Corporate Compliance Scam Continues. . .

. . But some of the perpetrators may have been caught.

California

California businesses have recent reports.  The scam seems to have been operating in California for years.

Colorado

There are reports of the scam in Colorado: State Corporate Compliance fraud. The Secretary of State is also getting complaints about the Colorado Compliance Recorder: Updated Notice Regarding “Annual Minutes” Solicitations

Indiana

Indiana issued a warning that several businesses have reported receiving a deceptive letter that would appear to come from an official government source. The letter solicits an annual fee of $125 or $150 and claims it will be used for record keeping and processing of a company’s annual minutes. It gives the appearance of coming from a legitimate government agency and cites fictitious state law. Scam Alert for Businesses in Indiana. But the Secretary of State has filed a complaint to try to stop the scam.

Montana

Montana has issued a warning, although the Secretary of State has not received any complaints and is not aware of any Montana businesses being affected: Business Scam Alert (.pdf) (I am not sure that I agree that the scam is “potentially dangerous.”)

New York

In the Empire State, it looks like the scam has spread to condominiums and cooperatives: Scam or Useful Service? The Corporate Records Compliance Office Speaks

Texas

It looks like the scam has been operating in Texas for a few years, masquerading as a state agency.  They may have caught the person behind some of it: Californian Charged With Unlawfully Profiting From Fake State Document Scheme.

Others

Previously, I noted that the scam was found in Florida, Georgia, IllinoisMassachusetts, and Ohio.

Catching the Bad Guys

Its not clear if the scams in each state are perpetrated by the same group. The Indiana Secretary of State filed a complaint against Aaron V. Williams of Las Vegas, Lisa Diane Brown of California and several companies affiliated with them. (Of course these people have merely charged and are not necessarily guilty.)

UPDATE:

The Texas Attorney General filed suit against other parties, but the suit was dismissed.

References:

Social Media and Your Compliance Program

ethicspoint-logo

Bill Piwonka, Amanda Mayhew and Rodica Buzescu from EthicsPoint gave a webinar on social media and compliance. These are my notes:

The presentation started with a user poll on the approach to social media at the attendees’ organizations:

  • 27% block all social media sites
  • 42% block a few social media sites
  • only 29% allow all social media sites

In a second question, I was surprised to see that 37% of the attendees said they were using some form of Web 2.0 in their ethics program. That seemed like a big number to me.

Bill started off with a brief discussion of his view of web 2.0 and social media. He also highlighted some of the approaches and tools used by EthicsPoint. He moved on to the need of companies to monitor their brand. It easy for customers, employees and competitors to craft your brand for you (and not in the way you want). You need to know what is being said and be prepared to respond when necessary.

On the call, 11% of the attendees did not use any social media platform, 11% used one, and 40% used 2 or three. The rest (like me) used more.

Why should compliance care about Social Media? It is here to stay. Generation Y and the Millennials grew up an learned in the world of social media. They enter business organizations and are cut off from the tools they used to learn and communicate.

Rodica took over and shared her perspective. She is new to EthicsPoint. When she started, she was cut off from her networks since they blocked Facebook, instant messaging and many other social media tools.

Amanda took over and gave her perspective as the general counsel and privacy officer at EthicsPoint. She pointed out that younger workers may not have been in the business environment long enough to realize that there are limits on what you can say outside the organization and inside the organization. EthicsPoint focuses on privacy and protection of their clients information. They have a tight policy on social media to protect that information.

Bill stepped up and pointed out that you cannot ignore social media. Even if you block access, employees can easily access them from a mobile device or home. Blocking is not an effective policy. You need to let your employees know what they can and cannot do. You need a policy. Bill used Intel’s Social Media Guidelines as an example.

Bill also pointed out that even if the company does not want to engage in social media, they need to monitor what is being said about your company in social media. You also want to make sure that someone else does not use your brand on social media platforms.

Amanda came back to emphasize a few points. It is important to make it clear what is confidential and what is not public. Another point was to be respectful, realizing that your mother, friends and boss may ready what you say. Anonymity is also a hot button for her.

What can you do? How can compliance professionals use Social Media?

Create a Facebook group for your compliance team. Allow people to see who you are and develop a relationship and trust.

Use YouTube to host and distribute training videos. Why buy expensive video hosting servers and software when YouTube will do it for free.

