Compliance, Enforcement, Regulatory, Standard of Care

New SEC Cybersecurity Incident rules for RIAs

May 16, 2024 Richard Chen Leave a comment

The SEC has just finalized rules requiring RIAs to adopt new measures for responding to cybersecurity incidents and notifying clients of such incidents.

RIAs and broker-dealers , among others, will now be required to develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.

The policies and procedures must address assessment of the situation, containment of the situation, and notification of affected clients.

Large advisers (i.e., those with at least $1.5 billion in assets under management) would need to comply with the new rules within 18 months of the publication of the final rules in the Federal Register while smaller advisers would need to comply within 24 months of such publication date.

What’s the marketing piece that creates the most compliance risk for RIAs?

May 2, 2024 Richard Chen Leave a comment

In my opinion, it’s the website.

With the SEC’s scrutiny of Marketing Rule compliance, I believe the SEC is closely scrutinizing Forms ADV filed by RIAs, and to the extent that RIAs indicate they are referencing testimonials, endorsements, third-party ratings, predecessor performance, hypothetical performance, or specific investment recommendations in their marketing materials, this gives the SEC an impetus to review the adviser’s marketing materials.

The marketing piece most easily accessible to the SEC is the RIA’s website, the address to which is also listed on the Form ADV.