Insight Analytical Note

Read

MNPI Risk Alert

Background:

  • On April 26th, 2022, the SEC’s Division of Examinations (“EXAMS”) issued a Risk Alert focused on issues surrounding the use of alternative data in investment activities, interaction with value added investors and general Code of Ethics violations.

Practices Highlighted:

The deficiencies outlined in the risk alert were as follows:

204A Violations

Section 204A of the Advisers Act requires investment advisers to implement appropriate policies and procedures reasonably designed to prevent the misuse of MNPI.  204A is broad and open to interpretation by examiners and enforcement staff.  This creates space for staff to interpret this provision and generate some of the findings below.

  • Alternative Data:
    • Exam staff observed managers using alternative data without documenting due diligence of their data providers.
    • Exam staff observed that managers did not have policies, procedures or guidelines regarding the evaluations of the terms, conditions and legal obligations related to the collection of data including policies about actions that need to be taken if red flags are detected.
    • Managers who did have procedures, did not adequately implement them.

      Analysis:  The Commission’s concern should be viewed through the lens of the three prongs of insider trading: (1) information materiality; (2) information being non-public; (3) the duty of confidentiality.  In addition, EXAM’S emphasis on consistency of diligence highlights the need to have a unified data acquisition and vetting process and to refresh the vetting periodically.  Based on the information contained in this alert, EXAMS is signaling that managers should:
      (1) Risk rate their data sources to identify which may be providing MNPI;
      (2) For those at risk of providing MNPI, managers should ensure that no duty confidentiality exists before trading.  This is usually done by examining underlying agreements with data Page 1 sources to ensure that the underlying data source has consented to their data being sold for the purposes of effectuating securities transactions.
      (3) Managers’ alternative data policies should include provisions for detecting and handling red flags.  For example, managers should have policies governing a high‐risk data source that cannot evidence their ability to sell data for the purposes of securities trading.
  • Value‐Added Investors:  Value‐added investors, or investors such as corporate executives who are more likely to possess MNPI, were the subject of an SEC settlement with MIO Partners, Inc. on November 19th 2021.
    • Exam staff observed that some managers did not have adequate policies and procedures to control the risks posed by value added investors.
    • In other cases, exam staff observed that value added investors were not adequately identified by compliance professionals.

      Analysis:  The risks of value-added investors emanate from the close relationship they have with the manager and the fact that some may have direct access to investment committees and portfolio managers.  Managers should think about who outside their organization may have access to MNPI and ensure that they are adequately trained and protected with strong confidentiality agreements.  Likewise, investment professionals and portfolio managers should be trained to detect and handle any potential MNPI received from value added investors or “friends of the firm”.
  • Expert Networks:
    • Exam staff observed expert network policies which lacked tracking, logging and note generation.
    • Exam staff observed insufficient trade surveillance around public companies in similar industries as those of expert network consultants.

      Analysis: For most firms, expert network activities pose lower risk.   Most reputable expert network providers will offer logging, tracking and transcription services, potentially satisfying EXAM’s concerns.  Staff’s findings around trade surveillance of related industries may be related to a very specific instance of non‐compliance as most managers research, trade in and surveille trades in industries within their investment mandates.
  • Code of Ethics:
    • Exam staff observed that some managers did not adequately identify all Access Persons.
    • Exam staff observed that some managers did not require pre‐approval for IPOs.
    • Exam staff observed that some managers could not evidence their review of holdings and transaction reports, that the CCO was self‐reviewing their own holdings reports, that some holdings reports were missing and not submitted, and private placements were not included on holdings reports.
    • Exam staff observed instances where Access Persons were not provided with a Code of Ethics and did not issue an acknowledgement.

      In an unusual approach, staff also highlighted two practices that were highlighted in the Code of Ethics adopting release and related to previous examination observations.
    • Staff highlighted that managers should ensure that Access Persons do not trade in names in the manager’s restricted list.
    • Staff highlighted the need to adopt policies to ensure that investments are first offered to clients before the adviser or employees may act on them.

      Analysis:  These appear to highlight the core bread and butter requirements of the Code of Ethics.  For private funds, the Code does not require investments to be offered to clients first, if timely disclosure is provided.

Key Takeaways:

  1. Not a Warning Shot:  Some registrants overestimate the signaling value of Risk Alerts.  In our experience, the only Risk Alerts that were followed by significant examinations were ones which explicitly stated so.  If this Risk Alert raises issues that a manager has not yet considered as part of their compliance program, then that issue should be placed on that managers agenda, but no wholesale shifting of resources should occur.
  2. Alternative Data Center Stage: The use and risks of alternative data were highlighted first and presented in good detail.  It is possible that alternative data was intended to be the main focus of this alert. By now, the SEC has a well developed playbook around compliance violations commonly present in data science programs.  That playbook involves 1) data risk assessments 2) enhanced vendor and data acquisitions diligence; 3) continued diligence and monitoring; and 4) robust procedures around internal data generation.  Expect more examiners to understand and be able to examine these practices.
  3. The Basics: Whether this Risk Alert is a warning shot or not, it’s critically important to get the compliance basics right.  This is especially true of any prescriptive rules, such as 204A‐1, the Code of Ethics Rule.  The Commission takes lapses on 204A‐1 and other prescriptive rules very seriously.