PRINT
EMAIL
SEARCH
White Paper: The Designated Third Party Requirement: The Final Frontier of SEC Rule 17a-4(f)
Authors: Jeffrey Plotkin
Publisher: Iron Mountain
11/1/2009
This White Paper, authored by Day Pitney Commercial Litigation partner Jeffrey Plotkin, was published by Iron Mountain, the world's leading provider of storage-as-a-service solutions for data protection and recovery, archiving, eDiscovery and intellectual property management. The White Paper explores the background and purpose of SEC Rule 17a-4(f), which requires broker-dealers to retain an independent third party to download electronically stored records for the SEC's review. The White Paper also discusses the current and future regulatory environment surrounding the rule, describes the collateral benefits of compliance with the rule, and offers suggestions to broker-dealers on how to choose the appropriate third party downloader for their regulatory and business needs.
Mr. Plotkin formerly served as Assistant Regional Administrator for the SEC's New York Regional Office, in the Division of Broker-Dealer Enforcement.
Introduction
In 1997, the SEC issued Rule 17a-4(f), which authorized broker-dealers to store their required books and records in electronic format. Broker-dealers who elected to store records electronically were required by the rule to retain a third party ("Designated Third Party" or "D3P") who had the ability to independently download electronically-stored information to another acceptable medium for the SEC's review (the "D3P Requirement"). The purpose of this provision was to ensure that, in the event a broker-dealer went out of business or refused to cooperate with the SEC, an independent third party could assist the SEC in retrieving information stored on electronic media.
The rule originally envisioned a D3P who would be able to independently download and convert information stored on portable media such as optical platters without having access to the broker-dealer's computer systems. As such, the rule expected that D3Ps would have their own systems to download and convert information on media supplied to it by the regulators.
Since 1997, the securities industry standard for electronic storage has shifted from portable media to hard-drive storage systems located on-site at the broker-dealer. As a result, the focus of D3Ps has shifted from so-called "independent access" - the ability to independently download data from portable media at the D3Ps' own facility, to "on-site" or "on-line" access - the ability to retrieve data from the broker-dealer's storage system at the broker-dealer's facility (on-site) or through secure remote access or a VPN solution (on-line). D3Ps must now have expertise in retrieving data via all three access protocols.
Despite this changing technological landscape, during the first ten years of the D3P Requirement the SEC and other securities regulators did not meaningfully scrutinize broker-dealers' compliance with the requirement. Certain broker-dealers therefore paid minimal attention to the requirement, confident in their belief that their non-compliance with the requirement would stay under the regulatory radar.
The regulatory environment changed in 2007, when the Financial Institution Regulatory Authority ("FINRA"), the primary self-regulatory organization ("SRO") for broker-dealers, decided to make D3P compliance a greater priority. FINRA examiners, in routine examinations of broker-dealers, started requesting copies of the D3P's required "Letter of Undertaking," along with the service agreement between the broker-dealer and the D3P, and any documentation verifying that D3Ps were complying with the terms of the agreement, including test reports of the D3P's ability to actually access and download random required books and records from digital storage. It is but a matter of time before we will see FINRA enforcement actions charging broker-dealers with violations of Rule 17a-4(f)'s D3P Requirement.
Broker-dealers therefore can no longer afford to ignore or back-burner compliance with the D3P Requirement. But fear of an enforcement action should not be the sole motivating factor for a broker-dealer to achieve compliance with the D3P Requirement. The D3P Requirement serves the beneficial purpose of forcing broker-dealers to collect, document, and analyze all systems setups and configurations concerning electronic recordkeeping, so that it can impart this knowledge to a D3P. By virtue of this exercise, broker-dealers become better organized, and in the process can discover and fill gaps in their general compliance with Rule 17a-4. Further, D3Ps become indispensable resources to broker-dealers in the case of personnel changes in IT; corporate combinations with other broker-dealers using different systems; destruction or loss of systems; and inability to access data stored through legacy systems (after firms have upgraded or purchased new and different storage technologies).
Also, certain D3P vendors now offer a complete set of third party services to broker-dealers under Rule 17a-4(f), including serving as custodian of the required duplicate set of electronic media, serving as required escrow agent for systems information, and serving as required D3P - thereby providing substantial efficiency, cost reduction, and a comprehensive compliance solution with respect to Rule 17a-4(f).
