Gary DeWaal and Associates LL

FINRA Fines Five ING Firms related to Email Review and Retention Violations

Valuable Lessons Learned News Developments

Published Date: May 09, 2013

FINRA has fined five ING firms USD 1.2 Million for various email retention and review violations.

According to the relevant FINRA Acceptance, Waiver and Consent Order (dated 15 February 2013), at various times from 2005 through 2011, one or more of these entities failed, among other things, to:

transfer from an active server to an archive server for retention in connection with applicable SEC and FINRA requirements emails to or from registered representatives who functioned as independent consultants;
configure secondary email addresses (ie, aliases) to ensure they would be transferred from an active server to an archive server; and
transfer from an active server to an archive server emails that initially were sent to distribution limits; emails that were blind copied to certain persons; or emails that were encrypted; as well as emails that initially were sent from a third party's software provider (ie, cloud email).

As a result the relevant email was not retained, subject to supervisory review, or reviewed. The firms also failed to review certain other email that had been retained and flagged for review.

In addition to the fine and a censure, the ING firms consented to conducting a comprehensive internal review related to their capture, retention and review of email. This matter had been self-reported by the firms, and FINRA took note of this in assessing its sanctions.

There are two valuable lessons learned from this matter: Firms,

should not take for granted the ongoing compliance of their technology systems, especially email, with regulatory requirements. In the first place the system may not have been configured 100% to comply with applicable requirements, but moreover, over time, what once was fully (or mostly compliant), may become less so because of software or set-up modifications; and
in addition to fully testing new systems that have regulatory requirements before roll-out, must periodically test such systems on an ongoing basis to ensure their continued compliance. All relevant features of the system must be carefully considered (e.g., as in this matter, the bcc feature and encryption) to ensure the system is compliant. Since many deficiencies are not apparent until a regulator's request, try to mimic sample regulators' requests internally to try to spot problems.

For more information, see:
http://www.finra.org/web/groups/industry/@ip/@enf/@ad/documents/industry/p207603.pdf

The information contained in this article is not legal advice. For legal advice, please consult with your attorney. The information in this article is derived from sources believed to be reliable as of May 9, 2013, but no representation or warranty is made regarding the accuracy of any statement. To ensure compliance with requirements imposed by U.S. Treasury Regulations, Gary DeWaal and Associates LLC informs you that any U.S. tax advice contained in this communication (including any attachments) was not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. Gary DeWaal and Associates may represent one or more entities mentioned in this article.