Welcome back to the Compliance In Context podcast! On today’s show, we dive into the conversation on how firms continue to develop legal practitioners and compliance officers in an AI era. In our Headlines section, the SEC Establishes a Financial Reporting and Accounting Unit Within Division of Enforcement and the SEC’s RegFlex Agenda SEC Agenda Targets Crypto, Climate Rescission, Treasury Clearing, and finally, we close up today with another installment of What’s On My Mind, where we review a recent quote from a track coach on how we can push our compliance colleagues to become the best versions of themselves.

Show

Headlines

• SEC Establishes Financial Reporting and Accounting Unit Within Division of Enforcement
• SEC Agenda Targets Crypto, Climate Rescission, Treasury Clearing

Interview with Kurt Wachholz

• Reviewing the University of Chicago Law School’s statement on education in the AI Era
• How should firms adapt its training and policies in response to AI?
• How can we as compliance professionals develop an AI-resilient pedagogy and assessment?
• What are the “essential human” skills that distinguish excellent compliance professionals?
• How should firms instruct the responsible, effective, and ethical use of AI?
• What are some techniques firms can employ to foster an active, in-person engagement of compliance experiences that are conducive to learning?
• What can firms do avoid a reliance on technology while still highlighting and enhancing the output of AI tools for compliance purposes?

What’s On My Mind

• A lesson from a track coach on the true definition of winning and becoming the best versions of ourselves

Quotes

19:56 – “We had them all present to the rest of the class, and the class judged everyone's presentation, the rationale, who they selected, why they selected, all that good stuff. We get done with the assignment, and I'm going up to tell everyone who won, because they all had to turn in who they thought did the best presentation. And what I said to them is, ‘You all failed the assignment.’ And they just couldn't believe it. It's like, ‘What do you mean we failed the assignment?’ I said, ‘Because what you all decided when you were given this was that you had to make a choice with what you were given.’ And so, the part we were trying to help them with was, nobody questioned the exercise. They tried to fit the exercise around what they were told to do. So what I was trying to help them with, especially when we think about ethics and things of that nature, sometimes you have to question the premise before you go to the answer. And so I thought that one of the things that was really helpful about that exercise is that your reasoning doesn't start with your choices; it starts with the premise for it. I think that really relates to AI. A lot of times, we're going to be thinking about what's the output and is it acceptable, versus what did we start with in the first place as to why we used the tool.” - Kurt

34:49 – “Experience is not just accumulating answers. Going through an exam and responding to the request didn't necessarily give me experience. What it gave me was an identity of, like, this means that this is the production of what something is being asked to produce. But it wasn't actually helping me learn how to think. It was helping me learn how to deliver.” - Kurt

42:45 – “Knowing the right answer is not the same as being able to produce the right outcome. Knowing we're doing something wrong isn't what you're winning. It's getting the right outcome from knowing that; that really matters to the business. How we give voice to a concern can determine whether that concern is even meaningful.” - Kurt

49:36 – “Finding the...

Welcome back to the Compliance In Context podcast! On today’s show, we will be providing a comprehensive, deep-dive look at Ponzi schemes—what are they, historical facts and impact, themes and trends, and some best practices to keep in mind to help prevent these types of frauds from occurring inside your firms and with any underlying clients. To help guide us through this important topic and share some fantastic insights for our listeners, we welcome in Daniel Brinks, a Partner with StoneTurn and former regulator who spent more than 15 years at the SEC, most recently serving as a forensic account in the SEC’s Division of Enforcement..

Show

Interview with Daniel Brinks

• Background on Ponzi Schemes
• What are the trends and are there early-detection red flags?
• Why do some fall apart at 18 months versus others that last 10 years?
• How do the feeder frauds operate?
• Why do Ponzi schemes have an air of legitimacy?
• What are the similar characteristics in Ponzi Schemes?
• Custody Rule Impact
• Why has the total number of Ponzi schemes declined in recent years?
• How do compliance officers make sure to prevent these frauds from occuring?

Quotes

05:39: “So his scheme lasted eight months. He raised, you know, $20 million. But I think that the hallmarks of his scheme are still the hallmarks of what we see today. So the hallmarks of the original Ponzi scheme, a promise of high return, low risk…an exotic investment strategy, then the theft of assets, fake account statements. And I think the hallmark of a true Ponzi scheme is the recycling of assets, where you're using the investments of new investors to meet redemption requests from prior investors.” – Daniel Brinks

08:53: “I think the unfortunate and sad truth is that most Ponzi schemes are only uncovered when investors start bringing them to the attention of regulators. So the SEC has a TCR system, and when investors can't get their money back from schemers, they start reporting, 'Where's my money?' And then the SEC starts investigating it. That's unfortunately how most of these schemes fall apart, when they can no longer meet redemption requests and people start making complaints.” – Daniel Brinks

