Tag Archives: SEC

How to hide LinkedIn Endorsements on the new LinkedIn profile design

Financial advisers now have two easy ways to hide LinkedIn Endorsements and reduce compliance risks.

Several weeks ago I raised concern over the new LinkedIn profile design, as there appeared to be no way to hide LinkedIn Endorsements from your public profile (see: New LinkedIn profiles raise compliance concerns as there appears to be no way to hide endorsements).

This was especially problematic for my audience of financial advisers, as FINRA and SEC regulations prohibit the use of information that can be construed as a testimonial.

Fortunately, LinkedIn’s new profile design now offers two options to hide endorsements from your public profile. Watch the 2:00 screencast below to see how it’s done.

(click to watch on YouTube)

New LinkedIn profiles raise compliance concerns as there appears to be no way to hide endorsements

LinkedIn rolled out its new Endorsements feature several months ago to all users. Since then, financial advisers have been worried about publicly displaying Endorsements on their profile, since they can be construed as testimonials which are strictly prohibited by FINRA and the SEC.

Fortunately, hiding Endorsements from one’s public profile is a fairly straightforward process (see: How to hide endorsements from your LinkedIn profile)

But now, LinkedIn is slowly rolling out redesigned profile pages worldwide that appears to remove the “Hide Endorsement” functionality.

Watch the screencast below to see a sample of the new profile design rolled out to one adviser’s account and how the “Hide Endorsement” button is missing.

I’ve reached out to LinkedIn for comment and have not yet received a reply. I’ll update this post accordingly.

(click here to watch on YouTube)

How to hide endorsements from your LinkedIn profile

Advisers must hide LinkedIn Endorsements to avoid compliance violations

Update 01/21/2013! LinkedIn is rolling out completely new profile designs to users, changing the way Endorsements are managed. Go read How to hide LinkedIn Endorsements on the new LinkedIn profile design now and watch the screencast reflecting the new changes.

As a financial adviser, you’re well aware that you can’t use client testimonials in any of your marketing materials. SEC and FINRA regulations prohibit the use of client testimonials (see: Adviser Use of LinkedIn May Violate SEC Rules).

LinkedIn’s latest feature called Endorsements, opens up another issue for financial advisers with LinkedIn profiles. Anyone can visit an adviser’s LinkedIn profile and endorse specific skills and expertise. Considering the broad language against client testimonials, allowing such endorsements should be avoided.

So how do you remove or disable Endorsements from showing up on your profile?

In the screencast below, I walk you though two ways you can prevent Endorsements from showing up on your public profile.

Watch the screencast now and hide any public endorsements on your own profile to avoid triggering compliance violations.

Bug Affects Dropbox Security: What Advisers Need To Know

Just last week I wrote a post addressing Dropbox and its use by financial advisers. It’s worth reading, but the summary is:

  • If you are regulated by FINRA, don’t use Dropbox (or any web-based service where you place client information) without the approval of your broker-dealer’s compliance department. Even after approval, document what your policies and procedures are to keep client information safe.
  • If you are regulated by the SEC or state as a registered investment adviser, document the steps you take to protect the security and confidentiality of customer information placed on web-based services such as Dropbox. You may optionally apply your own encryption to files saved in Dropbox to better protect them from unauthorized access.

So what happened over the weekend?

During system maintenance on Sunday, June 19, Dropbox introduced a bug into its authentication mechanism. Click here to read Dropbox’s explanation of the issue.

In summary, for a period of about four hours, correct passwords were not needed to log in and access Dropbox accounts. All that was required was a valid email address associated with an active account.

Make no mistake, this is a serious security issue.

Anyone who might have guessed an adviser’s email address (or even look it up on the adviser’s website) which happens to be used for a Dropbox account storing client files would have been able to access, view, download, et. al. those files without needing a valid password.

However, for advisers who encrypt or otherwise protect documents stored on Dropbox with access passwords, unauthorized access to the Dropbox account would not have yielded access to the contents of the files; only the file names would be visible (for password-protected documents).

The security lapse should never have happened, but it did. I said last week that adding an extra layer of security and/or encryption was optional. I feel I must be more specific in my recommendation of Dropbox.

If you choose to use Dropbox to store and share documents with client information, encrypt and/or password protect those documents prior to placing them in Dropbox.

Yes, this extra security makes sharing documents a bit more convoluted, as clients with whom you share files must remember the password required to access documents. But consider the alternative without the use of the extra layer of security in Sunday’s scenario.

And really, you shouldn’t have to apply your own security, but Dropbox isn’t touting their service for the enterprise market or regulated industries like financial services. They’re first and foremost a company providing a product for consumers. Should you choose to use Dropbox for client documents, take the necessary steps to better protect client information from unauthorized access.

Also, consider alternatives to Dropbox such as SugarSync, Carbonite, Egnyte, Wuala, and more. They’re worth investigating and performing your own due diligence.

Dropbox for Financial Advisers: Is it Safe? Secure?

Update 6/21/2011: A bug affected Dropbox’s password authentication mechanism on June 19. Read my follow up post on what advisers need to know about the compromised security.

