Compliance Programs, Policies, and Procedures

“For heaven’s sake, don’t adopt policies that you’re not going to implement,” she said. “Make sure you know who should do what and that they’re doing it.” So concludes a February 5, 2012 piece written by Mark Schoeff, Jr. in InvestmentNews titled “SEC targets compliance.” The quote is attributed to Rosalind Tyson, director of the SEC’s Los Angeles office.

Ms. Tyson also suggests that firms’ core business activities should be the basis for the compliance programs they design and implement. The same holds true for insurance compliance departments.

As a qualified independent assessor under IMSA, part of what we did was to look at exactly these issues at life insurance companies. Since the demise of IMSA, there isn’t a formal process for life insurers to evaluate these issues independent of a market conduct exam. Based on what we are seeing, some of the processes and procedures that were put into place as a result of IMSA assessments are at risk for triggering the concern raised by Ms. Tyson in the context of broker/dealers.

As we get further and further away from those assessments, who is monitoring what happens to those processes and procedures as there is evolution of the business and changes to the practices? Many of the IMSA assessments pre-date the recession and many companies have cut significant numbers of jobs since then. Do the policies and procedures that are on the books and assigned to specific positions still work with the remaining jobs at these companies. We often find they do not.

The companies we work with have a clear commitment to compliance. However, time can be the enemy of a compliance office. With time comes change, while we also have less and less time these days to do those things that need to be done. As we all try to keep up with fewer and fewer resources, making sure that policies and procedures reflect the current structure and core business activities of our companies can get put off and put off under the increasing demands.

InvestmentNews put out the warning to firms that the SEC is targeting compliance and I think the same can be said of Insurance Departments for insurers and producers. Compliance is not glamorous, but ignore it at your peril. 

The Importance of Expertise

The InvestmentNews column posted on Jan. 22 by Matthew Grove and John Moninger leads with: “Financial advisers who view 2012 as an opportunity to develop an expertise in retirement income planning will reap benefits to their practices and will be well-positioned to lead the industry over the next 20 years as baby boomers move from the accumulation phase of retirement planning to the spending phase.” They state that their conclusion is based on a recent survey by LPL Financial, LLC and New York Life/MainStay Investments. That survey is reported to state, among other things, that “about three in four retirees who use a financial professional indicated that they have consolidated their savings and investments with their primary adviser.”

While this business opportunity seems real and significant, the most important part of the opening of this opinion piece is, in my opinion, the need to “develop an expertise in retirement income planning.” Unfortunately, it is much easier to see the opportunity than it is to develop an expertise in retirement income planning. And there are many compliance issues that arise when there is a focus on retirement income planning without the appropriate expertise.

In addition, for life insurance agents, the consolidation of savings and investments with the primary adviser presents issues that go beyond the expertise. For a life insurance agent, a client that wants to consolidate also presents source of funds issues. It takes tremendous discipline to tell a client that wants to move from a securities investment to a life insurance product that the life agent cannot generally recommend or actually move funds that are currently in securities to insurance products without raising source of funds problems. An agent that succumbs to that enticing prospect could face fines, loss of license and other disciplinary actions!

Social Media and Compliance

The October 3, 2011 issue of InvestmentNews included the “On Social Media” column by Kristin Andree, titled: “About FINRA’s social-media update: Advisory firms now have more guidance on record keeping and supervision.” The lead is: “Compliance is the big reason that most financial advisers are merely dipping their toes into the social-media waters.” The same is true for insurance producers, although on the insurance side, we have even less regulatory guidance than financial advisors do.

A foundation of FINRA’s model of self-regulation that is making its way into insurance regulation is the importance of supervision. We see it very clearly in the annuity suitability regulations that are based on FINRA procedures and I think we will see it too with social media. However, if we look at the FINRA model of a broker-dealer/registered principal to be responsible for supervision of associated persons, there is a disconnect to the insurance world because there is no real equivalent for the broker-dealer. Instead of the firm being responsible for the conduct of associated persons, insurance companies are generally held responsible for the conduct of their agents. It is often a big leap between a home office and the agent in the field and we see those challenges for suitability supervision and we see it even more clearly in the use and regulation of social media.

Under Notice 11-39, a registered principal “must review prior to use any social media site that an associated person intends to employ for a business purpose. The registered principal may approve use of the site for a business purpose only if the registered principal has determined that the associated person can and will comply with all FINRA rules, the federal securities laws, including recordkeeping requirements and any additional requirements established by the firm.” The Notice makes clear that the review of the site must be in the form in which it will be launched, “to ensure that the registered principal will be reviewing not only the initial communication, but the social media site itself in its completed design.” That of course, is easier said than done. For example, we all know that Facebook changes its format and appearance regularly. (I often have to laugh when people lament the new Facebook. What was the old Facebook? Last week, last month? Social Media sites such as Facebook, LinkedIn and Twitter try to change regularly to maintain interest and add new features.) In that context, what does “completed design” mean? As of the day of launch? Or every day thereafter, with every change?

Personally, I like the distinction FINRA draws between “unscripted participation” in interactive electronic forum and “static postings.” The former are considered within the definition of a “public appearance under FINRA Notice 11-39 and the latter an “advertisement” under NASD Rule 2210. Firms are permitted to use a risk-based, post-use supervisory approach for public appearances. Advertisements must be approved by a registered principal prior to use. However, the distinction is not without its landmines: In the Answer to Question 6 in the Notice, it makes clear that interactive content (post use review) can become static if it is copied or forwarded and posted in a static forum, such as a blog or static area of a website. It would then become an advertisement and subject to prior approval by the registered principal.

In the InvestmentNews column, Ms. Andree recommends that “prior to allowing reps to use social media, firms establish very clear policies on what is allowed and what isn’t, and then do a ton of well-documented training around it. Don’t go overboard with the rules, but establish policies that protect consumers yet still allow advisers to brand themselves and serve as a resource to clients and prospects.” In general I agree that this is good advice for insurers looking at social media policies as well. A blanket prohibition creates a level playing field but just isn’t realistic for today’s world. To date that has worked for many companies, but more and more are reworking their social media policies to allow some use.

However, the more complex the rules, the more frustration and the greater the likelihood that they will not be consistently followed, perhaps only because they are misunderstood. Instead, clear rules, simply stated should be crafted so that they are easily understood and applied to the daily uses of social media. Once the rules are in place, they should be applied consistently and compliance monitored regularly. On-going training is essential. Social media is part of the culture and here to stay, though evolution will continue. As that evolution occurs, regulatory mandates will as well, that is a given. Compliance doesn’t have to keep insurance companies and producers out of the social media marketplace. Compliance does not have to be what prevents insurance producers from using social media. Compliance should ensure only that new media, like older media, does not result in market abuses, it should not be what keeps producers off Facebook, LinkedIn, Twitter and blogs.