13:44: “I think the two characteristics that exist that investors and investment advisors should be on the lookout for the most is lack of transparency…the hard to get real answers on pieces of paper, statements. Think about as a scheme grows from ten investors to 100 or 200 investors, now you're sending quarterly statements to 200 investors. Like, that's a big administrative lift that probably most schemers don't have the ability to come up with rational answers for, where you're manufacturing complete trading histories that tie out, you know, multiple sets of books. It's really complicated to have multiple sets of books. So when schemes seem to get outside the realm of what people can do easily, information gets harder and harder to come by, and people should take that as a real warning flag when they're not getting, you know, account statements and things like that, or if the account statements look weird, right? They don’t look exactly what you would expect they would look like from a core custodian.” – Daniel Brinks

17:49: “I think another explanation for why [Ponzi schemes have declined] could be because we've generally been in a strong economic cycle. So, economic recessions cause increased numbers of redemption requests, and that puts a lot of pressure on the fund, and it makes them harder to ma- make, to meet those redemption requests. And that's when, whenever there's a recession, we see the number of Ponzi schemes that are prosecuted spike almost immediately. And I think the current strong economic cycle kind of has allowed frauds to go under the radar.”

Welcome back to the Compliance In Context podcast! On today’s show, we discuss how to build a culture of compliance in AI world and some best practices firms are using now to build AI into their respective operations and compliance programs. In our Headlines section, the SEC to Raise Qualified Client Threshold for Performance-Based Fees, SIFMA Re-urges the SEC to Overhaul Communications Retention Rules, and SIFMA Urges SEC to Overhaul Communications Retention Rules, and finally, we close up today with another installment of Outtakes, where we review a recent enforcement action involving fraud and registration charges against three venture capital fund managers and their owner.

Show

Headlines

• SEC issued a final order that adjusts the dollar amount thresholds for “qualified clients” under Rule 205-3 of the Investment Advisers Act
• SIFMA Urges SEC to Overhaul Communications Retention Rules

Interview with Erik Olsen

• How are you seeing firms successfully use AI, both inside and outside of compliance?
• Have you developed an AI policy?
• What voices inside the firm did you engage to help draft it (i.e. what departments were consulted)?
• From an operational perspective, what are the key considerations firms should consider before implementing AI into their systems and processes?
• What impact has incorporating AI into your firm had from a compliance perspective?
• What are some of the best practices you see firms implementing across the compliance program to foster a “culture of compliance” where AI feels ever present?
• Where do you see AI going in the future and what steps are you taking now to help accommodate the changing environment?

Outtakes

• SEC charges venture capital fund managers for making false and misleading disclosures, failing to disclose certain conflicts of interest and failing to comply with Securities Act and Investment Company Act registration requirements.

Quotes

14:13 – “Well, it’s, it’s the new shiny toy, right? It’s the souped-up new shiny toy that, as we always hear, you know, our neighbors down the street have and we don’t have, right? The same way they do marketing or, or something like that. So yeah, I agree with you. We got to figure out what is the use case for us because in, you know, us, you, them, it-it’s not going to be equal. Even though we all do asset management, you know, as we know within even the product lineup and the strategies we offer, it’s not all equal. So we do have to do that analysis. What do we use it for? What type of firm are we? Like I said at the top, we’re about 39 people. That AI use may look totally different than a shop that’s 1,000 people, right? Not only just what it... how you use it, what you’re using it for, but even how you even get to implement it.” – Erik Olsen

16:43 – “We are Microsoft Suite users, right? Copilot is basically in there. So we gave everyone the ability to use Copilot for work-related stuff. And in our acceptable use policy, which is an IT-owned policy, we had a section dedicated to large language learning models and AI and what you--basically the limitations. It was basically Copilot or bust. Here are the finer points. You know, put restrictions around trying to get backdoor access to Claude or Gemini or ChatGPT, whatever, et cetera. So that’s been kind of the last, again, let’s say, call it a year. And of course, people want more, which is fine. And the constant pullback was, “Yes, we want, we want more. Explain that to us,” and us re...

Welcome back to the Compliance In Context podcast! On today’s show, we discuss the FINRA Forward initiative and review some of the recent FINRA rulemaking activity in areas like outside business activities, personal securities transactions, gifts and gratuities, and performance advertising. In our Headlines section, the DOL reinstates the prior fiduciary standard under ERISA and Senator Warren Questions SEC Chair on alleged political interference in enforcement, and finally, we close up today with another installment of Outtakes, where a recent lawsuit filed by a former client against an RIA raises important considerations around appropriate disclosures and applicable standards of care.

