Time to party. AdvisorVault’s 17a-4 Managed 365 Service gets FINRA firms compliant on the Microsoft Cloud with our unique offering bundling our Managed Microsoft 365 & FINRA Designated Third Party service combined we include the four essential features into one that’ll finally keep regulators happy with the Microsoft Cloud.

Guaranteed FINRA Compliance on MS 365

The past few years I been getting lots of firms approaching me about FINRA compliance on Microsoft 365, even the ones already on Microsoft who were worried about meeting 17a-4, and rightly so: upon further investigation, I found they surely had gaps in their data compliance strategy on the cloud.

First problem I saw right off the bat was firms weren’t fully migrated to the cloud. I mean despite paying for a subscription to Microsoft 365, data was still scattered all over the place; half on 365, some in-house, the rest on various cloud services like dropbox, even Google Workspace was in the mix. Also, employees weren’t cybersecure – not by FINRA standards. Worst though, they actually thought Microsoft was backing up their data, but in fact nothing was retained offsite for 17a-4. In addition, they couldn’t do regular compliance supervision – they’d be in big trouble if FINRA came in asking for a sample set of data from their archive.

Finally, they didn’t have the Designated Third-Party attestation letters from Microsoft – another big No-No when FINRA shows up since regulators expect to have a third party with access to records stored on a firm’s systems independently in the event a firm is unable to do so (or somehow fails to cooperate – there’s also worries of firms “covering their tracks” when they know an audit is coming).

The FINRA Electronic Records Request Process:

FINRA Requests Data

During an audit, FINRA requests a sample set of data from the firm’s 17a-4 archive going back 7 yrs.

Access Archive

D3P gives compliance officer or FINRA independent access to firms’ records in original format

Download Records

Records are downloaded from archive in PST or Zip format, saved to disk for compliance review

1.  Properly Moving to Microsoft 365

Firstly, our 17a-4 Managed 365 Service gets firms on the Microsoft Cloud properly. Since most FINRA firms aren’t correctly managed on the cloud (few cloud providers understand FINRAs demands), they face a problem with this move; Microsoft doesn’t understand the unique challenges FINRA firms face and they end up with gaps in their electronic records retention for FINRA 17a-4 compliance.

The 17a-4 Managed 365 Service is able to take over the management of our customers 365 tenant and with full control we are able to take the proper steps ensuring firms are 17a-4 compliant on the cloud. For instance, being fully migrated ensuring no gaps appear in their electronic records retention of data stored on the Cloud, the 17a-4 Managed 365 Service takes these steps to make sure firms are properly on the Microsoft Cloud:

  • 365 Management: take Ownership of firms 365 Tenant; prepare it for 17a-4 compliance by eliminating gaps in electronic records archiving by centralized systems on the cloud

  • Migrate Data: ridding customers of in-house data by moving all users’ files off personal PCs to OneDrive; migrating in-house data stored on servers to company SharePoint sites

  • Consolidate Cloud: move data off other cloud services to Microsoft such as dropbox &  Google to consolidate all records on 365

  • Message Compliance: email accounts migrated to Exchange Online with private/group chats on Teams configured; ready to be archived centrally for 17a-4

When a FINRA firm moves their operation to Microsoft 365, they must understand it doesn’t meet the requirements of 17a-4 there are three problems with Microsoft and compliance:

Not 17a-4 Archived

Data not retained long-term  seven yrs. as per FINRA; file versions don’t go back 3-yrs; email retention not enabled; no supervisory interface for audits

Cybersecure

FINRA level cybersecurity policies not applied to users; proactive monitoring not enabled; cloud reports not sent to compliance officers

Won't Act As D3P

Microsoft won’t act as the D3P; nor provide the 17a-4 attestation letters; won’t help with electronic records request or respond to FINRA during audits

2. FINRA Cybersecurity Best Practices Applied to Microsoft 365

Once a firm is fully migrated to Microsoft 365, the second step of our 17a-4 Managed 365 Service is applying FINRA cybersecurity to the cloud. Since by default the Microsoft Cloud isn’t cybersecure surely not by FINRA standards, it needs to be secured. Especially now with the updated cybersecurity rules where FINRA is demanding firms are more proactive when it comes to cybersecurity. In other words, they must now show they’re dynamically monitoring threats (this most definitely includes user activity on the Microsoft Cloud – often left wide open to attacks).

