The Alternative Investment Management Association (AIMA) highlighted concerns over some upcoming critical final rules from the Securities and Exchange Commission (SEC).
The predictive data analytics proposal compels registered investment advisers and broker-dealers to identify, evaluate, and “eliminate or neutralize” conflicts for every technology they use in communications or investment management and to document and update this evaluation annually.
“Our primary concern is: the proposal means firms would have the nearly impossible task of assessing and recording all uses of covered technology, termed predictive data analytics, including basic tools like Excel spreadsheets. This could deter them from adopting innovative technologies that benefit investors and provide greater market access, efficiency, and returns,” AIMA wrote.
Another proposal is related to cyber for advisers and fund. The proposed SEC rule concerning Cybersecurity Risk Management for Investment Advisers and Funds introduces strict regulations for the adoption, implementation, annual review, and reporting of detailed and comprehensive written cybersecurity policies, controls, and procedures.
AIMA’s primary concerns are:
- The 48-hour notification deadline for significant cyber incidents—this proposed deadline could burden IT security teams and distract them from responding to threats. Tough luck if you’re a one-person IT security band. By contrast, the UK’s GDPR has a 72-hour cyber incident reporting deadline.
- The public disclosure of cybersecurity risks and incidents — The last thing a firm wants after a cyberattack is to publicly broadcast its cybersecurity flaws and roll out the red carpet for hackers. Why must this be disclosed publicly and so soon after the event?