We urge our clients to consult Pillsbury’s comprehensive COVID-19 Resource Center for information regarding Responding to a Global Crisis, Business Interruption, Cybersecurity, Employer Concerns and other general matters related to the COVID-19 pandemic. We also recommend the following specific measures to mitigate risks of business interruption and regulatory noncompliance resulting from the COVID-19 pandemic.
Registered and Exempt Reporting Firms:
The deadline for the annual update of Form ADV is approaching. We have previously notified you regarding filing obligations that were due between January 1 and March 1. Below is a recommended compliance and filing deadline table addressing registered firms’ obligations for the remainder of the calendar year. Let us know if you need any assistance.
In response to the coronavirus pandemic, see the Pillsbury articles and webinar regarding our recommendations. If you have not already, at this point you should:
Please contact us with any of your needs.
Read this article and additional Pillsbury publications at Pillsbury Insights.
The California Consumer Privacy Act (CCPA), a broad statute which imposes new data privacy obligations on certain companies that do business in California, will become effective on January 1, 2020. Fund managers and other investment advisers (“Advisers”) and certain of their affiliates that are currently subject to data privacy laws pursuant to the Gramm-Leach-Bliley Act (GLBA) or the UK General Data Protection Regulation (GDPR) may have additional obligations to consider and prepare for as the CCPA compliance deadline approaches.
Recommendations for employers before new law goes into effect on January 1, 2020
TAKEAWAYS
While acknowledging the challenges in applying the securities laws to digital assets, the Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA), in a joint statement on July 8, 2019, reaffirm that those rules equally apply to digital assets, and promise they will continue to engage the industry in finding solutions.
Read the full public statement HERE.
SEC Risk Alert regarding safety of customer records and cloud vendor diligence.
As part of its cybersecurity sweep, the SEC has examined risks related to the storage of customer records and information by investment advisers on cloud-based storage platforms and issued a Risk Alert, “Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features.” The sweep focused on vendor due diligence and oversight and registered advisers’ monitoring of data and customer information safety. Among other information, OCIE sought vendor contracts (including service level agreements); vendor reviews; risks assessments of cloud service providers, including data encryption, data loss prevention, books & records exposure, identity and access management; and policies and procedures and their alignment to technology standards.
The Risk Alert identified as the main compliance issues related to cloud-based storage (i) Misconfigured network storage solutions (inadequately configured security settings to protect against unauthorized access; lack of policies and procedures addressing the security configuration); (ii) Inadequate oversight of vendor-provided network storage solutions (lack of, or inadequate, policies, procedures, contractual provisions that security settings on vendor-provided network storage solutions were configured in accordance with the firm’s standards); and (iii) Insufficient data classification policies and procedures (firms’ policies and procedures did not identify the different types of data stored electronically by the firm and the appropriate controls for each type of data).
The Risk Alert encourages investment advisers to review their practices, policies, and procedures with respect to the electronic storage of customer information and to consider any necessary improvements, and to actively oversee vendors. The SEC included helpful recommendations for cyber/cloud risk management, including the implementation of policies and procedures designed to support the initial installation, on-going maintenance, and regular review of the network storage solution; guidelines for security controls and baseline security configuration standards to ensure that each network solution is configured properly; and vendor management policies and procedures that include, among other things, regular implementation of software patches and hardware updates followed by reviews to ensure that those patches and updates did not unintentionally change, weaken, or otherwise modify the security configuration.
Please contact your counsel at Pillsbury’s Investment Funds Group if you need help with reviewing and enhancing your cloud storage and related policies.
This is a reminder about the upcoming annual compliance deadlines that may or may not apply to you.
Please click HERE to open a summary chart of the filing deadlines.
Please feel free to contact us if you have questions or need assistance with any of these filings.
Sincerely,
Pillsbury IFIM Group
This is a reminder that the 2019 IARD account renewal obligation for investment advisers (including exempt reporting advisers) starts this November. An investment adviser must ensure that its IARD account is adequately funded to cover payment of all applicable registration renewal fees and notice filing fees.
Key Dates in the Renewal Process:
November 12, 2018 – Preliminary Renewal Statements which list advisers’ renewal fee amount are available for printing through the IARD system.
December 17, 2018 – Deadline for full payment of Preliminary Renewal Statements. In order for the payment to be posted to its IARD Renewal account by the December 17 deadline, an investment adviser should submit its preliminary renewal fee to FINRA through the IARD system by December 14, 2018.
December 28, 2018 – January 1, 2019 – IARD system shut down. The system is generally unavailable during this period.
January 2, 2019 – Final Renewal Statements are available for printing. Any additional fees that were not included in the Preliminary Renewal Statements will show in the Final Renewal Statements.
January 21, 2019 – Deadline for full payment of Final Renewal Statements.
For more information about the 2019 IARD Account Renewal Program including information on IARD’s Renewal Payment Options and Addresses, please visit http://www.iard.com/renewals.asp
Please contact us if you have questions.
The California legislature recently passed a bill that would require public companies whose principal place of business is in California (as indicated in their Form 10-K) to have at least 1 woman on its Board of Directors by the end of 2019. Thereafter, by the end of 2021, these companies would be required to have a minimum of 1 female director if they have a board of 4 or less, 2 female directors if they have a board of 5, or 3 female directors if they have a board of 6 or more. There would be a monetary fine for non-compliance of $100,000 for a first violation and $300,00 for a second or subsequent violation (per-seat).
The bill is currently under consideration by Governor Jerry Brown, who has until September 30th to decide whether to sign the bill.
Investment Fund Law Blog