Examinations: SEC 2023 Priorities

February 2023

KPMG Insights. 

• The SEC (and the prior FINRA issuance, see KPMG Regulatory Alert here) provides an incredibly helpful “roadmap” for companies to utilize in terms of 2023 regulatory expectations.
• The SEC’s 2023 Examination Priorities give insight into a large array of upcoming regulatory risks and areas of SEC attention, including:
  • New rules (e.g., Marketing Rule, Derivatives Rule, and Fair Valuation Rule).
  • Examination focal areas (e.g., RIAs to private funds; retail investor “best interest” and fiduciary duty; ESG-related service and fund offerings, fund labeling and retail investor “best interest"; and crypto or “crypto-related” asset trading). 
• Companies should quickly assess and conduct “gap assessment” of their practices relative to such regulatory insight in order to prioritize actions, seek investments (as needed), and swiftly ‘remediate’ known gaps to regulatory expectations.

The SEC’s Division of Examinations (Division) issued its annual list of examination priorities focusing on products, practices, and services that it believes present significant areas of heightened risk to investors and U.S. capital markets. The Division’s 2023 priorities, which reflect the SEC’s ambitious 2022 and 2023 regulatory rulemaking agenda, are outlined below.

• Information Security and Operational Resiliency: The Division notes “the current risk environment related to cybersecurity is considered elevated given the larger market events, geopolitical concerns, and the proliferation of cybersecurity attacks, particularly ransomware attacks.” As such, the Division will assess firms’ policies and procedures, governance practices, and response to cyber-related incidents, including those related to ransomware attacks, and compliance with Regulations S-P and S-ID, where applicable. Examinations will look to practices for:
  • Safeguarding customer records and information and preventing account intrusions, as well as policies and practices around access and authorization, including from remote environments.
  • Cybersecurity risks associated with the use of third-party vendors, including visibility into the security and integrity of third-party products and services.
  • Operational resiliency planning, such as efforts to consider and/or address climate-related risks.

See related KPMG Regulatory Alerts:

Data Retention and Deletion: Increasing Regulatory Expectations (here)

Cybersecurity: SEC Proposals for Public Company Reporting, Disclosures (here)

Cybersecurity: SEC Proposal for Adviser/Fund Risk Management (here)

• Crypto Assets and Emerging Financial Technology: The Division will examine broker-dealers and RIAs offering new products and services (e.g., crypto assets and associated products or services) or employing new practices using emerging technologies (e.g., mobile apps, automated digital investment advice) to determine whether they consider associated unique risks in their compliance programs. Firms employing digital engagement practices and related tools and methods will be assessed on whether:
  • Recommendations were made or advice was provided (e.g., through the use of social media marketing and social trading platforms).
  • Representations are fair and accurate.
  • Operations and controls in place are consistent with disclosures made to investors.
  • Any advice or recommendations are in the best interest of the investor considering the investor’s financial situation and investment objectives.
  • Risks associated with such practices are considered, including the impact these practices may have on certain investors, such as seniors.
    
    The Division will “monitor and, when appropriate, conduct examinations” of registrants potentially impacted or affected by disruption in the crypto asset market. Examinations will assess whether market participants involved in crypto and crypto-related assets (including offering, sale, recommendation of, advice regarding, or trading):
    • Met and followed their respective standards of care when making recommendations, referrals, or providing investment advice.
    • Routinely reviewed, updated, and enhanced their compliance, disclosure, and risk management practices.
• RIA Examinations: In addition to core areas for review (e.g., custody and safekeeping of assets, valuation, portfolio management, brokerage and execution, calculation of fees) examinations will include policies and procedures for retaining and monitoring electronic communications and using third-party service providers.
• RIC Examinations: Beyond “perennial focus areas”, such examinations will consider processes for assessing and approving fund fees, derivatives and liquidity risk management programs, and funds with specific characteristics, such as: turnkey funds; mutual funds that converted to ETFs; and medium and small fund complexes that have experienced excessive staff attrition.
• Broker-Dealer Examinations: In 2023, examinations will focus on “broker-dealer compliance and supervisory programs generally, including those for electronic communications related to firm business, as well as the recordkeeping for those electronic communications.” Areas of continued focus will include compliance with the Customer Protection Rule and the Net Capital Rule; trading practices in equities and fixed income securities, including conflicts of interest in order routing and execution that may negatively impact retail investors; and compliance with Regulation SHO.
• Clearance and Settlement: Title VIII of the Dodd Frank Act requires the SEC to annually conduct at least one risk-based examination of SEC supervised clearing agencies that are designated as systemically important. These examinations will focus on core risks, processes, and controls in areas including the nature of clearing agencies’ operations and assessment of financial and operational risk. Other registered clearing agencies will be examined based on risk.  For all examinations, areas of focus may include liquidity risk management, counterparty credit stress testing, governance and escalation, and the compliance function, among other things.
• Regulation SCI: “SCI entities” (including national securities exchanges, registered and certain exempt clearing agencies, FINRA, MSRB, plan processors, and certain ATSs) are required to establish, maintain, and enforce written policies and procedures “reasonably designed” to ensure their systems’ capacity, integrity, resiliency, availability, and security. Continued examination of these entities’ policies and procedures will focus on:
  • Consideration of the software development life cycle, with a particular focus on the programs to review and keep current systems development and testing methodologies.
  • Ensuring SCI systems operated by third parties on behalf of SCI entities have adequate levels of capacity, integrity, resiliency, availability, and security.
  • Whether a system, if breached, would be reasonably likely to pose a security threat to SCI systems.
  • Ensuring SCI systems have adequate levels of security to maintain the SCI entity’s operational capability, giving consideration to reliance on external applications such as the cloud.

See related KPMG Regulatory Alert:

Cybersecurity: SEC Reg SCI Proposal, Future Considerations (here)

• AML: SEC states the importance of AML program examinations has been elevated due to the current geopolitical environment and the increased imposition of sanctions. Examinations will focus on broker-dealers’ and RIAs’ compliance with AML requirements including whether firms:
  • Have appropriate customer identification programs.
  • Adhere to SAR filing obligations.
  • Conduct ongoing customer due diligence.
  • Comply with beneficial ownership requirements.
  • Conduct robust and timely independent tests of their AML programs.
• LIBOR Transition. The Division will continue to assess broker-dealer and RIA preparation for transition away from LIBOR, which is scheduled for discontinuation in mid-2023.