The popularity of on-line trading and growth in the number of broker- dealers with on-line channels has significantly changed the way many investors trade and manage their savings and investments. Last year alone, broker-dealers handled an average of about one million on-line trades per day from individual investors. In regulating the activities of all broker- dealers, NASD and NYSE have a different role from SEC, as SEC’s general role is to maintain the integrity of the securities markets. NASD and NYSE are membership-based SROs, and their general role has been to oversee their members’ activities. Among other things, NYSE and NASD, (through NASDR) regulate market facilities, write rules governing member conduct (with SEC approval), examine members for violations of securities laws and SRO rules, and discipline members that fail to follow such laws and rules. SEC, among other things, supervises the SROs to ensure that they use their regulatory powers effectively and responsibly. SEC conducts this oversight by reviewing SRO rules, disciplinary actions, and other activities. It also inspects SROs to ensure compliance with the Securities Exchange Act of 1934 (the Exchange Act). Both SEC and the SROs conduct examinations of broker-dealers. A primary objective of the SEC’s broker- dealer examination program is to provide oversight of the SROs that are responsible for routinely examining their member firms. SEC and the SROs maintain examination procedures that provide guidelines for their respective staff in conducting examinations of broker-dealers. In our previous report, we noted that on-line trading is sometimes confused with day trading. We noted that a significant difference between on-line trading and day trading is access to the markets. On-line investors access the markets through Internet service providers and brokers’ order routing systems, a process that can take several seconds or minutes, while day traders have virtually direct access to the markets. At the time we issued our report, the differences between on-line trading and day trading were diminishing as these industries developed. For example, some on- line broker-dealers now offer their active traders services similar to those already provided to day traders, including news, price quotes, and customized software. Since we issued our previous report, NASD and NYSE have adopted rules that include definitions of day trading that are broader than the definition used in our previous report. For example, one definition describes day trading as overall trading characterized by the regular transmission by a customer of intraday orders to effect both the purchase and the sale of the same security or securities in the same day. Thus, some active on-line traders also meet the definition of a day trader. According to an SEC official, a small number of on-line account holders are likely to be responsible for the majority of trades made on-line. To assess the extent to which the on-line trading market has changed since our previous report, we gathered industry data from 1999 and 2000 on on- line trading accounts and market volume and analyzed those trends for changes in activity. We used industry data from J.P. Morgan H&Q for this purpose. We also collected data from SEC, NYSE, and NASDR on complaints related to on-line trading. We analyzed these data to identify trends in the volume and nature of complaints in 1999 to 2000. During this period, NYSE began using an on-line trading complaint category. SEC began categorizing on-line trading complaints in 1997. To better understand the data and their reliability, we determined how the data are gathered and analyzed and collected regulators’ opinions as to the limitations of the data. To understand regulators’ efforts to respond to our previous recommendations, we reviewed the rules, OCIE recommendations, and other guidance created since our May 2000 report. We examined these documents for specific criteria and determined the extent to which we believed the actions taken were consistent with both the substance and form of the recommendations in our previous report. We met with officials from SEC, NYSE, NASDR, the Securities Industry Association (SIA), and three larger firms to discuss their perspectives on the newly issued rules, guidance, and recommendations. We also reviewed the public Web sites of a limited number of small, medium, and large broker-dealers that offer on- line trading services to determine what these firms were doing in terms of providing disclosure to on-line investors. To assess the extent to which the regulators’ actions are enforceable and the likelihood that the regulators will identify instances of noncompliance, we determined the legal force behind the newly created rules, guidance, and recommendations and the other means regulators use to encourage cooperation from broker-dealers. We also determined the extent to which the regulators considered the newly created criteria in their examination procedures and modules. To make this determination, we reviewed NASDR’s, NYSE’s, and SEC’s examination modules for procedures that address the disclosure of margin risk, order routing or trade execution, privacy policies, trading concepts and risks, and risk of systems outages and actual outages, or operational capability. We met with officials from SEC, NASDR, and NYSE to discuss these issues and understand how they are considered in examinations and otherwise enforced. We conducted our work in New York, NY and Washington D.C. between November 2000 and June 2001 in accordance with generally accepted government auditing standards. According to industry data, the on-line trading industry has changed significantly during 1999 and 2000, with rapid growth in both accounts and trading activity giving way to a period of diminishing growth in the number of accounts and declining trading activity. The volume of complaints involving on-line trading generally followed a similar pattern during these 2 years, peaking in the first half of 2000 and then decreasing. The nature of these complaints has also changed, with complaints about access to accounts falling relative to complaints about margin position sellouts. In our earlier report, we reported that the number of firms offering on-line trading had grown from 37 in January 1997 to 160 in July 1999 and that many traditional brokers were planning to offer an on-line option to their customers. In its January 2001 report on on-line trading, SEC reported that over 200 broker-dealers were providing retail investors with the ability to trade on-line. During 1999 and 2000 the number of on-line brokerage accounts continued to grow, nearly doubling from 8.6 million in the first quarter of 1999 to 17.4 million in the second quarter of 2000, or more than 10 percent each quarter. Since then, the quarterly rate of increase has slowed to less than 6 percent (see fig. 1). On-line trading activity followed a somewhat different pattern, rising dramatically and then declining. The average volume of on-line trades grew from about 455,000 per day in the first quarter of 1999 to more than 1.24 million per day in the first quarter of 2000—an increase of 173 percent. However, after the first quarter of 2000 the average volume of on- line trades fell. Investors made an average of about 900,000 trades