August 12, 2020

Select COVID-19 Compliance Risks and Considerations for 

Broker-Dealers and Investment Advisers*

I. Introduction

In response to the broad and varied effects of, and the public and private sector responses to,

COVID-19, SEC registrants have been faced with new operational, technological, commercial,

and other challenges and issues. In many cases, these challenges and issues have created 

important regulatory and compliance questions and considerations for SEC registrants. 

Through this period, OCIE has remained operational nationwide and continues to execute on its

mission. As described in more detail in our March 23, 2020 statement, OCIE has worked with 

SEC registrants to address the timing of its requests, availability of registrant personnel, and 

other matters to minimize disruptions.

1 Specifically, OCIE has worked with SEC registrants to 

ensure that its work can be conducted in a manner consistent with maintaining normal operations 

and appropriate health and safety measures. OCIE has also actively engaged in on-going 

outreach and other efforts with many SEC registrants to assess the impacts of COVID-19 and to 

discuss, among many other things, operational resiliency challenges.

Through these and other efforts, as well as consultation and coordination with our SEC 

colleagues and other regulators, OCIE has identified a number of COVID-19-related issues,

risks, and practices relevant to SEC-registered investment advisers and broker-dealers 

(collectively, “Firms”). Additionally, market volatility related to COVID-19 may have 

heightened the risks of misconduct in various areas that the staff believe merit additional 

attention.

The purpose of this Risk Alert is to share some of these observations with Firms, investors, and 

the public generally. OCIE’s observations and recommendations fall broadly into the following 

six categories: (1) protection of investors’ assets; (2) supervision of personnel; (3) practices 

relating to fees, expenses, and financial transactions; (4) investment fraud; (5) business 

continuity; and (6) the protection of investor and other sensitive information. 

 

* The views expressed herein are those of the staff of OCIE. This Risk Alert is not a rule, regulation, or statement of the 

Securities and Exchange Commission (the “SEC” or the “Commission”). The Commission has neither approved nor 

disapproved the content of this Risk Alert. This Risk Alert has no legal force or effect: it does not alter or amend applicable 

law, and it creates no new or additional obligations for any person. This document was prepared by OCIE staff and is not 

legal advice.

1 OCIE, Statement on Operations and Exams – Health, Safety, Investor Protection and Continued Operations are our Priorities

(March 23, 2020). 
2

II. Staff Observations on Areas of Risk and Focus

A. Protection of Investor Assets

Each Firm has a responsibility to ensure the safety of its investors’ assets and to guard against

theft, loss, and misappropriation.2 In light of the current environment, the staff has observed that 

some Firms have modified their normal operating practices regarding collecting and processing 

investor checks and transfer requests. OCIE encourages Firms to review their practices, and 

make adjustments, where appropriate, including in situations where investors mail checks to 

Firms and Firms are not picking up their mail daily. Firms may want to update their supervisory 

and compliance policies and procedures to reflect any adjustments made and to consider 

disclosing to investors that checks or assets mailed to the Firm’s office location may experience 

delays in processing until personnel are able to access the mail or deliveries at that office 

location.3

OCIE also encourages Firms to review and make any necessary changes to their policies and 

procedures around disbursements to investors, including where investors are taking unusual or 

unscheduled withdrawals from their accounts, particularly COVID-19 related distributions from 

their retirement accounts.4 Firms may want to consider: 

• Implementing additional steps to validate the identity of the investor and the authenticity 

of disbursement instructions, including whether the person is authorized to make the

request and bank account names and numbers are accurate; and 

• Recommending that each investor has a trusted contact person in place, particularly for

seniors and other vulnerable investors.

5

 

 2 Investment Advisers Act of 1940 (“Advisers Act”) Rule 206(4)-2 (“Custody Rule”) requires investment advisers that are 

registered or required to be registered with the SEC and that have custody of their clients’ funds or securities to safeguard 

those funds against theft, loss, misappropriation, or financial reverses of an adviser. Securities Exchange Act of 1934 

(“Exchange Act”) Rule 15c3-3 requires SEC-registered broker-dealers to obtain and maintain possession and control of all 

fully paid securities and excess margin securities. 