Financial advisers want to know: is Dropbox, the simple and convenient file storage service, safe and secure? The answer to that question may not be so clear.

Is Dropbox safe and secure?

Can I store and share client documents on Dropbox?

I get asked these questions about Dropbox, a simple and convenient file storage service based in the cloud, quite often at conferences and while consulting with financial advisers.

I’ve discussed Dropbox several times on FPPad (see The iPad for Financial Advisers and Wealth Managers, A Real Life Example of Productivity Tips in Action, and Dropbox Featured in Forbes; Tools Should “Just Work”), but have not specifically addressed security characteristics of the service as they apply to financial advisers and registered representatives.

Frankly, Dropbox’s security attributes of have been a moving target as of late. That’s not necessarily a bad thing for the wildly-popular service, used by more than 25 million people, but it is important that advisers take a close look at how Dropbox communicates regarding its security.

Is It Secure?

I won’t rehash the details of recent controversy over Dropbox’s changes to its statements on security here, but I do want to direct you to a resource that I feel fairly addresses the situation.

Over at TechRepublic, IT consultant Michael Kassner posted an interview with ChenLi Wang of Dropbox’s Business Operations. Read Kassner’s post to gain perspective on Dropbox’s changes to its security statements and how they apply to its users. Click the link below to read it first, then come back and continue reading this post.

TechRepublic: Dropbox: Convenient? Absolutely, but is it secure?

Security Discussion

Flickr: Grey Wind

Now that you have some background on the issue, let’s address security from the financial adviser’s perspective.

Without question, financial advisers collect and maintain personally identifiable information (PII) on clients in order to deliver financial advisory services. Both FINRA and the SEC have requirements in place that FINRA member firms and registered advisers must follow. SEC Regulation S-P, Privacy of Consumer Financial Information, is the primary rule by which advisers must abide to address the protection of client information and records.

With respect to Dropbox, what must advisers do to abide by the requirements?

If you operate under FINRA, you must first ask your broker-dealer’s compliance department what your options are when considering the use of cloud-based applications, including Dropbox. It’s likely your broker-dealer has performed due diligence on a select number of providers which likely include vendors of cloud-based CRM, portfolio management software, financial planning, and document management applications.

Empirically, some broker-dealers have approved the use of services like Dropbox for their registered representatives, while others prohibit its use. So I cannot provide specific guidance for those of you affiliated with a broker-dealer; check with them first.

If you are an SEC or state-registered investment adviser, you must have written policies and procedures in place that address the steps you follow to protect client information. If you elect to use Dropbox, document the steps you take that are designed to (taken directly from Reg S-P):

(i) insure the security and confidentiality of customer records and information;

(ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information; and

(iii) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

From Kassner’s post highlighted earlier, Dropbox acknowledges that, in “rare circumstances,” a “small number of employees” are able to access user data according to the provisions in Dropbox’s privacy policy (e.g., when legally required to do so). Aside from the rare circumstances, Dropbox’s Wang went on to say:

We have strict policy and technical access controls that prohibit employee access except in these rare circumstances. In addition, we employ a number of physical and electronic security measures to protect user information from unauthorized access.

So let me challenge you, the adviser, with this question: What steps do you have in place to insure the security of client information stored on other web-based services? Have you performed similar due diligence on your CRM provider, online financial planning software, or even your online e-newsletter service? If you feel those services adequately protect the security of client information, how does that align with your confidence in Dropbox’s ability to provide similar protection?

Encryption

Before concluding this post, let’s briefly address the option of using additional encryption. To better protect client information, records can be encrypted using third-party applications before they’re transferred to web-based services like Dropbox (though I know of no methods advisers can use to encrypt client data stored in, say, web-based CRM. Does that make it more vulnerable?).

Remember, Dropbox stated, “all files stored on Dropbox servers are encrypted (AES 256).” Is it necessary to add yet another layer of encryption to files stored on Dropbox? Perhaps. If additional encryption is applied to documents stored on Dropbox, even if the “small number” of Dropbox employees access files legally under “rare circumstances,” all they will see are encrypted files with no meaningful data.

So, yes, the use of third-party encryption such as TrueCrypt, SecretSync, and others mentioned in Kassner’s post, does add an additional layer of obfuscation to protect against information access by Dropbox employees. But does that mean it is required to comply with regulatory requirements?

I believe the answer is no.

Files are already stored encrypted on Dropbox. There’s a reasonable expectation that the files will remain protected from unauthorized access. Assuming select Dropbox employees do access stored files, citing the legal requirement to do so, that access is likely to be authorized, as it is in response to a request from law enforcement. If this were to happen to you, you probably would have more to be concerned about than Dropbox decrypting your files and providing them to law enforcement.

Best Practices

Let me close with what I believe to be best practices for the use of cloud-based storage services, including Dropbox.

If you’re a FINRA member, check with your broker-dealer’s compliance department before using any web-based service. Obtain approval before storing any client information on such services. Also, document your policies and procedures regarding the steps you take to protect client data when using web-based applications.

If you’re an independent registered investment adviser, document the policies and procedures you employ to protect client data when using any web-based service. For added protection, you may optionally apply third-party encryption where applicable, but I believe it is not a requirement to comply with SEC Regulation S-P rules.