Best Buy uses a blog to make ethics a completely transparent dialogue.  Best Buy’s Chief Ethics Officer blogs on actual ethics and incidents at Best Buy. Of course, she does not use real names and disguises identifying information.

Use web 2.0 for professional development by joining online communities focused on ethics and compliance issues. EthicsPoint has user forums focused on its product.

In the Q&A there was a lot of discussion about how much to monitor and how much to limit. “Ignorance is not bliss.”

Another issue that came up in Q&A is who to friend on Facebook and who to make connections with on LinkedIn. In particular in the educational environment it is very tricky to friend or not friend. There is a similar dynamic in the workplace.

What about productivity? Does Facebook turn you into a slacker? Does blogging make you less useful? Bill turned this around and gave example of how he uses these tools as part of his job. (It was an impressive list.)

How do you develop your own policy? EthicsPoint started with Intel’s Social Media Guidelines as their model.  (You can also take a look at one of my models: Blogging / Social Internet Policy.)

(In the interest of disclosure some of the material was borrowed from my presentation on Social Media at the Boston EthicsPoint Regional User Forum in Boston. Bill also noted this in the presentation)

EU Proposes Directive on Alternative Investment Fund Managers

eu

The European Commission published a draft Directive on Alternative Investment Fund Managers to establish a common regulatory and supervisory framework for all investment managers of funds promoted to investors in the European Union and not currently subject to European level regulation. Though the measure is directed at the hedge fund industry, the Directive would affect the operations of managers of all funds that are not registered as UCITS (Undertakings for Collective Investments in Transferable Securities), including private equity, real estate, infrastructure and venture capital funds.

The Directive is at an early stage of the legislative process and may be subject to significant change before it is adopted. Even in its current form it will not come into force before the end of 2011 and the proposals relating to the promotion of funds incorporated outside the EU will not come into force for a further three years after that. I expect there will intense lobbying from the financial services industry and the hedge fund industry.

The Directive is mainly driven by the European Commission’s aim to get control over what it perceives as systemic risks in unregulated fund markets. There is a set of regulations focused on managers domiciled in the EU and a second set on funds marketed in the EU.

References:

Private Fund Transparency Act

We have another bill that is proposing to regulate private pools of capital. Yesterday, Senator Jack Reed (RI) introduced the Private Fund Transparency Act of 2009 (S.1276)

According to the press release, the Private Fund Transparency Act of 2009 will:

  • Require all hedge fund and other investment pool advisers that manage more than $30 million in assets to register as investment advisers with the SEC. The remaining smaller funds will continue to fall under state oversight.
  • Provide the SEC with the authority to collect information from the hedge fund industry and other investment pools, including the risks they may pose to the financial system.
  • Authorize the SEC to require hedge funds and other investment pools to maintain and share with other federal agencies any information necessary for the calculation of systemic risk.
  • Clarify other aspects of SEC’s authority in order to strengthen its ability to oversee registered investment advisers.

The text of bill has not been released yet. I am not sure it matters given that there are already two other similar bills: Hedge Fund Adviser Registration Act of 2009 and the Hedge Fund Transparency Act of 2009. On top of that, the Obama administration is finalizing their proposed plan for changing the regulatory framework of the financial industry.

I  found Senator Reed’s reasoning on the need for his proposed law to be an interesting perspective:

“Private funds are not currently subject to the same set of standards and regulations as banks and mutual funds, reflecting the traditional view that their investors are more sophisticated and therefore require less protection. This has enabled private funds to operate largely outside the framework of the financial regulatory system even as they have become increasingly interwoven with the rest of the country’s financial markets. As a result, there is no data on the number and nature of these firms or ability to calculate the risks they pose to America’s broader economy.”

Press Release from Senator Reed on the Private Fund Transparency Act

CCOutreach

sec-seal

The SEC formed the CCOutreach (yes, that is how they spell it) to promote open communications and coordination among securities regulators and the industry on mutual fund, investment adviser, and broker-dealer compliance issues. In addition to the national seminar in November of each year, they host regional seminars to enable Chief Compliance Officers to interact with the staff from their local SEC office. I attended the Boston Regional CCOutreach seminar. These are my notes:

To start off, there was the usual SEC disclaimer: The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its staff. The views expressed by the staff in these written materials are those of the staff and do not necessarily reflect the views of the Commission or of other Commission staff.

