Social Media Compliance in the Financial Services Industry Morris N. Simkin Law Office of Morris Simkin July 26, 2017

Morris Simkin 60 E. 42d Street New York, NY 10165 212 455 0476 msimkin@securitiesregslawyer.com

What is “Social Media” The Federal Financial Institutions Examination Council defines it: “a form of interactive online communication in which users can generate and share content through text, images, audio and/or video” 78 Federal Register 76297 (December 17, 2013)

Social Media FFIEC Examples include: Facebook, Google Plus, MySpace, Twitter, blogs, and bulletin boards- e.g. Yelp, video- Flickr, YouTube, networking- LinkedIn, Second Life, FarmVille and CityVille

Social Media Subsequent examples include Pinterest, Tumblr, Instagram, Vine, Snapchat

Growth of Social Media In 2013 some 1.734 billion users or 25% of the world’s adult population; By 2017 it is estimated at 2.55 billion, or 72% of the world’s adult population

Survey How many attendees are: a) broker-dealers; b) SEC registered investment advisers; c) banks; and d) other? How many are working in firm’s that have adopted a “Social Media Policy?” How many are in-house counsel or compliance personnel; How many are outside counsel or consultants? How many are with firms that allow employees to maintain personal social media accounts that refer to the person’s employment or position with a financial institution?

Survey How many are with a firm that uses a web crawler or similar web analytic to track social media references to the firm? How many are with a firm that uses a web crawler or similar web analytics to track employee use of social media?

General rule There is no established federal body of law governing use of social media other than the National Labor Relations Act and the Federal Trade Commission Act

National Labor Relations Act The National Labor Relations Act prohibits an employer from limiting or restricting the ability of its employees to communicate with one another about their working conditions and terms of employment

Federal Trade Commission Act This Act prohibits the dissemination of false or misleading statements

State Laws A large number of states have adopted laws prohibiting employers from requiring their employees or applicants for employment to give the employer their pass words and access to their private social media accounts

Securities and Exchange Commission Form ADV: The SEC recently amended Form ADV that all investment advisers must file to register with the SEC, and thereafter to annually update, to disclose all the social media sites where the adviser controls the content and that are used to promote the adviser’s business to potential clients

Form ADV Excluded from this disclosure requirement are social media accounts used to promote the business of other parties-such as affiliates, and internal social media

SEC Division of Investment Management Division issued guidance in March 2014 on investment advisers using social media to promote their business through testimonials. Rule 206(4)-1(a)(1) prohibits investment advisers from using testimonials Division interprets testimonials to be client statements of their experience with or endorsement of an investment adviser

Investment Management The interpretation states that in the case of social media encouraging clients or third parties to write reviews or report on their experience with the adviser could come within this prohibition. Also, encouraging others to “like” an adviser is viewed as a testimonial. But unsolicited testimonials or reports of third parties are not within the prohibition

Investment Management The interpretation also says that use of a third party’s report or review by an adviser in its advertisements could be deemed a prohibited testimonial But reprinting or restating a third party social media account would be permitted if a) the content is independent of the adviser, b) the social media is not connected with the adviser, and c) all comments in that social media regarding the adviser are included

SEC Office of Compliance Inspections and Examinations In a January 2012 Risk Alert OCIE outlined its staff’s observations regarding supervision and compliance policies for advisers that use social media Some 13 elements were noted

OCIE These include: Guidelines on appropriate and inappropriate use of social media; Content standards to assure that the content is consistent with the firm’s fiduciary standards; Monitoring; Frequency of Monitoring; Prior approval of content; Firm Resources- are sufficient compliance resources dedicated to this monitoring.

OCIE part 2 Criteria for approving participation; Training of personnel; Certification by users of social media; Functionality of the social media sites being used; Personal/Professional Sites- firm controls over their use; Information Security-control unauthorized access or use of firm information; Enterprise Wide Content- are there other businesses affiliated with the adviser who may use social media or which could affect the adviser’s social media content;

OCIE part 3 Finally, the Alert reminded firms of the need to retain records of the firm’s social media usage

FINRA Two rules of the Financial Institutions Regulatory Authority (FINRA) are directly relevant: Rule 2210 Communications with the Public; and Rule 3110 Supervision

Rule 2210 A firm principal is required to approve in advance each retail communication A retail communication is a communication- written or electronic, distributed to more than 25 retail investors within any 30 calendar day period The rule does not apply to a retail communication that does not constitute a “research report”, does not make a recommendation or promote a product or service of the firm, and is posted on an online interactive electronic forum

FINRA Rule 3110 This rule requires a member firm to have supervisory procedures to review incoming and outgoing written or electronic correspondence relating to the firm’s investment banking or securities business

Regulatory Notice 10-06 This notice provides FINRA’s guidance on use of social media for business purposes by a firm’s personnel, and does not apply to personal usage It points out the need to retain records of such usage; and to review the communications through such social media It suggests prohibiting use of social media to recommend specific investments or investment products

RN 10-06 The RN states that static blogs are advertising subject to FINRA’s rules It also reiterates the SEC’s “entanglement” theory- that a firm or its personnel could be so closely identified with a third party’s blog or social media content as to be entangled with that blog or posting and thereby subject to FINRA and SEC rules

RN 11-39 This RN repeats much of RN 10-06 regarding a firm’s responsibilities to supervise, review and retain records of social media postings It discuses accessing social media from an employee’s personal device. To the extent such postings are “business” related they are subject to the requirements for review and retaining copies in the firm’s records

FFIEC Guidance Each institution is responsible for an appropriate risk assessment and maintaining a risk management program of its use of social media appropriate for the institution’s size, activities and risk profile in the consumer area

FFIEC Guidance The guidance identifies several areas of focus. These include: Compliance and legal risks – among the statutes cited were Fair Lending Laws, Equal Credit Opportunity, Fair Housing Act, Truth in Lending, Notice of FDIC or NCUA Insurance, Electronic Funds Transfer Act, Bank Secrecy Act, and Community Reinvestment Act.

FFIEC Reputation Risk- the possibility of negative public opinion, fraud and brand identity, privacy concerns, and consumer complaints and inquiries

Some concluding Thoughts Social Media usage as part of employment and outside Social Media monitoring