Thursday, March 17, 2005

 

SEC Mandated Email Archiving for RIA HFs

R U Compliant?

By Terry Stanton, Managing Editor
Monday, January 24, 2005 3:18:31 PM ET

Under registration, hedge funds will have to archive all electronic communication, including instant messaging

It's the cute little message system that once was mostly the province of keyboard-chattering teenagers and preadolescents. A fast way to share fleeting thoughts and tidbits of information with family, friends and co-workers, it's efficient, it's ephemeral, but now, for hedge funds, it's official—an official medium of business communication, that is.

It's instant messaging, and now that hedge funds face the prospect of mandatory registration with the Securities and Exchange Commission as investment advisers, they need to face the fact that IM-generated communication can be a bona fide business record. And that means they need to ensure that they have a system in place to store instant messages in a way that satisfies the commission's requirement as spelled out in Rule 17a-4 under the Securities Exchange Act of 1934, among other legal mandates that go with registration.

One for the Archives

At many unregistered funds, and probably at some that have signed up with regulators, executives haven't given much thought to whether their procedures for electronic storage—if they have any formal protocol at all—live up to federal standards. What attention they have paid to the issue might deal only with email. With its automatic backup and storage features, email sorts and retains its own record on hard drives and networks. Companies that back up and store the messages on tape may be satisfied that they are in compliance with regulations for the financial industry. Officials at such companies might want to get to know the rules better, including what kinds of searches they might have to conduct in the event of an audit.

At a seminar on the issue of record keeping and instant messaging at the fall meeting of the Futures Industry Association, David Cox, chief technical officer at Calyon Financial Inc., Chicago, told the audience, "Anyone in the room who thinks they're in compliance with the new regulations, think again."

While that discussion focused on how to lasso instant messaging into a proper storage pen, dealing with IM begins with understanding the requirements for retention of any electronic communication. The basic rule is that organizations in financial services, along with other selected industries, must capture and store for auditing purposes all business-related communications conducted by employees and with clients, generally for a minimum of five years.

For email, that means "a usage policy backed up by active processes for monitoring, archiving and storage," says Richard Fleischman, whose New York-based RFA Technology Consulting firm helps financial companies, hedge funds among them, with message-storage compliance issues. "Additionally they require an email forensic solution that can track, report and monitor email usage to avoid costly manual recovery practices," he said, referring to the complex process that may be involved in retrieving specific messages from records that merely have been slapped onto magnetic tape.

A fully compliant solution stores messages on a medium (WORM—or, "write once, read many") whose contents can be read but not written over or deleted and which can be retrieved in targeted searches, such as by individual, time period or trading position for a particular holding.

So far, the hedge fund world has not rushed into strict compliance.

"Virtually none of them archive email properly," says Chris Grandi, managing director of Boston-based Eze Castle Integration Inc., speaking of hedge fund clients with which his Boston-based firm has worked. "They back it up on tape, but then [to retrieve something for an audit] you have to restore it and search and find—which could take 300 hours and thousands of dollars to do. We deem that unacceptable."

The IM Conundrum

While a haphazard approach of back-up-and-hope might let a firm squeak by for email when the examiners come knocking—albeit with great expense and hassle—it won't work with instant messaging.

"In the IM space, there is more entropy than there is movement in the other direction," Jonathan Christensen, vice president of products and chief technology officer for FaceTime, Foster City, Calif., told his audience as a member of that IM seminar panel. In science, entropy refers to the tendency of things to move to a state of disorder, and while Mr. Christensen was describing the persistent lack of standardization and control among IM networks as their use grows, he also was referring to the tendency of information transmitted via IM to vanish into thin air unless deliberate measures are taken to capture it and store it.

While the same storage requirements that cover email apply to instant messages, complying with them is a trickier task technologically and one that eludes many firms that don't act. "The vast majority of IM use is still ‘undiscovered,'" Mr. Christensen said at the seminar. "Unlike email, IM has no backup or archive, no standard addressing method, no monitoring tools. It's very tricky to manage because of nuances as to how it works." And yet, he said, instant messaging is the fastest-growing form of communication, one that is used in 90% of enterprises and that by 2006 will "usurp email as the preferred method."

But tricky to manage is not the same as impossible or even highly difficult or expensive, all three of the IM specialists contacted for this article agree. Their companies each offer technical and administrative solutions for the IM challenge that don't require much in the way of active monitoring or policing and that can be economically feasible even for small shops.

