National Examination Risk Alert

National Examination Risk Alert

By the Office of Compliance Inspections and Examinations 1

In this Alert:

Volume II, Issue 1

Topic: Observations related to the use

of social media by registered

investment advisers.

Investment Adviser Use of Social

Media

Key Takeaways:

Investment advisers that use or permit

the use of social media by their

representatives, solicitors and/or third

parties should consider periodically

evaluating the effectiveness of their

compliance program as it relates to

social media. Factors that might be

considered include usage guidelines,

content standards, sufficient

monitoring, approval of content,

training, etc. Particular attention

should be paid to third party content

(if permitted) and recordkeeping

responsibilities.

January 4, 2012

I.

Introduction

Social media 2 is landscape-shifting. It converts the

traditional two-party, adviser-to-client communication into an

interactive, multi-party dialogue among advisers, clients, and

prospects, within an open architecture accessible to third-party

observers. It also converts a static medium, such as a website,

where viewers passively receive content, into a medium where

users actively create content.

The use of social media by the financial services industry

is rapidly accelerating. In growing numbers, registered

investment advisers (“RIAs” or “firms”) are using social media

to communicate with existing and potential clients, promote

services, educate investors and recruit new employees. Pursuant

to Advisers Act Rule 206(4)-7, 3 firms using social media should

adopt, and periodically review the effectiveness of, policies and

1

The Securities and Exchange Commission (“SEC”), as a matter of policy, disclaims responsibility

for any private publication or statement by any of its employees. The views expressed herein are

those of the staff of the Office of Compliance Inspections and Examinations, in coordination with

other SEC staff, including in the Division of Enforcement’s Asset Management Unit and the

Division of Investment Management, and do not necessarily reflect the views of the Commission or

the other staff members of the SEC. The staff of the Financial Industry Regulatory Authority

(“FINRA”) was also consulted in the preparation of this Risk Alert. This document was prepared by

the SEC staff and is not legal advice.

2

“Social media” is an umbrella term that encompasses various activities that integrate technology,

social interaction and content creation. Social media may use many technologies, including, but not

limited to, blogs, microblogs, wikis, photos and video sharing, podcasts, social networking, and

virtual worlds. The terms “social media,” “social media sites,” “sites” and “social networking sites”

are used interchangeably in this communication.

17 C.F.R. §206(4)-7.

3

1

procedures regarding social media in the face of rapidly changing technology. 4

Firms’ use of social media must comply with various provisions of the federal securities

laws, including, but not limited to, the antifraud provisions, 5 compliance provisions, 6 and

recordkeeping provisions. 7

RIAs’ use of social media has been a matter of interest to the staff, which recently identified

registered investment advisers of varying sizes and strategies that were using social media to

evaluate whether their use complied with the federal securities laws. 8 Below are some

observations from that review, as well as factors that the staff believes a firm that permits the use

of social media may want to consider in complying with its obligations under the federal

securities laws.

II.

Staff Observations

A.

Compliance Program Related to the Use of Social Media

Many firms have policies and procedures within their compliance programs that

specifically apply to the use of social media by the firm and its IARs; however, the staff

observed variation in the form and substance of the policies and procedures. The staff noted that

many firms have multiple overlapping procedures that apply to advertisements, client

communications or electronic communications generally, which may or may not specifically

include social media use. Such lack of specificity may cause confusion as to what procedures or

standards apply to social media use. Many procedures were also not specific as to which types

of social networking activity are permitted or prohibited by the firm and many did not address

the use of social media by solicitors.

4

5

6

7

8

This Alert is not intended as a comprehensive summary of all compliance matters pertaining to the

use of social media by RIAs. Rather, it discusses measures that may assist RIAs in designing

reasonable procedures designed to prevent violations of the Advisers Act and other federal securities

laws with respect to firm, investment advisory representative (“IAR”) and solicitor (employees or

third parties that solicit or “find” new advisory clients) use of social media.

See, e.g., Section 17(a) of the Securities Act of 1933 (“Securities Act”), 15 U.S.C. §77q(a), Section

10(b) of the Securities Exchange Act of 1934 (“Exchange Act”), 15 U.S.C. §78j(b), and Rule 10b-5

thereunder, 17 C.F.R. §240.10b-5, and Sections 206(1), 206(2), and 206(4) of the Advisers Act, 15

U.S.C. §§806-6(2), 806-6(4), and Rule 206(4)-1 thereunder, 17 C.F.R. §206(4)-1.

