Compliance March 20, 2023

SEC Looks to Overhaul Regs SCI, SP

The SEC’s proposed updates would expand the institutions subject to various data security requirements and strengthen data breach notification requirements.

Reported by


The SEC last week proposed changes to Regulation Systems Compliance and Integrity (Reg SCI) and Regulation S-P, also called the Safeguarding Rule, at an open hearing.

Reg SCI

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

The current Reg SCI, adopted in 2014, requires SCI entities to have security policies, take corrective action in response to system issues and undergo business continuity and disaster recovery testing. Under the proposal, BC/DR tests must also address the unavailability of a third party to which the SCI entity outsources. They also must immediately notify the SEC of a wider range of cyber events, such as those that deny access to systems and processes of the SCI entity.

SCI entities include self-regulatory organizations like FINRA, stock and options exchanges, registered clearing agencies and alternative trading systems.

If the new rule is adopted, SCI entities would have to make significant changes to some of their policies. They would need to update their procedures to include “the maintenance of a written inventory and classification of all SCI systems and a program for life cycle management; a program to prevent the unauthorized access to such systems and information therein; and a program to manage and oversee certain third-party providers, including cloud service providers, of covered systems.”

The proposed update to Reg SCI would also expand the entities that are subject to the rule. Currently, SCI entities are those involved in trading, clearance and settlement, and market regulation. Under the proposal, registered security-based swap data repositories, clearing agencies that are exempt from registration and large broker/dealers would also be subject to the rule.

The proposal was approved by a 3-2 vote, with SEC Commissioners Mark Uyeda and Hester Peirce dissenting. Uyeda expressed specific concern about the reporting requirements of the proposed Reg SCI and how it would interact with reporting requirements from other rules. Reg SCI requires immediate notification to the SEC of “significant cybersecurity incidents.” Uyeda wrote that overlapping reporting requirements can be confusing and might undermine cybersecurity if registrants are more concerned about reporting in a timely manner than addressing the breach.

Reg S-P

An update to Reg S-P, which was also proposed by the SEC on Wednesday, would require broker/dealers, registered investment advisers and transfer agents to adopt policies for the protection of customer records and notify clients affected by data breaches that put them at risk. Covered institutions must have written policies that outline an incident response program to address unauthorized access to customer information and to provide timely notification to affected individuals.

The covered institutions must inform customers of a data breach “as soon as practicable,” but cannot wait longer than 30 days from the date they became aware of the breach.

SEC Commissioner Caroline Crenshaw, who voted for both proposals, said the update to Reg S-P is important because it would expand safeguarding requirements to transfer agents, who are uncovered under the existing Reg S-P, which was finalized in 2000.

SEC Chairman Gary Gensler, who also voted for both proposals, said in a statement that covered institutions currently have no obligation to inform their customers of data breaches, even though awareness would allow those customers to take steps to mitigate the damage done to them by the breach.

Compliance March 20, 2023

Biden’s First Veto Keeps DOL’s ESG Rule in Place

The president followed through on his promise to veto a Congressional attempt to nix a DOL rule allowing ESG investing in retirement plans.

Reported by


President Joe Biden on Monday used his first veto to maintain an environmental, social and governance rule for retirement investing plans that, according to many legal experts and industry participants, has no material bearing on the management of those investments.

In a series of events that may reveal more about the political battleground of ESG investing than it does the decision to use those investments in retirement plans, Biden made good on his promise to keep a November 2022 rule by the Department Labor. That rule states that retirement plan fiduciaries may consider ESG factors when making retirement plan investing decisions.

Never miss a story — sign up for PLANADVISER newsletters to keep up on the latest retirement plan adviser news.

The DOL ruling lifted what had often been described as the “chilling” effect of a DOL decision under President Donald Trump that noted fiduciaries should only consider “pecuniary” factors when doing plan design. This February, a Republican-led Congressional Review Act resolution nullifying the DOL rule passed the House of Representatives along party lines of 216 to 204. The resolution, which was led by Representative Andy Barr, R-Kentucky, stated the DOL guidance would harm everyday retirement savers by allowing ESG-focused investments in their plans, sometimes as a default option they are not aware is being made.

The U.S. Senate quickly approved the resolution two days later by a vote of 50 to 46, with Senator Joe Manchin, D-West Virginia, and Senator Jon Tester, D-Montana, joining Senate Republicans in voting yes. Three Democrats were absent.

The resolution, while symbolic, was essentially dead on arrival on Biden’s desk. He had already said before the House passage that he would veto the bill in order to keep the DOL ruling intact.

For retirement plan fiduciaries—including advisers and plan sponsors—responsible for the investments put into defined contribution retirement plans, the debate itself has seemed overblown. As 401(k) retirement plan adviser Kevin Takinen of Sequoia Consulting Group told PLANADVISER soon after the act passed Congress, the debate over ESG factors has been swinging back and forth over the past six years, to the point where industry actors take a straightforward, conservative approach to including ESG-focused investments.

“Because of the constant fluctuations, [plan fiduciaries] have held steady,” he says. “If we are going to add in a fund that has an ESG mandate, let’s make sure it meets everything else that might be one of the factors in the plan’s investment policy statement. It’s got to meet everything else in the IPS, so that remains tried and true in all situations.”

Politicians on the left have, perhaps counterintuitively, argued that the rule should be kept because of the very fact that it does not mandate anything, but simply allows fiduciaries to provide ESG options if requested.

“This is a really important point I think folks are missing: The Biden rule is fundamentally neutral on how ESG factors are taken into consideration, so long as the investment fund is meeting its fiduciary obligations to its beneficiaries,” Senate President Pro Tem Patty Murray, D-Washington, said on the floor during a Senate debate. “The rule we are talking about is neutral on whether a fiduciary is considering these factors from a particular perspective.”

Many of her Republican counterparts disagree. To them, the rule signifies an investment focus that may be dangerous for investors as, they argue, it goes beyond solely looking at how well the investments will perform for savers.

“Retirement plans should be solely focused on delivering maximum returns, not advancing a political agenda,” said representative Barr, who is chair of the House Financial Services Subcommittee on Financial Institutions and Monetary Policy, in a statement ahead of the House vote. “If Congress doesn’t block the Department of Labor’s rule greenlighting ESG investing in retirement plans, retirees will suffer diminished returns on the investment of their hard-earned money. It’s time for Congress to act.”

Senator Murray said in an emailed statement after the veto that “the Biden rule is fundamentally neutral on how ESG factors are taken into consideration so long as the investment fund is meeting its fiduciary obligations to its beneficiaries. I’m not sure everyone gets that—because the fact of the matter is, some of the same people who are railing against this rule, and against ESG investing, have advocated for positions that essentially are ESG investing.”

For now, the rule remains. It would require a two-thirds vote in both the House and the Senate to override Biden’s veto.

«