Cybersecurity
Cybersecurity is the practice of protecting networks, systems, hardware and data from digital attacks. It encompasses everything pertaining to protecting sensitive data – personally identifiable information (“PII”), protected health information (“PHI”), personal information, intellectual property, data, and industry information systems – from theft and damage attempted by criminals and adversaries.

This Field Notice outlines some important best practices around ESI’s cybersecurity requirements. For more best practices and guidance, please review Field Notice 2021-09 Cybersecurity and ESI’s Written Supervisory Procedures.

Branch Cybersecurity Policy
It is recommended that each branch have a documented cybersecurity policy. Here are some items to consider including in the policy:

1. What to do if there is a cybersecurity-related issue
   To report an incident, please contact your supervisor. In coordination with your supervisor, please contact ESI Compliance (esicompliance@nationallife.com) to report. Cybersecurity-related issues may include, but are not limited to:
   • email hacking
   • password compromise
   • computer hacking
   • computer/device theft or loss
   • Other situations, whether caused by humans or technology, that resulted or could result, in the exposure of confidential information to unauthorized parties 
2. Vetting third party IT providers or resources
   The ESI Confidentiality Agreement is required whenever a third-party or outside service provider may have access to ESI’s confidential client information or records. Examples of third-party services may include, but are not limited to, shredding services, document storage facilities, office cleaning services, or IT service providers.
   When using outside third-party IT resources, in addition to obtaining a confidentiality agreement, the vendor should be adequately assessed to ensure that they have effective security practices.
3. Inventory of Assets
   It is recommended that you create and maintain a technology inventory. This should include computers, laptops, scanners, tablets, phones, printers, etc. In case an issue arises, this inventory will help you understand what asset has gone missing or has been impacted and who it belonged to.

Important Reminders
Below is a list of important reminders around security and protection of information:

• Scanners must be linked to an NLG email: When scanning documents, the scanner must be linked to an NLG email address for the security of the information being scanned. When utilizing a phone or other device to scan or take a photo of documents, such devices must be encrypted and linked to an NLG email address. Outside email addresses may not be encrypted or as secure as your NLG email. 
• Sharing of passwords is prohibited: Passwords may not be shared for any reason. This includes providing an NRF passwords for an RR’s computer, email, or online system to access client information.
• Accessing client accounts is prohibited: RRs and NRFs are not permitted to obtain passwords from a client to access a client’s account information or other PII (even with the client’s permission). Only clients may access their own accounts.
• Email encryption: National Life encrypts email for all outgoing electronic mail that contains PII: ABA routing numbers, credit card numbers, social security numbers, federal tax IDs, and policy numbers. When sending a message with sensitive information, you must use your National Life email account and type “[PRIVATE]” in the subject line to enable the encryption of the message.
• Phishing emails: Be mindful of suspicious email from unknown senders. Such email may have spelling or grammatical errors or create a sense of urgency. Additionally, never open an email attachment unless it comes from a trusted source. Home office employees may report potential phishing email by clicking the “Phish Alert Report” button within Outlook. Field representatives may forward the email as an attachment to spam@nationallife.com.

Anti-Virus and Encryption
Everyone associated with ESI must have anti-virus software on all computers that access or store clients’ PII. In addition, all portable devices and external media (e.g. zip drive, flash drive, mobile phone, laptop, disks) that access or store clients’ PII must be encrypted. Backup drives should be encrypted to prevent unauthorized access in the event they are stolen or lost.

Anti-virus/anti-malware software vendors that are compliant with Entreda: 

• AVAST! Software    
• AVG Technologies
• BitDefender 
• Checkpoint
• Crowdstrike Falcon
• Fortinet
• Cylance Protect
• ESET
• Kaspersky
• Malwarebytes Premium
• McAfee
• Windows Defender
• Panda Security
• SentinelOne
• Symantec Corp.
• Norton360
• Sophos
• Trend Micro
• Vipre Anti-Virus
• Webroot
• Zone Alarm

Encryption vendors that are compliant with Entreda:

• Microsoft BitLocker Encryption
• McAfee
• Sophos
• Symantec (full disk encryption only)

Entreda
Everyone is required to have the Entreda Unify System (“Entreda”) software installed on all computers and laptops that access or store clients’ PII or are used to access the agent portal. Entreda monitors the security of the computer system, including any key security control deficiencies status deficiencies.

Once installed, Entreda calculates a security risk score based on certain criteria including auto-screen lock, WiFi, password, and encryption settings, among other factors. A device must maintain a passing score of 660 or above to be compliant. Failure to install Entreda or maintain a passing score of 660 will prevent users from accessing the agent portal. Please refer to FN 2021-19 Entreda Unify Systems for more details.