The presentations started off with some interesting statistics (as of 12/31/2008):

  • 11,292 Registered Investment Advisers
  • 1,521 exams of investment advisers in 2008
    • 64% resulted in deficiency letters
    • 4% resulted in enforcement referral
  • 1,082 Registered Investment Companies
  • 219 exams of investment companies in 2008
    • 67% resulted in a deficiency letter
    • 5% resulted in enforcement referral

Rulemaking

The presentation continued by highlighting some of the current rulemakings in process: the amendments to Form N-1A, the principal trading rule, and amendments to Part 2 of Form ADV. They also noted two rulemakings that should be popping up soon. First is a proposed regulation on money market funds. This is largely in reaction to the issues with those types of funds last fall.The second is a likely rule making on pay to play issues.

Enforcement

The presentation moved on to three types of current enforcement actions, with recent enforcement cases as examples.

The first type is prominent fraud cases, using the SEC v. Robert Brown case as an example. This was a classic Ponzi scheme. The promoter promised astronomical returns, but really used the money to pay off early investors and to pamper himself. When confronted by investors, he claimed the delay in returning the money was due to the Patriot Act.

The second type is compliance failure cases, using the SEC v. Locke Capital case as an example. In this case, the adviser had less than $175 million, but claimed to have over $1 billion under management in order to gain credibility and attract legitimate investors.

The third type is prominent fund failure cases, using the Evergreen case as an example. Evergreen had a fund experiencing some gyrations due to its mortgage-backed securities holdings. The company put together some talking points for investors who called to complain or called with questions. That resulted in selective disclosure of a material piece of information. There were also issues related to failures in their valuation methods.

Fiduciary Duty

The presentation turned to fiduciary issues. A particular issue was how clients got out of positions. This is a reverse of  IPO investigations by the SEC. With IPOs, the SEC investigated whether some clients got preferred access to IPOs and how allocations of IPO shares were made to clients. With the all of the illiquidity in the market, the SEC is now focused on who was able to get out of those illiquid positions and whether some clients got preferred access to the exit.

There was some discussion of the Hennessee case where the SEC brought action for an investment adviser failing to conduct diligence. There seemed to be some split on the panel. Some saw the case as a failure of fiduciary duty. Others thought it was merely a failure to do what the firm advertised it did (subject investments to a vigorous due diligence review).

The presentation moved to what the SEC is looking at during a review. They emphasized that the first step is reviewing the marketing materials and disclosure documents. The SEC wants to understand the company’s business model before the review. They don’t do a cookie cutter review, but a customized review tailored to the company’s business model. The next step is looking at the deficiency letters, their recommendations and what the company has done in response. (You have a target on your back if you have a deficiency and have not done anything in response.)

The panel turned to companies with dual registrations. If you are wearing two hats, you have a heightened level of disclosure. The SEC does not want to regulate the business model, but they do want to make sure you are fair and equitable. Dual registration is commonplace and clients are comfortable with it. But conflicts seem unavoidable, so there is a heightened need for compliance and disclosure.

The focus shifted to proxy voting and the issues associated with it. The panel highlighted the Intech case where the company was subject to a proceeding for failing to sufficiently describe its proxy voting policies and procedures and failing to address a material potential conflict of interest. Intech decided to vote in accordance with AFL-CIO-based proxy voting recommendations for all clients’ securities at a time it was currying favor with the union for more investment business. The panel had a general consensus that it was not wrong to follow a voting model as long as it is fully disclosed.  The panel was split on whether Intech could have disclosed their way out the problem. Some panelists thought the conflict was too much.

Deficiencies

Things turned to problems and how a problem can morph from a disclosure to a deficiency to an enforcement. One of the panelists rattled off a list of factors:

  • Were there deficiency letters?
  • Did you fix the deficiency?
  • Did people raise issues and you ignore them?
  • How long was the problem going on?
  • Were clients harmed?
  • Was it intentional or inadvertent?
  • How far off was the disclosure?
  • Did the firm profit from the problem?

“There is a difference between candid disclosure and clever disclosure.”

