rule, it will tell you for how long you need to maintain those, books and records. So make sure that anytime you're, drafting a new policy or procedure that, that information is added where it needs to go. In terms of prohibited channels now with off channel communications, make sure that that list is updated frequently. Your the individuals at your company need to know the acceptable channels, the monitored channels, the band channels. And as new technologies are, you know, created and being used, you need to update that list and put that new technology, somewhere into one of those three categories. There's also once you do that, if there is some sort of off channel communication violation, these steps here on the right, are a general framework for how you should move forward in terms of reporting violations, great framework here, assess the situation, notify key stakeholders, figure out how this happened. Was somebody using a brand new technology that, you didn't know existed? If so, make sure that gets added to one of those three channels. Make sure you self report to the regulators, and cooperate with any sort of investigation, that will stem from this. They really appreciate, and you may receive some sort of lower penalty. I can't guarantee that, obviously, for any sort of, cooperation, with their investigations. Once that is completed, you need to implement any sort of remedial measures. If the regulatory body has instructed you that you need to undertake certain steps or modify your policies and procedures in a certain way, make sure you do that. Then move forward, document, and archive everything relating to this investigation, this violation, and use that information to review and improve your policies. That's sort of a high level, quick sort of how to for a very lengthy sort of, process. We did our best to condense that down for you. And, Med, do you have something to add? Just a couple thoughts, Kate, and appreciate that that great summary. So one one is just on your your thoughts on the, you know, band channels. I I I don't think that it is necessarily required or expected that there would be an exhaustive list and that you're you you sort of maintaining that on an ongoing basis, but you definitely wanna include, to your point, a representative list, particularly of the more popular channels that may be used by by employees from time to time. And you absolutely want to be very, very clear about which channels are approved for use with client communications, firm business as such, whichever standard we're under here. And that obviously, would include only channels that are monitored, by the firm for supervisory purposes and that where those communications can be captured for record keeping purposes. The only other point I wanted to make is just to emphasize again the fact that record keeping is a dynamic rather than static process. We're constantly adding new records, and as well as record keeping requirements as new rules are passed. There's often a record keeping component, which would augment the record keeping rules generally, and and other records that have been preserved as required are aging out on a on a regular basis. Right? So we need to know and track, when that time you know, when that clock starts ticking because there are certain records to your point that, you know, that clock doesn't start ticking on, you know, substantiating documents for marketing materials that are still in use even if it's 30 years old. But other records as they're aged out, you know, we can begin disposing of properly. So we just wanna make sure that we're doing that on a regular basis because rare instances but have had firms that kinda had some difficult situations with SEC examiners that really never had to occur because three years had since the absence, they could have gotten rid of these older records. So just something to keep in mind. It it's it's not a static process, but great summary. Appreciate that. And that brings us, I think, to our last polling question, if we can change slides, which is, how do you currently manage your compliance calendar? Do you do so manually? Do you do so with the support of of technology, some manual, some techno technology, or not really sure, how you do that or whether you do that, I guess. So we'll sort of keep that, all open for a moment. As as I just mentioned, I we're sort of wrapping up with this poll. So just wanna thank you all for for joining, for your participation in the polling questions. Thank you, Kate. It's been a pleasure to present with you. I sincerely hope that we've provided some practical considerations for expanding your compliance calendar for strengthening your compliance program, through regular, periodic and documented testing. Thank you all so much. Thank you.