If you no longer utilize a device for business purposes, all ESI data must be permanently removed from that device. Once removed, please contact Rich Whalen (rwhalen@nationallife.com) to confirm and allow him to remove the device from Entreda reporting.

Questions
If you have any cybersecurity-related questions, please contact your supervisor. 

---

Private Placement Offerings
Equity Services, Inc. (“ESI”) permits its Registered Representatives and Investment Adviser Representatives (collectively “Representatives) to invest in private placement offerings for their own accounts.  However, ESI’s Code of Ethics requires that all RRs and IARs obtain approval BEFORE investing in a private placement offering. This notice is a reminder of ESI’s process for the review and approval of private placement offerings.

Procedure
Requests for review of a private placement offering should be emailed to the ESI Compliance team at ESICompliance@nationallife.com. With the initial request, include a copy of the offering statement and/or subscription agreement and any other collateral materials you have which describe the program.

Once the necessary information has been received, ESI will complete its review and approve or deny the request. If approved, the Representative will receive an Approval and Stipulation Letter (along with instructions on how to confirm the transaction in Star Compliance) which they must sign and return to Compliance before investing. The letter enumerates the conditions under which they may participate in the offering (see “Stipulations” below).  If denied, the Representative will be notified of the reason for the denial in writing.

You may not invest any capital in a private placement offering prior to receiving approval from ESI. To do so is a violation of ESI’s Code of Ethics and could subject you to disciplinary action. Once you are approved to participate in a program, future additional investments in the same program do not require pre-approval but must be entered into Star Compliance for review by Compliance and for quarterly and annual reporting.

IAR Quarterly Reporting
For IARs, private placements are reportable on the Quarterly Transaction Report covering the quarter in which the transaction occurred, as well as on the Annual Holdings Report, for as long as the holding is maintained.

If the request is approved, the initial transaction and holdings information will automatically populate the quarterly and annual reports, as appropriate.  NOTE:  Private placements are not included on any brokerage firm data feed.  Consequently, any subsequent transactions (buy/sell) in the holding must be manually entered into Star Compliance via the “Private Transactions” tile.

Stipulations
The list below represents the standard stipulations that accompany approval to participate in a private placement offering.  The Firm reserves the right to add any additional stipulations, as warranted.

• Your insurance and investment businesses are separate and not connected to the investment.
• ESI understands that you are not aware of any current ESI clients who are investors in the private investment.
• To the extent any clients may be investors in the proposed private placement, you represent that you have had no involvement with their decision to invest.
• The private placement offering should not be offered by you or your spouse to any clients, potential clients, or affiliated representatives of ESI or National Life.
• You will not refer anyone to the proposed private placement to participate in the investments.
• The private placement offering should not be discussed with ESI or National Life representatives and/or agents.
• The approval to invest should, in no way, be considered an endorsement of the offering. ESI does not review or approve the merits of private placement offerings. 
• The transaction must be disclosed on your Quarterly Transaction Report for the quarter in which the transaction is executed, and on your annual personal securities holding report for as long as you hold the security.
• You represent that you are a passive investor in the private placement and have or will have no role in running the business.
• You acknowledge your understanding that additional investments in a private placement requires prior review and approval by ESI.

Clients’ Investments in Private Placements
Currently, ESI does not offer private placements. As such, Registered Representatives and Investment Adviser Representatives are prohibited from offering, recommending, evaluating, or in any way facilitating a client to invest in a placement offering. A Representative who facilitates an investment in, or refers a prospect to, a private placement offeror is considered to have engaged in an unapproved private securities transaction, or “selling away”. This includes even just introducing a potential investor to an underwriter or offeror for a private placement. Selling away is a serious FINRA rule violation, and often results in significant regulatory sanctions.

Questions
If you have any questions about this requirement, please contact ESI Compliance, at 800-344-7437.

TC129793(1122)1

Read More  

Both the 2022 Annual Compliance Meeting (“ACM”) and the 2022-2023 Firm Element continuing education (“CE”) program are available in RegEd for all Registered Representatives (“RRs”). This field notice explains these requirements and how to access them. 

Please note the due dates for completing the ACM and CE, as they are different:

• Annual Compliance Meeting: complete by December 31, 2022
• Firm Element CE: complete by February 28, 2023

2022 ANNUAL COMPLIANCE MEETING

Login to RegEd (see below for instructions). Under the “My Requirements” section, find “Equity Services Inc. 2022 Annual Compliance Meeting”.

Click on the course to open the meeting in a new window. Ensure the volume on your device is working, as you must be able to hear the audio. As a reminder: ensure you complete the acknowledgement at the end of the presentation in order to receive credit for the meeting. If you don’t complete the acknowledgement, the system will not record your session as complete.