per day in the last quarter of 2000, a drop of about 28 percent. Despite the decline in 2000, on-line trading remained well above 1999 levels (see fig. 2). The growth of on-line trading activity outpaced the growth of overall retail trading activity from the first quarter of 1999 to the first quarter of 2000 but then began to decline, falling more than conventional trading through brokers. On-line retail stock trading increased from around 29 percent in the first quarter of 1999 to around 40 percent in the first quarter of 2000, and by the end of the year around 30 percent of all retail stock trades were being performed on-line. One measure of investors’ dissatisfaction with on-line broker-dealers is the number of complaints investors file with SEC and other regulatory authorities. During the past 2 years, the number of complaints SEC has received have followed a pattern somewhat similar to that of trading volume, reaching a peak in the first half of 2000 and then declining. In fact, the surge in such complaints in the first half of 2000 outpaced the increase in trading volume from the previous 6-month period. For 2000, SEC received 27,920 complaints, of which 4,271—or 15 percent—were classified as on-line complaints. While the total number of on-line complaints for 2000 increased over those of 1999, these complaints declined dramatically during the second half of the year, falling to 42 percent of their January to June levels. In the last quarter of 2000, SEC received approximately the same number of on-line complaints it received during the last quarter of 1999 (see fig. 3). Overall, the number of complaints NASDR received that involved on-line trading firms followed a similar pattern. According to NASDR, although it does not specifically track complaints as on-line issues, the number of complaints NASDR received involving on-line firms peaked in the first quarter of 2000. During that quarter, 950 complaints, or 44 percent of the total complaints it received, involved on-line trading firms. By the fourth quarter of 2000, the number of on-line complaints received had fallen to 427, or 33 percent of the 1,275 total it received. In addition to compiling complaint data, NASDR also compiles statistics on arbitration disputes between broker-dealers and customers, including disputes arising from on- line trading. The number of such disputes increased from 55 to 214 from 1999 to 2000 but it is expected to decline this year. NYSE saw the same trend in complaints. During the first quarter of 2000, NYSE member firms reported 7,625 on-line trading complaints, or 27 percent of the total complaints received. By the fourth quarter of 2000, the number of complaints had fallen to 1,737, or 11 percent of the 15,371 total it received. Some of the growth in complaints about on-line trading during the first half of 2000 may be attributed to growth in the volume of on-line trading. We took these factors into account by comparing the volume of complaints involving on-line trading with the volume of on-line trading (see fig. 4). While the volume of daily on-line trades almost doubled between the first quarter of 1999 and the last quarter of 2000, the number of complaints to SEC fell by almost one half. In the first quarter of 1999, there were about 4 times as many complaints per 100,000 on-line trades as there had been in the last quarter of 2000. On-line investors who are dissatisfied with the processing of an order or the handling of their account have several options for filing a complaint. They can file a complaint directly with their broker-dealer, with SEC, NASDR, or NYSE (if their brokerage firm is a member). SEC and SROs have their own procedures for compiling complaints. For example, SEC sorts on-line trading complaints into 1 of 26 categories. Many brokerage firms now have a link to the SEC’s investor education Web site, which provides a convenient form for filing a complaint on-line. Investors can also file a complaint through the NASDR Web site. NASD and NYSE rules require member firms to report complaints to regulators, and NYSE added an on-line complaint category during 1999. While the pattern of complaints over this period may be instructive in understanding the quality of service broker-dealers provided, these data should be viewed with some caution, for several reasons. First, complaints are not necessarily violations. For example, regulators told us that a lack of understanding of margin agreements leads some customers to complain that stocks have been sold without their permission—even though investors had agreed to such a condition by signing a margin agreement when opening the account. Second, the number of complaints depends to some degree on how easily investors can file them. Some brokerage firms now have direct links to the recently revised SEC Web page with its on- line complaint form. Thus the increased ease with which investors may submit complaints may result in more complaints being filed than would have been the case otherwise. Third, the way data are categorized can affect the number and composition of complaints counted. Each complaint is assigned a single code, even if the complaint involves multiple allegations of rule and regulation violations. The composition of complaints to SEC involving on-line trading was somewhat different in 2000 than it was in 1999. In both years, complaints involving failure or delay in processing orders and difficulty accessing accounts were among the most common; but in 2000, complaints involving margin position sellouts and transfer of accounts increased dramatically. Table 1 compares the 10 most common on-line complaints filed with SEC in 2000 with complaints filed in 1999. The single most frequent complaint to SEC involving on-line trades during 2000 was failure or delays in processing orders—typically a buy or sell order was either not executed by a broker or was not executed in a timely fashion. Changes in the composition of complaints reflect, to some extent, changes in market and industry conditions. In 1999, when security prices were rising, margin calls were not as common as they were in 2000, when security prices fell. This fact helps explain why complaints about margin position sellouts increased by 200 percent in 2000. The 50-percent decline in complaints about accessing accounts that occurred even though the number of accounts was growing could be due to the increased reliability of Internet service providers and on-line trading technology or to declining trading volume. Similarly, complaints involving the transfer and opening of accounts could have grown in part because the number of accounts continued to grow. In our earlier report, we noted that many firms were experiencing recurrent delays and outages in their on-line trading systems. Industry representatives reported that they have invested heavily to improve performance, and broker-dealers told us that delays and outages are less frequent. These factors may explain the decline in complaints involving access. While many brokerage firms reported having made substantial investments to enhance system performance in the last year, it is too early to say whether these investments will prevent delays and outages during sustained periods of high trading volume. The extent to which regulators’ actions have addressed the