3 Investment advisers and certain broker-dealers have an obligation to promptly transmit investor checks. See Custody Rule 

and Exchange Act 15c3-3-(k)(2), respectively. Commission staff have addressed certain provisions of the broker-dealer 

financial responsibility rules and investment adviser Custody Rule, among other things. This Risk Alert provides a list of 

SEC resources for references to COVID-19-related temporary relief and other topics discussed herein. 

4 See, e.g., Congressional Research Services, In Focus: Withdrawals and Loans from Retirement Accounts for COVID-19 

Expenses (updated March 27, 2020) and SEC Public Statement, Chairman Clayton, “Confirmation of June 30 Compliance 

Date for Regulation Best Interest and Form CRS” (June 15, 2020) (“The Coronavirus Aid, Relief and Economic Security 

(CARES) Act allows eligible participants in certain tax-advantaged retirement plans to take early distributions of up to 

$100,000 during this calendar year without being subject to early withdrawal penalties and with an expanded window for 

paying the income tax they owe on the amounts they withdraw.”).

5 See, e.g., FINRA Rules 2165 (FINRA exploitation rule) and 4512(a)(1)(F) (FINRA rule on trusted contact person) and SEC 

Office of the Investor Advocate, “How the SEC Works to Protect Senior Investors” (May 2019).
3

B. Supervision of Personnel

Firms have an obligation to supervise their personnel, including providing oversight of 

supervised persons’ investment and trading activities.6 A Firm’s supervisory and compliance 

program should include policies and procedures that are tailored to its specific business activities 

and operations and should be amended as necessary to reflect the Firm’s current business 

activities and operations.7

As Firms need to make significant changes to respond to the health and economic effects of 

COVID-19 – such as shifting to Firm-wide telework conducted from dispersed remote locations,

dealing with significant market volatility and related issues, and responding to operational,

technological, and other challenges – OCIE encourages Firms to closely review and, where 

appropriate, modify their supervisory and compliance policies and procedures. 

For example, Firms may wish to modify their practices to address:

• Supervisors not having the same level of oversight and interaction with supervised 

persons when they are working remotely. 

• Supervised persons making securities recommendations in market sectors that have

experienced greater volatility or may have heightened risks for fraud.

8

• The impact of limited on-site due diligence reviews and other resource constraints

associated with reviewing of third-party managers, investments, and portfolio holding 

companies. 

• Communications or transactions occurring outside of the Firms’ systems due to personnel 

working from remote locations and using personal devices.

 6 Advisers Act Rule 206(4)-7 (the “Compliance Rule”) requires SEC-registered investment advisers to adopt and implement 

written policies and procedures that are reasonably designed to prevent violations of the Advisers Act. Advisers Act Section 

203(e)(6) also authorizes the Commission to institute proceedings to determine whether it is in the public interest to 

sanction an investment adviser if it has failed reasonably to supervise a person subject to its supervision, with a view to 

preventing violations of the provisions of such statutes, rules, and regulations by that person. FINRA Rule 3110 requires 

FINRA member broker-dealers to establish and maintain a system to supervise the activities of each associated person that is 

reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA 

rules. Strong compliance programs incorporate legal requirements and essential controls that are periodically reviewed and 

updated. 

7 Advisers Act Rule 206(4)-7(b) requires investment advisers to review, at least annually, the adequacy of their established 

policies and procedures. FINRA Rule 3110(b)(1) states that “each member shall establish, maintain, and enforce written 

procedures to supervise the types of business in which they engage.” See also FINRA Regulatory Notice 20-16: Transition 

to Remote Work and Remote Supervision (May 28, 2020) (sharing practices implemented by FINRA member firms to, for 

example, supervise in a remote work environment during the pandemic). Significant compliance events, changes in 

business arrangements, and regulatory developments, among other things, may lead to the need for a review.

8 See, e.g., SEC Press Release 2020-11, SEC Charges Companies and CEO for Misleading COVID-19 Claims (May 14, 

2020) (The SEC alleges that two firms “sought to take advantage of the COVID-19 crisis by misleading investors about 

their ability to provide medical solutions.”). See also FINRA Notice to Members 20-14: Sales Practice Obligations with 

Respect to Oil-Linked Exchange-Traded Products (May 15, 2020). 
4

• Remote oversight of trading, including reviews of affiliated, cross, and aberrational 

trading, particularly in high volume investments.

