White Collar Roundup - May 2019

SEC Issues Privacy Risk Alert to Registrants

In a sign of its own deepened recognition of the risk of identity theft and other compromise of personal information, the Securities and Exchange Commission (SEC) has put registered firms on further notice that many need to substantially improve their cybersecurity and related controls. On April 16, the SEC's Office of Compliance Inspections and Examinations (OCIE) issued a Risk Alert. Notwithstanding that document's anodyne title (Investments Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies), OCIE's message was pretty pointed. In four concise pages, OCIE summarized what it characterized as the "most common deficiencies or weaknesses" detected in recent examinations assessing compliance with Reg. S-P, the SEC implementation of the Gramm-Leach-Bliley Act's privacy requirements. OCIE found that registrants had failed to adopt fundamental protections, including written customer information safeguards, inventories of customer information storage locations and plans to govern cybersecurity incident response. In addition, OCIE found serious training deficiencies, such as an absence of controls to limit transmission of customer information over personal devices or to revoke logon rights of departing staff. Moreover, the Risk Alert contained a knowing and well-placed shot that condemned halfhearted (or less) protections, such as "written policies and procedures that contained numerous blank spaces" that were designed to be filled in by registrants" —but hadn't. How the SEC will respond if these defects persist remains to be seen. It's fair to say, however, that regulators are giving the problem tougher scrutiny than ever before.

Investment Advisers or Ponzi Schemers?

The owner and two former directors of the Woodbridge Group of Companies, LLC, were charged with "orchestrating a massive investment fraud (Ponzi) scheme" by the U.S. Attorney's Office for the Southern District of Florida, according to a press release. The indictment alleges that these individuals made material misrepresentations and operated a kind of "boiler room," featuring "high-pressure sales tactics, deception, material misrepresentations, and investor manipulation" in the course of the scheme. "Through telemarketing, Woodbridge sales agents contacted potential investors located throughout the United States, and solicited, offered, and sold Woodbridge investments to them. For...