Do you have practical information with respect to these best practices? Perhaps your broker-dealer has raised issues on web-based services that are not included here. Please leave comments and feedback below to help clarify what advisers need to do to protect client data stored in cloud-based services.

 

Full Disclosure: I use Dropbox every day; it significantly simplifies my life. I store both personal and company files on the service. However, I am neither SEC or state-registered nor am I a FINRA member.

For those files that contain private or sensitive information, like social security numbers and bank account numbers, I add individual file password protection. All of these files are in PDF format, so I use Adobe Acrobat to encrypt all document contents with 256-bit AES and require a password to open the document.

Even Adobe PDF document passwords are not a 100% guarantee against unauthorized access. No password-based security system is. But with a combination of mixed case, numbers, and punctuation, the time required to apply a brute-force attack to crack the password may deter unauthorized users from an attempt, and instead seek out more vulnerable targets for an attack. I feel that this level of protection is adequate for my personal situation and acknowledge that the benefits of using web-based services like Dropbox are compelling enough to accept the risk trade-off. Your situation may dictate different considerations.

 

BrightScope Launches Advisor Pages™, Aggregates SEC/FINRA Sources to Improve Adviser Search

BrightScopeOne innovative company is attempting to change the way consumers search for financial advisers.

BrightScope, the San Diego, Calif.-based provider of independent investment research and financial data, today announced the release of BrightScope Advisor Pages™.

Click here to read the press release at MarketWire.com

Changing Search

In the past, consumers searching for financial advisers faced an uphill battle of gathering information from multiple disparate sources, including information publicly available from the Securities and Exchange Commission and the Financial Industry Regulatory Authority.

Often, consumers likely turned to search engines like Google and Bing to enter queries for advisers in their city, but the results offered no way to compare the basic information of one adviser to another.

Enter BrightScope Advisor Pages, where much of the public data is aggregated into one searchable database that supports filters to narrow search results. Adviser profiles include firm affiliation, contact information, registration type (Registered Representative of a Broker-Dealer, Registered Investment Adviser, or dually registered), and assets under management in addition to other information.

Adviser Search Legacy

Websites to search for financial advisers are not new. Roughly two years ago, a trio of sites were launched that provided a searchable database of financial professionals, including EvaluateMyAdvisor.com, FABeetle, and financeanswers.com. None of these sites are active today (hence the absence of hyperlinks). While we do not know the specifics of these sites’ reasons to shut down, we suspect that the controversial feature of allowing visitors to post ratings and reviews of advisers led to tricky compliance issues.

As many advisers subscribe to our blog, we recommend that you visit Advisor Pages and search for your own profile. If any data is incorrect, use the “Claim Your Profile” link to create a free account and contact BrightScope staff to correct the discrepancies.

 

What Advisers Can Expect on Examination Requests from the SEC

Steelbridge Compliance, a compliance consulting firm to investment advisers based in Dallas, Tex. (located just a mile from FPPad world headquarters), yesterday released a copy of a recent examination request list from the SEC.

The request document is 28 pages and covers much of the standard areas for inspection including trading history, itemized lists of all client accounts, and two years of all email history.

Notably absent from the February 2011 document is a request for the adviser’s use of social media, including Facebook, Twitter, and LinkedIn.

Click here to visit the Steelbridge Compliance blog and download the notice.

Independent Broker/Dealers Warming Up To Social Media

Like it or not, social media in financial services has been a recurring topic in the industry this year. The big question for FINRA-regulated registered representatives and SEC-regulated investment advisers is how to engage in social media activities without violating compliance rules (even after FINRA released its guidance on using social networking websites).

In the first significant step in the broker/dealer environment, Cambridge Investment Research announced that it plans to support their representatives’ use of social media by adopting compliance and monitoring software from Socialware.

Click here to read the announcement from Financial Planning Magazine online.

FPPad subscribers have read about Austin, Tx. based Socialware before and their tools that help advisers and representatives satisfy compliance requirements when using social media websites.

The fact that Cambridge is stepping up to the plate and giving the tentative green light to its reps means more and more financial professionals will be able to manage social media profiles to engage in conversations with clients and prospects.

Upcoming Financial Adviser Webcast Series: Guide to Going Digital

I joined a fantastic team at Revenue Architects to deliver a series of financial adviser webcasts to help advisers accelerate their online presence.

Revenue Architects is an expert network of independent marketing, sales, and technology professionals aligned to support the diverse needs for adviser revenue performance. All the details of Revenue Architects can be viewed on their website, http://www.revenuearchitects.com/

I’m presenting the Guide to Going Digital webcast with John Stone, CEO of Revenue Architects, on Tuesday, June 08, 2010 from 4:00 PM – 6:00 PM (ET). The webcast details can be viewed here: http://www.revenuearchitects.com/events-and-webcasts/

FPPad readers are eligible for a 10% discount off the webcast registration. Enter the code FPPadDigital to receive your discount. The code is valid for all four of the events in the Financial Adviser Webcast series.

I hope you consider joining the webcast if you’re serious about growing your presence in the rapidly evolving digital world.