FINRA reports that there has been a steady increase in the number of incidents in which criminals attempt to scam broker-dealers and their clients.
FINRA says that one way crooks do this is that they target a legitimate broker-dealer by building a website that looks very similar to that of the broker-dealer’s or a registered representative’s site. They will then capture information the customer enters into that site and use it to defraud the investor.
FINRA has also reported that it has seen an increase in the number of instances in which a fraudster poses as a customer requesting funds from his or her account. In a typical example, the criminal will obtain information about the customer’s email account by hacking into the email. Then the criminal sends an email to the broker-dealer requesting that it wire funds to an account overseas, often urgently and often stating that he/she won’t be available for the next 8 hours because he/she is boarding an international flight. This is in hopes that the broker-dealer does not call to verify the transfer. And once these funds are wired, they are almost never recovered. Thieves sometimes also do this with requests for checks to be issued on the customer’s account.
Broker-dealers should ensure that their internal control procedures related to customer requests for funds are effective. Many broker-dealers require a telephone conversation with a customer for disbursement requests over a certain amount that are not being sent to the address of record. Further, during these conversations, customers are required to provide identifying information. To prevent change of address scams where a crook asks to change the address and then requests a check, FINRA requires that broker-dealers take certain steps to ensure there are adequate controls around customer address change requests. Firms must sent notice of any change of address to the customer at the old address (and to the registered representative) on or before the 30th day after the date the firm received the notice of the change. Those requirements can be found in SEC Rule 17a-3(a)(17)(i)(B)(3) or just click here.
FINRA recommends that broker-dealers, “Immediately contact the SEC and FINRA” and “Report to the FBI” in the event that they believe that their professional identity is being employed in a scam. If your firm has been a victim of such an attack, visit FINRA’s page on Customer Information Protection for a checklist of steps to take.
If you have questions about internal financial controls, Mitch Atkins, FINRA’s former South Region Director has extensive experience in this area. Call Mitch Atkins, Principal at FirstMark Regulatory Solutions, at 561-948-6511.
In discussing FINRA rules, one would be remiss to omit a discussion one of the simplest, yet most powerful rules in FINRA’s book – 
One of the more controversial aspects of the requirements can be found in Rule 4530(b). This is the section which requires reporting when a broker-dealer, “has reasonably concluded or reasonably should have concluded that an associated person of the member or the member itself has violated any securities-, insurance-, commodities-, financial- or investment-related laws, rules, regulations or standards of conduct of any domestic or foreign regulatory body or self-regulatory organization.” FINRA has said in the supplementary material to the rule that it only expects reporting of conduct that has “widespread or potential widespread impact” to the broker-dealer, its customers or the markets. It also requires reporting of conduct that arises from, “a material failure of the member’s systems, policies, or practices involving numerous customers, multiple errors or significant dollar amounts.” And for purposes of this reporting requirement, FINRA has stated that the rule applies only to situations where the member has “concluded or reasonably should have concluded on its own that violative conduct has occurred.” In other words, the requirement of paragraph (b) of the rule does not apply to findings by external bodies. Again, the full requirement can be viewed 
FINRA Rule 3240
The holding of customer mail is generally frowned upon by regulators in the securities industry. This is because there have been many instances in which fraud and theft of customer funds has occurred and the perpetrator was able to prevent (or delay) the client’s discovery of the situation. In many instances where a theft of client funds has occurred, the perpetrator found a way to suppress the client’s statements of account. These statements are generally sent by a separate clearing broker or by the clearing unit of a brokerage firm. Having this statement redirected to the perpetrator’s office is one way to suppress it, and potentially alter it.
Rule 8210 states that FINRA may request information from persons associated with broker-dealers in connection with an examination. This permits FINRA to require testimony from its associated persons and to compel the production of documents and other information. FINRA is permitted by Rule 8210 to serve an 8210 request on the last address reported to the CRD system, so it is important for representatives to keep their CRD address updated. The Rule permits FINRA broad authority to request information, including information that may be considered “personal” in nature such as cellular telephone bills, tax returns and personal bank statements. This is because these items may contain information necessary to complete an investigation.
FINRA recently held its South Region Compliance Seminar in Fort Lauderdale, Florida. One of the panels at the conference was titled, Branch Office Supervision. There were no surprises from this panel – branch supervision is a critical aspect of any supervisory system. And with the updates to FINRA’s Supervision Rule taking effect December 1, 2014, now is a good time to be discussing branch office supervision. What was clear from this discussion is that FINRA is moving more and more to a risk-based approach to supervising branch offices.
