Commentary – RegEd.com

1. Know the handbook.

The NAIC’s Market Regulation Handbook Examination Standards Summary (available free of charge as a downloadable PDF) is a high-level compilation of the market conduct standards found in the more complete Market Regulation Handbook, available from the NAIC, details each function within an organization that a market conduct examiner would review during the exam process.

Make sure your policies and procedures align with each standard in the summary. If they do, you probably have a robust compliance framework already, and you’d be prepared for a regulatory examination.

Monitor and measure these standards. For example, one standard is complaint handling. During an MCE, an examiner will review a company’s complaint records to ensure it follows these standards. This includes complaints being recorded properly and the company taking adequate steps to resolve them appropriately.

2. Understand common exam triggers.

Regulators pay close attention to these areas. Manage them successfully to lessen the frequency of being examined.

Complaints: The most frequent trigger for a market conduct exam.

Claim denials and slow payments

Policy cancellations and non-renewals

Drastic changes in premiums

Regulatory action or activity in other states: State departments of insurance (DOI) compile data in their jurisdictions and share it with other DOIs. A red flag in one state can trigger investigations in others.

Market Conduct Annual Statement (MCAS) outliers: MCAS results can be a strong indicator of a possible market conduct examination. Regulators look for outliers in the results, like the number of complaints, claim denials, and other metrics.

New laws and regulations: New laws and regulations are being adopted around evolving functions, such as cybersecurity and health care, and regulators focus on how insurers keep on top of the changes.

Market share and premium growth: Larger organizations may tend to be examined more often than smaller market participants.

3. When it comes time for an exam, be prepared and establish a defined process.

If you are chosen for an exam, show that you have your house in order and conduct yourself positively for the best possible result.

Appoint an exam coordinator who has thorough knowledge of the company, its organization, and its processes. A well-appointed coordinator can expedite the process and encourage a positive result.

Prepare for the examiner’s arrival in advance, having read the coordinator handbook, if relevant. Provide a comfortable, welcoming workplace and fully functioning technology to avoid unnecessary delays. Being friendly, accommodating, respectful, and collaborative can only help—especially when negotiating points in the final report.

Respond to exam criticisms quickly. Acknowledge any deficiencies, own them, and work with the examiner to develop a remediation plan in a timely manner to keep the project on track.

Build a process to manage workflow and data. Ideally, an organization would use technology to facilitate the exchange of information between examiners and different parts of the company.

4. Utilize technology that is designed for the job.

Many organizations still use ’90s-vintage technology—email, spreadsheets or a secure file share—for market conduct exams, making the process ad hoc, reactive, cumbersome, and unreliable. A system that orchestrates all the moving parts can ensure a vastly better outcome.

A purpose-built solution that manages tagged and searchable market conduct content specifically, rather than fishing for information in email and shared files manually. This allows for more timely and accurate responses to examiners’ criticisms during the market conduct exam process.

Created by people experienced in the market conduct exam process and uses structured project templates to replace manual task tracking.

Accommodation of staff involved by identifying and notifying each one in advance, allowing for preparation of any obligations and tasks well ahead of deadlines, and enabling collaboration among them during the process.

5. More Best Practices

Create, test, and verify the implementation of policies and procedures for each exam-triggering area. For example, analyze complaint data to identify trends and implement appropriate corrective action. Implement a solid complaint tracking system that allows for effective management of complaints, and any uptick in complaints should be investigated immediately.

Go to the regulators before they go after you by self-reporting compliance issues before they rise to a regulator’s attention. Most DOIs look favorably on companies that do this.

Review recent examination results of other companies, which are published on some state department of insurance websites. These can provide insight into different states’ market conduct priorities. For example, one state may be more focused on privacy issues while another looks closely at property & casualty claims.

RegEd is ready to assist insurance companies manage the process of a market conduct exam, including task management, document management, communication with the examiners, documentation, audit trails, reporting, and more, supported by efficient and enabling technology and people with deep experience in the process.

Learn more about our Market Conduct Exam Management solution.

On October 16, 2019, FINRA published its 2019 Report on FINRA Examination Findings and Observations. This report is a useful resource for firms to leverage to improve their compliance and risk management programs.