On Site or Off

As with many IT challenges, organizations seeking to implement message archiving can work with suppliers to set up a system in-house or can completely outsource the job, including the physical storage, to a vendor. Many of the technology consultants that work in this field can help with either route.

Generally the in-house solution, involving an on-site server, has relatively high upfront costs—perhaps US$40,000 or more and requires some ongoing monitoring by internal employees with expertise. Shipping the storage job out to an offsite location requires no new onsite hardware and is much less expensive to implement, but may involve a per-user charge and will entail an ongoing service fee. Start-up costs for outsourcing may be as low as US$3,000.

For larger firms, the in-house option and the one-time major investment will even out with the ongoing cost of outsourcing in about 24 months, according to Mr. Fleischman (although periodically the storage medium in the on-site hardware must be replaced). Obviously, the outsourcing approach makes more economic sense for the many smaller firms that manage hedge funds. "Monthly, you're renting space on somebody's servers," he says, "but it's US$500 a month vs. US$40,000."

Money is not the whole issue. "The smaller shops definitely have less time and attention to worry about IT structure," says Mr. Christensen, whose FaceTime firm has an off-site archiving product, RTShield, geared to small- and medium-sized firms but which also counts many of the largest financial institutions among its customers. For many of the big banks, FaceTime's in-house IM Auditor system is the choice.

For the hedge funds served by Eze Castle, "off-site is much more popular," Mr. Grandi says. His firm markets its Integration Email & IM solution, which like many such offerings uses software from other suppliers (iLumin Software Services and IMIlogic) for archiving, indexing and retrieval tasks. As with other outsourced systems, Eze Castle's setup transfers a copy of each email and IM to secure facility. Those messages "sit in suburban Boston, outside any financial district," Mr. Grandi says.

RFA also offers two basic approaches. It can install an on-site server that collects email and instant messages (along with Bloomberg messaging, as most of the providers do), using Zantaz and IMLogic software. If the client firm chooses, RFA will monitor the system from offsite for a fee. RFA's offsite solution is called MessageRite. It provides a scalable messaging infrastructure that archives and indexes, using technology and software from Lightport and Iron Mountain

A number of other vendors offer products and services for message archiving. For example, Smarsh Inc., of Portland, Ore., recently announced the release of its Archive InSite product, which is geared to small- and mid-sized hedge funds.

It's Not Too Late

If you are a hedge fund manager and you haven't given much thought to the IM activity in your office, or to the issue of archiving electronic messages in general in anticipation of the imposition of mandatory SEC registration Feb. 1, 2006, not only do you still have about a year to get a system into place but you are far from alone.

Mr. Grandi says that many fund firms are just at the stage of appointing a chief compliance officer and that many fund executives, while vaguely aware that a record-retention protocol is part of the registration checklist, have not delved into the details. Right now he estimates that about 90% of funds have not achieved full compliance.

He says Eze Castle is starting to see an uptick in inquires about archiving from hedge funds in the wake of the SEC's adoption of the final rule, and he anticipates a large increase in activity over the next six months, a sentiment shared by FaceTime's Mr. Christensen and RFA's Mr. Fleischman, who says, "They're queuing up for the first and second quarter. By summertime, people will have something in place, or a clear plan."

"They are slowly learning," Mr. Grandi says. "They're asking questions. Now that they know there has to be a compliance officer, they're learning about it, but they don't know what it means."

Mr. Christensen observes a similar scene. "There's already some understanding, but maybe some frustration," he says. "They say, ‘We see the regulation, but explain to us what it means, how we can comply in an affordable, simple solution.' Most of these guys want to comply, and it's really been [a matter of] understanding what it means. Hedge funds typically are smaller organizations—kind of lean, mean organizations. Their IT is focused on proprietary algorithms for strategy, not information management."

The typical fund manager has a rather limited understanding of IM and archiving technology, to say the least, says Mr. Grandi. "The majority has no clue. They outsource everything, so they don't know a lot."

That's not to say that hedge fund managers should be signing up for night classes in IT. There's plenty of help from professionals available. Still, a bit of knowledge can be helpful. That a number of technology companies are able to provide compliance systems that are nearly turnkey in implementation and not highly burdensome to maintain is good news for time-stretched and cost-conscious managers, but a bit of time invested up front to understand the devilish ways of instant messaging can help ensure that the solution from the vendor is appropriate and as airtight as possible.

I Want My IM!

The technology vendors say that many of their clients, upon first learning about the rules for record retention and being told what a slippery fish IM is to catch and store, respond by proposing to banish the use of instant messaging from their premises.