recommendations in our earlier report varies by recommendation in terms of substance, form, and completeness (see table 2). Regulators have initiated action that address the substance of almost all of our recommendations by creating rules, recommended practices, and other forms of guidance. For example, SEC has adopted rules that are consistent with our recommendations on privacy and best execution. Regulation S-P, adopted as a result of requirements in the Gramm-Leach-Bliley Act (GLBA), is consistent with our recommendation on privacy considerations, while SEC Rules 11Ac1-6 and 11Ac1-5 promulgated under the Exchange Act address trade execution disclosure. In addition, NASDR has adopted Rule 2341, which requires broker-dealers to disclose the risk of trading on margin. OCIE staff also issued a report in January 2001— ”Examinations of Broker-Dealers Offering Online Trading: Summary of Findings and Recommendations”—that makes recommendations in each of the areas in which we made recommendations. Some of the actions regulators have taken are fairly comprehensive, covering all the criteria that we recommended. However, in the areas of trading risk and operational capability, regulators have not fully met the substance of our recommendations. That is, neither SEC nor the SROs require broker-dealers to disclose trading risk to all of their on-line trading customers. In addition, while SEC staff is considering recordkeeping requirements in the area of operational capability, at present OCIE only recommends that broker-dealers consider maintaining such records. In most cases where regulators have taken action, broker-dealers are not required to disclose information on their Web site as we recommended and sometimes have the option of disclosing information either electronically or through paper delivery. Generally, SEC’s position is that until electronic media becomes more universally accessible, market intermediaries with delivery obligations are required to continue delivering paper copies of certain documents. However, individuals who trade on-line may prefer to review information given to them on-line and therefore benefit from disclosures made on Web sites. Where appropriate, such Web site disclosure would be most useful where its delivery is tailored to individual investors. In our previous report, we recommended that SEC take action on the issue of protecting investors’ privacy because of the increased emphasis given to these issues under GLBA. We reported that SEC’s examinations found that many firms had implemented measures to address customer privacy and confidentiality, but some firms’ privacy policies did not disclose that they might share information with affiliated vendors offering related financial services. We also noted SEC’s finding that only a limited number of firms used a second layer of password protection or required customers to periodically change their password. At the time that we made these recommendations, SEC had already published for notice and comment proposed Regulation S-P, a privacy regulation that requires broker-dealers to provide investors with a notice of their privacy policies and practices. Regulation S-P was required by Section 504 of GLBA, which limited the instances in which a broker-dealer could disclose nonpublic personal information about a consumer to nonaffiliated third parties and required SEC with certain other regulators to adopt consistent and comparable regulations requiring the institutions that they regulate to disclose their privacy policies. Since our report was issued, Regulation S-P has become effective. It requires brokerage firms to adopt policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information. The OCIE report includes recommended security practices that firms should consider in adopting such policies and procedures. Regulation S-P requires broker-dealers to protect their customers’ privacy by prohibiting firms from disclosing nonpublic personal information to a nonaffiliated third party without first providing customers with a “clear and conspicuous” notice that states the broker’s privacy policies and practices and gives the customer the chance to “opt out.” It allows broker- dealers to provide privacy notices either in writing or if the customer agrees, electronically. For customers who conduct transactions electronically, Regulation S-P states that an appropriate way of notifying customers is to post the notice on the firm’s electronic site; in turn, customers must acknowledge receiving the notice before buying a particular financial product or service. However, on-line traders may not necessarily receive disclosure on Web sites. Regulation S-P does not require the broker-dealers to post the disclosure notice on their Web sites. According to an SEC official, Regulation S-P was adopted to conform with the requirements mandated by GLBA and had to be consistent with the regulations adopted by the other agencies. Regulation S-P also requires brokers to adopt policies and procedures that create administrative, technical, and physical safeguards to protect customers’ records and nonpublic information. While the rule sets no specific criteria for these safeguards, it does state that these policies and procedures must be reasonably designed to ensure security and confidentiality, guard against any anticipated threats or hazards to the security or integrity of customer information, and restrict unauthorized access to customer information. Regulation S-P allows firms to adopt the policies and procedures that are best suited to the broker-dealers’ actual operations. The OCIE report provides recommendations for adopting security policies and procedures in the areas of encryption technology, firewalls, passwords and the use of cookies. For example, in its recommendation on encryption, OCIE encouraged firms to evaluate the security of their Web site and E-mail systems and consider developing procedures to reduce the likelihood that personal information will be sent through unsecured transmissions. Regarding firewalls, OCIE encouraged firms to consider implementing a periodic review of their security in light of changes in technology and the introduction of new security methods. Further, OCIE recommended that firms provide guidelines and training to employees that explain and provide examples of what is and is not permissible in the areas of the home use of the computer, E-mail, chat rooms, bulletin boards and Web sites. In our previous report, we recommended that broker-dealers be required to include accurate and complete information on the quality of trade execution on their Web sites. In making this recommendation, we cited SEC’s finding that some broker-dealers were not meeting their best execution requirements—that is, they were not seeking the most advantageous terms for their customers (i.e., price, speed, and the likelihood of execution). We also noted that the Chairman of SEC had stated that investors would benefit greatly from more information about execution quality. Since our report was published, SEC has adopted two rules designed to improve the way trade execution and routing practices are disclosed. Rule 11Ac1-6 requires that by October 2001, broker-dealers publicly disclose quarterly the identity of the market centers to which they route a significant percentage of