As the football season was winding down, on January 4, 2017, the Financial Industry Regulatory Authority (FINRA) published its 2017 Annual Regulatory and Examination Priorities Letter.¹ According to FINRA President and CEO, Robert Cook, this year’s 11-page letter focuses on “core ‘blocking and tackling’ issues of compliance, supervision and risk management.”² In contrast, last year’s letter “address[ed] three broad issues—culture, conflicts of interest and ethics; supervision, risk management and controls; and liquidity,” in addition to “more narrowly focused topics.”³ The focus (and brevity) of FINRA’s priorities letters continues to improve—11 pages this year, 13 pages last year and 17 pages in 2015 (with 19 footnotes, covering at least 35 issues). It appears that FINRA has heeded the industry’s request to make its annual priorities letter more focused to give firms the opportunity to “evaluat[e] their business” and “to help identify applicable priorities.”⁴ Perhaps FINRA is taking to heart the precepts of George Allen (former head coach of the old Los Angeles Rams and the Washington football team) who once said, “Try not to do too many things at once.”⁵

Unlike many other summaries of FINRA’s priorities, this analysis focuses on some of FINRA’s 2017 priorities, as well as priorities from previous years, while also examining real-world implications arising from these priorities based on relevant disciplinary actions from 2016.⁶

The Starting Lineup

• The Old Pros (Senior Investors)

The 2017 Priorities Letter confirms FINRA’s increasing scrutiny on firms’ treatment of senior investors.⁷ Interestingly, the Securities and Exchange Commission (SEC) Office of Compliance Inspections and Examinations (OCIE), in its recently released 2017 examination priorities letter, also focused on senior investors and retirement investments.⁸ While FINRA discussed senior investors in the 2015 and 2016 priorities letters,⁹ they were not featured in previous years as prominently as this year. For example, in 2016, FINRA “urged” firms to proactively monitor for “red flags of possible abuse” related to senior investor accounts.¹⁰ This year, in contrast, FINRA sternly warned firms that FINRA examiners will actively “assess firms’ controls to protect senior investors.”¹¹ This increased scrutiny revolves around three main areas:

• Supervisory controls: FINRA will be examining firms to see if they have supervisory controls in place to “protect senior investors from fraud, abuse, and improper advice.”¹²
• Suitability: FINRA will be reviewing firms’ policies and procedures addressing product suitability and (over)concentration in particular products, including “examining firms’ product vetting processes, supervisory systems and controls to review recommendations.”¹³
• Complex products: FINRA will be particularly focused on firms’ sales of complex, novel, illiquid and highly speculative products to seniors.¹⁴ 

During 2016, FINRA brought 19 cases involving senior-related matters, assessed fines of approximately $1.5 million, and ordered disgorgement or restitution of approximately $700,000. Based on the 2017 Priorities Letter, these numbers will likely increase during 2017 and beyond.

• Calling the Plays (Product Suitability and Concentration)

The 2017 Priorities Letter emphasized fundamental suitability issues, addressing:

• Whether customers and registered representatives understand product features;
• How firms conduct reasonable-basis and customer-specific suitability reviews; and
• How firms vet products and supervise recommendations, including focusing on excessive concentration in customers’ accounts. 

In addition, the 2017 Priorities Letter focused on the market’s impact on particular financial products, noting that firms “should be attentive to shifts in the interest rate environment and should be prepared to assess and discuss the possible impact of these changes on recommendations to clients.”¹⁵ The 2017 Priorities Letter also highlighted certain products, only some of which were similarly featured in 2016, as set forth below:
                             

FINRA did not explain why the mix of products changed substantially from 2016 to 2017. 

In 2016, FINRA brought 53 cases involving suitability, assessed fines of approximately $7.4 million, and ordered disgorgement or restitution of almost $14 million. In addition to those cases, FINRA brought 11 cases involving churning and excessive trading, assessed fines of approximately $1.3 million, and ordered disgorgement or restitution of approximately $2.8 million. Given the mix of new highlighted products, it is difficult to predict whether enforcement actions will increase in 2017.

