Quarterly highlights

(New) Modernization of Beneficial Ownership Reporting

On October 10, 2023, the Commission adopted amendments to certain rules that govern beneficial ownership reporting. The amendments generally shorten the filing deadlines for initial and amended beneficial ownership reports filed on Schedules 13D and 13G. The amendments also clarify the disclosure requirements of Schedule 13D with respect to derivative securities. The SEC is also expanded the timeframe within a given business day by which Schedules 13D and 13G must be filed, and separately requiring that Schedule 13D and 13G filings be made using a structured, machine-readable data language. Further, as discussed in the adopting release, under the current rules, an investor’s use of a cash-settled derivative security may result in the person being treated as a beneficial owner of the class of the reference equity security. The SEC is also providing guidance on the application of the current legal standard found in Section 13(d)(3) and 13(g)(3) of the Securities Exchange Act of 1934 to certain common types of shareholder engagement activities. Finally, the SEC made certain technical revisions. The amendments become effective on February 5, 2024, but the adopting release specifies compliance dates.

• SEC Release Number 33-11253 and 34-98704 (October 10, 2023): Modernization of Beneficial Ownership Reporting (Final Rule)

Customer Account Statements

FINRA has adopted amendments to Rule 2231 (Customer Account Statements) to add eight new supplementary materials pertaining to:

• Compliance with Rule 4311 (Carrying Agreements);
• The transmission of customer account statements to other persons or entities;
• The use of electronic media to satisfy delivery obligations;
• Compliance with Rule 3150 (Holding of Customer Mail);
• The information disclosed on customer account statements;
• Assets externally held;
• The use of logos and trademarks, etc.; and
• The use of summary statements.

Several of these new supplementary materials are derived largely from Temporary Dual FINRA-NYSE Rule 409T (Statements of Accounts to Customers) and Temporary Dual FINRA-NYSE Rule Interpretation 409T, which will be deleted as a result of amended Rule 2231. These changes become effective on January 1, 2024.

FINRA Regulatory Notice 23-02 (January 18, 2023): FINRA Amends FINRA Rule 2231

Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

The Commission is adopting new rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incidents by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934. Specifically, we are adopting amendments to require current disclosure about material cybersecurity incidents. We are also adopting rules requiring periodic disclosures about a registrant’s processes to assess, identify, and manage material cybersecurity risks, management’s role in assessing and managing material cybersecurity risks, and the board of directors’ oversight of cybersecurity risks. Lastly, the final rules require the cybersecurity disclosures to be presented in Inline eXtensible Business Reporting Language (“Inline XBRL”).

The amendments became effective September 5, 2023.

• SEC Release No. 33-11216; 34-97989; File No. S7-09-22 (July 26, 2023): Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

Ransomware

FINRA has received reports about increasing numbers and sophistication of ransomware incidents. Ransomware typically involves bad actors gaining unauthorized access to firm systems and encrypting or otherwise accessing sensitive firm data or customer information, then holding that hijacked data for ransom. Some ransomware attacks have become significant threats that include theft of data and bad actors’ ongoing network access.

Ransomware attacks have proliferated due to, in part, increased use of technology and continued adoption of cryptocurrencies, which bad actors use to hide their identities when collecting ransom payments. Further, Ransomware-as-a-Service (RaaS) models, where bad actors purchase attack services on the dark web,1 have helped execute attacks on a much larger scale and make attacks available to less technologically savvy bad actors.

Rule 30 of the U.S. Securities and Exchange Commission’s (SEC) Regulation S-P requires firms to have written policies and procedures that are reasonably designed to safeguard customer records and information. FINRA Rule 4370 (Business Continuity Plans and Emergency Contact Information) also applies to ransomware attacks that include denials of service and other interruptions to members’ operations.

FINRA Regulatory Notice 22-29 (December 14, 2022): FINRA Alerts Firms to Ransomware Risks

FINRA Shares Practices for Obtaining Customers’ Trusted Contacts

Member firms are required to make reasonable efforts to obtain the name of and contact information for a trusted contact for a non-institutional customer’s account. This Notice summarizes member firms’ regulatory obligations, discusses the benefits of trusted contacts in administering customers’ accounts, highlights customer education resources and shares effective practices member firms use.