See, e.g., Section 206(4) of the Advisers Act, 15 U.S.C. § 806-6(4), and Rule 206(4)-7 thereunder,

17 C.F.R. §206(4)-7.

See, e.g., Section 204 of the Advisers Act, 15 U.S.C. § 804, and Rule 204(2) thereunder, 17 C.F.R.

§204(2).

To the extent that a firm provides both brokerage and investment advisory services (“dual

registrant”), it is required to adhere to both the federal securities laws and FINRA applicable rules,

including but not limited to, depending on the circumstances, Rule 17a-4(b) (recordkeeping) under

the Exchange Act, 17 C.F.R §240.17a-4(b), and NASD Rules 2210 and 3010. FINRA has issued

guidance regarding the application of the federal securities laws and its rules to the use of social

media by broker-dealers or their representatives. See FINRA Regulatory Notice 11-39 (Aug. 2011);

FINRA Regulatory Notice 10-06 (Jan. 2010).

2

When evaluating its controls and compliance program, a firm should first identify conflicts

and other compliance factors currently creating risk exposure for the firm and its clients in light

of the firm's particular operations, and then test whether its existing policies and procedures

effectively address those risks. 9

Below is a non-exhaustive list of factors 10 that an investment adviser 11 may want to consider

when evaluating the effectiveness of its compliance program with respect to firm, IAR or

solicitor use of social media:

•

Usage Guidelines. A firm may consider whether to create firm usage guidelines that

provide guidance to IARs and solicitors on the appropriate and inappropriate use of

social media. A firm may also consider addressing appropriate restrictions and

prohibitions regarding the use of social media sites based on the firm’s analysis of the

risk to the firm and its clients. For example, a firm may choose to provide an

exclusive list of approved social media networking sites for IARs’ use or prohibit the

use of specific functionalities on a site.

•

Content Standards. A firm may consider the risks that content created by the firm

or its IARs or solicitors implicates its fiduciary duty or other regulatory issues (e.g.,

such as content that contains investment recommendations, information on specific

investment services or investment performance). A firm may also consider whether

to articulate clear guidelines with respect to such content, and whether to prohibit

specific content or impose other content restrictions. 12

•

Monitoring. A firm may consider how to effectively monitor the firm’s social media

sites or firm use of third-party sites, taking into account that many third-party sites

may not provide complete access to a supervisor or compliance personnel.

•

Frequency of Monitoring. A firm may consider the frequency with which it

monitors IAR or solicitor activity on a social media site. For example, using a riskbased approach, a firm may conclude that periodic, daily or real-time monitoring of

the postings on a site is appropriate. This determination could depend on the volume

and pace of communications posted on a site or the nature of, and the probability to

9

10

11

12

See Rule 206(4)-7. See generally Compliance Programs of Investment Companies and Investment

Advisers, 68 FR 74714, 74716 (Dec. 24, 2003)(“Compliance Release”).

Firms are encouraged to consider the factors described herein in assessing the effectiveness of their

compliance program and implementing improvements that will best protect their clients. Firms are

cautioned that these factors and suggestions are neither exhaustive nor will they constitute a safe

harbor nor a “checklist” for SEC examiners. Other factors besides those highlighted here may also

be appropriate. While some of the factors discussed herein reflect existing regulatory requirements,

the adequacy of a compliance program can be determined only with reference to the profile of the

specific firm and the specific facts and circumstances.

Dual registrants may also want to consider these factors, although they do not modify or displace

firms’ obligations under the federal securities laws, FINRA or other rules relevant to social media, or

FINRA guidance in this area, as referenced in footnote 7 supra.

A majority of the advisers we observed prohibited the posting of recommendations or information on

specific products or services on their social media sites.

3

mislead contained in, the subject matter discussed in particular conversation streams.

The after-the fact review of violative content days after it was posted on a firm’s

social networking site, depending on the circumstances, may not be reasonable,

particularly where social media content can be rapidly and broadly disseminated to

investors and the markets.