FIRM ELEMENT CE COURSE ASSIGNMENTS

All registered persons will complete the following courses:

Diminished Capacity: Recognizing and Responding to the Signs: As the number of Boomers in retirement grows exponentially, financial services firms increasingly struggle with issues relating to the elderly, including accommodating normal aging, identifying diminished cognitive and financial capacity, and recognizing and reporting elder abuse. Documenting suitable recommendations and rationale and a strict adherence to firm and regulatory requirements will allow you to serve your aging clients both sensitively and faithfully. 

Switching, Second Edition (821_2): While switching itself is not illegal, if not done in the best interest of the client, it is both unethical and illegal. This course explains and discusses switching and its impact on customer accounts, suitability, record-keeping and reporting rules, and reviews some FINRA actions demonstrating how switching violation is disciplined.

Suitability of Variable Products (930): This course discusses the nature, benefits and risks of variable universal life insurance and variable annuities and focuses on suitability concerns involving these products. It also explains the SEC’s Regulation Best Interest, which imposes a higher standard of conduct when making recommendations to retail customers.

AML Annual Update: 2022 (35AU22): AML – The Anti-Money Laundering Annual Update: 2022 reviews FinCEN’s accomplishments during 2021 relating to its requirements under the AML Act of 2020. It discusses important FINRA enforcement cases against individuals and firms, emphasizing the conduct FINRA considers to violate AML rules.

FINRA: Ethical Considerations for Registered Representatives (EL_ELC170): This course presents six common ethical principles and selected decision-making models for registered representatives to consider when facing ethical dilemmas. Scenarios demonstrate how these models can be practically applied to common ethical challenges faced by securities professionals.

SINGLE SIGN-ON (SSO) WITH REGED

Use your NLG login credentials to access your agent portal. From the home page, click on “Training”. Under “Continuing Education”, find and click “RegEd Courses”.

This will bring you to your RegEd dashboard. From there you can launch your Firm Element courses.

If, for some reason, you have a problem with SSO, you can still access your courses directly through RegEd’s website:

• Go to www.reged.com:
  • Look for a welcome email from RegEd
  • Click “Secure Login” à “RegEd Compliance Management”
  • At the login screen:
    • Username: your ESI rep code (included in your welcome message from RegEd)
    • Password: “Welcome#2022” (you will be prompted to change this upon login)
    • Company code: EQUITYSI

• If you did not receive an email with your username, click “Username” on the login screen:

Provide your NLG email address and click “Submit”. You will receive an email with your username.

TECHNICAL SUPPORT

RegEd customer support is available Monday-Friday, 8:00am to 8:00pm EST. Technical questions with the RegEd website can be directed to RegEd Customer Service at 800-334.8322 or info@reged.com.  RegEd’s Web Chat feature is available at www.reged.com/contactus.

FREQUENTLY ASKED QUESTIONS

How long do I have to complete the Annual Compliance Meeting?

The Annual Compliance Meeting must be completed by 12/31/2022.

How long do I have to complete the Firm Element courses?

The Firm Element courses must be completed by 2/28/2023.

What if I miss the due date?

A RR who has not completed the Annual Compliance Meeting by 12/31/2022 or the Firm Element courses by 2/28/2023 may be subject to disciplinary action.

How do I pay for my courses through RegEd?

The cost of the Firm Element courses is covered in the ESI affiliation fee. You will not have to pay separately for your Firm Element courses.

Am I required to complete the Firm Element courses?

Covered Persons, as defined under FINRA Rule 1240(b)(1), are subject to the Firm Element CE program. At ESI, Covered Persons include all RRs in the field, and home office personnel working within ESI (registered and non-registered), and certain National Life employees registered as Operations Professionals.

Do I have to complete the Firm Element courses if I join ESI mid-year?

RRs whose ESI affiliation is active prior to 7/1/2022 must complete the program. Those whose ESI affiliation is active on or after 7/1/2022 are exempt from the current year’s Firm Element CE program

What if I recently completed FINRA’s Regulatory CE Session?

Regulatory Element training is an online exam administered by FINRA and must be completed on an annual basis. Firm Element training is an annual requirement administered by the broker-dealer and must be completed in addition to the Regulatory Element. Both are required elements of FINRA’s overall CE requirement.

Can I obtain insurance CE credit through RegEd?

Yes, your access to RegEd gives you the ability to order additional courses from their catalog of insurance CE courses, as well. You will be responsible for the cost of courses purchased to fulfill insurance CE requirements, and RegEd will bill you directly. Additional fees for CE credits may vary depending on the state(s) requested.