Show

Headlines

• The U.S. Department of Labor (“DOL”) restored its prior five-part test for determining “fiduciary” status under the Employee Retirement Income Security Act (“ERISA”)
• Senate Banking Committee Member Elizabeth Warren pressed SEC Chair Paul Atkins to address allegations of political interference in enforcement matters before the agency

Interview with Ed Wegener

• What is FINRA Forward?
• What does FINRA hope to achieve with the FINRA Forward Initiatives?
• What have we seen to-date?
• What are the potential benefits?
• What are some potential challenges?
• What are the key changes in proposed Rule 3290?
• What are the key changes for Rule 3220 related to Gifts and Gratuities?
• What are the key changes Proposed for Advertising (Performance)?

Outtakes

• SEC-registered investment advisor allegedly assured a client that a $10 million bond investment was “guaranteed” before the underlying project collapsed entirely

Quotes

10:55 – “It’s clear that things don’t stay the same. Things change. The way we do business, technology, all of that changes, and it’s important for the rules to keep up with that. As well as show regulators enforce those rules. And so, from time to time, it’s really important to take a look and say, ‘What’s changed?’ and ‘Do we need to realign the rules with those changes?” – Ed Wegener

22:00 – “What you’re going to see is not just much more efficient regulators, which is always good, but more effective regulators. And so it’s important for firms to keep up because what you don’t want is regulators coming in with all this information and data and things that you don’t know about.” – Ed Wegener

22:37 – “There’s an opportunity for a great partnership there, between compliance departments and regulators, and this could be a really good way to do that. And the other thing, too, is all of these things are great. It only takes one big scandal to happen for things to just snap back into a much more reactive mode. So that’s one of the things the industry’s got to keep their eye on the ball, just make sure we’re keeping things in check, because we want to continue the momentum of all these changes and don’t want to have to take a step back.” – Ed Wegener

26:44 – “Probably the most important change in the proposal is that it would only apply to investment-related outside activities. So non-investment-related outside activities (such as being employed at a ride share company or working in a retai...

Welcome back to the Compliance In Context podcast! On today’s show, we will be diving into the SEC Enforcement Manual, and more specifically, to some of the recent amendments that were made and what it tells us about the state of SEC Enforcement right now. To help guide us through the conversation, we are very pleased to welcome in Brian Rubin and Ellen Connell. In our Headlines section, SEC and CFTC begin to clarify application of federal securities laws to cryptocurrency, and finally, we close up today with another installment of Outtakes, where we try to help spread the word about an active phishing campaign targeting FINRA and SEC-registered financial services firms and advisers and how to make sure to avoid getting caught flat-footed.

Show

Headlines

• SEC and CFTC jointly issued an interpretive release regarding the application of federal securities laws and federal commodities laws to certain crypto assets and transactions

Interview with Brian Rubin and Ellen Connell

• What is the SEC Enforcement Manual and what is its purpose?
• The SEC recently announced a broad set of revisions to its Enforcement Manual. At a high level, what was the rationale for the update and what does it tell us about the current state of the Division of Enforcement?
• What is the new process for obtaining cooperation credit?
• What are some of other factors the SEC weighs when determining whether to apply cooperation credit?
• Were there any other noteworthy changes to the manual that firms and individuals should be aware of as they are going through an investigation?
• The staff indicated greater access to the investigative file, evaluating whether providing access would help the recipient respond meaningfully and help both sides assess the strength of the evidence. Does this really mean greater access to the file? Are we talking full open jacket?
• Overall, what is your reaction to the SEC Enforcement Manual updates?
• What is the longest lasting impact?
• Regardless of the increase or decrease in numbers, where do you expect most of the enforcement cases to come from—exams or elsewhere?
• Keeping in mind the new changes to the SEC Enforcement Manual, do you think firms should take a harder look at self-reporting?

Outtakes

• Active phishing campaign targeting FINRA and SEC-registered financial services firms and advisers

Quotes

11:20 – “So the enforcement manual is basically an internal playbook guiding the staff on how to conduct investigations and recommend enforcement actions. When I was there, and I don’t know if this is still the case, it was in a red plastic binder, and we referred to it as the Red Book. It’s to help ensure fairness and consistency, and transparency for the process. And it covers everything from opening investigation to collecting evidence, engaging with companies and individuals, the Wells process, negotiations, cooperation, as we’ll talk about.” – Brian Rubin

13:11 – “This is the first set of updates since 2017, so it’s been quite a while. And the then SEC enforcement director (who just as we’re recording, announced her resignation just yesterday)she was quoted, Judge Margaret Ryan, in the press release explaining the relevance, saying that these updates to the enforcement manual are intended to ensure greater uniformity, to reflect the division’s best practices, to improve the staff’s ability to carry out the SEC’s mission of work on behalf of investors.” – E...

