• SEC sets timeline for finalization of third-party oversight proposal.
• Emerging technology providers and internet advisers are potentially in sight for further regulations.

Internet-based registered investment advisers (RIAs) who leverage new tools and technologies to provide access to investment products have been driving innovation to the benefit of investors, albeit with some novel risks as well. RIAs are facing a more complicated operating environment as regulators both finalize rule proposals and consider new ones.

Last month the Securities and Exchange Commission (SEC) released its Spring 2023 regulatory agenda. Among a list of priorities were two items affecting RIAs:

• The finalization of a proposal addressing the SEC’s approach to third-party risk management by RIAs, and
• A new proposal on changes to the registration regime for internet investment advisers.

The agenda indicates that the amendments to rules on outsourcing by investment advisers under the Investment Advisers Act are set to be finalized by April 2024, and a notice of proposed rulemaking related to changes to existing registration exemptions for internet investment advisers could be expected by October of this year.

Regulatory Focus on Evolution of Investment Advisers

On May 19, 2023, SEC Chairman Gensler said that the evolution of RIA’s use of third parties beyond tasks such as information technology and middle-office functions has spurred the proposed new rules “to ensure that advisers continue to meet their fiduciary obligations.”

In the same remarks, Chairman Gensler indicated that new rules in this area may not stop with the proposal on outsourcing by investment advisers. Chairman Gensler discussed developments in technology already playing a role in the industry via robo-advising and trading algorithms, among other things, and emphasized that investment advisers “consistent with their fiduciary duty need to act in an investor’s best interest.”

For example, the discussion references the issue of a “robo-advisor that has an algorithm … that not only looks at the investor’s interest but also considers the interest of the robo-advisor itself.” The Chairman noted that he has asked SEC staff to make recommendations for the Commission’s consideration on how to address this emerging issue, which could become part of a future rule proposal.

Highlights from the Proposal on Outsourcing by Investment Advisers

The proposed rule on outsourcing was designed to prohibit RIAs from outsourcing certain services or functions without meeting minimum regulatory and risk-management requirements. The amendments would also require advisers to “periodically monitor the performance and reassess the retention of the service provider” in order to continue to outsource the services, and maintain books and records on outsourced functions.

The rule pertains only to “covered functions,” which it defines as those outsourced functions that (1) are necessary to provide investment advisory services in compliance with the Federal securities law and (2) “if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser’s clients or on the adviser’s ability to provide investment advisory services.” Examples of these functions include adviser/subadviser duties, client servicing, cybersecurity, investment risk, portfolio management, portfolio accounting, pricing, and regulatory compliance. The proposal excludes general office functions and clerical work as well as licensing of general software packages.

The due diligence requirement proposed by the rule would require RIAs to “reasonably identify and determine that it would be appropriate to outsource the covered function, that it would be appropriate to select the service provider, and once selected, that it is appropriate to continue to outsource the covered function, by complying with six specific elements.” The recordkeeping requirements of the proposal requires RIAs to determine which functions are covered functions and “make and keep a list or other record of covered functions that the adviser has outsourced to a service provider and the name of each service provider, along with a record of the factors, corresponding to each listed function, that led the adviser to list it as a covered function.” The rule also includes specific requirements for advisers that rely on a third-party for recordkeeping services.

The SEC received 97 comments on the rule proposal, with a common criticism focused on the proposal being burdensome to advisers, especially smaller advisers — in particular, the finalized rule would require new responsibilities for third parties, as well as likely ultimately require the renegotiation of third-party contracts with RIAs.

The rule proposal follows a trend in financial services more generally, where registered and supervised providers of financial products and services partner with other companies who have specialized expertise in technology infrastructure or applications. These partnerships can serve investors and consumers through efficiencies and product innovation but can create compliance questions as well as potential risks depending on the nature of the partnership. We should expect this trend to continue in the investment advisory space. Indeed, enhanced regulation of third-party risk management is also on the agenda for banking regulators — read more on that development here.

Changes to Internet Investment Adviser Exemption under the Investment Advisers Act

A separate item on the SEC’s regulatory agenda indicates the agency is considering “recommending that the Commission propose amendments to the exemption for internet advisers from the prohibition against registration under the Investment Advisers Act.” The existing “internet advisers exemption” went into effect in early 2003, more than 20 years ago, and was designed in part to foster interstate commerce by easing multi-state licensing requirements for emerging, internet-based companies providing investment advice to investors located throughout the United States.

While the details of the proposal to amend this rule remain to be seen, it is possible that changes to the exemption will expand the SEC’s authority over internet investment advisers who today are benefiting from the exemption from state-registration requirements. Indeed, the existing rule requires that certain conditions be met in order for a firm to avail itself of the exemption.

In any case, investment advisers have a fiduciary duty to act with the client’s best interests in mind under the SEC’s regulations. New technologies and business practices have implicated this fiduciary responsibility in new and different ways. The SEC Chairman’s recent remarks suggest the agency is concerned that trading algorithms designed to advise clients on investment strategy might not always be meeting that duty to the agency’s satisfaction, thus exposing investors to risk and advisers using those algorithms to possible compliance risk.

Again, while its content and scope remain unclear, the SEC’s agenda indicates a notice of proposed rulemaking that might touch on these topics could be expected by October of this year.

 Considerations for Investment Advisers and Fintech Partners

Given the impending timeline for the finalization of new rules on RIAs’ third-party relationships and the increasing focus from regulators on the issue, RIAs will need to reevaluate their current approach to third-party management. Vendors in the space should be aware of the pending rule changes and consider the governance, operational, and compliance enhancements that may be necessary to maintain their relationships with RIAs under a more stringent regulatory environment.

Put Patomak’s Expertise to Work

Patomak has deep experience conducting compliance reviews of RIAs, broker-dealers, swap dealers, banking entities, and other financial firms, including aiding firms in enhancing their third-party, vendor-management protocols to meet SEC and FINRA rules and regulations and best practices. If you’d like to learn more about how Patomak can partner with you, contact Paul Atkins (patkins@patomak.com), Jill Sommers (jsommers@patomak.com), or Mark Wetjen (mwetjen@patomak.com).