• Not Quite “Spygate”¹⁷ (Cybersecurity)

In both the 2016 and the 2017 Priorities Letters, FINRA emphasized that cybersecurity was a top priority.¹⁸ While FINRA recognized that “there is no one-size-fits-all approach to cybersecurity,” the 2017 Priorities Letter highlighted the following areas of concern:

• “[M]ethods for preventing data loss”;
• Understanding data and how it flows through the firm and possibly to vendors; 
• Controls used to “monitor and protect” data; 
• Management of vendor relationships, “including the controls to manage those relationships”; 
• “[C]ontrols to protect sensitive information from insider threats”;
• Controls at branch offices, “particularly [at] independent contractor branch offices,” which “tend to be weaker than those at firms’ home offices.”¹⁹ FINRA noted that it observed “poor controls related to the use of passwords, encryption of data, use of portable storage devices, implementation of patches and virus protection, and the physical security of assets and data.”²⁰

In addition, like last year, in 2017 FINRA connected cybersecurity to books and records requirements. Under Securities Exchange Act Rule 17a-4(f), certain records are to be preserved in a non-rewriteable, non-erasable format, commonly referred to as a “write once, read many” (WORM) format. In the 2016 Priorities Letter, FINRA stated that it would “consider examining firms’ abilities to protect the confidentiality, integrity and availability of sensitive customer and other information, including compliance with SEC Regulation S-P” and Rule 17a-4(f).²¹ FINRA did, in fact, conduct such examinations, and it brought enforcement actions against 12 firms for, among other things, failing to preserve records in WORM format. FINRA fined these firms a total of $14.4 million.²²

While these settlements contained no allegations of cybersecurity breaches or hacking, FINRA attempted to connect this basic books and records issue to cybersecurity by making the following statement in its press release: “Over the past decade, the volume of sensitive financial data stored electronically has risen exponentially and there have been increasingly aggressive attempts to hack into electronic data repositories, posing a threat to inadequately protected records, further emphasizing the need to maintain records in WORM format.”²³

Other than those so-called cybersecurity cases, FINRA brought one case involving an actual instance of hacking.²⁴ In that case, FINRA fined the firm $650,000 for failing to establish, maintain and enforce a supervisory system reasonably designed to ensure the security of confidential customer information stored on electronic systems at the firm’s branch offices. The firm’s alleged failure allowed hackers with foreign Internet Protocol addresses to access the firm’s server, exposing the confidential records and information of approximately 5,400 of the firm’s customers. Given the priority of cybersecurity cases and the almost-daily breaches reported in the media, these cases are likely going to increase in 2017 and beyond. 

• Show me the anti-money laundering²⁵ 

Anti-money laundering (AML) has long been a priority of FINRA and the SEC,²⁶ and that theme continued in the 2017 Priorities Letter. Among the issues highlighted by FINRA were the following:

• “[G]aps in firms’ automated trading and money movement surveillance systems caused by data integrity problems, poorly set parameters or surveillance patterns that do not capture problematic behavior such as suspicious microcap activity”; 
• “[W]eaknesses in systems monitoring foreign currency transactions and transactions that flow through suspense accounts”; 
• Using the same trading surveillance for other supervisory purposes, but not including “alerts tailored to the firm’s anti-money laundering red flags”; and
• Controls around accounts held by nominee companies.²⁷

Notably, the following areas were excluded from the 2017 Priorities Letter but highlighted in the 2016 Priorities Letter:

• Acknowledging risk-based approaches to “exclude certain customer transactions from one or more aspects of AML surveillance”; and
• Delegating “monitoring of suspicious trading activity to personnel outside of the AML function,” and “ensuring an open line of communication with the personnel conducting reviews of trading activity.”²⁸

During 2016, FINRA brought 29 AML cases and assessed fines of more than $43 million. Given the continued high priority of this issue, the number of cases will probably increase in the future. 

• Comeback Players (High-Risk and Recidivist Brokers)

The 2017 Priorities Letter focused on firms’ hiring and supervising “high-risk and recidivist brokers.”²⁹ These individuals are of particular interest to FINRA because they may “pose a high risk to investors.”³⁰ Interestingly, the 2016 Priorities Letter did not focus on this issue but FINRA’s 2015 examination priorities letter did. Specifically, the 2015 Priorities Letter noted that “[t]he activities of certain high-risk brokers cause outsized risk to investors, including the heightened potential to become a fraud victim.”³¹

The 2017 Priorities Letter outlined FINRA’s prescriptive, three-step approach for deterring and detecting such representatives:

• FINRA has established a dedicated examination unit to “identify and examine brokers who may pose a high risk to investors.”³²
• FINRA will “review firms’ supervisory procedures for hiring or retaining statutorily disqualified and recidivist brokers.”³³
• FINRA will “evaluate firms’ branch office inspection programs as well as their supervisory systems for branch and non-branch office locations, including, but not limited to, independent contractor branches.”³⁴

FINRA’s focus on these “problem” brokers extends not just to the regular examination cycle, but also to FINRA’s examination of firms’ applications to associate with statutorily disqualified individuals, as well as new and continuing membership applications where members “employ or seek to employ registered representatives with problematic regulatory histories.”³⁵ FINRA has not yet focused on this issue in the context of an enforcement action. 