•

Approval of Content. A firm may want to consider the appropriateness of preapproval requirements (as opposed to after-the-fact review, as discussed above). 13

•

Firm Resources. A firm may consider whether it has dedicated sufficient

compliance resources to adequately monitor IAR or solicitor activity on social media

sites, including the ability to monitor the activity of numerous IARs or solicitors. A

firm may also consider employing conversation monitoring or similar services from

outside vendors, if, for example, the firm has many IARs or solicitors who use social

media sites. A firm may consider using sampling, spot checking, or lexicon-based or

other search methodologies, or a combination of methodologies, to monitor social

media use and content. 14

•

Criteria for Approving Participation. In analyzing the risk exposure for a firm and

its clients due to the use of a social networking site, the firm’s compliance procedures

may consider, without limitation, the reputation of the site, the site’s privacy policy,

the ability to remove third-party posts, controls on anonymous posting and the

advertising practices of any social media site that the firm, or its IARs or solicitors

use to conduct business.

•

Training. In establishing or reviewing any training requirements for its IARs, a firm

may consider implementing training related to social media that seeks to promote

compliance and to prevent potential violations of the federal securities laws and the

firm’s internal policies.

•

Certification. A firm may consider whether to require a certification by IARs and

advisory solicitors confirming that those individuals understand and are complying

with the firm’s social media policies and procedures.

• Functionality. A firm may consider the functionality of each social media site

approved for use, including the continuing obligation to address any upgrades or

modifications to the functionality that affect the risk exposure for the firm or its

clients. Such consideration is particularly significant given the rapidly evolving

nature of this new media. For example, a firm that chooses to host social media on a

site that includes a functionality or engages in a practice that exposes a client-user’s

13

14

The pre-approval of postings on a social media site is presently only required for broker-dealers in

certain circumstances. See NASD Rule 2210.

While the firm may use third-party services for this purpose, the firm is ultimately responsible for its

IARs’ or solicitors’ use of social media.

4

privacy, which practice or policy cannot be disabled or modified, may need to

consider whether the firm’s participation is appropriate.

•

Personal/Professional Sites. A firm may consider whether to adopt policies and

procedures to address an IAR or solicitor conducting firm business on personal (nonbusiness) or third-party social media sites. For example, a firm may choose to specify

what types of firm communications or content are permitted on a site that is not

operated, supervised or sponsored by the firm. While a firm may determine that it is

appropriate to permit business card information on a specific personal site or thirdparty site, it may choose to prohibit conducting firm business on that site.

•

Information Security. A firm may consider whether permitting its IARs to have

access to social media sites poses any information security risks. Protecting

information and information systems from unauthorized access, use, disclosure,

disruption, modification, perusal, inspection, recording or destruction is an important

risk faced by all firms. Although hacking and other breaches of information security

can be posed in multiple ways, use of social media, especially third party social media

sites, may pose elevated risks. Firms may consider adopting compliance policies and

procedures to create appropriate firewalls between sensitive customer information, as

well as the firm’s own proprietary information, and any social media site to the extent

that the firm permits access to such sites by its IARs.

•

Enterprise Wide Sites. An RIA that is part of a larger financial services or other

corporate enterprise may consider whether to create usage guidelines reasonably

designed to prevent the advertising practices of a firm-wide social media site from

violations of the Advisers Act

B.

Third-Party Content

Most firms allow third parties to make postings on their social media sites, but the

policies and procedures governing such third-party postings vary in what types of postings are

permissible. Some firms allow third parties to post messages, forward links, and post articles on

the firms’ social media sites, while other firms have explicit policies limiting third-party use to

“one way postings,” where the firms’ IARs or solicitors post on the firms’ social media sites but

do not interact with third parties or respond to third-party postings. More conservatively, some

firms limit third-party postings to authorized users and prohibit postings by the general public.

Many firms post disclaimers directly on their site stating that they do not approve or endorse any

third-party communications posted on their site in an attempt to avoid having a third-party

posting attributed to the firm.

Firms that allow for third-party postings on their social media sites may consider having

policies and procedures concerning third-party postings, including the posting of testimonials

about the firm or its IARs as well as reasonable safeguards in place to avoid any violation of the

federal securities laws.

5

•

C.

