Financial Industry Regulatory Authority Inc. communications record retention rules apply to all communications devices and technologies, FINRA officials say.
FINRA, Washington, talks about the rules that govern member firms' use of social networking websites and personal communications devices in FINRA Regulatory Notice 11-39.
The rules apply to FINRA member firms and associated persons and entities, including life insurance agents who sell variable life and variable annuity products.
FINRA released an earlier batch of social networking guidance in January 2010, in FINRA Regulatory Notice 10-06.
Some of the other existing FINRA and U.S. Securities and Exchange Commission (SEC) rules that apply to FINRA members' social media use include SEC Rule 17a-4(b) under the Securities Exchange Act of 1934 (SEA), which requires broker-dealers to save some records for at least 3 years, and NASD Rule 2210, a FINRA rule that governs "public appearances" in interactive electronic forums, such as message boards.
SEA Rule 17a-4(b)(4), for example, applies to "all communications which are subject to rules of a self-regulatory organization of which the member, broker or dealer is a member regarding communications with the public," FINRA officials say. "The SEC has stated that the content of an electronic communication determines whether it must be preserved."
NASD Rule 2210, which was created by a FINRA predecessor organization, exempts a member, broker or dealer from the need to get prior approval by a registered principal.
When making social media public appearances, "firms may adopt risk-based supervisory procedures utilizing post-use review, including sampling and lexicon-based search methodologies, of unscripted participation in an interactive electronic forum," FINRA officials say.
A firm must adopt procedures to keep the interactive electronic communications from violating FINRA or SEC rules governing matters such as a ban on misleading statements.
FINRA officials address questions about use of new communications services and technologies in a question-and-answer section.
FINRA officials note in the first answer that SEA Rule 17a-4(b)(4) recordkeeping requirements have nothing to do with whether a person associated with a FINRA member firm uses a personal device or technology to make the communication.
"SEA Rule 17a-4(b)(4) requires a firm to retain records of communications that relate to its 'business as such,'" officials say. "Whether a particular communication is related to the business of the firm depends upon the facts and circumstances. This analysis does not depend upon the type of device or technology used to transmit the communication, nor does it depend upon whether it is a firm-issued or personal device of the individual; rather, the content of the communication is determinative."
A firm should train associated persons about the differences between business and nonbusiness communications and the measures needed to ensure that any business communication made by associated persons is "retained, retrievable and supervised," officials say.
The FINRA officials also raise record retention issues in a response to a question about comments posted to a social media site run by a member firm or an associated person.
FINRA generally will not treat the participants' posts as if they were the firm's posts, but the firm still has to keep records of all social media site communications relating to its business as such, officials say.
FINRA officials say they approve of the idea of member firms letting associated persons use "personal communication devices and other equipment, such as a smart phone or tablet computer," to run firm business applications.
But a firm must supervise the activity, and "the firm must be able to retain, retrieve and supervise business communications regardless of whether they are conducted from a device owned by the firm or by the associated person," officials say.
A firm should be able to separate personal and business communications made on the same device, officials add.
Officials suggest that one way to keep business and personal communications separate would be to require associated persons to use separate applications for business and personal communications.
"If possible, this application should provide a secure portal into the firm's own communication system, particularly if confidential customer information may be shared," officials say. "Of course, firms also are free to treat all communications made through the personal communication device as business communications."