their orders. Broker-dealers must also reveal the nature of their relationships with these market centers, including any internalization or payment for order flow arrangements that could create a conflict of interest between the broker-dealer and its customers. Broker- dealers are also required to post reports disclosing where they route orders on a Web site that is free and readily accessible to the public, give customers a written copy of this information on request, and notify customers annually that a written copy is available on request. SEC has interpreted the disclosure requirements to state that the information must appear on a broker-dealer’s Web site or be accessible via a hyperlink to the Web site. Finally, the new rule requires that brokers tell customers who ask where individual orders were routed for execution. Companion Rule 11Ac1-5 requires that market centers make monthly electronic disclosures of information about the quality of their executions on a stock-by-stock basis. This disclosure is designed to provide information about the way market orders of various sizes are executed relative to public quotes and about effective spreads. Together, Rules 11Ac1-6 and 11Ac1-5 provide improved information for investors to determine where their orders are being sent and how well their trades are being executed at such locations. OCIE’s report not only provides guidance but also reminds broker-dealers of existing legal requirements regarding best execution. The report states, for instance, that “a broker-dealer must regularly and rigorously examine execution quality likely to be obtained from the different markets or market makers trading a security.” In addition, firms are also advised to document the steps they take to comply with best execution obligations. In April 2001, NASD also issued Notice 01-22 to its members reiterating their best execution obligations and providing guidance to members concerning existing best execution requirements. A broker-dealer must evaluate whether opportunities exist for obtaining improved executions of customer orders. The Notice also discusses how SEC Rules 11Ac1-5 and 11Ac1-6 will assist members in meeting their regular and rigorous examination obligation. According to SEC, creating a transparent process for determining the quality of trade execution in the securities market should spur more vigorous competition and provide the best possible prices for investors. The Acting SEC Chairman recently stated that optimally the increased disclosure these rules require, could motivate brokers and order execution centers to continually improve both services and prices for investors, leading to a marketwide improvement in execution quality. In our previous report, we recommended that regulators ensure that broker-dealers with on-line trading systems include accurate and complete information on their Web sites about margin requirements. We noted that SEC had determined from customer complaints that many investors trading on-line did not understand their broker-dealer’s margin requirements. We also found that many broker-dealers did not provide margin information for investors on their Web sites. Investors might not know, for instance, that they can lose more money than they deposit in a margin account if the securities purchased on margin decline in value. They also might not be aware that brokers have the right to force the sale of securities if the value of the cash and securities in the investor’s account falls below the amount required as collateral for the margin loan (usually 30—50 percent for on-line accounts). “It is important that you fully understand the risks involved in trading securities on margin. These risks include the following: You can lose more funds than you deposit in the margin account. A decline in the value of securities that are purchased on margin may require you to provide additional funds to the firm that has made the loan to avoid the forced sale of those securities or other securities in your account(s). The firm can force the sale of securities or other assets in your account(s). If the equity in your account falls below the maintenance margin requirements or the firm’s higher “house” requirements, the firm can sell your securities or other assets in any of your accounts held at the firm to cover the margin deficiency….without contacting you….Most firms will attempt to notify their customers of margin calls, but they are not required to do so…. You are not entitled to choose which securities …in your account(s) are liquidated or sold to meet a margin call….The firm can increase its “house” maintenance margin requirements at any time…. you are not entitled to an extension of time on a margin call.” Broker-dealers can develop their own disclosure statements, provided that they are substantially similar to the sample and incorporate all the relevant concepts. OCIE’s report describes the NASD margin rule and recommends that broker-dealers also inform investors that some securities have higher margin requirements and provide an explanation of how the actual interest rate for margin loans is calculated. The new NASD Rule 2341 and OCIE report give broker-dealers the option of providing the disclosure either in writing or electronically. Although we believe that these margin disclosures provide substantial information to investors regarding the risks of trading on margin, they do not fully meet our recommendation that the information be available on broker-dealer’s Web sites. If broker-dealers choose to provide these disclosures in paper form only, on-line traders may not have this information readily accessible when they trade on-line. For customers trading on margin, such Web site disclosure would be most useful where its delivery is tailored to individual investors. In addition, general Web site disclosure would make such information more readily available to other on-line investors who are considering trading on margin. In a review that occurred prior to the effective date of NASD’s margin rule, SEC’s OCIE staff found that approximately one-third of the broker-dealers it examined did not provide customers with any information on margin requirements other than the margin agreement itself. Our review of a small number of broker-dealers’ Web sites (also done prior to the rules’ effective date) showed that some broker-dealers do not disclose margin risks on their sites. We noted, however, that other broker-dealers posted disclosures with language very similar to that required by the NASD rule prior to the rule’s compliance date of June 2001. We recommended that broker-dealers include accurate and complete information on trading risks on their Web site. In making our recommendation last year, we considered SEC complaints suggesting that many on-line investors may not understand the risks they are taking or the rules and procedures for trading. These include the risks of potential losses to on-line traders who do not understand the differences between market and limit orders and the effect of these different orders and trading volume on trade execution. In addition, we noted in our May 2000 report that SEC had received many complaints from on-line traders concerning access to shares of initial public offerings (IPO). Customers wanted more information on how on-line firms