Compliance Technology
Playing Catch-up in E-archiving | The High Cost of Best Execution | Pre-trade Compliance: Better, Cheaper, Faster | Iron Mountain: Toward a Paperless Office | Compliance Is Still People-Powered |
Playing Catch-up in E-archiving
Many firms still need IT boost to meet e-communications requirements
February 18, 2008
Changes to the U.S. Federal Rules of Civil Procedure (FRCP), requiring companies to have enterprisewide retention policies for all electronic communications, went into effect on Dec. 1, 2006. As the deadline approached, observers predicted a sea change in corporate attitudes toward e-communications archiving. The new rules will cause companies to "formalize and staff information management programs," said research firm Gartner in October 2006.
More than one year later, the revised FRCP--along with Securities and Exchange Commission rules and guidance from the Financial Industry Regulatory Authority (Finra)--are prodding financial services firms to develop comprehensive e-archiving policies, but many are not complying, experts say. Some firms are not fully aware of the requirements; others may be feeling cost pressures or have been lulled into complacency by their information technology team.
A lot of companies "think they are in compliance," says Matthew Smith, president and COO of Torrance, Calif.-based software provider LiveOffice Corp. Firms looked at Finra's guidance on the review and supervision of e-communications, issued Dec. 7, "and said, We need to back up our e-mail.' Then their IT person tells them [their system is] OK. But they need to save two copies, stored in Worm," or write once, read many, format. "Without that, you are out of compliance."
As firms get up to speed on regulatory and legal requirements, says Smith, they will be in the market for compliance technology, much of it from third-party service providers like LiveOffice. "Outsourcing is an insurance policy," he notes. Being out of compliance "makes everybody look bad."
Increased Oversight
Beyond the reputational risk, ineffective e-records management can be expensive. In December 2002, the SEC signaled a period of stricter oversight by fining five bulge-bracket firms a total of $8.25 million for failing to preserve e-mail communications as required by the agency's Rule 17a-4.
"The genesis for industry growth was the 2002 SEC clampdown," says Sean Hegarty, product manager for digital archives at Boston-based data storage company Iron Mountain. While expansion has since slowed, "there is still money to be made," asserts Hegarty.
"In many cases, vendors are helping to drive trends--they develop the technology as one or two examiners ask for it," says Stephen Marsh, CEO of Smarsh, a Portland, Ore.-based technology provider. "The regulations are not changing so much. What is changing are expectations about supervision. Technology is causing regulators to demand more from e-mail reviews. E-mails are expected to be turned over in a day's time."
Examiners are also looking for evidence that policies are being followed. "Finra examiners want proof that you are doing the supervision," he says. "It is not enough to have policies and procedures." As a result, technology providers are increasingly focused on audit trails, notes Marsh.
Solutions are also being developed for a broader range of e-communications. The new Finra guidelines extend well beyond e-mail, covering instant messaging, text messaging, Web-based e-mail and device-to-device messaging, which has spurred a new wave of archiving systems.
Also driving innovation are new policies designed to include everyone in the organization. "A lot of financial services firms only archived a small number of people," explains Smith of LiveOffice. "Now they need to archive everybody. If not, it has the appearance of destroying information."
