A myriad of international agencies and institutions regulate and oversee financial markets. In the US, the Securities and Exchange Commission (SEC), and the Financial Industry Regulatory Authority (FINRA) enforce the rules and publish directives regarding the use and retention of business records. In Canada, the Investment Industry Regulatory Organization of Canada (IIROC) has several guidelines regarding the tracking and preservation of business communications.
Within the European Union (EU), the European Securities and Markets Authority acts as an independent authority that enforces regulations that include several guidelines on recordkeeping – such as the Markets in Financial Instruments Directive (MiFID II), which came into full force on January 3, 2018.
In the United Kingdom, the Financial Conduct Authority (FCA), which oversees over 56,000 financial firms, implements recordkeeping requirements that oblige businesses to archive business communications, including those that are sent or received electronically.
Although opinions vary on the efficiency, effectiveness and even the need for some of these agencies, they were each designed with specific goals and are likely to exist for the foreseeable future. With that in mind, the following is a complete review of each regulatory body.
Regulatory Coverage
The United States
- SEC – The SEC, an independent agency within the U.S. government, was established by the Securities Exchange Act of 1934. Its regulatory coverage includes the U.S. stock exchanges, options markets, and options exchanges as well as all other electronic exchanges and other electronic securities markets. It also regulates investment advisors who are not covered by the state regulatory agencies.
- FINRA – Created in 2007 from its predecessor, the National Association of Securities Dealers (NASD), FINRA is considered a self-regulatory organization (SRO) which oversees all firms that are in the securities business with the public. It is also in authority for training financial services professionals, licensing and testing agents, and supervises the mediation and arbitration processes for disputes between customers and brokers.
Canada
- IIROC – Similar to the FINRA in the U.S., the IIROC is the governing authority for all debt and equity markets, investments, and investment brokers, dealers and providers in Canada. It has the authority to set and implement laws in the Canadian securities and trading markets. It can levy fines, suspensions and other disciplinary action against non-compliant firms, brokers, and IIROC also regulates all investment-related sales activity by brokers, agents, and planners.
EU
- ESMA –ESMA is an independent EU authority whose purpose is to improve investor protection and promote stable, orderly financial markets. Its activities are fourfold: 1) Assessing risks to investors, markets, and financial stability; 2) Completing a single rulebook for EU financial markets; 3) Promoting standardization of supervision practices, and; 4) Directly supervising specific financial bodies.
United Kingdom
- FCA – FCA regulates and ensures that the relevant financial markets in the U.K. function well. It has the powers to enforce its mandate, including rule-making, investigative and enforcement powers. And since it is an independent body, the FCA also has the power to raise fees. It, therefore, charges fees to authorized firms that carry out activities regulated by the FCA, and other bodies like recognized investment exchanges.
Recordkeeping Requirements
SEC – To comply with the SEC Rule 17a-3 & 17-a4, brokers and dealers must:
- Preserve email records for 6 years; the first two years of which must be in an accessible location.
- Time-stamp all records with a unique and sequential identification number.
- Store archives in a non-rewriteable/non-erasable format, organized and indexed with a duplicate copy stored separately from the original.
- Duplicate indexes and store them separately from the original. They should also be available for examination and preserved as long as the original records, for at least six years.
FINRA – To comply with FINRA Reg. Notice 17-18, financial firms must:
- Retain electronic correspondence with customers and other relevant communications for at least 3 years on non-rewriteable and non-erasable storage, AKA Write Once, Read Many (WORM).
- Store files on a system that prohibits alterations, erasure or loss of
- Index communications for ease of access.
- Keep a duplicate copy of each record stored in a separate location.
IIROC – To comply with IIROC Rule 29.7, dealer members must:
- Retain records relating to their business activities, financial affairs, client transactions and communication for 5 years from the date of creation.
- Design systems and programs with compliant record retention and retrieval functionalities for those methods of communication permitted at the firm.
- Maintain transaction-related documents entered into on behalf of each client, including but not limited to trade confirmation statements, emails and notes of oral communications with clients.
ESMA – To comply with recordkeeping requirements of MiFID II, financial firms must:
- Conduct surveillance of critical communications to ensure that they are compliant with market rules.
- Record telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission, and execution of client orders.
- Keep the records in a medium that can be accessed by the relevant national competent authority (NCA) for a period of 5 years.
FCA – The recordkeeping requirements of MiFID II also applies to financial services in U.K. However, the Chapter 9 of SYSC handbook includes additional provisions regarding recordkeeping requirements that apply to MiFID optional exemption firms and third country firms.
Overall, these agencies seek to regulate and protect those who participate in the respective industries they govern. Understanding the essence of the recordkeeping regulations being enforced by these regulatory bodies is critical to ensure full compliance and to avoid significant monetary fines and legal troubles.
At TeleMessage, we offer our Mobile Archiver that can help financial services leaders to efficiently manage data and content including enterprise SMS, emails, and web and social media content, concerning compliance. Our archiving solution is equipped with versioning, and robust governance capabilities that ensure content across all digital channels is compliant and meets global regulatory requirements.
Read More: Fines for Non-Compliance – GDPR, FINRA, MiFID II
Preparing Your Financial Organization for the SEC Messaging Compliance Audit
