A recent FINRA disciplinary action concerning email retention and review, and the $9 million imposed in sanctions, is sending shudders through the brokerage industry, with firms concerned that FINRA is looking to identify more systemic email failures to justify more sanctions bonanzas. Firms should evaluate their systems and consider self-reporting any identified problems; however, the disciplinary action also indicates that self-reporting has its own peril.
FINRA fined LPL Financial LLC (LPL) $7.5 million for significant failures in its email system that prevented LPL from accessing hundreds of millions of emails, and from reviewing tens of millions of other emails over an approximately six-year period. FINRA was particularly concerned that LPL’s inadequate systems and procedures caused the firm to provide incomplete responses to email requests from regulators, and also likely affected the firm’s production of emails in arbitrations and private actions. Accordingly, FINRA also required the firm to establish a $1.5 million fund to pay discovery sanctions to customer claimants that were potentially affected by the system failures, and to notify regulators that may have received incomplete email production.
FINRA also found that the firm failed to be fully candid with the regulator in its self-report of the email lapses (FINRA has a strong focus on the obligation of firms to report internal conclusions of violations under Rule 4530), and that the firm failed to follow through on preliminary internal audit findings about its email systems.
FINRA attributed LPL’s supervisory lapses, at least in part, to the firm’s rapid expansion without a concomitant investment in technology and compliance resources. The resulting “patchwork” of email systems did not provide LPL with adequate access to and oversight over the email correspondence of its registered representatives.
FINRA also focused on the nature of the firm’s business model, in which many of its registered representatives are independent contractors rather than employees, and frequently operate under more than one or more DBA names and use more than one DBA email address in addition to their firm address. FINRA found that LPL’s systems were inadequate to capture DBA email. Additional findings, discussed in the accompanying client alert, set out a laundry list of potential email problems; firms should use that list as a guide to reviewing their systems.
We encourage broker-dealers to conduct a comprehensive compliance audit of existing systems, policies and procedures related to surveillance, retention and recordkeeping obligations for electronic communications. Make sure that the firm is capturing, retaining and reviewing the emails of all registered representatives, including emails used by registered representatives in the conduct of their employment outside of the firm’s email systems. In addition, firms should ensure that the firm’s internal audit function has adequate resources, authority and support to investigate identified issues and make recommendations for corrective action, and that the firm remediates any identified issues promptly.