The vendors also say it's a bad idea.

"The interesting thing with IM," says Mr. Grandi, "is that they'll say, ‘Well, I'll just tell people to stop using it.'"

Such a tack is ill-advised for two major reasons: the marketplace and human behavior.

Preventing people from using IM in a hedge fund office might solve some headaches for the hedge fund, but it won't change the fact that instant messaging is the primary means of communication for many of the folks with whom hedge funds do business—especially those in the trading community.

"We tell people, you can try to shut it down, but your traders and the people who have contact with Wall Street won't like it," Mr. Grandi says. "IM is prolific" in communication between buy and sell sides, he adds.

In other words, cutting off IM means cutting off an important channel of communication and could have a negative effect on efficiency and performance.

In any event, Mr. Christensen says, seeking to ban IM usage by fiat or trying to restrict usage to one IM network (the big three are AOL, Yahoo! and MSN) for the sake of standardization is an unrealistic strategy. People who use IM will keep using it unless they are physically prevented from doing so by network blocks.

As for confining users to one network, he notes that different IM networks prevail in different industries. Institutional traders on Wall Street use AOL's AIM "almost exclusively," he says, while among energy traders, Yahoo! Messenger is king. "There's cross-talk," he says, noting that many users communicate over more than one service. "Asking them to move" to one approved service, for the sake of simplifying the archiving process, "means they have to give up a piece of their Rolodex—their address network."

Mr. Christensen says that even the AOL and Yahoo! IM providers acknowledged how futile or misguided it is to try to confine users to one service when they abandoned last year their efforts to market an archiving and control product that worked only for traffic on their networks. He advises companies just to accept the fact that people use different networks and to adopt a compliance solution, such as FaceTime's or others, that works for all the known networks. "Most firms with more than 100 people already have all three major networks running. Even in a small shop with 15 people, there's always one or two people using something else."

Everybody Now

Because the SEC does not require that communication of all employees be retained—just that of those interacting with clients and involved in transactions—some companies that adopt archiving systems try to apply them only to selected users.

But the technology people say that savings obtained by excluding some mailboxes from an archiving solution are probably not worth the loss of certainty that everything is being retained. Mr. Christensen says many of the large institutions with which he works archives everything from everybody, for the sake of both simplicity and ultimate security. Mr. Fleischman says he advises all clients to include all employees. In many cases, especially at smaller offices, the extra software cost for universal coverage is negligible.

In setting up a retention system for IM, organizations might also do well to examine their general policies regarding the use of email and instant messaging—or to create and implement policies if they don't have them. As Mr. Fleischman notes in a statement on "messaging compliance" that he wrote, "Each email/IM sent has a potential liability attached. Executive management and corporate officers have a fiduciary duty to act in the best interest of the company and may become personally liable for statutory offenses committed by the firm. With so many people using email/IM so frequently, and having a mistaken impression that this type of communication is private, there is a risk of intellectual property or other confidential information being sent outside of the company's domain."

In short, it makes good business sense to have a policy on electronic messages and to ensure that employees are aware of it. A specific consideration for IM is screen names that people use. Mr. Christensen notes that unlike company email, with IM, users pick their own names, meaning that some guidelines might be in order. Among questions he suggests addressing are, "Are your people choosing risqué names? Is corporate HR policy being violated?"

A sound compliance and retention program also is likely to yield the benefit of increased security in a company's communication system, since the systems installed for archiving can also set up blocks to thwart would-be hackers, spoofers, identity thieves and other miscreants of the web.

No one says SEC registration is going to be a picnic, but by acting soon on email and IM issues, hedge fund managers can reap the satisfaction of both checking a regulatory chore off their list and finding that they have a communication system that is secure, efficient and law-abiding. At that fall seminar, Dale Martin, executive vice president of Cargill Financial Services, Chicago, noted that a properly instituted IM system is both an important security asset and a facilitator of good business practice. He said that excessive use of email by employees, with the constant "cc'ing" and lengthy volleying sessions of replies that flourish almost inevitably was choking work flow. "Email was being used as IM," he said. "Productivity suffered." Setting up a sanctioned, secure IM protocol and encouraging IM use addressed the problem and yielded benefits for the company. "We wanted to push an internal culture so that we had a global sense of community," he said, "so that we could provide outstanding service and so that all internal employees see the same culture."

TStanton@HedgeWorld.com
Comments:
Great information and ideas.. It helps ma a lot..


Google apps archiving


 
Informative post..Thanks for sharing.
RIA Chief Compliance Officer

 
Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?