Virtually all of the Regulation S-P violations involving broker-dealers have been in connection with a registered representative changing firms and improperly taking customer information.

While the report is focused on state-registered investment advisers, which tend to be significantly smaller than SEC-registered firms, the compliance guidance and reminders of potentially problematic issues should be of interest, including to CFTC-registered CTAs. Page 5 of the report sets out a list of bullet points of common regulatory issues. Throughout, the report highlights various types of regulatory tools published by NASAA.

The FINRA FAQ on mark-ups strongly suggests that firms should review their compliance procedures relating to PMP determinations and corrections. Firms should make sure that their processes are sufficiently flexible to account for the current market volatility and that they are sufficiently detailed as to any correction of a PMP determination.

The argument that broker-dealers should not be responsible for the misuse of data that they do not control seems on its face quite reasonable. It re-raises, however, a more fundamental question. Is the collection of so much sensitive data in a single location a good idea? The SEC simply cannot guarantee that the system will be always safe from hacking. The regulatory benefits do not seem to justify the cybersecurity risks.

Leaving aside CAT-specific…