One of the findings in the report pertains to failure to effectively monitor for and react to regulatory changes. Firms are required to review regulatory changes against their supervisory systems, including their written supervisory procedures and training programs. FINRA found that some firms did not adequately respond to recent regulatory changes such as FinCen’s new Customer Due Diligence (CDD) obligations and requirements around Financial Exploitation of Specified Adults among other recently adopted or amended rules.

In addition, branch supervision and inspection programs were found to be inadequate at some firms. The following areas were specifically cited as supervisory and risk management gaps:

Failure to fully understand the activities that are taking place at branch offices, including the unique products and services offered at each branch location;
Failure to conduct periodic inspections of non-branch locations;
Failure to determine relevant areas of review, taking into consideration the nature and complexities of product and service offerings or indicators of irregularities or misconduct;
Failure to reduce the inspections and reviews to a written report;
Failure to follow through with necessary corrective action.

Suitability once again made the Sales Practice and Supervision hit list. Specific findings included:

Inadequate supervision of product exchanges;
Failure to identify and respond to red flags;
Inadequate oversight around customer account information changes;
Failure to recognize unsuitable transaction patterns;
Inadequate supervision of trading activities (excessive trading or churning);
Inadequate training of supervisors;
Unsuitable options strategies to unsophisticated customers.

Digital communications made it into this year’s report. FINRA specifically noted some firms that prohibit for business-related communications the use of text messaging, social media and collaboration applications such as Facebook, did not maintain a process to identify and respond to red flags around the use of the prohibited digital channel communications. Red flags could have been detected through adequate customer complaint management, email monitoring, outside business activity (OBA) reviews as well as advertising reviews. Some effective practices to manage digital communication were flagged, including:

Establishing comprehensive governance structures by leveraging marketing, compliance and technology departments as well as third-party vendors;
Defining and controlling permissible digital channels though supervision; records retention; policies and procedures; blocking prohibited channels; restricting use of messaging and collaboration applications that limit the firm’s ability to retain records;
WSPs to manage the lifecycle of video content which includes live-streamed public appearances, scripted commercials or video blogs;
Training prior to providing RRs access to firm-approved digital channels;
Disciplining misuse of digital communications such as temporarily suspending or blocking channels and requiring additional training.

FINRA also shares a number of cybersecurity-related observations and best practices in their 2019 report in hopes of assisting firms with strengthening their cybersecurity programs. The report reminds firms to evaluate each of the best practices and controls described in the report. Highlighted best practices include:

Maintaining branch-level written cybersecurity policies to protect confidential data;
Implementing procedures to verify that branch office controls were implemented and are functioning adequately;
Documenting formal policies and procedures on vendor and third-party management that include onboarding, ongoing monitoring, off-boarding and disposal of sensitive client information;
Establishing and regularly testing written formal incident response plans that outline procedures to follow when responding to cybersecurity and information security incidents;
Establishing data protection controls such as encryption of confidential data (customer and firm information) whether it is stored internally or at vendor locations;
Ensuring system patching is timely applied;
Applying a ‘Policy of Least Privilege’ around access controls, by only granting access to systems and data when required and removing such access rights when no longer needed;
Implementing multi-factor or two-factor authentication controls for RRs, employees, vendors and contractors accessing firm systems and data from outside the organization;
Maintaining an inventory of critical information technology assets, including hardware, software, data in home and branch offices; legacy assets that vendors no longer support as well as corresponding cybersecurity controls to protect these assets;
Implementation of data loss prevention controls to protect sensitive customer information such as SSN, dates of birth, bank information, driver’s license numbers;
Training for RRs, personnel, third-party providers and consultants;
Implementation of change management procedures to document, review, prioritize, test, approve, manage hardware and software changes.

Training staff on how to implement firm business continuity plans (BCPs) was cited as a BCP best practice in addition to engaging in annual testing of the BCP. Note: FINRA is currently conducting a retrospective review of FINRA Rule 3270 ~ Business Continuity Plans and Emergency Contact Information. See FINRA Regulatory Notice 19-06.

These are just some of the numerous highlights from the 2019 Report on FINRA Examination Findings and Observations to take into consideration when assessing the adequacy and effectiveness of your firm’s supervisory and risk management operations.

Note: RegEd is not engaged in rendering legal, accounting or other professional services. If legal or other professional advice is warranted, the services of an appropriate professional should be sought.