FINRA Regulatory Notice 22-31 (December 15, 2022): FINRA Shares Practices for Obtaining Customers’Trusted Contacts

(New) Amendments to Covered Agency Transaction Requirements under FINRA Rule 4210; Announcement of Effective Date

FINRA has amended the requirements relating to Covered Agency Transactions that FINRA originally adopted in 2016. Covered Agency Transactions include:
1. To Be Announced transactions, inclusive of adjustable-rate mortgage transactions
2. Specified Pool Transactions
3. Transactions in Collateralized Mortgage Obligations, issued in conformity with a program of an agency or Government-Sponsored Enterprise, with forward settlement dates, as recapped more fully in this Notice.

This Notice provides an overview of the amendments. The SEC approved the amendments on July 27, 2023. FINRA stated in its rule filing, and the SEC noted in approving the rule change, that the amendments would become effective between nine and ten months following the SEC’s approval. Consistent with this timeframe, the amendments become effective on May 22, 2024.

• FINRA Regulatory Notice: 23-14 (August 18, 2023): Amendments to Covered Agency Transaction Requirements under FINRA Rule 4210; Announcement of Effective Date

FINRA Reminds Members Of Their Obligation When Selling Private Placements

This Notice highlights a member’s obligation, when recommending a security, to conduct a reasonable investigation of the security. This duty has long been rooted in the antifraud provisions of the federal securities laws and is a core component of a broker-dealer’s obligations under SEC Regulation Best Interest (Reg BI) and FINRA Rule 2111 (Suitability), the fundamental standards that members must meet when recommending securities. This Notice also addresses certain additional obligations for members when selling private placements, including FINRA’s filing requirements and its communications with the public and supervision rules.

FINRA Regulatory Notice 23-08 (May 9, 2023): FINRA Reminds Members of Their Obligation When Selling Private Placements

MSRB Adopts Amendments to Rules G-12 and G-15, Shortening Regular-Way Settlement Transaction to T+1

On May 25, 2023, the Municipal Securities Rulemaking Board (MSRB) received approval from the SEC on May 25, 2023, to amend MSRB Rules G-12, on uniform practice, and G-15, on confirmation, clearance, settlement and other uniform practice requirements with respect to transactions with customers.

MSRB Rules G-12 and G-15, as amended, define regular-way settlement for municipal securities transactions as occurring one business day after the trade date (“T+1”) and make a technical amendment to Rule G-12 to update an outdated cross-reference. The amendments align with regular-way settlement on T+1 for equities and corporate bonds under Exchange Act Rule 15c6-1 (“Amended SEC Rule 15c6-1”) to further shorten the settlement process, requiring the settlement of most equity and corporate bond transactions on T+1.

The compliance date for the amendments is May 28, 2024, which aligns with the implementation date for Amended SEA Rule 15c6-1.

• MSRB Regulatory Notice 2023-06 (May 30, 2023): MSRB Adopts Amendments to Rules G-12 and G-15, Shortening Regular-Way Settlement for Municipal Securities Transactions to T+1

SEC Approves New MSRB Rule G-46 On Duties Of Solicitor Municipal Advisors And Related Amendments To MSRB Rule G-8

On March 29, 2023, the MSRB received approval from the SEC to create a new rule, MSRB Rule G-46, on duties of solicitor municipal advisors and amend MSRB Rule G-8, on books and records. New MSRB Rule G-46 is designed to establish the core standards of conduct for solicitor municipal advisors when engaging in solicitation activities that would require them to register with the SEC and the MSRB as municipal advisors. The related amendments to Rule G-8 establish recordkeeping requirements to facilitate and document compliance with the new obligations of Rule G-46.

The adoption of Rule G-46 and the related amendments to Rule G-8 furthers the MSRB’s mandate to protect municipal entities, obligated persons, investors, and the public interest. The compliance date for Rule G-46 and the related amendments to Rule G-8 is March 1, 2024.