allocated IPO shares and methods of distributing IPO shares on-line. To date, however, neither SEC nor the SROs have required on-line broker- dealers to post information on trading risks on their Web sites. OCIE’s report, however, does make several recommendations in the area of investor education and disclosure. For example, it recommends that broker-dealers consider enhancing their Web sites to provide a basic explanation of securities trading, including definitions of each of the terms used on the order entry page that can be accessed from the trading screen. The report also states that the most helpful on-line brokerage Web sites provide a glossary that defines investment terms and explains that a market order may be executed at a higher or lower price than the one displayed on the Web site at the time the order is placed. SEC officials informed us that it has urged on-line broker-dealers to create links from their Web sites to the SEC’s investor education site, which provides information about the risks of on-line trading. According to an SEC official, a series of examinations showed that many broker-dealers voluntarily followed this advice, and we confirmed this finding during our review of a small number of broker-dealer sites. We also noted that while some firms offer a substantial amount of information on their Web sites, including definitions of key terms, the quality of this information varies. In addition, OCIE found in its review that some firms did not provide their customers with any information on trading risks. NASD issued Rule 2361, effective October 2000, requiring broker-dealers that promote a day-trading strategy to provide their noninstitutional customers a day-trading risk disclosure statement before opening a new account. As mentioned earlier, some on-line traders also meet the definition of a day trader and could benefit from this disclosure. The disclosure statement can be provided in writing or electronically and essentially describes the risks involved in day trading. For example, the statement explains that day trading is not appropriate for someone with limited resources and investment experience. It further explains that day trading requires in-depth knowledge of the securities markets and trading techniques and strategies and warns that a day trader should be familiar with a securities firm’s business practices, including the operation of the firm’s order execution system and procedures. However, because these disclosures do not apply to all on-line traders and may be provided in writing or electronically, the rule does not fully address the substance of our recommendation. In April 2000, SEC issued guidance to on-line broker-dealers conducting IPOs. In that release, SEC noted its concern that investors may not have access to all the information they need to fully understand the on-line public offering process. In its report, OCIE suggested that firms review the SEC release and provide customers with a full and accurate description of their on-line IPO allocation and distribution methods and the probability of receiving shares. In our previous report, we recommended that SEC require broker-dealers with on-line trading systems to maintain consistent records on systems delays and outages and their related causes and to disclose on their Web sites the potential for service disruptions. We also recommended that SEC monitor these records to ensure those firms have adequate capacity to serve their customers. We made these recommendations in part because on-line investors were experiencing problems with trading system outages and delays. At that time, officials from several large broker-dealers told us they anticipated more disruptions as firms expanded or upgraded their systems. Currently, neither SEC, NASD, nor NYSE has a specific rule requiring broker-dealers to maintain records of system delays and outages and their related causes and to disclose the potential for service disruptions on their Web sites, nor is there currently a definition of delays and outages. OCIE’s report does state that broker-dealers should consider maintaining records of capacity evaluations and systems slowdowns and outages, including details of the cause and impact. In addition, OCIE suggests that firms make every reasonable effort to inform customers of operational difficulties and provide all new customers with information in plain English on the risks of systems delays or outages. Although the OCIE report provides some useful guidance on operational capability issues, SEC has not yet defined what constitutes an outage or delay. According to an SEC official, SEC staff is currently considering proposing a rule that would implement operational capability standards for broker- dealers and address the problem of defining the term outage. That is, SEC staff is reconsidering a rule it had first proposed in March 1999. That proposed rule would have required, as a condition of conducting securities business, that broker-dealers have sufficient operational capacity to enter, execute, clear and settle orders, and deliver funds and securities promptly and accurately. In response to the March proposal, SEC received numerous comment letters generally stating that the proposed rule was “overly vague.” An SEC official recently stated that the new rule the staff is considering recommending to the Commission is more narrowly tailored than the March 1999 proposed rule. In addition, the rule that SEC staff is considering recommending will establish requirements for recordkeeping and disclosure of operational difficulties for all broker-dealers, not just on- line broker-dealers. SEC staff said other alternatives could include a requirement that broker-dealers maintain written policies and procedures showing that they plan for, test, and review their operational capabilities on an ongoing basis. The process of developing the rule is complicated by several factors. First, rapid technological changes make it difficult to develop rules for reporting capacity and performance issues that are flexible enough to keep pace with future technological changes without being overly vague and ineffective. Second, while standard measures of outages or delays might allow for consistent measurement by broker-dealers, as a matter of course, many firms have outages or delays that do not affect customers. Thus, it is important to have a meaningful definition that takes into account customers’ ability to place and execute orders. For example, the same amount of outage time for the same system component on two separate occasions could have very different impact on customer service, depending on how that system component affects the entire system. Industry representatives have told us that broker-dealers believe that such a rule governing operational capability is unnecessary. According to the Securities Industry Association, enormous market pressures, the current regulatory structure, which includes existing guidance on operational capabilities, and the “obligation to do better” for the customer provide sufficient protections for investors against spikes in volume. While existing guidelines do provide some guidance, they do not provide clear criteria that broker-dealers can use to measure systems slowdowns and outages. We understand that operational capability problems