The document discusses regulatory requirements and best practices for retaining, supervising, and producing electronic communications. It notes that FINRA fines for electronic communications violations have substantially increased in recent years. Firms must automatically archive all internal and external communications for at least three years and supervise electronic communications to comply with regulations. Technology best practices include using archiving solutions that can capture all message types and flag high-risk messages, regularly updating supervision procedures, and ensuring archived data can be easily searched and retrieved for regulatory requests.

1. Retaining and Supervising Electronic
Communications for Regulatory
Compliance
Brian L. Rubin
Susan Krawczyk
Jaliya S. Faulkner
Jimmy Douglas
May 14, 2014

2. ©2014 Sutherland Asbill & Brennan LLP
General Background
• FINRA has brought an increasing number of
electronic communications-related enforcement
actions over the past five years
Fines
Reported
Percentage Change Percentage of Total
FINRA Fines
Cases Reported Percentage Change
2008 $3.1 million -- 11% 26 --
2009 $1.9 million (39%) 4% 22 (15%)
2010 $4 million 111% 9% 37 68%
2011 $5.3 million 33% 8% 58 57%
2012 $6.5 million 23% 8% 63 9%
2013 $15.1 million 132% 27% 66 5%
Source: Sutherland FINRA Focus #1: 2013 Electronic Communications (Feb. 25, 2014), available at
http://w w w.sutherland.com/New sCommentary/Press-Releases/161274/Sutherland-FINRA-Focus-1-2013-Electronic-
Communications)

3. ©2014 Sutherland Asbill & Brennan LLP
General Background
• Fines for electronic communications violations have
increased substantially as well
 Violations stemming from electronic communications
transgressions generated the highest number of fines for the
FINRA annual analysis of disciplinary actions in 2013
 FINRA reported $15.1 million in fines from 66 cases involving
alleged electronic communications violations – a 132% increase
compared to fines of $6.5 million in 2012

4. ©2014 Sutherland Asbill & Brennan LLP
Retaining Electronic
Communications
Legal Requirements
 Capture of all internal & external
communications
 SEC 17a-3, 17a-4, 204-2
 FINRA 3110, 3130B, 8210
 FINRA Reg. Notices 07-59, 10-06, 10-59, 11-
39, 14-10
 Retention
 Three years
 No use of personal email or social sites for
business communication that can’t be
archived

5. ©2014 Sutherland Asbill & Brennan LLP
Retaining Electronic
Communications
Enforcement Actions have been levied against
firms for:
 Failure to journal emails between registered reps
and independent contractors
 Failure to capture emails from DBAs, alternate email
addresses, distribution lists, emails received as
BCCs, encrypted emails, emails sent through third-
party systems
 Relying on manual system rather than automatic
archiving system
 Failure to preserve in WORM format

6. ©2014 Sutherland Asbill & Brennan LLP
Retaining Electronic
Communications
Technology Best Practices
 Archiving solution should be automatic – don’t rely
on a manual process that allows for missing or
deleted information
 Solution should account for multiple message or
content types: Email, instant messaging, text
messaging, websites and social media
 Solution should capture and render each message
type its original native format

7. ©2014 Sutherland Asbill & Brennan LLP
Retaining Electronic
Communications
Examples of other types of electronic communications
supervision essentials that must be retained
21.7%
22.6%
23.5%
27.0%
40.9%
52.2%
70.4%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Evidence or proof of third-party service provider
Third-party attestation letter
Non-disclosure agreement (NDA)
Archiving vendor contract
Supervision activity reports
Disaster recovery or business continuity plan
Written supervisory procedures
Documentation Requested During an Exam

8. ©2014 Sutherland Asbill & Brennan LLP
Retaining Electronic
Communications
Most commonly requested content types
1. Email
2. Website pages
3. Instant messages
4. Bloomberg or Reuters messages
5. Social media
6. Email marketing
7. Text/SMS messages

9. ©2014 Sutherland Asbill & Brennan LLP
Supervising Electronic
Communications
Legal Requirements
• FINRA 3110, 3120, Regulatory Notice 07-59
• Retail Communications must be reviewed and approved prior to distribution
• EXCEPTION:
• If no financial recommendation is being made
• If it is not promoting a product or the firm
• If it is a real-time response re: posts on bulletin boards
• Firms should develop a post-response review procedure
• Firms should adopt a social media policy
• Institutional Communications
• Must establish procedures appropriate to business
• Must include procedures for supervisory review
• Documented training & education on procedures & policies
• Correspondence must be retained and reviewed
• Internal communications must be retained and reviewed

