Policy Patty Newsletter - September 2023

September 30, 2023

Here is a compilation of critical headlines I covered in September 2023. Click on the headline to access the full article/blog.

Just so you know, this newsletter does not include all relevant developments that may impact your organization's governance, risk, and compliance controls. It is provided for informational purposes only and does not offer legal, accounting, or tax advice.

POLICY PATTY POSTS

• Plug Power Settles for Financial and Accounting Failures - The SEC settled an action with Plug Power to pay a $1.25 million civil fine to settle charges over financial reporting, accounting, and control failures that required a multi-year restatement. The SEC said Plug Power could face another $5 million fine if it fails to fully address a material weakness in its internal controls over financial reporting and ineffective disclosure controls.
• FTC Settles with Another EdTech Provider for COPPA Failures - The FTC announced its settlement order against Edmodo Inc. for violations of the Children's Online Privacy Protection Act (COPPA) Rule and Section 5 of the Federal Trade Commission Act (FTC Act).
• SEC Settles Charges with Prime Group For Disclosure Failures - The SEC settled charges against Prime Group for failing to adequately disclose millions of dollars in real estate brokerage fees paid to a firm owned by its CEO.
• Sample SEC Letter to Companies Regarding Their XBRL Disclosures - The SEC recently published a reminder on improving the details of the XBRL "tags" used in securities filings to avoid receiving a request from SEC staff asking for an explanation on why these filings aren't meeting expectations. The reminder includes a sample comment letter about inadequate XBRL filings.
• Summary of CFTC Commissioner Romer's Speech- NASAA Annual Meeting - A summary of CFTC Chair CFTC Commissioner Christy Goldsmith Romero's speech at NASAA's Annual Meeting – September 11, 2023. With the US at the cusp of some technological advances, which can also be challenging, Romero wanted to share her views on one of the best ways to modernize investor protection: for regulators to keep pace with technology.
• Fed Takes Action against Kansas Bank for various deficiencies - The Federal Reserve Bank announced a cease and desist order (the "order") against Gardner Bancshares, a Kansas bank holding company. The order follows an October 2022 examination and requires the company and its $100 million-asset Small Business Bank (collectively, "the Bank") to address staffing, internal controls, credit risk management, and information security issues.
• SEC Charges Nine Firms with Marketing Rule Violations - The SEC just announced the results of its sweep of investment advisers - finding they advertised hypothetical performance to mass audiences on their websites without the requisite policies and procedures. Nine registered investment advisers were charged and ordered to pay $850,000 combined.
• Verizon Settles With DOJ on Alleged Cybersecurity Lapses - The Department of Justice (DOJ) reached a $4.1 million settlement with Verizon Business Network Services to resolve False Claims Act allegations of failing to satisfy government contract cybersecurity controls. The DOJ noted alleged cybersecurity control failures required in internet connection and other external network contracts.
• DFS Updates NY's Efforts on Virtual Currency Oversight (policypatty.com) - New York State Department of Financial Services (DFS) Superintendent Adrienne A. Harris provided an update on an ongoing initiative to strengthen DFS oversight of virtual currencies.

• New York Provides Updated Guidance on Virtual Currency - The New York State Department of Financial Services published "guidance" for the US digital asset industry following an earlier statement from NYDFS Superintendent Adrienne A. Harris explaining her goal of prioritizing regulations for "virtual currency policy" to keep pace with digital asset innovation (see my post - bit.ly/46f1tIg).
• FBI and CISA Release Advisory on Snatch Ransomware | CISA - Check out the joint advisory from the FBI and CISA??#StopRansomware: Snatch Ransomware. The advisory provides indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with the Snatch ransomware variant.

• SEC Settles Whistleblower Violations with CBRE - It may be time to look at your employee separation agreements and release forms in light of the SEC's growing focus on whistleblower actions. In the latest matter, the SEC announced its Order against CBRE, Inc., to settle charges against the commercial real estate services and investment firm for using an employee release form that the SEC alleged violated Exchange Act Rule 21F-17, the SEC's whistleblower protection rule.
• 3M settles with OFAC for Sanctions Violations - The US Treasury Department's Office of Foreign Assets Control (OFAC) settled with a 3M for actions involving a subsidiary's sale of materials to a sanctioned Iranian entity over two years in violation of OFAC sanctions. 3M reached a $9.6m settlement with OFAC for violating these US sanctions on Iran.
• NASAA Issues Reg BI Report and Findings - Phase II (B) - NASAA's Broker-Dealer Section Committee (the "Committee") issued a report that summarizes their latest review - Phase II (B) of its Coordinated National Regulation Best Interest Examination Initiative ("Phase II (B) Exam"). The Report reflects the Committee findings and serves as the sequel to two prior Regulation Best Interest ("Reg BI") exam initiatives conducted by the NASAA membership.
• Beneficial Ownership Information Reporting Deadline Extension for Reporting Companies Created or Registered in 2024
• Deutsche Bank Sub to Pay $25 Million for AML and ESG Violations - Recently, the SEC charged registered investment adviser DWS Investment Management Americas Inc. (DIMA or DWS), a Deutsche Bank subsidiary, in two separate enforcement actions. In my post, I highlight the two separate actions and provide Policy Patty's key takeaways on the policy failures. You'll note that most are ongoing, common issues involving policy management failures. Policies that are not appropriately designed and managed inadequately.
• SEC Charges 10 Firms with Widespread Recordkeeping Failures - Off-channel communications seem to be the gift that keeps giving to financial services regulators. My post covers the recent SEC action against several firms for widespread and longstanding failures to maintain and preserve electronic communications and summarizes regulatory activities and lessons learned.

