The SEC on the Use of Financial Services Social Media

Acknowledging that the use of financial services social media is rapidly accelerating, the SEC recently issued its observations following its review of the matter. In its pronouncement, the SEC notes that pursuant to Advisers Act Rule 206(4)-7, firms engaged in financial services social media should adopt, and periodically review the effectiveness of, policies and procedures regarding financial services social media in the face of rapidly changing technology. Firms’ use of financial services social media must comply with various provisions of the federal securities laws, including, but not limited to, the antifraud provisions, compliance provisions, and recordkeeping provisions.

Many firms have policies and procedures within their compliance programs that specifically apply to the use of financial services social media by the firm and its IARs; however, the staff observed variation in the form and substance of the policies and procedures. The SEC staff noted that many firms have multiple overlapping procedures that apply to advertisements, client communications or electronic communications generally, which may or may not specifically include financial services social media use. Such lack of specificity may cause confusion as to what procedures or standards apply to financial services social media use. Many procedures were also not specific as to which types of social networking activity are permitted or prohibited by the firm and many did not address the use of financial services social media by solicitors.

The SEC notes that when evaluating its controls and compliance program, a firm should first identify conflicts and other compliance factors currently creating risk exposure for the firm and its clients in light of the firm's particular operations, and then test whether its existing policies and procedures effectively address those risks.

The SEC offers a non-exhaustive list of factors that an investment adviser may want to consider when evaluating the effectiveness of its compliance program with respect to firm, IAR or solicitor use of financial services social media:

*Usage Guidelines. A firm may consider whether to create firm usage guidelines that provide guidance to Investment Advisory Representatives (IARs) and solicitors on the appropriate and inappropriate use of financial services social media. A firm may also consider addressing appropriate restrictions and prohibitions regarding the use of social media sites based on the firm’s analysis of the risk to the firm and its clients. For example, a firm may choose to provide an exclusive list of approved social media networking sites for IARs’ use or prohibit the use of specific functionalities on a site.

*Content Standards. A firm may consider the risks that content created by the firm or its IARs or solicitors implicates its fiduciary duty or other regulatory issues (e.g., such as content that contains investment recommendations, information on specific investment services or investment performance). A firm may also consider whether to articulate clear guidelines with respect to such content, and whether to prohibit specific content or impose other content restrictions.

*Monitoring. A firm may consider how to effectively monitor the firm’s financial services social media sites or firm use of third-party sites, taking into account that many third-party sites may not provide complete access to a supervisor or compliance personnel.

*Frequency of Monitoring. A firm may consider the frequency with which it monitors IAR or solicitor activity on a social media or a financial services social media site. For example, using a risk-based approach, a firm may conclude that periodic, daily or real-time monitoring of the postings on a site is appropriate. This determination could depend on the volume and pace of communications posted on a site or the nature of, and the probability to mislead contained in, the subject matter discussed in particular conversation streams. The after-the fact review of violative content days after it was posted on a firm’s social networking site, depending on the circumstances, may not be reasonable, particularly where social media content can be rapidly and broadly disseminated to investors and the markets.

*Approval of Content. A firm may want to consider the appropriateness of pre-approval requirements (as opposed to after-the-fact review, as discussed above).

*Firm Resources. A firm may consider whether it has dedicated sufficient compliance resources to adequately monitor IAR or solicitor activity on social media sites or financial social media sites, including the ability to monitor the activity of numerous IARs or solicitors. A firm may also consider employing conversation monitoring or similar services from outside vendors, if, for example, the firm has many IARs or solicitors who use social media sites. A firm may consider using sampling, spot checking, or lexicon-based or other search methodologies, or a combination of methodologies, to monitor social media use and content.

*Criteria for Approving Participation. In analyzing the risk exposure for a firm and its clients due to the use of a social networking site, the firm’s compliance procedures may consider, without limitation, the reputation of the site, the site’s privacy policy, the ability to remove third-party posts, controls on anonymous posting and the advertising practices of any social media site that the firm, or its IARs or solicitors use to conduct business.

*Training. In establishing or reviewing any training requirements for its IARs, a firm may consider implementing training related to financial services social media that seeks to promote compliance and to prevent potential violations of the federal securities laws and the firm’s internal policies.

*Certification. A firm may consider whether to require a certification by IARs and advisory solicitors confirming that those individuals understand and are complying with the firm’s social media policies and procedures.

*Functionality. A firm may consider the functionality of each financial services social media site approved for use, including the continuing obligation to address any upgrades or modifications to the functionality that affect the risk exposure for the firm or its clients. Such consideration is particularly significant given the rapidly evolving nature of this new media. For example, a firm that chooses to host financial services social media on a site that includes a functionality or engages in a practice that exposes a client-user’s privacy, which practice or policy cannot be disabled or modified, may need to consider whether the firm’s participation is appropriate.

*Personal/Professional Sites. A firm may consider whether to adopt policies and procedures to address an IAR or solicitor conducting firm business on personal (non-business) or third-party social media sites. For example, a firm may choose to specify what types of firm communications or content are permitted on a site that is not operated, supervised or sponsored by the firm. While a firm may determine that it is appropriate to permit business card information on a specific personal site or third-party site, it may choose to prohibit conducting firm business on that site.

*Information Security. A firm may consider whether permitting its IARs to have access to social media sites poses any information security risks. Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction is an important risk faced by all firms. Although hacking and other breaches of information security can be posed in multiple ways, use of financial services social media, especially third party social media sites, may pose elevated risks. Firms may consider adopting compliance policies and procedures to create appropriate firewalls between sensitive customer information, as well as the firm’s own proprietary information, and any social media site to the extent that the firm permits access to such sites by its IARs.

*Enterprise Wide Sites. An RIA that is part of a larger financial services or other corporate enterprise may consider whether to create usage guidelines reasonably designed to prevent the advertising practices of a firm-wide social media site from violations of the Advisers Act.

The SEC also provided guidance on other matters related to financial services social media usage, including the use of third party content and recordkeeping.