• The inability to perform the same level of diligence during background checks when 

onboarding personnel – such as obtaining fingerprint information and completing

required Form U4 verifications – or to have personnel take requisite examinations.9

C. Fees, Expenses, and Financial Transactions

Firms have obligations relating to considering and informing investors about the costs of services

and investment products, and the related compensation received by the Firms or their supervised 

persons.10 The recent market volatility and the resulting impact on investor assets and the related 

fees collected by Firms may have increased financial pressures on Firms and their personnel to 

compensate for lost revenue. While these incentives and related risks always exist, the current 

situation may have increased the potential for misconduct regarding:

• Financial conflicts of interest, such as: (1) recommending retirement plan rollovers to 

individual retirement accounts, workplace plan distributions, and retirement account 

transfers into advised accounts or investments in products that the Firms or their 

personnel are soliciting; (2) borrowing or taking loans from investors and clients; and 

(3) making recommendations that result in higher costs to investors and that generate

greater compensation for supervised persons, such as investments with termination fees 

that are switched for new investments with high up-front charges or mutual funds with 

higher cost share classes when lower cost share classes are available.

• Fees and expenses charged to investors, such as: (1) advisory fee calculation errors, 

including valuation issues that result in over-billing of advisory fees;11 (2) inaccurate 

calculations of tiered fees, including failure to provide breakpoints and aggregate household accounts; and (3) failures to refund prepaid fees for terminated accounts.

 9 See, e.g., Order Under Section 17A and Section 36 of the Securities Exchange Act of 1934 Extending Temporary Exemption 

from Specified Provisions of the Exchange Act and Certain Rules Thereunder, Exchange Act Release No. 89170 (June 26, 

2020) and related FINRA FAQs. 

10 Advisers Act Section 206 imposes a fiduciary duty on investment advisers. See, e.g., Commission Interpretation Regarding 

Standard of Conduct for Investment Advisers (“Fiduciary Interp.”), Advisers Act Release No. 5248 (June 5, 2019) (“The 

cost (including fees and compensation)... associated with investment advice would generally be one of many important 

factors... to consider when determining whether a security or investment strategy involving a security or securities is in the 

best interest of the client.”). Regulation Best Interest requires a broker-dealer, when making a recommendation of any 

securities transaction or investment strategy involving securities to a retail customer, to act in the best interest of the retail 

customer and not place its interests ahead of the retail customer. Among other obligations, a broker-dealer must understand 

and consider the potential costs associated with a recommendation, make relevant disclosures and address its conflicts of 

interest associated with the cost of investing. See Exchange Act Rule 15l-1(a)(2)(ii) and Regulation Best Interest: The 

Broker-Dealer Standard of Conduct, Exchange Act Release No. 86031 (June 5, 2019) (“Reg BI Adopting Release”) (A 

broker-dealer’s general obligation under Regulation Best Interest is satisfied only if the broker-dealer complies with four 

specified component obligations, relating to disclosure, care, conflicts of interest, and compliance.).

11 The Commission has brought enforcement actions against advisers for causing the overvaluation of certain holdings 

maintained in clients’ accounts, which also may result in clients paying higher asset-based advisory fees and inflated

portfolio performance returns (see, e.g., In re Semper Capital Management, Advisers Act Release No. 5489 (April 28, 2020) 

(settled)).
5

Firms may wish to review their fees and expenses policies and procedures and consider 

enhancing their compliance monitoring, particularly by: 

• Validating the accuracy of their disclosures, fee and expense calculations, and the 

investment valuations used.

• Identifying transactions that resulted in high fees and expenses to investors, monitoring 

for such trends, and evaluating whether these transactions were in the best interest of 

investors. 

• Evaluating the risks associated with borrowing or taking loans from investors, clients,

and other parties that create conflicts of interest, as this may impair the impartiality of 

Firms’ recommendations.

12 Also, if advisers seek financial assistance, this may result in 

an obligation to update disclosures on Form ADV Part 2.13 

D. Investment Fraud

The staff has observed that times of crisis or uncertainty can create a heightened risk of 

investment fraud through fraudulent offerings. Firms should be cognizant of these risks when 

conducting due diligence on investments and in determining that the investments are in the best 

interest of investors.

