NASAA Series 63Ethical Practices and ObligationsMedium
A broker-dealer's internal cybersecurity policy mandates that all client data must be encrypted both in transit and at rest. An agent, finding the encryption process cumbersome, frequently saves client account numbers, social security numbers, and birth dates to an unencrypted spreadsheet on their personal, unsecured laptop to work from home more easily. This agent's actions represent a violation of:
- AThe insider trading rules
- BThe anti-churning provisions of the Uniform Securities Act
- CThe firm's cybersecurity policy and client data protection mandates
- DThe agent's suitability obligations
Show answer & explanationAnswer & explanation
Correct answer: C. The firm's cybersecurity policy and client data protection mandates
The agent's actions directly contravene the firm's cybersecurity policy and the broader regulatory requirements for protecting sensitive client data. Storing unencrypted client information on an unsecured personal device creates significant data breach risks and violates privacy mandates.
Why the other options are wrong
- A. Insider trading involves using non-public information for trading, which is not described here.
- B. Anti-churning provisions address excessive trading for commissions, which is unrelated to data security.
- D. Suitability obligations relate to recommending appropriate investments, not data security practices.
Client Data Security
Agents and firms are obligated to protect sensitive client information from unauthorized access, use, or disclosure through robust cybersecurity measures.
- Includes encryption, secure storage, and access controls.
- Violations can lead to data breaches, identity theft, and regulatory penalties.
- Policies must be followed to ensure compliance with privacy regulations (e.g., Regulation S-P).
Memory trick: Client data is a treasure, guard it with a digital fortress.