MSRB Regulatory Notice 2023-03 (March 30, 2023): SEC Approves New MSRB Rule G-46 on Duties of Solicitor Municipal Advisors and Related Amendments to MSRB Rule G-8

FINRA Shares Effective Practices To Address Risks Of Fraudulent Transfers Of Accounts Through ACATS

To bring attention to a rising trend in the fraudulent transfer of customer accounts through the Automated Customer Account Transfer Service (ACATS), FINRA issued Regulatory Notice 22-21, which alerted member firms about how bad actors effect fraudulent transfers of customer assets using ACATS (referred to as ACATS fraud). That Notice listed several existing regulatory obligations that may apply in connection with ACATS fraud and provided contact information for reporting the fraud. FINRA’s regulatory programs—through examinations and investigations, review of customer complaints and member firm engagement—have identified increased instances of ACATS fraud. Through recent industry engagement, FINRA has gained further insights from member firms and other industry representatives about their approaches to detect and mitigate the risk of ACATS fraud. This Notice provides an overview of some indicators of ACATS fraud and the practices some firms apply to address it.

FINRA Regulatory Notice 23-06 (March 28, 2023): FINRA Shares Effective Practices to Address Risks of Fraudulent Transfers of Accounts Through ACATS

(New) Regulatory Extension (REX) System Update

The SEC has amended SEA Rule 15c6-1(a) to shorten the standard settlement cycle for most broker-dealer transactions from two business days after the trade date (T+2) to one business day after the trade date (T+1). To aid firms in preparing for this transition, FINRA is updating the Regulatory Extension (REX) system to enable firms to file extension of time requests under the shortened settlement cycle. Firms may file such requests beginning May 31, 2024, via the batch file process and by completing the online request form by logging into the REX system via FINRA Gateway. Further, FINRA is updating the REX Customer Test Environment to allow testing under various scenarios for both batch and online request form filings.

• FINRA Regulatory Notice 23-15 (September 5, 2023): Regulation T and SEA Rule 15c3-3 Extension of Time Requests Under a T+1 Settlement Cycle

FINRA Adopts Amendments to Require Reporting of Transactions in U.S. Dollar-Denominated Foreign Sovereign Debt Securities to TRACE

FINRA has adopted amendments to the Rule 6700 Series to require firms to report transactions in U.S. dollar-denominated foreign sovereign debt securities to TRACE. “Foreign sovereign debt security” is defined as a debt security that is issued or guaranteed by the government of a foreign country, any political subdivision of a foreign country or a supranational entity. Transaction reports in U.S. dollar-denominated foreign sovereign debt securities will not be subject to public dissemination.

Transactions in U.S. dollar-denominated foreign sovereign debt securities generally will be subject to a same-day reporting requirement. Specifically, reportable TRACE transactions in U.S. dollar-denominated foreign sovereign debt securities executed on a business day at or after 12:00 a.m. Eastern Time (ET) through 5:00 p.m. ET must be reported the same day during TRACE system hours. Transactions executed on a business day after 5:00 p.m. ET but before the TRACE system closes must be reported no later than the next business day (T+1) during TRACE system hours, and, if reported on T+1, designated “as/of” and include the date of execution. Firms that wish to report transactions in U.S. dollar-denominated foreign sovereign debt securities on an immediate basis may do so. These amendments became effective on November 6, 2023.

• FINRA Regulatory Notice 22-28 (December 13, 2022): TRACE Reporting of Foreign Sovereign Debt Securities

FINRA Adopts Enhancements to TRACE Reporting for U.S Treasury Securities

FINRA adopted amendments to Rule 6730 (Transaction Reporting) to: (i) require members to report transactions in U.S. Treasury securities to FINRA’s Trade Reporting and Compliance Engine (TRACE) as soon as practicable but no later than 60 minutes from the time of execution; and (ii) require members to report electronically executed transactions in U.S. Treasury securities to TRACE in the finest increment captured by the system used to execute the transaction, subject to an exception for members with limited trading volume in U.S. Treasury securities. FINRA is also revising its TRACE Frequently Asked Questions (FAQs) to standardize price reporting for Treasury bills and Floating Rate Notes (FRNs) by requiring all transactions to be reported using the dollar price. The amendments to reduce the trade reporting timeframe for transactions in U.S. Treasury securities will take effect on May 15, 2023. The amendments related to the granularity of execution timestamps, as well as the revisions to the TRACE FAQs to standardize price reporting, became effective on November 6, 2023.

• FINRA Regulatory Notice 22-27 (December 1, 2022): FINRA Adopts Enhancements to TRACE Reporting for U.S. Treasury Securities