RIA Compliance Blog
The Securities and Exchange Commission (“SEC”) issued a settled administrative order against TAG Associates LLC (“TAG”), a Delaware limited liability company registered with the SEC as an investment adviser since January 2002. Among other violations identified in the proceeding, the SEC found that TAG failed to comply with Regulation S-ID by inadequately administering and maintaining its written Identity Theft Prevention Program (“Program”), as required under 17 C.F.R. § 248.201. While the proceeding also involved a separate finding relating to the Custody Rule under the Investment Advisers Act, the order highlighted the violation of Regulation S-ID and the importance of ongoing compliance reviews and management oversight in ensuring that Programs are properly administered and maintained.
Regulation S-ID requires investment advisers to develop and implement a written Program to detect, prevent, and mitigate identity theft. Under 17 C.F.R. § 248.201(d)(2), the Program must: (i) identify relevant “red flags” for the covered accounts and incorporate them into the Program; (ii) detect the red flags that have been incorporated into the Program; (iii) respond appropriately to any red flags that are detected pursuant to the Program to prevent and mitigate identity theft; (iv) ensure that the Program, including red flags determined to be relevant, is updated periodically to reflect changes in risks to customers and to the safety and soundness of the firm from identity theft; and (v) provide continuous administration of program by involving the Board of Directors, an appropriate committee thereof, or senior management. For the purpose of the regulation, “red flag” is defined as a pattern, practice, or specific activity that indicates the possible existence of identity theft. A “covered account” includes an account that a financial institution offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions.
TAG initially adopted its Program on June 12, 2014. The written document incorporated examples of potential identity theft indicators provided in Supplement A to Appendix A of Regulation S-ID. It also required updates in response to material changes in the firm’s business operations, organizational structure, or location, as well as material identity theft incidents involving covered accounts. In addition, TAG’s chief compliance officer was responsible for including a review of the Program in the firm’s annual compliance review process.
Although TAG had these written procedures in place, it failed to establish an effective review process for periodically reviewing and assessing the Program. From 2015 through 2023, TAG retained outside compliance consultants to conduct annual assessments of its broader compliance policies and procedures. However, these engagements did not specifically reference the Program or Regulation S-ID. Furthermore, the consultants advised TAG to undertake its own assessment of the Program to determine whether its provisions remained appropriate. Despite this recommendation, TAG failed to independently assess the Program’s continued effectiveness.
The need for such an assessment became particularly apparent as TAG experienced attempted identity theft incidents. In November 2017, the firm received a fraudulent wire transfer request. In April 2021, another attempted fraud was brought to employee’s’ attention by TAG’s chief executive officer. Despite these incidents, TAG did not review its existing policies and procedures, evaluate whether new risks had emerged, or consider whether additional protective measures were necessary.
The SEC also identified deficiencies in the Program’s management oversight structure. In particular, TAG failed to ensure that the Program was appropriately supervised and administered by its board of directors, an appropriate committee, or a designated senior management employee, as required by Regulation S-ID. This lack of oversight was further reflected in the firm’s reporting practices. Between 2014 and 2023, no annual reports concerning the Program’s effectiveness, significant identity theft incidents, or recommended improvements were submitted to TAG’s chief executive officer. Furthermore, TAG did not revise its Program until December 2023, when it incorporated an updated version into its compliance manual and added further identity theft indicators for the first time. Based on these findings, the SEC concluded that TAG had willfully violated Regulation S-ID.
This enforcement action serves as a reminder that investment advisers’ obligations under Regulation S-ID extend beyond the initial adoption of a written identity theft prevention policy. Investment advisers must actively maintain and periodically evaluate their Programs to ensure they remain effective in addressing their evolving business operations and identity theft risks, particularly when actual incidents or attempted fraud reveal potential weaknesses in existing policies and procedures. The action also underscores the importance of appropriate management oversight, including appropriate supervisory involvement and regular reporting to senior management regarding a Program’s effectiveness, “red flag” incidents, and recommended improvements. Ultimately, a written policy alone is insufficient without meaningful implementation, ongoing oversight, and periodic evaluation.
Parker MacIntyre provides legal and compliance services to investment advisers, broker-dealers, registered representatives, hedge funds, and issuers of securities, among others. Our Investment Adviser Group assists financial service providers with complex issues that arise in the course of their business, including complying with federal and state laws and rules. Please visit our Investment Adviser Practice Group page for more information.