may not be as significant as they were in 1999 to 2000 because of a decline in trading volume and upgraded technology. According to NYSE officials, recent on- line trading volume has not experienced the same level of activity as it did during the first quarter of 2000; and therefore, upgraded systems may not have yet operated under those same market conditions. OCIE found that many of the firms they examined did not provide a plain English disclosure about the risks of system outages or slowdowns. They also found that about one-quarter of the firms examined either did not conduct assessments of their operational capabilities or had difficulty responding to questions about capacity. Thus, we continue to believe that broker-dealers maintaining consistent records about delays and outages could better inform investors about the potential for and the adverse effects of delays and outages. It could also assist securities regulators in assessing whether broker-dealers are complying with SEC guidance on systems capacity. Finally, having such a definition would assist broker- dealers adhere to OCIE recommendations about maintaining records of systems slowdowns and outages. Although we did not make a recommendation that broker-dealers provide clarification on the issue of suitability, we noted in our previous report that as firms begin to tailor advice to individual on-line investors, suitability issues might arise. We also reported that because more full- service broker-dealers were offering on-line channels, suitability was becoming an increasingly important issue. Under NASD rules, suitability becomes an issue when broker-dealers or registered representatives recommend securities to investors. NYSE rules establish certain responsibilities for broker-dealers that have been interpreted as imposing upon them suitability requirements. In its recently issued Notice to Members 01-23, NASDR provided guidance to help broker-dealers understand when suitability can become a concern in an electronic environment. The notice discusses some of the issues that may arise when an electronic communication from a broker-dealer to a customer results in a recommendation as defined by NASD’s suitability rule. It also provides guidelines to assist members in evaluating whether a particular communication could be viewed as a recommendation. NASDR noted that the more closely a broker tailors a communication to an individual, the more likely that communication will be viewed as a recommendation. The enforceability of the actions that have been taken since our last report, as well as the regulators’ likelihood of identifying weaknesses or deficiencies in broker-dealers’ behavior, depends on whether the actions are rules, guidance, or recommendations. Where the regulator has established rules, the regulator has the legal authority to take action if it finds that broker-dealers have violated them. Regulators may use other means to influence broker-dealers to follow OCIE recommended practices or other guidance. For example, in reporting the results of examinations, NASDR and SEC can cite broker-dealers for a “weakness” that is technically not a rule violation and ask the firm to take corrective action if a firm fails to adopt guidance or recommendations. NASDR and SEC officials stated that when firms are cited for a weakness, they typically correct the weakness in a timely manner. In addition, NASDR and the NYSE—self regulatory organizations (SRO)—have umbrella rules that allow them to take action against their members, even if no other specific rule is violated. NYSE officials stated that they can take action using these rules if one of its members consistently and pervasively fails to follow generally accepted business practices, and NASDR officials stated that they can take action if one of their members does not adhere to high standards of business conduct. The likelihood that regulators’ would identify weaknesses or deficiencies also depends in part on whether the actions they took were in the form of rules, guidance, or recommendation. Regulators plan to include means of identifying violations of the recently created rules in their examination procedures. However, examination procedures do not currently include steps to address all of the recommended practices from the January 2001 OCIE report, although SEC and NYSE plan to include such steps in future procedures. Examiners are routinely provided guidance affecting broker- dealers, such as the OCIE report. However, until OCIE recommended practices become the subject of examination procedures, regulators may be less likely to identify weaknesses in the areas addressed in this report. Where securities regulators have adopted rules that address our recommendations, SEC and SROs can take actions to compel broker- dealers to correct violations. If an SEC or SRO examination reveals that a broker-dealer is violating a rule, SEC and SROs may issue the broker- dealer a “deficiency letter” identifying the rule violation and outlining mandatory remedial steps. The regulators then ask for a written response and the broker-dealer must show that the deficiencies have been corrected. In other cases, if the violations are serious—for instance, if investor funds or securities are at risk—the examination staff at SEC or the SROs may refer the matter to the enforcement division at the appropriate agency. If a matter is referred to the SEC’s division of enforcement, the division determines whether to investigate the matter further, and whether, after a complete investigation, to recommend an enforcement action. Both SEC and SROs have the authority to bring a proceeding if a broker-dealer has violated the regulator’s rule. Thus, where SEC has promulgated rules and regulations addressing our recommendations, it can conduct investigations into possible violations and prosecute broker-dealers in civil suits in the federal courts and in administrative proceedings. In civil suits, SEC can seek an injunction prohibiting the broker from violating the SEC rule again. In addition, SEC can seek civil money penalties and the return of illegal profits, or disgorgement. Regarding brokers, dealers, and their employees, SEC may also institute administrative proceedings to revoke or suspend registration of broker-dealers or bar or suspend broker-dealer employees. If a matter is referred to an SRO’s division of enforcement, that division determines whether to investigate and bring an action against a broker- dealer. SROs can sanction their members for violating SEC’s rules as well as those of SROs. Thus, if NASDR responded to our recommendation with a rule, NASDR can take disciplinary actions against brokerage firms and its employees for violations. NASDR can also take disciplinary action for violations of many of SEC rules and regulations. Similarly, if NYSE promulgated rules in response to our recommendations, it can discipline violators (both brokerage firms and their employees). Both NASDR and NYSE can impose fines, censure, suspend, or expel violators and limit their activities, functions and operations, but only after an appropriate hearing. NASDR can also order restitution to injured customers. SEC and SROs can influence broker-dealers to follow recommendations or other guidance. While SEC may not generally bring enforcement proceedings