Hedge Fund Compliance Blog

HomeAbout UsBlogContact UsService ProvidersPWG TechCheckTraining

SEC Proposed Privacy Law Amendments: What’s the Impact on Hedge Funds?

Heads up hedge fund registered investment advisers!  The SEC’s proposed amendments to Reg S-P (privacy and safe-guarding of personal information) beef it up considerably and, if enacted as proposed, will undoubtedly come at an increased cost to RIA’s.

The proposed amendments have several important components related to the development of a much more comprehensive “information security program” (addressing administrative, technical and physical aspects):

  • designation of an employee to be in charge of the program, who will assess, in writing, the relevant risks, and design a program addressing the risks
  • regular testing of the program and training of staff
  • maintaining and preserving records related to the implementation of the  program, i.e., documentation of operations, breaches and assessments 
  • implementation of procedures to respond to security breaches, including notification to clients and possibly the SEC in more serious cases
  • personal information covered by the rule is broadened to include both “non-public” personal information, as well as consumer report information
  • a requirement to oversee service providers and their privacy safeguard programs

The SEC stated in its release that they are seeking these amendments in order to respond to an increasing number of privacy breaches coming out of securities industry firms.  The cost-benefit analysis estimates that costs for implementing the changes related to these amendments for a small firm will run around $18,500 to implement and around $10,800 per year thereafter. And the number for large firms are exponentially higher. 

While hedge funds with registered investment advisers already have a program in place, these additional requirements, particularly the designated supervisory employee and the service provider review component, are not insignificant. The costs and administrative burden will be very real. We just the benefits will be worth it! 

To view the full rule, go to: http://www.sec.gov/rules/proposed/2008/34-57427fr.pdf