Testimonials. Whether a third-party statement is a testimonial 15 depends upon all of

the facts and circumstances relating to the statement. The term “testimonial” is not

defined in Rule 206(4)-1(a)(1), but SEC staff consistently interprets that term to

include a statement of a client's experience with, or endorsement of, an investment

adviser. Therefore, the staff believes that, depending on the facts and circumstances,

the use of “social plug-ins” such as the “like” button could be a testimonial under the

Advisers Act. 16 Third-party use of the “like” feature on an investment adviser’s

social media site could be deemed to be a testimonial if it is an explicit or implicit

statement of a client's or clients' experience with an investment adviser or IAR. If, for

example, the public is invited to “like” an IAR’s biography posted on a social media

site, that election could be viewed as a type of testimonial prohibited by rule 206(4)1(a)(1).

Recordkeeping Responsibilities

The Advisers Act sets forth the recordkeeping obligations of registered investment

advisers. 17 The recordkeeping obligation does not differentiate between various media, including

paper and electronic communications, such as e-mails, instant messages and other Internet

communications that relate to the advisers’ recommendations or advice. RIAs that communicate

through social media must retain records of those communications if they contain information

that satisfies an investment adviser’s recordkeeping obligations under the Advisers Act. 18 In the

staff’s view the content of the communication is determinative. A firm that intends to

communicate, or permit its IARs to communicate, through social media sites may wish to

determine that it can retain all required records related to social media communications and make

them available for inspection.

Social media offers multiple ways to communicate with existing or potential clients from

status updates, discussion boards, emails, texting, direct messaging or chat rooms. RIAs should

consider reviewing their document retention policies to ensure that any required records

generated by social media communications are retained in compliance with the federal securities

laws, including in a manner that is easily accessible for a period not less than five years. RIAs

15

16

17

18

Rule 206(4)-1(a)(1) states that:

[i]t shall constitute a fraudulent, deceptive, or manipulative act, practice, or course of business …

for any investment adviser registered or required to be registered under [the Advisers Act], directly

or indirectly, to publish, circulate, or distribute any advertisement which refers, directly or

indirectly, to any testimonial of any kind concerning the investment adviser or concerning any

advice, analysis, report or other service rendered by such investment adviser.

Some social media sites do not permit an investment adviser to disable the “like” or similar feature,

which may require an investment adviser to develop a system to monitor and, if necessary, remove

third-party postings.

Rule 204-2 requires investment advisers to make certain books and records relating to their advisory

business (“required records”) and to keep them for a specified period of time. In addition, the rule

requires investment advisers that keep required records in an electronic format to keep them in a

manner that allows the records to be arranged and indexed. See Section 204 of the Advisers Act and

Rule 204-2 thereunder.

See Rule 204-2.

6

should consider whether their retention policies account for the volume of communication and

unique communication channels available to each particular social media site. Investment

advisers may consider adopting compliance policies and procedures that address (if relevant) the

following factors, among others, relating to the recordkeeping and production requirements of

required records generated by social media communications:

•

•

•

•

•

•

IV.

Determining, among other things, (1) whether each social media communication used

is a required record, and, if so, (2) the applicable retention period, and (3) the

accessibility of the records.

Maintaining social media communications in electronic or paper format (e.g., screen

print or pdf of social media page, if practicable).

Conducting employee training programs to educate advisory personnel about

recordkeeping provisions.

Arranging and indexing social media communications that are required records and

kept in an electronic format to promote easy location, access and retrieval of a

particular record.

Periodic test checking (using key word searches or otherwise) to ascertain whether

employees are complying with the compliance policies and procedures (e.g., whether

employees are improperly destroying required records).

Using third parties to keep records consistent with the recordkeeping requirements.

Conclusion

While many RIAs are eager to leverage social media to market and communicate with

existing clients, and to promote general visibility, RIAs should ensure that they are in

compliance with all of the regulatory requirements and be aware of the risks associated with

using various forms of social media. The staff hopes that sharing observations from its recent

review of RIAs’ use of social media as well as its suggestions regarding factors that firms may

wish to consider is helpful to firms in strengthening their compliance and risk management

programs. The staff also welcomes comments and suggestions about how the Commission’s

examination program can better fulfill its mission to promote compliance, prevent fraud, monitor

risk, and inform SEC policy. If you suspect or observe activity that may violate the federal

securities laws or otherwise operates to harm investors, please notify us at

http://www.sec.gov/complaint/info_tipscomplaint.shtml.

7