V (and T) Day: A Loving Reminder About Testing and Verification

Lovers out there: it’s that time of year. Those of you with partners or others (whether actual or potential), in accordance with the rules established by the United Capitalists of America, will soon be boosting the profits of chocolatiers, florists and card sellers (or even teddy bear and lingere shops). No getting around it. Even though all year long you periodically and randomly shower the people you love with love—on their birthdays, your anniversaries, gifty holidays like X-Mas and, if you’re really romantic, Super Bowl victories—you are REQUIRED to once more proclaim your affection, adoration, addiction and love. You have a deadline and it approaches. Get to work. V-Day is here.
 
Compliance lovers out there: it’s that time of year. A similar scenario is at hand for you. T&V (Testing and Verification) Day approaches. NASD Rule 3012(a)(1) says you have to:
designate and specifically identify to NASD one or more principals who shall establish, maintain, and enforce a system of supervisory control policies and procedures that (A) test and verify that the member's supervisory procedures are reasonably designed with respect to the activities of the member and its registered representatives and associated persons, to achieve compliance with applicable securities laws and regulations, and with applicable NASD rules and (B) create additional or amend supervisory procedures where the need is identified by such testing and verification. The designated principal or principals must submit to the member's senior management no less than annually, a report detailing each member's system of supervisory controls, the summary of the test results and significant identified exceptions, and any additional or amended supervisory procedures created in response to the test results.
 
The due date is not universal, but it is a 12-month anniversary date, not a floating or calendar day. And even if you feel like you tested and verified all year long while meeting your routine compliance obligations (C/E needs analysis process, AML independent testing, regular business activity reviews, producing manager oversight, BCP annual review, WSP updates, office inspections, etc.), you still have to engage in this ritual. ...Even though, for most folks reading this, your firm is tiny by FINRA standards and your oversight is automatic, given the involvement of senior management/owners. Hard to imagine you don’t know exactly where you stand right now, in terms of maintaining and enforcing your supervisory system. This is not unlike your personal obligation to buy a Valentine’s Day card: seemingly redundant and forced, yet entirely necessary.
 
So get it to it.
 
Look at the date of last year’s “3012 Report” or “3012/3130 Combined Report” and make sure you do some (more) testing and verifying and then summarize your process and findings in a written report, dated no later than the anniversary of last year’s report. Remember to present the report to the Top Business Officer for signature and don’t forget the accompanying 3130 Certification… the document that says almost nothing and spreads no liability to senior management, even though it was supposed to do that. Oh, and if you are the sole principal or one of very few, the sole senior manager, and the only top business officer, don’t be embarrassed by all this self analysis, internal dialogue and correspondence with yourself… T&V Day is a day to celebrate the relationship you have with yourself: loneliness be gone, thanks to 3012 and 3130.
 
Tools to use when testing and verifying: what you want is some sort of list, preferably not the entire NASD/FINRA Rulebook. Your list should name topic areas that apply to your firm.
 
What you’ll do is, on a risk-basis, choose some of these areas to ‘test.’ You want to see if your procedures on that topic are up to date and reflect what your firm really expects; and you’ll want to take a look at your records to see if personnel are complying with the procedures. Don’t test every area of compliance every year! It’s not necessary. Remember to choose areas based on factors like: What went wrong last year? What does FINRA care about these days? What is most likely to be misunderstood and screwed up? Which areas of non-compliance pose a big risk to customers? What is new and hasn’t been tested yet? What areas have already been tested, thanks to all the other rules (c/e, AML, office inspections)? Note on the list which areas you tested (good old-fashioned circles will do), and record notes on your results: “Okay”/”have to update”/”remind reps about this”/”not doing—send memo”…that sort of thing. If you want to get more technical, please do. FINRA won’t mind.
 
THE LIST: Maybe you used to use FINRA’s “3010 Checklist” but that thing is too old and unreliable (not updated for consolidation changes and new rules/guidance). I suggest you use the Table of Contents from your WSP. Makes sense, right? Add to it stuff that should be reviewed every year, like any results from regulatory exams, new complaints/arbitrations, internal investigations, new product areas, and ‘hot topics’ and, wa-la, you’re ready to go.  For hot topics, take a look at FINRA’s January 2012 Regulatory and Examination Priorities letter…that will inform you about what FINRA cares about.
 
After you write your report and share it and get signatures and have the CEO sign the Certification, put everything in a drawer. Don’t send it anywhere: this is NOT related to your 3012 producing manager oversight and ‘limited size and resources exception’ on CRD. There is NO exception from the T/V Rule—sorry. But there is leeway. Do what seems reasonable for your firm, while meeting the letter of the Rule.
 
After reading all this, being forced into a Hallmark store doesn’t sound so bad, does it? Once again my blog proves useful to humanity. Now you can stop being cynical about V.D. Rule 2.14 and rejoice in how easy that compliance is compared to the other kind. Go get’em, Tiger.

Hi Sharon: Some excellent

Hi Sharon:

Some excellent comments in your blog on 3012. I particularly liked your statement that the 3130 certification says almost nothing and does not spread any liability to senior management. Some of the CEOs we at Integrated Management Resources deal with have been signing these certifications for years and have no idea what they are -- despite our year-in and year-out explanations. As you know, the idea was that top management could no longer claim "I wasn't told" about compliance problems at the firm, but alas -- it just doesn't work.
Your step-by-step instructions on dealing with 3012/3130 are very helpful. Thanks for sharing!
Christine LaBastille

Post new comment

The content of this field is kept private and will not be shown publicly.
CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.