As we step into 2025, wealth management firms face an evolving regulatory landscape. Agencies like the U.S. Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA) are intensifying their scrutiny in several key areas, including ESG reporting, cybersecurity, and off-channel communication. To navigate these changes effectively, wealth management firms must stay informed and proactive.
Key Regulatory Measures
The SEC recently outlined its 2025 priorities. Here are the top four regulatory priorities for 2025 and actionable insights to help firms prepare:
1. Enhanced Environmental, Social, and Governance (ESG) Reporting
Regulatory bodies are pushing for more transparency and accuracy in ESG reporting. Firms must ensure they have robust systems in place to track and report ESG metrics accurately. This includes integrating ESG considerations into their investment processes and ensuring compliance with evolving disclosure requirements.
Brief Summary of the Latest Updates on the SEC's ESG Disclosure Rules:
- Climate-Related Disclosures: In March 2024, the SEC adopted rules to enhance and standardize climate-related disclosures for public companies. These rules require companies to disclose climate-related risks that could materially impact their business, strategy, operations, or financial condition. This includes both quantitative and qualitative information about how they manage these risks.
- Implementation Pause: The implementation of these rules has been paused due to legal challenges, but many companies are still preparing for these disclosures, seeing it as an opportunity to gain a competitive edge by prioritizing ESG transparency.
- Ongoing Developments: Legal battles continue, and the final details of the rules are still evolving. Companies should stay informed and ready for potential changes.
Understanding the Issue of Greenwashing in ESG Disclosures and the Importance of Verified ESG Data Sources:
- Greenwashing: Some companies make misleading claims about their environmental practices to appear more sustainable, which can mislead investors and stakeholders.
- Regulatory Scrutiny: Regulatory bodies like the SEC are increasing oversight to ensure accurate and transparent ESG disclosures.
- Verified ESG Data: Using reliable ESG data sources, such as MSCI and Sustainalytics, helps companies provide credible information and avoid greenwashing.
Actionable Insights:
- ESG strategy - Develop a comprehensive ESG strategy that includes clear reporting guidelines and regular audits to ensure compliance.
- Leverage Technology for ESG Data Collection - Implement advanced data analytics tools to gather and analyze ESG data efficiently. This will help in identifying trends and making informed decisions.
- Engage Stakeholders - Regularly communicate with stakeholders, including clients, employees, and investors, about your ESG initiatives and progress. Transparency builds trust and aligns interests.
2. Strengthened Cybersecurity Measures
With the rise in cyber threats, regulatory agencies are emphasizing the need for enhanced cybersecurity measures. Firms are expected to implement strong cybersecurity frameworks to protect sensitive client information and ensure the integrity of their systems.
Key Aspects of the SEC's 2023 Cybersecurity Rule:
- Incident Disclosure: Public companies must disclose material cybersecurity incidents within four business days of determining their materiality. This rule aims to enhance transparency and provide investors with timely information about significant cybersecurity events that could impact a company's financial health and operations.
- Annual Reporting: Companies are required to provide annual disclosures about their cybersecurity risk management, strategy, and governance.
- Board Oversight: The rule emphasizes the role of the board of directors in overseeing cybersecurity risks.
Focal Points of 2025:
- Continued Emphasis: The SEC continues to prioritize cybersecurity disclosures in 2025, ensuring companies comply with the rules and provide accurate and timely information.
- Enforcement Actions: The SEC has been active in enforcing these rules, highlighting the importance of vigorous cybersecurity measures and transparent reporting.
Actionable Insights:
- Multi-Factor Authentication (MFA) - Add an additional layer of security by implementing MFA for all applications and systems. Demand several types of verification before granting access to classified information and systems. To manage new threats, review, and update MFA policies on a regular basis.
- Enhance Endpoint Security - Deploy antivirus software and firewalls on all devices. Use advanced threat detection systems to identify and neutralize threats in real-time. Regularly update and patch all endpoint devices to prevent vulnerabilities.
- Adopt Zero-Trust Frameworks - Enforce constant user and device verification, irrespective of where they are. Put robust access controls in place and keep an eye on all network activity. Verify that only authorized and authenticated users have access to critical resources.
- Strengthen Vendor Risk Management - Examine each third-party vendor's security procedures. Conduct routine risk assessments to find possible weak points. Verify that vendors abide by all applicable security laws and guidelines.
- Regular Employee Training - To protect against potential threats and put safe practices in place, invest in cutting-edge security technologies and conduct routine cybersecurity audits. Awareness is key to preventing breaches.
- Incident Response Plan - Create an incident response plan and update it frequently. To make sure that every employee is aware of their roles and responsibilities in the event of a cyber incident, direct mock drills.
3. Off-Channel Communication Compliance
There are serious compliance issues when using off-channel communication channels (like social media and messaging apps). Regulators are concentrating on making sure that all communications with clients are accurately documented and tracked.
Understanding the Applicable Rules:
- FINRA Rule 4511 mandates that FINRA members create and maintain books and records for a minimum of six years, using media and formats that adhere to Securities Exchange Act (SEA) Rule 17a-4.
- In Regulatory Notice 17-18, FINRA also made it clear that financial institutions are required to keep track of business-related communications sent via chat services and text messaging applications.
- Text messages, social media, WhatsApp Messenger, instant messaging, email, and collaboration tools are all considered electronic communications and are governed by the rules.
Instances of Past Enforcement Actions and Fines:
The SEC's enforcement actions have targeted a wide range of financial institutions, including major banks and investment firms. In September 2022, the SEC announced $1.1 billion in fines and the Commodity Futures Trading Commission disclosed $710 million in penalties.
