Keyword Search as a Supervisory System
Crestline Securities has 45 registered reps across three offices and no dedicated surveillance staff. Its written supervisory procedures provide that a compliance assistant will review 25 emails per rep per quarter using a keyword list last revised in 2018, forwarding hits to the CCO. The assistant holds no securities license and has had no training on the list. In June a hit surfaces an email a rep sent in January telling a 71-year-old client that a bond fund 'cannot lose principal and will pay 8% for sure'; the client invested $200,000 in February. The same search run shows roughly 40 earlier hits marked 'reviewed - OK' with no reviewer name, no date, and no notes. The CCO's instinct is to discipline the rep and move on.
1. Evaluate the adequacy of the email review program under FINRA Rule 3110.
Read the worked answer
Sampling is permissible; a system that cannot function as designed is not. The rule requires written procedures reasonably designed to achieve compliance, and the review of correspondence is a core element. Failure points here:
- Stale lexicon. A 2018 keyword list will miss current products and current pitches. No process exists to update it after new products, new offices, or prior hits.
- Untrained, unlicensed reviewer. The person screening for sales-practice and suitability problems has no basis to recognize one.
- No documentation. 'Reviewed - OK' with no name, date, or rationale is indistinguishable from no review at all and defeats any ability to demonstrate supervision.
- No escalation timeline. A January email surfacing in June means six months of undetected exposure, and the client was already invested.
The program is deficient as written and as operated. Discipline of the rep addresses one symptom; the CCO's first deliverable is a remediation plan with dates, owners, and evidence.
2. What must the firm do about the client and the communication now?
Read the worked answer
The statement that a bond fund 'cannot lose principal and will pay 8% for sure' is a misleading communication and potentially a fraud exposure, regardless of the rep's intent.
- Contact the client by a principal, not the rep, to correct the representation and explain the actual risks, including that principal can be lost and the 8% is not guaranteed.
- Review the position for suitability given the client's age and objectives; determine whether rescission or a make-whole remedy is appropriate, and document the decision either way.
- Review all of that rep's correspondence and accounts, not just this email, since the hit rate on this client suggests a pattern.
- Consider reportability. A misleading sales communication may trigger Rule 4530 obligations if it becomes a regulatory matter, and any settlement or arbitration would be a reportable event on Form U4.
- Preserve records - the email, the review trail, and all client communications about the correction.
3. What remediation and documentation should the CCO deliver to senior management?
Read the worked answer
A credible package has four parts:
System. Rebuild the lexicon with product-specific terms, set risk-based sampling (new reps, high-complaint reps, and senior-investor accounts reviewed more heavily), require licensed or trained reviewers, and set a hard escalation clock (for example, hits triaged within five business days by a principal).
People. Training for the reviewer and all reps on communications standards; an annual compliance meeting that actually covers the firm's own findings.
Accountability. Documented supervisory review of the reviewer's work, a named principal owner for the program, and consequences for reps who make guarantees.
Evidence. A written remediation memo with the gap analysis, the corrective actions, completion dates, and a follow-up sample review showing the new process working. Regulators judge supervision by what the firm can produce, not by what it intended.