Now that you’ve seen what ACA Insight has to offer, don’t be without it. Subscribe now!

The weekly news source for investment management legal and compliance professionals

Current subscribers - please log in to the website in the upper right-hand corner

News November 13, 2017 Issue

Think You Don’t Have Custody? Think Again

Some advisers may believe they don’t have to comply with Rule 206(4)-2, the Custody Rule, because they do not possess client assets. Such a belief could get them in trouble, both with clients and with the SEC. Turns out there are at least five types of custody – and only three of them involve asset possession.

The Custody Rule is complicated and easily misunderstood, not only in terms of whether an adviser actually has custody, but also in terms of some of the Rule’s requirements, such as those requiring surprise examinations. Custody requirements, which have evolved since the Rule was adopted, also require a knowledge of subsequent agency guidance, no-action letters, answers to frequently asked questions, and enforcement actions.

The Rule "is a trap for the unwary," said Sidley Austin partner Laurin Blumenthal Kleiman. "Depending on your strategy, how you comply with the Rule may not be intuitive or even logical."

The most important initial steps are understanding the meaning of "custody," as defined in the Rule and guidance, and the definition of what constitutes a "security," as defined by the Advisers Act, she said.

Types of custody

There are at least five types of custody, said Pickard Djinis and Pisarri partner Mari-Anne Pisarri. One of them – dealing with "inadvertent" custody – was first described in a February 2017 SEC Guidance Update on the subject. These must be understood before going further.

  • Actual custody. This is what most people think of as custody: physical possession of your client’s funds or securities. An adviser has actual custody, Pisarri said, even when it only temporarily has possession of client assets.
  • Constructive custody. Physical possession of the funds or securities is not required to meet this category. All that is needed is for the adviser to have the legal authority to move or use them. For instance, an adviser’s power of attorney to withdraw funds from a client’s account or to transmit client funds to a third party would meet this definition. "If an adviser pays bills for its client, or if the advisory firm is the legal owner of the account, it is deemed to have custody," Pisarri said. On the other hand, transferring money from one client account to another owned by the same client in a closed loop, or instructing the qualified custodian to send assets to the client at his or her home address would generally not constitute custody, she said.
  • Imputed actual custody. Similar to actual custody, except the client’s funds are in the possession of an affiliate of the advisory firm.
  • Imputed constructive custody. Similar to constructive custody, except the legal authority to move or use client assets is held by an affiliate of the firm.
  • Inadvertent actual custody. This is something most investment advisers didn’t worry about until the staff issued the guidance earlier this year, Pisarri said. This type of custody may occur when a client, despite having a written agreement with an advisory firm that forbids the adviser to direct money out of the account to pay the client’s tax bills or other indebtedness, has a separate agreement with the custodian giving the adviser broad authority to have assets moved out of the account and sent to third parties. In that case, the advisory firm has custody, even though it may know nothing about the agreement between the client and the custodian. "It’s hard to see where the risk is here," said Pisarri. "After all, if an advisory firm doesn’t know it has custody, it’s a pretty safe bet that it’s not going to abuse that access and steal from the client."

"There’s been an industry outcry in relation to the February 2017 Guidance on inadvertent custody," said Morgan Lewis partner Christine Lombardo. After all, she said, "an adviser can only know what it knows" and should not be held accountable from a regulatory perspective for separate agreements that may exist between the client and the custodian, where the adviser has no knowledge of the terms.

As for the definition of what constitutes a "security," Kleiman said that the Advisers Act defines a security as any "evidence of indebtedness." That means instruments many might not think of as securities, such as a mortgage or a collateralized loan obligation, may be deemed to be securities and subject to the Custody Rule.

The cybersecurity connection

Another development is "the connection between constructive custody and cyber risk," said Pisarri. "People are hijacking email accounts and sending phishing requests for money transfers." When managers at advisory firms act on those fraudulent transfer requests, they are not only sending money to a hacker, they are also admitting that they have custody and opening themselves to the burdens of the Custody Rule, she said.

Pisarri said that at least one of her clients was forced to pay back a client for money stolen through such an attempt.

Yesterday, today and tomorrow

The real problem with the Custody Rule is not the definition of what constitutes custody, but the complications in regard to its surprise examination requirements, Pisarri said. Without those requirements, which she said were added after the Bernard Madoff scandal to calm the public, compliance with the Custody Rule would not be that difficult.

Under the Rule, if an adviser has any type of custody, it must meet a series of requirements, including ensuring that client funds and securities are physically held by a "qualified custodian’" such as a bank or broker-dealer, and having a reasonable belief that the qualified custodian is sending account statements to the client at least quarterly. With very few exceptions, advisers with actual, constructive, imputed or inadvertent custody must also have the subject assets verified by an annual surprise examination conducted by an independent accountant. Alternatively, advisers of pooled investment vehicles may distribute financial statements, audited by an independent public accountant, to all shareholders, generally within 120 days of the vehicle’s fiscal year end. Additional conditions apply in the case of actual custody, either direct or imputed.

While the surprise exam requirement may have value where assets are physically held by an adviser or its affiliate, the benefits in a constructive custody context are hard to discern, said Pisarri. "Monthly or quarterly account statements from the qualified custodian are a much more effective way to protect investors than a once-a-year sampling of accounts through a surprise exam." In addition, she noted, eliminating the surprise exam requirement in the case of constructive custody would resolve much of the confusion that has engulfed the industry and taxed the SEC staff since the Rule was amended several years ago.

As the Rule is currently written, "there isn’t a way to ‘cure’ a violation," said Kleiman. "All you can do is address the circumstances that caused the violation and move forward."

Best practices

So what’s an advisory firm chief compliance officer to do while he or she is waiting for Rule reform? Consider the following:

  • Review the Rule and the SEC guidance. These include the SEC’s August 2013 Guidance Update on privately offered securities and the Custody Rule, its February 2017 Guidance Update on inadvertent custody, its February 2017 risk alert on frequent compliance topics found during investment adviser examinations, its March 2013 risk alert about "significant deficiencies" involving adviser custody, agency staff responses to FAQs, and the staff’s February 2017 no-action letter sent to the IAA in regard to standing letters of authorization. Once you learn these, you can then seek to determine whether you have custody, said Kleiman. If you determine that you do not have custody, "make sure you memorialize your conclusions and your reasons for reaching them," she said.
  • Review all your firm’s compliance policies and procedures against the Rule and other requirements. By matching one against the other, you may find areas where internal compliance policies and procedures fall short, said Pisarri.
  • Test to ensure that client-facing employees are following the proper procedures. For instance, "look at documentation of client transfers of money," Pisarri suggested.
  • Inventory all client relationships. "Analyze each client relationship to determine your firm’s level of authority in terms of custody," said Lombardo. For instance, can your firm pay bills for your clients?
  • Scrub custodial agreements with clients. To the extent an adviser is either a party to the custody agreement or has such agreements in its possession, check to analyze the level of authority granted to an adviser for the client and whether the custodian will "accept any instruction" from an investment adviser acting for the client, said Lombardo.
  • Review new accounts as they come in. With new advisory relationships, there is the ability to get ahead of these issues and assess custody, in light of the recent Guidance, from the outset, Lombardo said.
  • Conduct training with customer service staff, mailroom staff and others. Make sure they are following procedures on when to return mail, including having compliance personnel log the inadvertent receipt of assets and keeping copies of the relevant documents before the checks are returned), how to handle electronic transfer requests, and more, Pisarri said.