- Chief Compliance Officer and VP of Legal Affairs, Arrow Electronics
By 
Aaron Nicodemus2023-11-08T20:10:00
A New York state law that takes effect next year will make it more difficult for registered investment advisers (RIAs) in the state to conduct proactive testing for violations of their firms’ off-channel communication policies.
The law, A836, signed by Gov. Kathy Hochul on Sept. 14, prohibits an employer “from requesting or requiring that an employee or applicant disclose any username, password, or other means for accessing a personal account through specified electronic communications devices.” The law takes effect 180 days after passage, in March.
The law contains a carve-out for entities that are required to monitor or retain employee communications “under federal law or by a self-regulatory organization,” and there lies the rub for RIAs. While all communications by broker-dealers are required to be monitored and retained by federal securities law, only communications that specifically deal with investment advice are required to be monitored and retained by RIAs.
THIS IS MEMBERS-ONLY CONTENT. To continue reading, choose one of the options below.
News and analysis for the well-informed compliance or audit exec. Select an option and click continue.
Annual Membership $499 Value offer
Full price one year membership with auto-renewal.
Membership $599
One-year only, no auto-renewal.
Establishing a set of policies and procedures to prevent employee use of nonauthorized electronic communications to conduct business is relatively straightforward. The hard part is monitoring compliance.
New York hospitals would be required to have a cybersecurity program that includes regular cyber risk assessments under newly proposed regulations.
Firms monitoring employee use of off-channel communications for business purposes face numerous obstacles. How much is enough, in the opinion of regulators? How much is too much, in the eyes of employees? Determinations must be made as regulators crack down.
Breaches of the EU’s GDPR can cost companies substantial sums and huge reputational damage. Now some are warning that the implementation of the EU’s AI Act will be just as far-reaching, and could potentially lead to similar numbers of cases.
Any product that uses AI needs to be safety assessed for its entire lifespan under new rules that went into effect recently across the EU. Experts warned companies using AI to tailor products could be classed as “manufacturers” and face the same duty of care as developed.
When lawmakers slam the U.K.’s chief financial regulator as “incompetent,” it not only opens the doors for others to pile criticism on it, but it sparks a debate about how the organization can be improved–or removed.
