FINRA Warns Member Firms of Third-Party Compliance Risks
From the Desk of Jim Eccleston at Eccleston Law:
The Financial Industry Regulatory Authority (FINRA) has warned member firms that it will continue to sanction those that fail to flag regulatory violations committed by third-party vendors.
The warning comes at a time when technological innovation has enabled firms to increasingly rely on outsourcing. FINRA’s regulatory notice “reminds” member firms that supervisory systems and associated procedures apply to the “activities or functions” of their third-party vendors. According to the notice, FINRA urges member firms to determine whether their supervisory procedures for third-party vendors are “sufficient to maintain compliance with applicable rules.” FINRA notes that previous examinations of member firms have exposed violations related to cybersecurity, “technology governance”, as well as books and records requirements.
For instance, FINRA reports that some member firms have failed to “document or implement” procedures to examine vendor cybersecurity practices. Additionally, some member firms have failed to properly oversee the disposal of confidential client information following the dissolution of vendor relationships. Through the notice, FINRA has urged member firms to adhere to a “risk-based approach” to vendor management, which factors in the sensitivity and complexity of the outsourcing. According to the notice, member firms ought to question whether a particular vendor is performing a “business-critical” role or fulfilling a regulatory requirement and consider the vendor’s reputation and history in the industry.
Tags: eccleston, eccleston law, finra, third party compliance
