Keeping Clients' Information Safe

How secure are your technology and data practices? A pilot survey from the NASAA looks at state-registered advisers.

A survey from the North American Securities Administrators Association (NASAA) asked state-registered small and mid-sized investment adviser firms how they use websites and technology, such as tablets and other mobile devices, to connect with clients—and keep their clients’ information safe.

Advisory firms are increasingly using technology to communicate with their clients and to access client data. Of the 440 advisers in nine states who responded to the survey, nine in ten firms (92%) use email to contact clients, and 85% use other electronic devices—such as computers, smartphones, tablets, etc.—to access client information. Still, only 54% reported using secure email, and a similar number (56.7%) have procedures in place to authenticate any client instructions the firm receives via email or other electronic messaging.

Never miss a story — sign up for PLANADVISER newsletters to keep up on the latest retirement plan adviser news.

Two-thirds (66%) reported that 3% or less of their firm’s overall expenses was directly related to information technology security, and more than one-third (37%) claim their firm does not conduct risk assessments to identify potential threats, vulnerabilities and consequences. Of those who do, only 10% conduct such assessments on a weekly basis, while 40% perform their reviews annually.  

Nearly half of responding firms (46%) said they do not apply encryption to their files or devices, and of those who do, one-third (32%) do not require that software to be applied universally across all electronic devices used to access client information. 

Perhaps this behavior stems from a lack of a perceived threat to advisory firms: Just 4.1% reported a “cybersecurity incident,” while1.1% admitted their firm has, directly or indirectly, experienced theft, loss, unauthorized exposure, or unauthorized access to or use of client information. (Still, 6% did not respond to that question.)

One-quarter (25%) of firms said they do not have a website, and just over half of respondents (51%) said that their firm’s website does not include a client portal. Two-thirds (66%) do not utilize the firm’s website to use or access client information data.

The advisory firms reported on the technology-related procedures or training programs they currently maintain:

 

  • 44.6% have a policy addressing cybersecurity;
  • 47.4%, the disposal of electronic data storage devices;
  • 39.2%, loss of electronic devices; and
  • 38.0%, detecting unauthorized activity on your networks or devices.

 

More than one-fifth (23.1%) even said their firm has no procedures relating to any technology issues. If advisers are not concerned about their data security, the report finds they may be more focused on another aspect of their online services: The most common issue for which firms have established such a program or procedure is social media. More than half (50.9%) reported policies relating to the use of LinkedIn, Twitter, Facebook, etc. for business purposes.

The full report of the preliminary survey results is available here.

PANC 2014: Washington Update

There is an extensive amount of regulatory rulemaking going on in Washington that could impact retirement plans in the months and years ahead, and major tax reform proposals are still on the table.

“Retirement policy is very much on the mind of Washington politicians, with two themes in play,” said Roberta Ufford, principal with Groom Law Group, speaking at the 2014 PLANADVISER National Conference “Washington Update” panel Monday. “The first is tax reform, specifically with regard to what Washington views as the lost tax revenue that the retirement system has. Working with a 10-year projection, that doesn’t account for how these revenues are taxed when they are drawn down. As a result, there is talk about switching to Roth accounts or limiting contributions.”

The second key retirement issue that Washington politicians are kicking around is limited coverage, Ufford continued. Thus, regulators are now talking about “multiple employer plans that would shift fiduciary responsibilities from sponsors and make plans more attractive” to smaller businesses, Ufford said. Legislators are also considering a “saver’s credit, start-up credit and annuities.”

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

With the 40th anniversary of the Employee Retirement Income Security Act (ERISA) having just passed earlier this month, it is important to remember that the law “has evolved because it did not contemplate the retirement savings programs we have now,” said David Weiner, principal with David Weiner Legal. It is also critical for retirement plan advisers to keep in mind that ERISA is “just a piece” of America’s retirement savings legislation, Ufford added. “There is Social Security, municipal and state plans, 403(b) plans,” she said.

With regards to the Department of Labor’s (DOL) efforts to potentially redefine which service providers are fiduciaries, DOL’s initial focus was on “regulating when an adviser is giving advice on retirement plan distributions and stands to gain fees,” Weiner said. DOL has now extended its questioning of fiduciaries to include selection of funds on an investment menu and how custodians price assets, Ufford said, making the pending regulation even more “controversial.” Given the repeated delays on this ruling and the upcoming presidential election in 2016, it is unlikely the DOL will return to the drafting table anytime soon, Weiner said. Additionally, there is a bill in the House of Representatives that would preclude the DOL from issuing this rule until the Securities and Exchange Commission (SEC) settles its rules of conduct for broker/dealers, Ufford added.

As to how a broadened definition of fiduciaries, whenever it is finally adopted, would affect retirement plan advisers, “for those who are already a fiduciary, this would be good for you because you are already ahead of the game,” Ufford said. “But if you aren’t, you might have to jump into the pool; your affiliates and custodians may have to change their business model as well.” Additionally, Weiner added, advisers will need to “be aware of co-fiduciaries. Make sure to monitor their activities.”

And even if the new definition of fiduciaries remains tabled, “the DOL is looking at the definition of fiduciaries through enforcement, audits and litigation,” Ufford warned. In particular, the DOL has an ongoing fiduciary adviser compensation project centered on revenue sharing and disclosure, Ufford said. “The DOL is looking at when advisers are receiving undisclosed compensation. The DOL is also looking at service providers and how you are paid through 12(b)(1) fees and other fees, such as for attending conferences,” she said.

As for the DOL’s proposal to require summarized 408(b)(2) and 404(a)(5) fee disclosures to, respectively, plan sponsors and plan participants if the disclosures are presented overly lengthy documents, this has been met with considerable opposition from the retirement plan industry, Weiner said. Their major contention is that it is “too difficult to summarize,” he said. Now that the “battles lines have been drawn, there is likely to be a delay on this proposal’s implementation.”

Likewise, retirement plan advisers can expect continued delays on the SEC project stemming from the Dodd-Frank bill on assisting retail investors distinguish the difference between advisers and broker/dealers, Ufford said. “The SEC found that investors don’t realize that broker/dealers are only held to ‘suitable’ but not ‘in the best interest’ standards,” she said. Given the fact that there are still 18 rulemaking projects pending from the Dodd-Frank bill—and the fact that the SEC and the DOL are supposed to coordinate their efforts on this educational initiative—the SEC may not get to this initiative anytime soon, she said.

The same holds true for the complicated task of standardizing how target-date fund (TDF) glide paths are disclosed, Ufford said. “There is no timetable for this at the SEC or the DOL,” she said. However, advisers should pay heed as to whether the SEC or the DOL spearheads this effort. “If the DOL adopts the rule, TDF disclosure rules will not just cover mutual funds but extend to collective investment trusts and separately managed accounts,” she said.

At the IRS, the most notable initiative is its recent allowance for retirement plans to offer qualified longevity annuity contracts (QLACs), Weiner said. However, only a very small percentage of plans have adopted QLACs, he said. “It is a good first step—but contracts are limited to the lesser of $125,000 or 25% of an account balance, with minimum distributions at age 85.”

«