Notable companies which were fined include Barclays, Citigroup, Bank of America, and Goldman Sachs. The Commodities Futures Trading Commission (CFTC) gave Bank of America the biggest fine, totaling $100 million. The penalties were $75 million for each of the following companies: Barclays, Citigroup, Credit Suisse, Deutsche Bank, Goldman Sachs, Morgan Stanley, and UBS. Cantor Fitzgerald was fined $6 million, Jefferies $30 million, and Nomura $50 million.
Actionable Insights:
- Approved Communication Platforms - Make a list of communication platforms that have been approved and meet regulatory requirements. Consider making certain that every employee interacts with clients using these platforms.
- Automated Monitoring Tools - Procure automated technologies that can keep tabs on and record off-channel communications. This guarantees that every interaction is documented and accessible for review when required.
- Regular Audits - Audit communication records on a regular basis to make sure policies are being followed. To prevent regulatory problems, promptly resolve any discrepancies.
4. Increased Regulatory Oversight and Fiduciary Duties
The Department of Labor (DOL) and the SEC are stepping up their efforts to make sure financial companies uphold transparency and fiduciary obligations. When it comes to expensive products, unusual investments, illiquid assets, and conflicts of interest, the SEC will closely examine whether investment advisers are fulfilling their fiduciary duties.
Key Areas of Emphasis Include:
- Conflicts of Interest - Unreported conflicts are a concern for the SEC, particularly in revenue-sharing arrangements and expensive goods. For failing to disclose revenue-sharing payments from specific mutual funds, businesses have faced penalties. Regulation Best Interest (Reg BI) requires broker-dealers to act in the best interest of retail customers, disclosing conflicts and ensuring recommendations are customer-focused.
- Fee Transparency - Client trust is ramped up via transparent fee arrangements. The SEC has taken action against companies that failed to disclose investment product fees in a sufficient manner. Clients are better able to make decisions when fees are disclosed clearly. The DOL's fiduciary rule, which requires advisers to act in their clients' best interests and to steer clear of conflicts, places a strong emphasis on fee transparency, particularly in retirement accounts.
- Regulation Best Interest (Reg BI) - Reg BI establishes a ‘best interest’ standard for broker-dealers, requiring disclosure of material conflicts and ensuring recommendations are client-focused. This regulation aims to enhance advice quality and protect retail investors.
- DOL’s Fiduciary Rule - The DOL's evolving fiduciary rule redefines who qualifies as a fiduciary under Employee Retirement Income Security Act (ERISA), requiring financial professionals to act in clients' best interests, especially in retirement accounts. Changes to the exemptions for prohibited transactions are included in order to avoid conflicts and provide sensible advice.
Emphasizing Fee Transparency and Conflict Disclosures:
- Fee Transparency: All fees related to investment products and services, such as management and performance fees, should be made explicit. Clients are assisted in making well-informed decisions by transparent structures.
- Conflict Disclosures: Review and report on any conflicts of interest on a regular basis, including revenue-sharing plans and payments to third parties. Transparency and trust are maintained by making sure clients are aware of these conflicts. Wealth management companies can comply with DOL and SEC regulations while fostering closer, more reliable relationships with their clients.
Actionable Insights:
- Proactive Compliance Reviews - Plan frequent compliance reviews to find and fix potential problems before they become more serious. This proactive strategy can stop violations of regulations.
- Continuous Education - Your compliance team should be encouraged to pursue continuous learning. To keep them abreast of the most recent regulatory requirements, make courses and certifications accessible.
- Collaboration with Legal Experts - Interpret new rules and make the required adjustments in close collaboration with legal and compliance specialists. Their knowledge can be useful when negotiating intricate regulatory environments.
Wrapping Up: Preparing for Regulatory Challenges in 2025
Findings from the 2025 FINRA Annual Regulatory Oversight Report can be summarized as follows:
- Third-Party Risk: Firms need to enhance oversight of third-party vendors.
- Cybersecurity: Strengthening defenses against cyber threats and fraud is crucial.
- Artificial Intelligence (AI): Increased scrutiny on ethical and transparent AI practices.
- Investment Fraud: Focus on combating schemes targeting investors.
- Extended Hours Trading: New regulations to ensure market integrity.
- Regulation Best Interest (Reg BI): Ongoing compliance with Reg BI requirements.
- Remote Inspections: Updates to the Remote Inspections Pilot Program.
- Fractional Share Transactions: Enhancements in trade reporting for transparency.
Conclusion
These findings demonstrate how the regulatory environment is changing and how businesses must modify their compliance programs to reflect these changes. Considering the increased regulatory scrutiny, and that regulatory requirements continue to grow in complexity, wealth management firms should leverage advanced technology to manage compliance more efficiently and effectively. RegVerse is an AI-powered software and services company focused on helping wealth management firms streamline and automate compliance using the the latest AI-driven technologies and human insight. The Fusion 1 solution delivers end-to-end compliance and risk management for audits, attestations, code of ethics, and policy oversight. Avery is AI-powered regulatory intelligence for real-time compliance tracking. RegVerse automates RIA and Broker-Dealer compliance with ADV filings, policy updates and enforcement tracking. TrackCyber offers continuous cyber risk assessment and compliance monitoring. OmnibusX enables seamless data integration across platforms. Together they deliver on the promise of AI-powered compliance -– the real-time regulatory intelligence that automatically maps obligations, audits policies, and flags risks before they become regulatory issues. By embracing these solutions, firms can stay ahead of compliance demands, enhance operational efficiency, and focus on delivering exceptional value to their clients. Compliance teams get the time back to focus on what matters. Learn more at www.regverse.com
Contact RegVerse