10. ©2014 Sutherland Asbill & Brennan LLP
Supervising Electronic
Communications
Enforcement Actions
• Often related to the reasonableness of the firm’s system
• What is the business model: Are they a wholesaler or
retailer?
• Some firms have been fined because they assumed they
didn’t need to supervise as often since they didn’t deal
directly with clients (i.e. wholesalers)
• Example: BDs who acquired or were acquired by another firm
and did not adequately ensure all emails from both firms were
integrated and captured by an archiving system
• Firms were fined that did not use or maintain a lexicon or list of
keywords that adequately flagged risky messages

11. ©2014 Sutherland Asbill & Brennan LLP
Supervising Electronic
Communications
Technology Best Practices
• Look for regulators to expect a more sophisticated approach to
supervision beyond basic keywords, including:
• Flagging messages from individuals or groups deemed “high
risk”
• Assigning points to specific types of violations
• Ensure your lexicon/keywords and groups are reviewed and
updated or “fine tuned” on a regular basis to ensure you’re
adequately flagging the right messages
• Look for a solution that will automate some of the supervision tasks
• Ask your provider what they can do. Many firms are not taking
full advantage of the capabilities of their archiving provider

12. ©2014 Sutherland Asbill & Brennan LLP
Monitoring Systems
How do you know your systems are working as they
should?
Legal Requirements FINRA 3110, 3120
 Firms have flexibility in how they approach their supervisory
systems
 Firms must have on ongoing review of supervisory systems to
identify possible gaps and ensure the systems are performing
effectively and as expected
 Firms shouldn’t allow reps to gain access to keyword lists.
Prevent the ability to “game” the system
 Firms need to ensure attachments are also viewable and
preferably can be scanned by the system

13. ©2014 Sutherland Asbill & Brennan LLP
Monitoring Systems
Enforcement Actions
 In most cases, when regulators found gaps or glitches in the
system, the fines came down to the reasonableness of the
firm’s system and procedures in the given circumstances
 A firm was fined when emails were not captured for a period
of ten days
 Another firm was fined when the disk provided from the
vendor was corrupted and was missing a 30 day period of
data
 Fines can also be levied if there is a significant delay in
production of data due to technical glitches

14. ©2014 Sutherland Asbill & Brennan LLP
Monitoring Systems
Technology Best Practices
 Ensure you’re monitoring messages with attachments
 Ensure you’re able to monitor and review encrypted emails
and that your email encryption service works seamlessly
with your overall archiving solution
 Ensure that any and all changes to your firm’s email hosting
or tech configuration are communicated to your archiving
vendor to avoid any journaling disruption
 Perform internal evaluations to ensure all supervision and
enforcement activities take place – look for a solution that
provides easy activity and audit trail reporting

15. ©2014 Sutherland Asbill & Brennan LLP
Producing Electronic
Communications
Legal Requirements
 1934 Act allows the SEC to require firms to make their
books and records available upon request
 FINRA 8210 indicates FINRA can require a member firm to
provide information and communications upon request
 The Record Keeping Rule indicates that firms maintain
records for at least two years in an easily accessible place,
with the ability to produce them within 24 hours (although
regulators are flexible in the timeframe, as dictated by the
details of the request or at the request of a firm)

16. ©2014 Sutherland Asbill & Brennan LLP
Producing Electronic
Communications
Enforcement Actions
 There has yet to be an enforcement action against a firm for
not meeting the 24 hour deadline
 Failure to respond will result in an enforcement action such
as being suspended or sanctioned
 Firms have also been sanctioned and fined for providing
incomplete documentation

17. ©2014 Sutherland Asbill & Brennan LLP
Producing Electronic
Communications
Technology Best Practices
 This is where you can differentiate between a full archiving
system and a basic backup. In a full archiving system,
information is easily searchable and retrievable
 Look for a solution where the vendor does not limit access
to your data or inhibit you from getting what you need in a
timely fashion
 Be wary of cost structures that are variable and may involve
high fees to access your data
 Have clear procedures in place for requesting data, so you
know who and how to ask for the information to get a
response as quickly as possible

18. ©2014 Sutherland Asbill & Brennan LLP
Questions?
Sutherland
Brian L. Rubin
brian.rubin@sutherland.com
202.383.0124
Susan Krawczyk
susan.krawczyk@sutherland.com
202.383.0197
Jaliya S. Faulkner
jaliya.faulkner@sutherland.com
404.853.8192
Smarsh
Jimmy Douglas
jdouglas@smarsh.com
866.762.7741