Riding the Bench

• “Clear eyes, full hearts, can’t lose”³⁶  (Culture, Conflicts and Ethics)

In both the 2015 and the 2016 Priorities Letters, FINRA spent considerable time discussing culture, conflicts and ethics. This year’s letter did not mention culture or ethics even once. While it did use the word “conflicts” once, the context involves “trading examination priorities” where FINRA is going to examine the “adequacy of alternative trading systems’ disclosures to customers about how they operate, [while] reviewing for potential conflicts of interest.”³⁷ It is possible that FINRA realizes that all firms believe their culture is admirable and ethical, and there may not be value in focusing on it as a concept. It appears that FINRA may believe that if firms concentrate on the fundamentals like “blocking and tackling,” then the culture will follow or that ethical firms with good culture do, in fact, focus on core issues. While these may appear to be metaphysical issues, it is safe to say that, for now, firms would do well to focus on the substantive issues contained in the 2017 Priorities Letter.

• Variable Audibles Annuities

Variable annuities were hardly addressed this year, despite playing a significant role in FINRA’s enforcement programs during 2016. The one mention concerns representatives recommending that clients trade long-term products, including variable annuities and other products, on a short-term basis.³⁸ This omission is curious because FINRA brought numerous variable annuity cases, including eight involving L-share variable annuities, fined the firms a total of $6.2 million, and ordered five of the firms to pay more than $6 million to customers.³⁹

• Scouting Reports (Due Diligence)

Despite the fact that due diligence cases were “yuuuge” in 2016 (to quote the former owner of the New Jersey Generals, a franchise of the United States Football League)⁴⁰ (23 cases, with fines of more than $3.3 million and restitution or disgorgement of approximately $1.1 million), there is not one reference to product due diligence in the 2017 Priorities Letter. Although as discussed above, FINRA does refer to “reasonable-basis” suitability and firms’ product vetting practices under “Product Suitability and Concentration.” 

The Final Score

Although FINRA may have a new head coach with a new playbook, its ultimate goals in 2017 remain the same—protect investors and preserve market integrity. The 2017 Priorities Letter outlines how FINRA intends to achieve those goals. Now it is time for firms to follow suit— lace-up and prepare for 2017 examinations, or risk being “blindsided” by disciplinary actions. Indeed, the preliminary data for 2016 indicates that last year was a record-setting year for FINRA’s fines. To try to prevent 2017 from setting similar records, firms may want to adjust their defensive line (along with their disclosures and policies and procedures). As former Dallas Cowboys Head Coach Tom Landry said: “Setting a goal is not the main thing. It is deciding how you will go about achieving it and staying with that plan.”⁴¹
                                   

¹ FINRA 2017 Examination Priorities Letter (Jan. 2017) available at http://www.finra.org/sites/default/files/2017-regulatory-and-examination-priorities-letter.pdf. 
  
² Cover Letter From FINRA President and CEO, Robert Cook (Jan. 4, 2017), available at http://www.finra.org/ industry/2017-regulatory-and-examination-priorities-letter. 
  
³ FINRA 2016 Examination Priorities Letter, p. 1 Jan. 2016) available at http://www.finra.org/sites/default/ files/2016-regulatory-and-examination-priorities-letter.pdf. 
  
⁴ 2017 Priorities Letter at p. 1. 
  
⁵ L. Entis, 10 Inspirational Quotes on Leadership From the NFL’s Greatest Coaches, ENTREPRENEUR, Jan. 27, 2015, available at https://www.entrepreneur.com/article/242262. 
  
⁶ The statistics for the disciplinary actions are taken from FINRA’s monthly “Disciplinary and Other FINRA Actions” reports from January through December 2016 (generally covering actions through October 2016), as well as FINRA’s press releases from January through December 2016. 
  
⁷ While the 2017 Priorities Letter does not define “senior investor,” a FINRA proposed rule related to the protection of senior investors and other vulnerable adults defines “specified adult” to include natural persons age 65 and older. See Proposed Rule Change to Adopt FINRA Rule 2165 (Financial Exploitation of Specified Adults) at p. 11, available at https://www.finra.org/sites/default/files/rule_filing_file/SR-FINRA-2016-039.pdf. For additional Sutherland analysis of the proposed rulemaking, please see Sutherland Legal Alert: Is It Safe? Limits of “Safe Harbor” for Temporary Holds on Senior Investor Transactions Under Proposed FINRA Rule 2165 (Jan. 12, 2017), available at http://www.sutherland.com/NewsCommentary/Legal-Alerts/195502/Legal-Alert-Is-It-Safe-Limits-of-Safe-Harbor-for-Temporary-Holds-on-Senior-Investor-Transactions-Under-Proposed-FINRA-Rule-2165.