Portfolio Management

In the area of portfolio management the SEC found found these to be the most common deficient practices:

  • Failure to adopt or maintain policies and procedures relating to its investment decision-making
  • Failure to maintain required books and records to corroborate investment decisions
  • Failure to disclose all conflicts of interest

In the current market turmoil “drift” is a hot topic. The panel focused on inadvertent drift versus intentional drift. Intentional drift is bad, putting clients into investments that do match up with their investment needs. The panelists acknowledged that this is a tough area. The key is to focus on the goal at the time of purchase of the investment. Then there needs to be a periodic review. Drift review is also difficult. You need to document specific requests by the client and update the investment objectives of the client.

Service Providers

Compliance officers need to review service providers since they are a risk factor according to the panel. In particular, you need to be attentive  to the existence of kickbacks or soft dollars. They panel went so far as to recommend running searches against email traffic for the possibility of communications about kickbacks. Another red flag for the SEC is frequently changing service providers.

Safeguarding Client Assets

The centerpiece for this part of the discussion was the new custody rule that has been published for comment: SEC Releases Proposed Custody Rules for Investment Advisers. The SEC plans to go directly to clients, custodian, counter-parties, and other third parties without notifying the investment adviser. They are expecting a custodian review to be a lengthy, time-consuming process. The surprise review must a surprise and must be a review of 100% of the assets. Sampling will not be permitted. The auditor must also be truly independent. They are going to look towards Regulation S-X for the definition of “independent.”

Performance Claims

It sounds like the SEC is going to look closely at performance claims, both for fraud in the claim itself and for the claim as an indication of underlying fraud. (Like Madoff‘s performance claims.)

The panel indicated an intent to look closely at how the performance numbers are calculated. A particular hot button is how illiquid and hard-to-value assets are included in the performance calculations. The SEC plans to run some forensics to see if there was some smoothing in the performance and whether the performance was too consistent or too good given the underlying assets in the portfolio.

In addition to the performance numbers themselves, the SEC is going to look closely at the disclosure wrapped around the performance claims. They want to make sure the disclosure and qualifications are consistent.

They are also going expect records to be kept to back up the performance claims. If you are claiming 20 years worth of results, you need to keep 20 years worth of records.

They emphasized the need to separate the valuation team from the portfolio management and marketing teams to get as much independence as possible. Using a third party custodian to value assets is probably acceptable, assuming there is no fraud or improper influences on the custodian.

Post-Mortem

The program was good and worth your time if you are a compliance officer for an Investment Adviser or Investment Company. I attended because I thought it best to meet and talk with people when you are in the position to offer them some help instead of needing them to help you. It seems that Congress wants the SEC to regulate private investment funds.

In the interest of full disclosure, the SEC gave out an inexpensive pen and a magnet with with SEC seal to attendees. I don’t think these “gifts” have influenced my decision-making about the SEC.

Materials:

Frontline Investigates Bank of America and the Government’s Role in the Banking System

frontline
Tuesday night is the premiere of Frontline’s latest report: Breaking the Bank. The report is supposed to include high-profile interviews with key players Ken Lewis and former Merrill Lynch CEO John Thain and will reveal the story of two banks at the heart of the financial crisis and their rocky merger. It may also look at the implications of the government’s new role in taking over (“nationalizing”?) the American banking system.

“The bets were huge and risky—billions of dollars on the housing market. The upside was undeniable—superbanks reaped billions of dollars, dominated the landscape, and gobbled up competitors. Then the bottom dropped out—the massive losses on Wall Street nearly broke the banks. In the worst crisis in decades, brand name banks are on the brink. Now as the federal government implements an unprecedented intervention in the industry, FRONTLINE goes behind closed doors to tell the inside story of how things went so wrong so fast and to document efforts to stabilize Wall Street. Veteran FRONTLINE producer Michael Kirk (Inside the Meltdown) untangles the complicated financial and political web threatening one particular superbank-Bank of America.”

UPDATE: The full version of the program is now available for viewing online: Breaking the Bank.

Here is a preview:

If you missed them, the Frontline reports on Inside the Meltdown and the Madoff Affair were wonderful and worth your time to watch. They are available online:

New Frontier: Best Practices in Fraud Investigations and EmergingTrends in SEC and DOJ Enforcement

securitiesdocket

Securities Docket sponsored a webinar addressing critical questions about recent changes in the economic and political climates, emerging trends in SEC and DOJ enforcement, and the potential impact on lawyers, accountants, investigators, and other consultants who perform fraud investigations. It also outlined best practices when conducting investigations for the DOJ and SEC.

