PLANADVISER - March/April 2022 - 9

procedures " reasonably designed to
address cybersecurity risks. "
The commission also proposed
a new rule
and
form under
the
Advisers Act to require advisers to
report " significant cybersecurity
incidents " affecting
his fund or private fund clients,
the regulator. Additionally,
the adviser, or
to
the SEC
proposed amendments to various
forms regarding disclosures related
to significant cybersecurity risks and
incidents that could affect advisers,
funds, their clients and shareholders.
Further, the SEC proposed new
recordkeeping requirements under the
two acts related to cybersecurity.
The SEC's annual priorities list
advises that the agency's enforcement
division will " continue to evaluate
whether regulated entities have
established, maintained and enforced
written cybersecurity policies and
procedures
as
required. " The list
indicates that areas of focus will
include information technology
governance, IT asset management,
cyber-threat
management/incident
response, business continuity planning
and third-party vendor management,
including utilization of cloud services.
Demonstrating its resolve, last
year the SEC announced a series of
sanctions against eight RIA firms
for failures in their cybersecurity
policies and procedures that resulted
in what the agency describes as " email
account takeovers, " which exposed the
personal information of thousands of
customers and clients at each firm.
Warning Against Crypto Risks
On March 10, the Department of Labor
published
compliance
assistance
for 401(k) plan fiduciaries that are
considering plan investments in
cryptocurrencies. According to the
DOL's
announcement,
formally
referred to as Compliance Assistance
Release No. 2022-01, the goal of the
compliance assistance is to protect
the retirement savings of U.S. workers
from extreme volatility and legal risks.
Published by the DOL's Employee
Benefits Security Administration,
they consider adding a cryptocurrency
option to a 401(k) plan's investment
menu.
As
EBSA
points
out,
the
Employee Retirement Income Security
Act requires plan fiduciaries to act
solely in the financial interests of plan
participants and adhere to the standards
of professional care in considering
investment options for them.
EBSA says cryptocurrencies are often
promoted as innovative investments
that offer investors unique potential
for outsized profits. These investments,
therefore, can all too easily attract
inexpert plan participants with great
expectations of high returns and little
appreciation of the risks the investments
pose to their plan account. The release
emphasizes that cryptocurrencies are
very different from typical retirement
plan investments, and it can be
extraordinarily difficult, even for expert
investors, to evaluate these assets and
separate the facts from the hype.
Other concerns cited by EBSA
relate to custodial and recordkeeping
considerations, which are extremely
important in the ERISA fiduciary
context. EBSA says cryptocurrencies
are not held like traditional plan assets
are, in trust or custodial accounts,
or are they readily valued compared
with other assets, or available to pay
benefits and plan expenses. With
some cryptocurrencies, EBSA warns,
simply losing or forgetting a password
can result in the loss of the asset
forever, while other methods of holding
cryptocurrencies can be vulnerable to
hackers and theft.
According to EBSA, the rules
the
compliance assistance cautions plan
fiduciaries to exercise " extreme care " as
and regulations governing the
cryptocurrency markets may be
evolving, and some market participants
may be operating outside of existing
regulatory frameworks or failing to
comply with them. Fiduciaries that
are considering whether to include
a cryptocurrency investment option
will have to cite in their analysis how
regulatory requirements may apply to
issuance, investments, trading or other
activities and how those requirements
might affect investment in the option by
401(k) plan participants.
To this end, EBSA cites a theoretical
example wherein the sale of some
cryptocurrencies
could
constitute
... cryptocurrency
investments,
therefore, can
all too easily attract
inexpert plan
participants
with great
expectations ...
the unlawful sale of securities in
unregistered transactions.
themselves
to
Plan
fiduciaries must take care to avoid
participating in unlawful transactions,
exposing
liability
and plan participants to the risks of
inadequate disclosures and the loss of
investor protections guaranteed under
securities laws.
DOL Amends Certain PTEs
The Department of Labor has
announced a final notice of
amendments to six class exemptions
appearing in the prohibited transaction
rules of the Employee Retirement
Income Security Act and the Internal
Revenue
Code.
The
amendments,
originally proposed in 2013, relate to
the use of credit ratings as conditions
in these class exemptions. Section
939A of the Dodd-Frank Wall Street
Reform and Consumer Protection
Act requires the DOL to remove any
references to, or requirements of
reliance on, credit ratings from its
class exemptions and to substitute
standards of creditworthiness as the
department determines appropriate.
According to the DOL, the reason
for the Dodd-Frank provisions was
Congress' finding that, in the 2008
financial crisis, certain of the credit
ratings had been inaccurate and
" contributed significantly to the
mismanagement of risks by financial
institutions and investors. [This] in
turn adversely impacted the health of
the economy in the United States and
around the world. " The DOL's review
of its class exemptions determined
that PTEs 75-1 Parts III and IV, 80-83,
planadviser.com March-April 2022 | 9
http://www.planadviser.com
PLANADVISER - March/April 2022

Table of Contents for the Digital Edition of PLANADVISER - March/April 2022