14 Firms and investors who suspect fraud should contact the SEC and report 

the potential fraud.

E. Business Continuity

Certain firms are required to adopt and implement compliance policies and procedures that are 

reasonably designed to prevent violation of the federal securities laws.15 As part of this process, 

Firms should consider their ability to operate critical business functions during emergency 

events.

16 Due to the pandemic, many Firms have shifted to predominantly operating from 

 12 See, e.g., SEC Staff Speech, Peter Driscoll, “How We Protect Retail Investors” (April 29, 2019). The Commission has 

brought enforcement actions against advisers for fraudulently inducing clients to invest in their businesses and for

recommending investments with undisclosed financial incentives for the firms, their supervised persons, or both (see, e.g., In 

re Fieldstone Financial Management Group, LLC, Advisers Act Release No. 5263 (July 1, 2019) (settled)). 

13 See Division of Investment Management Coronavirus (COVID-19) Response FAQs, Question II.4. (Posted April 27, 2020).

14 The SEC has suspended trading for many issuers due to false and misleading claims (e.g., purporting to have cures, 

vaccines, or curative drugs for COVID-19 infections, or access to personal protective equipment, testing, or other 

preventatives such as hand sanitizers). Firms have an obligation to provide advice that is in the best interest of each 

investor, which requires a reasonable understanding of both the investor and the proposed investment. See Fiduciary Interp; 

Reg BI Adopting Release; FINRA Notice to Members 20-08: Business Continuity Planning (March 9, 2020); and Exchange 

Act Rule 15l-1 (provides a new best interest standard for broker-dealer recommendations to retail investors).

15 See supra notes 6 and 7. 

16 Id. In adopting the Compliance Rule, the Commission stated that an investment adviser’s compliance policies and 

procedures should generally address business continuity plans. FINRA Rule 4370 requires broker-dealers that are members 

of FINRA to create and maintain a written business continuity plan identifying procedures relating to an emergency or 

significant business disruption. 
6

remote sites, and these transitions may raise compliance issues and other risks that could impact 

protracted remote operations, including:17

• Firms’ supervisory and compliance policies and procedures utilized under “normal 

operating conditions” may need to be modified or enhanced to address some of the 

unique risks and conflicts of interest present in remote operations. For example, 

supervised persons may need to take on new or expanded roles in order to maintain 

business operations. These and other changes in operations may create new risks that are 

not typically present.

• Firms’ security and support for facilities and remote sites may need to be modified or 

enhanced. Relevant issues that Firms should consider include, for example, whether: (1) 

additional resources and/or measures for securing servers and systems are needed, (2) the 

integrity of vacated facilities is maintained, (3) relocation infrastructure and support for 

personnel operating from remote sites is provided, and (4) remote location data is 

protected. If relevant practices and approaches are not addressed in business continuity 

plans and/or Firms do not have built-in redundancies for key operations and key person

succession plans, mission critical services to investors may be at risk. 

OCIE encourages Firms to review their continuity plans to address these matters, make changes 

to compliance policies and procedures, and provide disclosures to investors if their operations are 

materially impacted, as appropriate. 

F. Protection of Sensitive Information

Firms have an obligation to protect investors’ personally identifiable information (“PII”).18 The 

staff has observed that many Firms require their personnel to use videoconferencing and other 

electronic means to communicate while working remotely. While these communication methods 

have allowed Firms to continue their operations, these practices create:

• Vulnerabilities around the potential loss of sensitive information, including PII.

19 These

risks are attributed to, among other things: (1) remote access to networks and the use of 

web-based applications; (2) increased use of personally-owned devices; and (3) changes 

in controls over physical records, such as sensitive documents printed at remote locations

and the absence of personnel at Firms’ offices. 

 17 See, e.g., Chairman Clayton testimony, “Capital Markets and Emergency Lending in the COVID-19 Era” (June 25, 2020) 

(“OCIE has continued its efforts in examining registered entities for compliance with the federal securities laws, with a 

focus on the resiliency of critical market systems and verification of investor assets with financial professionals. Since midMarch, OCIE has supplemented its examinations with hundreds of outreach calls to registrants nationwide to assess the 

impact of COVID-19 on operational resiliency and business continuity planning.”).

