SEC announces Event and Emerging Risks Examination Team

On July 28, the Securities and Exchange Commission (SEC) announced the creation of the Event and Emerging Risks Examination Team (EERT) in the Office of Compliance Inspections and Examinations (OCIE).  The EERT will engage proactively with financial firms regarding current market events and emerging threats, mobilizing rapidly to provide expertise and resources to SEC regional offices as needed to help address critical matters.

The EERT will focus on implementing exam priorities identified by OCIE, which is responsible for examining registered broker-dealers, investment advisers, investment companies, self-regulatory organizations such as FINRA, transfer agents and others.  Using a risk-based approach to effectively allocate resources, OCIE works to promote compliance with securities laws and regulations, prevent fraud, monitor risk and inform regulatory policy.

Collaborating with OCIE’s exam staff, the EERT will help ensure, through examinations, engagement and monitoring, that firms are better prepared to address threats, incidents and emerging risks requiring immediate action.  The EERT will also work with OCIE staff to provide expertise and support when significant market events occur that could have a systemic impact or place investor assets at risk, including exchange outages, liquidity events and cybersecurity or operational resiliency concerns.

Adam Storch, formerly a Senior Advisor to the Director of OCIE focusing on risk, strategy and innovation, and prior to that Managing Executive and Chief Operating Officer of the SEC’s Division of Enforcement, will head the EERT, overseeing a team of specialized examiners, industry experts, accountants and quantitative analysts. 

Noting that recent events have demonstrated that market and operational risks can emerge suddenly, SEC Chairman Jay Clayton said that the SEC should be working to increase its ability to react to them, “bringing our various resources to bear to these situations."  According to OCIE Director Peter Driscoll, the EERT will assist OCIE in fulfilling its mission, including protecting clients and customers of financial firms, and enhance OCIE’s ability to effectively respond to exigent threats and incidents in the markets.

What’s next

Based on OCIE’s announced 2020 examination priorities (see our earlier alert) and statements by the SEC about current market events, operational risks and emerging threats, we anticipate that EERT will focus on at least the following areas:

• Information technology infrastructure and cybersecurity risks:  OCIE will likely assess how financial firms have adapted to the remote working environment precipitated by COVID-19 to minimize the risk of and address, as the SEC has previously described them, “threats through cyber intrusion, denial of service attacks, misuse by insiders and other cyber misconduct.”  OCIE also recently issued an alert on ransomware attacks.  We anticipate a great deal of focus on these issues both within firms and in their relationships with outside vendors.
• Regulation systems compliance and integrity (SCI):  Regulation SCI requires national securities exchanges, registered and certain exempt clearing agencies, FINRA, MSRB, plan processors and certain alternative trading systems to develop and enforce policies and procedures reasonably designed to ensure that their systems have adequate levels of capacity, integrity, resiliency, availability and security to maintain operational capability and promote the maintenance of fair and orderly markets.  This includes the ability to implement appropriate corrective measures to respond to certain events and to notify the SEC of their occurrence.  We expect that EERT will assess whether those subject to SCI have adopted and implemented appropriate policies and procedures sufficient to reasonably respond to current market events and emerging markets.
• Business continuity planning:  OCIE has previously examined and reported on business continuity and disaster recovery plans of investment advisers in response to Hurricane Sandy.  Since then, the SEC has (i) proposed Advisers Act Rule 206(4)-4, which would require investment advisers to adopt and implement a written business continuity and transition plan and review that annually, and (ii) issued guidance to registered investment companies regarding the importance of business continuity planning as part of their compliance obligations under the Investment Company Act.  Broker-dealers are also required to create, maintain and regularly review business continuity plans under FINRA Rule 4370.  In response to COVID-19, as reported by Chairman Clayton, OCIE supplemented its examinations with hundreds of outreach calls to regulated entities nationwide to discuss operational resiliency and business continuity planning.  We expect EERT to assess what steps regulated firms have undertaken to provide reasonable assurance that they can continue to operate during potential business continuity events such as COVID-19, natural disasters and cyberattacks.

If you have any questions regarding the matters discussed in this Alert, including OCIE, the EERT or the SEC’s examination program generally, please contact one of the authors or a member of the DLA Piper Financial Services team.