REPORTS AND OTHER INFORMATION

I've included below a summary of reports and other developments that, while I did not cover in September, may be relevant to your operations.

• Federal Reserve Board - Agencies propose guidance to enhance resolution planning at large banks
• Cybersecurity Alert - FINRA Notifies Member Firms of Joint CISA & FBI Cybersecurity Advisory (AA23-242A) | - In this advisory, FINRA highlights a recent joint Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) Cybersecurity Advisory published on August 30, 2023, and updates as needed. Advisory complements efforts by the FBI and international partners to disrupt Qakbot on August 25, 2023, which included the seizure of over $8.6 million worth of crypto assets extorted from victims. Law enforcement agencies identified over 700,000 computers that may have been infected by Qakbot, one of the most active forms of ransomware in 2023. Threat actors typically deliver Qakbot via social engineering.
• Three FTC Enforcement Trends to Watch This Fall (afslaw.com)

• Insurance Industry: Mid-2023 Privacy and Data Security Updates | Publications | Insights | Faegre Drinker Biddle & Reath LLP
• Mintz Matrix | Mintz - State Data Security Breach Notification Laws - As data breaches dominate national headlines, it remains important for businesses to invest in security and be ready to respond if a breach occurs. Part of your preparedness program should be staying current on data breach legislation at the state level, and we are here to help with our "Mintz Matrix," a detailed survey of US state data breach notification laws. Click here to download a print version of the Mintz Matrix
• Securities Class Action Filings 2023 Year in Review (cornerstone.com) = The number of securities class action filings increased in the first half of 2023, according to a report released today by Cornerstone Research and the Stanford Law School Securities Class Action Clearinghouse.
• Penalty Offense Authority and the Future of FTC Privacy Law
• DPC Case Studies 2018-2023 - The DPC, the Irish supervisory authority for the General Data Protection Regulation (GDPR), has produced a booklet containing 126 of our case studies from the first five years of the GDPR.
• Goldman to Pay SEC $6 Million in Penalties for Providing Deficient Blue Sheet Data - Goldman agreed to pay a penalty of $6 million to the SEC's for not providing complete and accurate information in the blue sheets. Per SEC's findings, Goldman made more than 22,000 inadequate blue sheet submissions to it from 2012 to 2022, comprising 43 different types of errors that affected more than 163 million transactions.
• As David Simon notes, #NationalCybersecurityAwarenessMonth begins in just a few days, and the attached document presents a comprehensive compilation of events that Skadden's Global Cybersecurity and Data Privacy Practice has put together to cover cybersecurity.
• FINRA Cybersecurity Advisory - SEC Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (Exchange Act Release No. 97989) | FINRA.org
• Texas-based media company Clear Channel Outdoor Holdings Inc. agreed to pay the SEC $26.1 million to resolve FCPA violations for bribing Chinese officials to buy outdoor advertising in China. Read more in the administrative order.
• SEC Enforcement Actions Reflect Expansion of SEC's AML Compliance Focus | WilmerHale. The SEC's recent anti-money laundering (AML) enforcement actions reflect the continued expansion of the SEC's efforts to police AML compliance beyond the traditional charges against broker-dealers for failures to file suspicious activity reports (SARs).
• FinCEN Announces $15 Million Civil Money Penalty Against Shinhan Bank America for Violations of the Bank Secrecy Act - FinCEN announced a $15 million civil money penalty against Shinhan Bank America for willful violations of the Bank Secrecy Act (BSA) and its implementing regulations.

Special News:

AIMA Regulatory Horizon Scan

The industry is entering a challenging period of regulatory change. Regulators worldwide have been focused on adjusting their regimes and have been particularly active in proposing changes to the requirements applicable to fund managers. Most amendments are still pending. AIMA has created this new resource to help members understand the potential overlaps in compliance periods to assist them in planning.