if a broker-dealer fails to adopt an OCIE recommendation or follow guidance, it may raise such “weaknesses” as a result of the examination process. Specifically, SEC staff told us that if it learns during an examination that a broker-dealer has failed to adopt a recommended practice or guidance, SEC will generally provide the firm with a letter identifying the failure to adopt the practice or guidance as a “weakness” and request the broker-dealer to take remedial steps. In addition, if a broker-dealer fails to disclose a material fact to a customer or engages in other fraudulent conduct, including accepting orders without adequate facilities, SEC has the authority to bring an action against the broker for violating section 10 of the Exchange Act and Rule 10b-5 thereunder. NASDR may also send a letter to broker-dealers that fail to adopt a recommended practice or guidance. SEC and NASDR staff informed us that when a firm is asked to take remedial steps, the firm usually will do so in a timely manner. In fact, SEC staff provided us with copies of deficiency letters, including one in which it cited a broker-dealer for weaknesses in the areas of privacy, operational capability, and suitability—areas covered in the OCIE report. SEC also provided us with the firm’s response, which demonstrated how the broker-dealer corrected the identified weaknesses. NASDR and NYSE may also rely upon their “umbrella rules” to take action against their members. NYSE relies on these rules to take action when broker-dealers consistently and pervasively fail to follow generally accepted business practices. NASDR officials stated that they use these rules to take action when broker-dealers fail to adhere to high standards of commercial conduct. These rules allow an SRO to take action if one of its members or someone associated with its members fails to follow certain business practices. NASD Rule 2110 requires NASD members to observe high standards of commercial honor and just and equitable principles of trade in conducting brokerage business. Similarly, NYSE Rule 401 requires all members to adhere at all times to the principles of good business practice in the conduct of their business affairs. Additionally, NYSE Rule 476(a)(6) requires its members to conduct themselves consistently with just and equitable principles of trade. Further, NYSE Rule 342 and NASD Rule 3010 require that member organizations and employees be reasonably supervised to ensure compliance with securities laws and regulations. Both NYSE and NASDR officials explained that they routinely use these “umbrella rules” to bring actions against member firms that fail to adhere to good business practices. NYSE told us that they recently brought enforcement action against a large broker-dealer for consistently lacking the ability to process customer orders on-line while continuing to advertise its on-line services. In this NYSE panel decision, the broker-dealer consented to the findings that it engaged in conduct inconsistent with just and equitable principles of trade—NYSE Rule 476 and failed to maintain appropriate procedures for supervision and control of its Internet trading business—NYSE Rule 342. NYSE officials explained that although NYSE and SEC do not have specific operational capability rules, the repetitive and pervasive nature of the broker-dealer’s conduct rose to a level of failing to follow generally accepted business practices. Regulators plan to include in their examination procedures means of identifying violations of the rules that address our recommendations. Specifically, regulators plan to include in their examination procedures steps for testing compliance with the new rules covering disclosures of margin risk, best execution, and privacy, that were recently adopted but have compliance dates that have either recently or not yet occurred. In addition, NYSE is in the process of developing an on-line trading examination module that will cover not only the new rules, but also OCIE recommendations in its procedures. Similarly, according to OCIE staff, OCIE’s examination modules are being revised to reflect OCIE recommendations made in its January 2001 report in addition to recent rule changes. However, according to an OCIE official, examination procedures targeted to identifying instances where broker-dealers are not following OCIE recommendations are not expected to be as comprehensive as procedures intended to identify rule violations. While OCIE recommendations, including those for disclosing trading risks and risks of system outages, are part of current examination procedures, including SEC’s and NASDR’s on-line trading examination modules, examination procedures do not currently cover OCIE recommended practices in the areas of disclosure of privacy, margin risks, and best execution. As part of their examination procedures, examiners from NASDR and SEC review broker-dealers’ Web sites to determine the types of disclosures firms are providing. The examiners are guided by their agencies’ on-line trading examination modules, which have sections on disclosure. For example, we found procedures explaining how to look for disclosure of trading risks and operational capacity. One procedure asked the examiners to determine whether the firm explains in detail the difference between market and limit orders and stop limit orders, and the benefits and risks of each. Another asked them to determine whether the firm discloses the possibility of delayed executions and market losses owing to system capacity limitations during periods of market volatility. In addition, we found procedures related to SEC’s 1998 Staff Legal Bulletin 8 guidance emphasizing that broker-dealers should have adequate capacity to handle high volume or high volatility trading days. At the time of our review, none of the regulators’ examination modules contained procedures to cover OCIE’s recommendations for margin, best execution, and privacy disclosures. However, rules have recently been approved in all three areas. Since the dates for complying with those rules have either recently or not yet occurred, regulators have not completed the written examination procedures for them. Once broker-dealers are required to comply with these rules, regulators told us that they plan to include steps in their procedures to examine for such compliance. Also, SEC plans to include steps in their examination procedures covering OCIE recommendations. Until these steps are made a part of the examination procedures, examiners would be less likely to identify instances where broker-dealers choose not to implement OCIE recommended practices. Further, according to an OCIE official, steps for assessing broker-dealers’ use of recommended practices may not be as comprehensive as steps intended to uncover rule violations. OCIE staff issued its report summarizing its on-line trading examination findings and recommendations in January 2001 in order to broadly heighten awareness of issues involving on-line trading, execution of investor transactions, capacity for handling trading volumes, and other matters. OCIE staff also chose to publish the January 2001 report, in part, because of the dramatic increase in both on-line trading and complaints by investors. By doing so, OCIE staff intended to assist broker-dealers in evaluating their own on-line