View White Paper
Related Practices: Shareholder and Securities Litigation
email to your friend
Authors: Jeffrey Plotkin
Publisher: Iron Mountain
11/1/2009
This White Paper, authored by Day Pitney Commercial Litigation partner Jeffrey Plotkin, was published by Iron Mountain, the world's leading provider of storage-as-a-service solutions for data protection and recovery, archiving, eDiscovery and intellectual property management. The White Paper explores the background and purpose of SEC Rule 17a-4(f), which requires broker-dealers to retain an independent third party to download electronically stored records for the SEC's review. The White Paper also discusses the current and future regulatory environment surrounding the rule, describes the collateral benefits of compliance with the rule, and offers suggestions to broker-dealers on how to choose the appropriate third party downloader for their regulatory and business needs.
Mr. Plotkin formerly served as Assistant Regional Administrator for the SEC's New York Regional Office, in the Division of Broker-Dealer Enforcement.
Introduction
In 1997, the SEC issued Rule 17a-4(f), which authorized broker-dealers to store their required books and records in electronic format. Broker-dealers who elected to store records electronically were required by the rule to retain a third party ("Designated Third Party" or "D3P") who had the ability to independently download electronically-stored information to another acceptable medium for the SEC's review (the "D3P Requirement"). The purpose of this provision was to ensure that, in the event a broker-dealer went out of business or refused to cooperate with the SEC, an independent third party could assist the SEC in retrieving information stored on electronic media.
The rule originally envisioned a D3P who would be able to independently download and convert information stored on portable media such as optical platters without having access to the broker-dealer's computer systems. As such, the rule expected that D3Ps would have their own systems to download and convert information on media supplied to it by the regulators.
Since 1997, the securities industry standard for electronic storage has shifted from portable media to hard-drive storage systems located on-site at the broker-dealer. As a result, the focus of D3Ps has shifted from so-called "independent access" - the ability to independently download data from portable media at the D3Ps' own facility, to "on-site" or "on-line" access - the ability to retrieve data from the broker-dealer's storage system at the broker-dealer's facility (on-site) or through secure remote access or a VPN solution (on-line). D3Ps must now have expertise in retrieving data via all three access protocols.
Despite this changing technological landscape, during the first ten years of the D3P Requirement the SEC and other securities regulators did not meaningfully scrutinize broker-dealers' compliance with the requirement. Certain broker-dealers therefore paid minimal attention to the requirement, confident in their belief that their non-compliance with the requirement would stay under the regulatory radar.
The regulatory environment changed in 2007, when the Financial Institution Regulatory Authority ("FINRA"), the primary self-regulatory organization ("SRO") for broker-dealers, decided to make D3P compliance a greater priority. FINRA examiners, in routine examinations of broker-dealers, started requesting copies of the D3P's required "Letter of Undertaking," along with the service agreement between the broker-dealer and the D3P, and any documentation verifying that D3Ps were complying with the terms of the agreement, including test reports of the D3P's ability to actually access and download random required books and records from digital storage. It is but a matter of time before we will see FINRA enforcement actions charging broker-dealers with violations of Rule 17a-4(f)'s D3P Requirement.
Broker-dealers therefore can no longer afford to ignore or back-burner compliance with the D3P Requirement. But fear of an enforcement action should not be the sole motivating factor for a broker-dealer to achieve compliance with the D3P Requirement. The D3P Requirement serves the beneficial purpose of forcing broker-dealers to collect, document, and analyze all systems setups and configurations concerning electronic recordkeeping, so that it can impart this knowledge to a D3P. By virtue of this exercise, broker-dealers become better organized, and in the process can discover and fill gaps in their general compliance with Rule 17a-4. Further, D3Ps become indispensable resources to broker-dealers in the case of personnel changes in IT; corporate combinations with other broker-dealers using different systems; destruction or loss of systems; and inability to access data stored through legacy systems (after firms have upgraded or purchased new and different storage technologies).
Also, certain D3P vendors now offer a complete set of third party services to broker-dealers under Rule 17a-4(f), including serving as custodian of the required duplicate set of electronic media, serving as required escrow agent for systems information, and serving as required D3P - thereby providing substantial efficiency, cost reduction, and a comprehensive compliance solution with respect to Rule 17a-4(f).
View White Paper
Related Practices: Shareholder and Securities Litigation
email to your friend