Firms must also show “policies, procedures, controls, and implementations are robust and reasonably designed.” Including proof of resiliency and capacity to detect, respond to, and recover from cyber incidents and also make the required notifications to impacted individuals.

  • Cybersecurity: deployment of best-practice FINRA cybersecurity policies on Microsoft 365; also detect, respond and recover from cyber incidents with notifications and alerts sent to compliance officers and IT staff

  • Threat Monitoring: monitoring enabled for cloud wide changes including sign-in from unusual locations; detection of unknown devices; suspicious mailbox activities;  always-on audit logging ; strip messages with suspicious attachments

  • Block Infections: enable Safe Attachments, Safe Links within files infected messages from entering the firm’s cloud; detect account creation/ deletion, suspicious email forwarding rules, public sharing of company data

  • Proactive Alerting: pre-configured notifications enabled on Microsoft 365; reports including proof of resiliency with capacity to detect threats

3. Electronic Records Archiving & Supervision Plug-in Satisfying FINRA 17a-4 Demands

To meet 17a-4 firms must also ensure a secondary copy of electronic records are transferred to a separate system off the Microsoft Cloud. Further, where it’s retained 7 yrs. as per 17a-4, in their original format. The goal essentially is so it can be access for ongoing compliance supervision and during a FINRA 17a-4 electronic records request. However, firms need to understand that the cloud is not backed up nor is data retained for compliance. In fact, Microsoft and Google do not backup or retain customers records for any type of compliance, FINRA firms must add it in. Our 17a-4 Managed 365 Service includes a backup and archiving Plug-in direct into Microsoft 365 with a supervisory interface for compliance officers and auditors access to the firm’s archive. Our 17a-4 cloud archiving plug-in includes these features:

  • Full Protection: retain complete email accounts on Exchange Online; data stored on OneDrive and SharePoint Sites including Teams archiving; granular protection to restore individual emails, files, contacts, calendar items and private/public chats

  • Cloud Archiving Plug-in: archives records off the Microsoft Cloud to a secondary 17a-4 compliant system; further protection against ransomware attacks and independent access off the Microsoft Cloud

  • FINRA Supervision: web interface for searching, flagging, keyword detection; download sample sets of data in PST and zip file format for regulators during audits

4. The FINRA 17a-4 Designated Third Party (D3P) for Cloud

Finally, Its critical firms establish a relationship with a designated third party – D3P. Especially when they are on Microsoft 365 because they need an independent third party with the ability to give the SEC (or FINRA) access to their retained electronic records during an audit, (something Microsoft won’t do) . What is expected is the D3P will help the firm reproduce a sample set of data for regulators. Also, FINRA may ask the D3P independently of the firm to reproduce electronic records from the archive. Included with the 17a-4 Managed 365 Service is the D3P requirement, why do firms need a D3P bundled with their 17a-4 archiving?

  • Act as The FINRA D3P:  provide firms the two 17a-4 third party storage notification letters required upon retention of electronic records

  • Preserving Records: retain firms’ data in a non-rewriteable format for 7 yrs; verify automatically the quality of the archiving process, and index records preserved on the FINRA compliant storage media

  • Respond to Audits: respond to requests by FINRA (or SEC) for independent access to firms records; even if firms are not cooperating with regulators; provide securities regulators with access to records and information stored on the companies systems independently of the firm

Summary

AdvisorVault’s 17a-4 Managed 365 Service gets FINRA firms compliant on the Microsoft Cloud with our unique offering bundling our Managed Microsoft 365 & FINRA Designated Third Party service combined it includes full migration to Microsoft 365, FINRA Cybersecurity Best Practice Applied to the Cloud, an archiving and supervision Plug-in with the FINRA Designated Third Party service.

About AdvisorVault

AdvisorVault is the only FINRA D3P with a Consolidated 17a-4 Service, designed to give small firms everything needed to meet today’s data compliance demands. Our turn-key approach performs the archiving, retention, and supervision of electronic records no matter where they are stored – in-house or in the cloud. Including the FINRA third party letters with all the required documentation. For one flat monthly fee it’s the only fully 17a-4 compliant option – Complete data compliance peace of mind, out-of-the-box.

Allan Lonz, President
alonz@advisorvault.com
direct: 416-985-0310
Toll free: 1-866-732-1407 ex 1