What if I am having system issues?

For technical assistance with the RegEd website or questions on insurance CE credit, RegEd customer support is available Monday-Friday, 8:00am to 8:00pm EST. Technical questions with the RegEd website can be directed to RegEd Customer Service at 800-334.8322 or info@reged.com.  RegEd’s Web Chat feature is available at www.reged.com/contactus.

Will my courses through RegEd fulfill certain National Life requirements?

No, National Life maintains a separate AML requirement, apart from ESI’s Firm Element curriculum.  Your National Life Annual E&O update and AML renewal can be easily updated in one system. Please contact National Life’s Compliance group for information on taking the 2-year AML renewal for National Life.

Additional Questions? Please feel free to contact Christine Embling at cembling@nationallife.com.      

CLICK HERE TO VIEW FIELD NOTICE 2022-26 IN FULL

(Having trouble with the link? Try refreshing your cache and logging into the NL Agent portal before clicking the link!)

TC129687(1122)1

Read More  

Equity Services Inc. (“ESI”) may not retain custody of client assets, including security/stock certificates and funds, or serve in any capacity that gives ESI and/or its representatives legal ownership, control of, or access to client funds or securities.  

Custody Defined

RRs/IARs who have custody or possession of client securities or funds are subject to extensive regulation pursuant to SEA Rule 240.15c3-3(k)(2)(ii) for broker dealers and Rule 206(4)-2 under the Investment Advisers Act of 1940 for investment advisers. These rules define custody as “holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.”

ESI is exempt from these rules as long as ESI does not maintain custody of client funds or securities. This requires that ESI clear all transactions with and for customers with a clearing firm and promptly transmit all customer funds and securities.

Examples

Examples of what constitutes custody include:

1. Possession of client funds or securities held beyond noon the next business day. Examples include:
2. Bond or stock certificates,
3. Checks received with a new account or transfer of funds, or
4. Checks received for a subsequent investment.
5. Any arrangement which authorizes or permits an RR/IAR to withdraw client funds or securities (e.g. a general power of attorney or signatory power over a client’s account, direct debiting of advisory fees, etc.)[1].
6. Any capacity (e.g. general partner of a limited partnership, trustee of a client’s trust, etc.) that gives an RR/IAR or a supervised person legal ownership or access to client funds or securities[2].
7. Having access to a customer’s bank account or the login info for their banking website.

Prompt Processing

Checks and transaction paperwork must be processed according to prompt processing requirements which means:

• Checks (new business and additional investments), and the paperwork accompanying checks, must be forwarded by noon the next business day after receipt,
• Transaction paperwork without checks must be forwarded within 2 business days after receipt, and
• For annuity paperwork, with or without checks, the Main OSJ has 7 business days from the Field OSJs date of receipt of the application to review and forward the application to the carrier. Field OSJs must promptly complete their review and forward annuity paperwork to the Main OSJ to allow time for the Main OSJ’s review and approval process.

To help ensure business is processed promptly:

• Have paperwork completed and signed electronically in Docupace to avoid delays between getting paperwork signed and putting it in Docupace.
• Promptly put manual paperwork into Docupace.
• Use Mobile Check Deposit when possible.
• Remember that additional investment checks do not require approval. Send additional investment checks to the product offeror concurrently with putting a copy in Docupace.

Handling inadvertent receipt of assets:

In the event that you inadvertently receive funds or security certificates from a client or have to return funds or securities to a client:

1. Promptly record receipt on the Checks Received/Transaction Blotter.
2. Scan into Docupace using “ESI Inadvertent Receipt”. Items to be scanned should include copies of the following, as applicable:  
   1. Item(s) received (stock certificate(s) or check),
   1. Correspondence returning item to client,
   1. Overnight package receipt with tracking number to ensure delivery.
3. Reject the item(s) in Docupace (submitter rejects).
4. Return to the client in-person or by overnight mail by noon of the next business day.

What to do if a check or security is accidently held?

If for any reason, a check or security is held beyond noon the next business day, please notify your supervisor, who will then advise ESI Compliance. We are required to report these instances annually to the SEC.

Questions:

If you have any questions, please feel free to contact ESI Compliance at 800-344-7437.

CLICK HERE TO VIEW FIELD NOTICE 2022-28 IN FULL

(Having trouble with the link? Try refreshing your cache and logging into the NL Agent portal before clicking the link!)

---

[1] Exceptions may be granted in situations involving family members (“family member” is a defined term in section 2.5.5 of the ESI Written Supervisory Procedures) but must be reviewed and approved by Compliance prior to establishing the relationship.

[2] Same exception as noted in footnote 1.

TC129687(1122)1

Read More