trading systems. In addition, while SEC’s Market Regulation Division is considering recommending an operational capability rule, the task has been complicated by the difficulty of crafting a rule that is flexible enough to keep apace of technological change while providing for meaningful measures for outages and delays. Given the relative newness of the rules and recommendations developed by SEC and NASDR, it is too soon to judge their overall effectiveness. On-line trading continues to be an important segment of the securities trading market. The industry reports investing greater resources toward improving performance of their systems, and regulators have made substantial progress in ensuring that investors receive better information in key investor protection areas. However, investors trading on-line continue to file a substantial number of complaints that indicate concern about failures and delays in processing orders, and according to OCIE, a lack of knowledge about trading and investing. OCIE’s findings in its January 2001 report confirmed those we reported 1 year ago and provide further support for our conclusion that providing complete information on the Web sites of on-line broker-dealers would provide greater opportunities for investors to make more informed investment decisions. With rules on privacy, trading execution, and margin becoming effective this year, investors should have more information with which to make informed judgments and weigh risks. Also, while our recommendations involving trading risk and operational capability were not the subject of rulemaking, OCIE made recommendations addressing these issues, which could encourage greater disclosure of trading risks and the risks of outages and delays. In addition, NASDR adopted a rule on risks of day trading. However, the ultimate influence of these OCIE recommended practices has yet to be measured and may be diminished where regulators are limited in their ability to enforce such guidance or are less likely to identify instances in which broker-dealers choose not to follow such guidance. In addition, there is still no agreement on a meaningful and consistent measure of outages and delays that would aid broker-dealers in following OCIE’s recommendations and assist regulators in judging the operational capability of broker-dealers. Furthermore, rules governing the disclosure of privacy issues, margin risk, and day-trading risk and OCIE recommendations for disclosure of trading risk allow written or electronic disclosure, limiting the likelihood that investors who exclusively use an on-line channel would have readily accessible information on these issues. To address the continuing concerns that investors have about failures and delays in processing orders, and to improve regulators’ ability to assess broker-dealers’ compliance with SEC capacity guidance, we recommend that the Acting Chairman, SEC work with the industry to establish consistent and meaningful measures for outages and delays and to ensure that broker-dealers maintain consistent records of system slowdowns and outages that impact their customers. Such information could be used by broker-dealers to better inform investors about the potential for and adverse effects of delays and outages. Furthermore, we recommend the Acting Chairman, SEC take steps to ensure that the conspicuous plain English disclosure of margin risk and the risk of systems outages or delays, and disclosure of trading risk be made on Web sites of broker-dealers that offer on-line trading. Where appropriate, such Web site disclosure would be most useful where its delivery is tailored to individual investors. Finally, given the uncertainty over the ultimate impact of OCIE’s recommendations to broker dealers, we recommend that the Acting Chairman, SEC monitor the extent to which broker-dealers embrace OCIE’s recommendations and other guidance on disclosing trading risk and the risk of systems outages or failures, and on protecting investor records and information. On the basis of this assessment, the Acting Chairman, SEC should determine the need for further rule making in these areas. We requested comments on a draft of this report from the Acting Chairman, SEC; President, NASDR; and the Chairman and CEO, NYSE. SEC and NASDR provided written comments (see app. I and II), and the Senior Vice-President, Member Firm Regulation, NYSE provided oral comments on June 29, 2001. NYSE officials told us that they generally concur with the findings of the report and stated that it represents an accurate presentation of the on-line industry. NYSE officials provided technical suggestions that we incorporated into the report where appropriate. SEC officials stated that they agreed with the report’s recommendations and provided technical comments that have been incorporated. The NASDR, commented on the meaning of Web site disclosure. Specifically, NASDR commented that individual delivery of the disclosures, whether done on-line or in paper format, is a more effective means of ensuring that communications are made to customers than a general Web posting. We believe that information would be more easily accessible to on-line investors if it is made available to them on broker- dealer Web sites. When disclosing such information on Web sites, it should be tailored to the individual investor where appropriate. In response, we modified the language in the report to make clear our intent that in some instances it is preferable that Web site disclosure of investor protection information be tailored for individual delivery. As agreed with your offices, unless you publicly release its contents earlier, we plan no further distribution of this report until 30 days from its issuance date. At that time, we will send copies of the report to the Chairman and Ranking Minority Members of the House Committee on Financial Services; the Chairmen of the House Energy and Commerce Committee and its Subcommittees on Telecommunications and the Internet, and Commerce, Trade, and Consumer Protection; the Chairman and Ranking Minority Members of the Senate Committee on Banking, Housing and Urban Affairs and other congressional committees. We will also send copies to the Acting Chairman of SEC, the Chairman and CEO of NYSE and the President of NASDR. Copies will also be made available to others upon request. If you or your staff have any questions regarding this report, please contact me at (202) 512-8678, hillmanr@gao.gov, or Mathew J. Scirè at (202) 512-6794, sciremj@gao.gov. Key contributors to this report were Nima Patel Edwards, William Lew, Robert F. Pollard, Karen C. Tremba and Sindy R. Udell. Appendix II: Comments From the National Association of Securities Dealers Regulation, Inc.

Summary: On-line trading continues to be an important part of the securities trading market. The industry reports investing greater resources to improve the performance of their systems, and regulators have made substantial progress in ensuring that investors receive better information in key investor protection areas. However, investors trading on-line continue to file many complaints about failures and delays in processing orders. GAO believes that providing complete information on the websites of on-line broker-dealers would allow investors to make more informed investment decisions.