Qualified Custodian

Separately from its privacy notices, what does Regulation S-P require a broker-dealer to do about the security of customer information?

1. A.Encrypt every electronic communication sent to a customer, whatever information it contains.Wrong. The requirement is a reasonably designed programme rather than one prescribed technical measure applied universally.
2. B.Store all customer records with an unaffiliated third-party custodian approved by the firm's examining authority.Wrong. No such outsourcing or approval requirement exists anywhere in the regulation.
3. C.Obtain a customer's written consent before storing any of that customer's information electronically.Wrong. Consent governs certain sharing decisions and has nothing to do with how records are secured.
4. D.Adopt written policies reasonably designed to protect customer records against anticipated threats and unauthorised access.Correct. This safeguards obligation addresses accidental and unauthorised loss, a failure mode the notice rules never touch.

Why: Regulation S-P contains a safeguards requirement obliging a firm to adopt written policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information, to protect against anticipated threats to their security or integrity, and to protect against unauthorised access or use that could result in substantial harm or inconvenience to a customer. This operates independently of the notice and opt-out provisions, which govern deliberate sharing; safeguards govern accidental or unauthorised loss. The regulation also requires proper disposal of consumer report information, since discarded records leak just as readily as breached ones. A firm can therefore comply perfectly with its notice obligations and still violate the regulation by leaving customer data unprotected.

Halverlea Advisory is a state-registered investment adviser that has deliberately structured itself to avoid custody: it uses an unaffiliated qualified custodian, has no authority to withdraw client assets, and never asks clients to send it anything. On Monday morning a client, without being asked, posts Halverlea a cheque for $40,000 made payable to her custodian, together with a note asking the adviser to see that it is invested. Under the NASAA model custody rule, what must Halverlea do to avoid being deemed to have custody?

1. A.Nothing, because the cheque is payable to the qualified custodian rather than to Halverlea.The payee line does not control. The adviser is in possession of a client asset and must act to negate custody.
2. B.Forward the cheque to the qualified custodian within three business days of receiving it.Forwarding is not the prescribed cure under the model rule. The asset must go back to the sender.
3. C.Return the cheque to the client within three business days of receiving it.Correct. Returning inadvertently received funds or securities to the sender within three business days prevents the adviser from being deemed to have custody.
4. D.Deposit the cheque in a separate account maintained solely for inadvertently received client funds.Depositing the cheque anywhere places the adviser in control of client assets, which is precisely what having custody means.

Why: An adviser that inadvertently receives client funds or securities is not automatically treated as having custody, provided it acts quickly. The model rule gives the firm a short window: it must return the funds or securities TO THE SENDER WITHIN THREE BUSINESS DAYS of receiving them. Forwarding the cheque onward to the custodian is not the prescribed cure, and neither is holding it while seeking instructions, because both leave the adviser in possession of client assets. The rule's logic is that custody is about possession and control, so the only reliable way to negate an inadvertent receipt is to put the asset straight back where it came from, promptly, and to document that you did.

An investment adviser takes custody of client assets but does not use a qualified custodian. This is:

1. A.Fine short-termThe appeal is the sense that a brief lapse does no harm. But the safeguard obligation attaches to the fact of holding client assets, not to how long the adviser holds them.
2. B.RequiredNothing compels an adviser to take custody at all, and many deliberately avoid it to escape these obligations. What is required is that an adviser who does take custody use a qualified custodian.
3. C.ProhibitedCorrect - a qualified custodian is required.
4. D.PermittedCustody itself is permitted, but only with its protections attached. Removing the qualified custodian strips out the very safeguard that makes holding client assets acceptable.

Why: Custody without a qualified custodian (and required safeguards) is prohibited.

An adviser with custody that uses a qualified custodian and sends clients quarterly account statements is:

1. A.Prohibited from having custodyCustody itself is not forbidden. The Act conditions it on safeguards, and this adviser has met them by using a qualified custodian and delivering statements.
2. B.Complying with the custody rulesCorrect - safeguards satisfied.
3. C.In violation regardlessThis treats custody as an incurable defect. The rules are written to make custody workable, which is why they spell out what an adviser must do rather than banning the practice.
4. D.Committing fraudFraud requires deception, and quarterly statements are its opposite. They give clients an independent view of what they actually hold.

Why: Meeting the custody safeguards (qualified custodian, quarterly statements) is permitted practice.