Panelists:

  • Gary Kleinrichert, Senior Managing Director in FTI Consulting’s Forensic and Litigation Consulting Practice
  • Pravin Rao, formerly an Assistant U.S. Attorney in the Northern District of Illinois and currently a partner in the Litigation group of Perkins Coie
  • Jose A. Lopez, formerly a Senior Attorney at the United States Securities and Exchange Commission’s Division of Enforcement and currently a partner at Schopf & Weiss LLP

The webcast is available for replay. But if you want to browse, these are my notes:

Gary started the presentation by noting there is a change in regulatory focus and likely to be a new regulatory framework. He also pointed out that the SEC has become aggressive in bringing securities cases.

He noted that the hedge funds and other pooled investments will be regulated although the scope is still uncertain.

After a lengthy run through some other potential and recent regulatory changes, Gary pointed out a few things that you can do right now:

  • Be preventative
  • Review Sarbanes-Oxley, financial reporting, and securities compliance
  • Whistleblowers – Speak with lawyers to ensure internal policies are effective

Jose took over and highlighted President Obama’s impact on the SEC. Again, they are getting more aggressive. How can you survive in this hostile environment:

  • Master the SEC’s Enforcement Manual (.pdf)
  • Conduct an Effective Investigation
  • If Charges Are Filed, Aggressively Seek Information and Documents

Jose advocated requesting a Termination Notice from the SEC. The SEC’s Enforcement Manual (.pdf) provides that the Division should notify individuals and entities at the earliest opportunity when the staff has determined not to recommend an enforcement action against them to the Commission.

There was discussion about witness assurance letters, providing civil immunity for witnesses. In limited circumstances and with specific authorization of the Commission, SEC staff may provide a witness with a letter assuring him or her that the SEC does not intend to bring an enforcement action. There seems to have been little use of this procedure. In practice its use has not materialized.

Pravin focused on the Department of Justice enforcement activities. The DOJ had a focus on terrorism. He has seen a shift back to financial crimes. There is also more white collar crime legislation coming out of Washington.

he offered up two guiding principles for internal investigations:

  • “One size does not fit all“
  • “What you don’t know can hurt you”

You want to conduct an internal investigation:

  • Identify and limit harm to the company
  • Obligations under laws, regulations to self-disclose
  • Assist in criminal defense of company
  • Puts company in better light with government regulators
  • Puts company in better light with shareholders, public

He stressed the need for an developing a game plan for the investigation. You need to define the scope and decided who should be interviewed.

The materials are available on the Securities Docket website: Today’s Webcast (June 15): Materials Available Here for “A New Frontier: Best Practices in Fraud Investigations and Emerging Trends in SEC and DOJ Enforcement”

Identity Theft Program Template for Low-Risk Entities

The Federal Trade Commission published a compliance template designed to assist financial institutions and creditors “at low risk for identity theft” in developing the Identity Theft Prevention Program required by the FTC’s Identity Theft Red Flags and Address Discrepancies Rule: Complying with the Red Flags Rule: A Do-It-Yourself Prevention Program for Businesses and Organizations at Low Risk for Identity Theft (.pdf)

The Red Flags Rule requires many businesses and organizations to implement a written Identity Theft Prevention Program to detect the “red flags” of identity theft in their operations. By focusing on red flags, you should be better able to spot an imposter using someone else’s identity. The Rule applies to companies that provide products or services and bill customers later. To find out if the Red Flags Rule applies to your business, read Fighting Fraud with the Red Flags Rule: A How-To Guide for Business (.pdf).

The FTC has designed the compliance template to help businesses  at low risk for identity theft design their own Identity Theft Prevention Program. In Part A, you determine whether your business or organization is at low risk. In Part B, if your business is in the low risk category, the template helps you to design your written Identity Theft Prevention Program.

Join Me at the Enterprise 2.0 Conference in Boston

enterprise 2.0 conference

I have been spending less time in the Enterprise 2.0 movement as a result of switching my career from knowledge management to compliance. Steve Wylie thought it would be a nice fit to have me bring my compliance perspective to The Evening in the Cloud program at this year’s Enterprise 2.0 Conference.

Any vendors presenting are forewarned that they had better be ready to answer questions on how their product deals with data privacy, records retention policies, and government regulation.