In January 2010, FINRA issued Regulatory Notice 10-06 in an attempt to provide guidance on the application of FINRA rules governing communications with the public to social media sites. The guidance did not provide much that was new. Largely, FINRA pointed out that the existing communication and record-keeping rules applied. Too bad that the site did not allow you to take the steps needed to comply with the existing rules.
Apparently, the guidance raised enough questions that FINRA decided to provide some additional guidance. It is not intended to alter the principles or the guidance provided in Regulatory Notice 10-06. Anyone expecting something new or innovative will be disappointed.
Q1: Does determining whether a communication is subject to the recordkeeping requirements of SEA Rule 17a-4(b)(4) depend on whether an associated person uses a personal device or technology to make the communication?
A1: SEA Rule 17a-4(b)(4) requires a firm to retain records of communications that relate to its “business as such.” Whether a particular communication is related to the business of the firm depends upon the facts and circumstances. This analysis does not depend upon the type of device or technology used to transmit the communication, nor does it depend upon whether it is a firm-issued or personal device of the individual; rather, the content of the communication is determinative. For instance, the requirement would apply if the electronic communication was received or sent by an associated person through a third-party’s platform or system. A firm’s policies and procedures must include training and education of its associated persons regarding the differences between business and nonbusiness communications and the measures required to ensure that any business communication made by associated persons is retained, retrievable and supervised.
The FINRA rules came first and they are in place for a good reason. It’s up to the firm to find a may to meet the compliance standards if they want to use third-party websites to publish information, communicate with the public, or communicate with clients. If cloud providers want to take over company-hosted communications they need to but more effort into the record-keeping and compliance requirements of the business world.
Sources:
- FINRA Regualtory Notice 11-39 (.pdf – 8 pages)
- FINRA Regulatory Notice 10-06
- FINRA Issues Guidance on Social Networking Sites – prior post on Compliance Building