18 The Safeguards Rule of Regulation S-P requires every SEC-registered broker-dealer and investment adviser to adopt written

policies and procedures to address administrative, technical, and physical safeguards for the protection of investor records 

and information. The Identity Theft Red Flags Rule of Regulation S-ID requires certain firms to develop and implement a 

written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft in connection with

the opening of a covered account or any existing covered account. 

19 National Institute of Standards Technology, ITL Bulletin: Security for Enterprise Telework, Remote Access, and Bring Your 

Own Device (BYOD) Solution (March 2020).
7

• More opportunities for fraudsters to use phishing and other means to improperly access 

systems and accounts by impersonating Firms’ personnel, websites, and/or investors.20

OCIE recommends that Firms pay particular attention to the risks regarding access to systems, 

investor data protection, and cybersecurity. In particular, Firms should assess their policies and 

procedures and consider:

• Enhancements to their identity protection practices, such as by reminding investors to 

contact the Firms directly by telephone for any concerns about suspicious 

communications and for Firms to have personnel available to answer these investor 

inquiries. 

• Providing Firm personnel with additional trainings and reminders, and otherwise 

spotlighting issues, related to: (1) phishing and other targeted cyberattacks; (2) sharing 

information while using certain remote systems (e.g., unsecure web-based video chat); 

(3) encrypting documents and using password-protected systems; and (4) destroying

physical records at remote locations.

• Conducting heightened reviews of personnel access rights and controls as individuals

take on new or expanded roles in order to maintain business operations. 

• Using validated encryption technologies to protect communications and data stored on all

devices, including personally-owned devices.

• Ensuring that remote access servers are secured effectively and kept fully patched.

• Enhancing system access security, such as requiring the use of multifactor authentication.

• Addressing new or additional cyber-related issues related to third parties, which may also 

be operating remotely when accessing Firms’ systems.

21

III. Conclusion

OCIE encourages Firms to remain informed regarding fraudulent activities that may affect 

investors’ assets and, when fraud is observed, to report such activities. Below are some SEC 

resources that may be helpful. 

Reporting Fraudulent Activities. Submit a tip or ask a question using the SEC’s tips, complaints 

and referral system or by phone at (202) 551-4790.

Reaching out to the SEC’s Office of Investor Education and Advocacy. Ask questions by phone 

at 1-800-732-0330 or using this online form, or email at Help@SEC.gov.

 20 Id. See also OCIE, Risk Alert: Cybersecurity: Ransomware Alert (July 10, 2020) and Department of Homeland Security, 

Cybersecurity and Infrastructure Security Agency Alert: Enterprise VPN Security (updated April 15, 2020) (When 

personnel access non-public electronic resources from external locations, the data security protections may be compromised 

by, among other things, the remote access methods used.).

21 See, e.g., OCIE, Cybersecurity and Resilience Operations (January 2020).
8

Staying Informed Regarding the SEC’s Response to COVID-19 and Related Activities:

• SEC’s Coronavirus (COVID-19) Response.

• COVID-19 Quick Reference Guide for Investors and Market Participants.

• Information regarding fighting COVID-19-related financial fraud.

• Investor Alert: Frauds Targeting Main Street Investors.

• Frequently Asked Questions Concerning the COVID-19 Pandemic and the Broker-Dealer 

Financial Responsibility Rules.

• Division of Investment Management Coronavirus (COVID-19) Response FAQs.

• List of recent trading suspensions.

This Risk Alert is intended to highlight for firms risks and issues that OCIE staff has identified. In addition, this 

Risk Alert describes risks that firms may consider to (i) assess their supervisory, compliance, and/or other risk 

management systems related to these risks, and (ii) make any changes, as may be appropriate, to address or 

strengthen such systems. Other risks besides those described in this Risk Alert may be appropriate to consider, 

and some issues discussed in this Risk Alert may not be relevant to a particular firm’s business. The adequacy of 

supervisory, compliance and other risk management systems can be determined only with reference to the profile 

of each specific firm and other facts and circumstances.