⁸See SEC OCIE Examination Priorities for 2017 at p. 3 (Jan. 2017), available at https://www.sec.gov/about/offices/ocie/national-examination-program-priorities-2017.pdf. 
  
⁹See FINRA 2016 Examination Priorities Letter, pp. 6-7 (Jan. 2016) available at http://www.finra.org/sites /default/ files/2016-regulatory-and-examination-priorities-letter.pdf (the 2016 Priorities Letter); FINRA 2015 Examination Priorities Letter, p. 10 (Jan. 2015) available at http://www.finra.org/sites/default/files/p602239.pdf (2015 Priorities Letter).
  
¹⁰ FINRA 2016 Examination Priorities Letter, pp. 6-7 (Jan. 2016) available at http://www.finra.org/sites/default/ files/2016-regulatory-and-examination-priorities-letter.pdf. 
  
¹¹ 2017 Priorities Letter at pp. 3-4. 
  
¹² 2017 Priorities Letter at pp. 3-4.
  
¹³Id. 
  
¹⁴Id.
  
¹⁵ 2017 Priorities Letter at p. 3. 
  
¹⁶ These products were also specifically mentioned in the OCIE Letter. See OCIE Letter at p. 2. 
  
¹⁷See, e.g., D. Van Natta Jr. et al., Spygate to Deflategate: Inside What Split the NFL and Patriots Apart, ESPN, Sept. 8, 2015, available at http://www.espn.com/espn/otl/story/_/id/13533995/split-nfl-new-england-patriots-apart. 
  
¹⁸ The OCIE Letter also mentions a cybersecurity focus for 2017. See OCIE Letter at p. 4 (“In 2017, we will continue our initiative to examine for cybersecurity compliance procedures and controls, including testing the implementation of those procedures and controls”).
  
¹⁹ 2017 Priorities Letter at p. 6. 
  
²⁰Id.
  
²¹ 2016 Priorities Letter at p. 3.
  
²² Press Release, FINRA Fines 12 Firms a Total of $14.4 Million for Failing to Protect Records From Alteration (Dec. 21, 2016) available at http://www.finra.org/newsroom/2016/finra-fines-12-firms-total-144-million-failing-protect-records-alteration. 
  
²³Id.
  
²⁴ FINRA AWC No. 2013035036601 (Oct. 21, 2016). 
  
²⁵Cf. Jerry Maguire, https://en.wikipedia.org/wiki/Jerry_Maguire#Famous_quotations (“Show me the Money!” shouted repeatedly in a phone exchange between Rod Tidwell and Jerry Maguire).
  
²⁶ The OCIE Letter also highlights the SEC staff’s plans to “continue to examine broker-dealers to assess whether AML programs are tailored to the specific risks that a firm faces. . .” OCIE Letter at pp. 4-5
  
²⁷ 2017 Priorities Letter at p. 8.
  
²⁸ 2016 Priorities Letter at pp. 4-5. 
  
²⁹ 2017 Priorities Letter at p. 2. The OCIE Letter also notes that the SEC staff “will continue to use [its] analytic capabilities to identify individuals with a track record of misconduct and examine the investment advisers that employ them.” OCIE Letter at p. 2. 
  
³⁰Id. 
  
³¹ FINRA 2015 Examination Priorities Letter, p. 9 (Jan. 2015) available at http://www.finra.org/sites/ default/files/p602239.pdf.
  
³² 2017 Priorities Letter at p. 2.
  
³³Id.
  
³⁴Id.
  
³⁵Id. 
  
³⁶http://www.esquire.com/entertainment/tv/a29117/coach-taylor-quotes/. 
  
³⁷ 2017 Priorities Letter at p. 10.
  
³⁸Id.
  
³⁹ Press Release, FINRA Fines Eight Firms a Total of $6.2 Million for Supervisory Failures Related to Variable Annuity L-Shares (Nov. 2, 2016) available at http://www.finra.org/newsroom/2016/finra-fines-eight-firms-total-62-million-supervisory-failures-related-variable-annuity. 
  
⁴⁰https://en.wikipedia.org/wiki/New_Jersey_Generals. 
  
⁴¹http://www.allprodad.com/our-top-10-favorite-tom-landry-quotes/.