Welcome back to the Compliance In Context podcast! On today’s show, we will be taking an in-depth look at two of the hottest areas in the investment management space, namely—tokenization and crypto. To help guide us through the conversation, we are very pleased to welcome in two fantastic experts in the space, Louis Froelich and Fizza Khan. In our Headlines section, the SEC is taking a hard look at an electronic delivery rule and the SEC Enforcement Director share details on the Divisions current enforcement approach, and finally, we close up today with another installment of History Has Your Back, where some old quotes from a Stoic philosopher might just give us the push we need to navigate the regulatory filing season.

Show

Headlines

• SEC Working on Off-Channel Communications, E-Delivery Rules
• SEC Enforcement Director Ryan Details Back-to-Basics Approach

Interview with Fizza Khan and Louis Froelich

• What is tokenization?
• How is it different from crypto?
• What are some examples of things people are tokenizing?
• What is the hope with tokenization and also importantly what does tokenization not do?
• Who can actually invest in tokens?
• How does tokenization impact compliance?
• Is this a threat to compliance?
• How does AI impact tokenization?
• How does the SEC view this type of innovation?
• What is one of the biggest things that folks listening to this podcast should keep in mind regarding tokenization?

History Has Your Back

• Using the wisdom of Stoic philosopher Seneca to help compliance officers survive the regulatory filing season

Quotes

09:26 – “I think a good way to start to think about tokenization is to focus on what it does, not what it is, right? Tokenization is itself a very technical process. Just like sending an email to someone else is actually very technical, how that all works, right? But everyone knows what it’s like to send and receive an email. Tokenization is not unlike sending and receiving email for digital assets, and digital assets here are legally, and that’s the goal tied to something in the real world. So you can create a tokenized version of something, which is really a digital version of something. It could be a cup, it could be a tape roller…And it could be, or it could be something like a stock, right? You create something that could be transacted digitally. And, as long as we’re going to talk about this today, as long as you take the proper steps, when you create the digital version of it, then what you get is a legally enforceable, standardized version of the thing that can be more easily transferred.” – Louis Froelich

11:55 – “I think the biggest differentiator between crypto and tokenization is crypto is this catch-all term. It’s a catch-all term to define digitalized or digitized assets. And it’s also a catch-all term that these assets, these digital assets, are then transacted on a blockchain. So that in and of itself is something that we can use kind of synonymously when referring to digital assets. I think that’s kind of like the nomenclature people are just reverting back to is saying crypto. And more importantly, I think crypto is, interestingly, the systems on which you transact. So I mentioned the blockchain, but they, you know, everything’s governed by a code as, as what Louis had alluded to with the tokenization process, and it’s all on this blockchain network. Tokenization is...

Welcome back to the Compliance In Context podcast! On today’s show, we get to dive deep into one of our favorite topics on this fine show, namely what’s happening with the SEC Marketing Rule and some recent guidance that’s come out from the Division of Examinations and the Division of Investment Management. To help guide us through the conversation, we are very pleased to welcome back to the show, Chris Mulligan and Jeff Blumberg. In our Headlines section, we pay tribute to the service of former Commissioner Caroline Crenshaw, and we will also review a recent FINRA proposal covering the financial exploitation of senior investors and a new rule addressing suspected fraud for all customers, and finally, we close up today with another installment of Outtakes, where we continue to see an increased focus from the SEC Division of Enforcement on insider trading and related fraud schemes.

Show

Headlines

• SEC Statement on Departure of Commissioner Caroline Crenshaw
• FINRA Proposes Increased Protections for Senior Investors and Other Vulnerable Customers

Interview with Chris Mulligan and Jeff Blumberg

• Overview of the new Marketing Rule FAQs
• What is the impact on Footnote 590?
• Discussion of the purpose and process behind SEC Risk Alerts
• What does the new Risk Alert tell us about the Marketing Rule?
• What is the impact on testimonials and endorsements?
• Reviewing the sufficiency of disclosure requirements, including links to websites and the “clear and prominent” standard
• What does the Risk Alert say about third-party ratings? What satisfies the “reasonable belief” standard regarding preparation of third-party ratings?
• What does the Risk Alert disclose regarding the SEC’s stance regarding compensation structures?
• When does a statement from a third-party trigger the Marketing Rule?
• Reviewing the “adoption and entanglement” doctrine and related issues

Outtakes

• SEC Charges Six in $41M Insider Trading Scheme

Quotes

08:03 – “I think this FAQ is going to be very welcome by the industry. And it really stems from the fact that the rule itself does not seem to require a model fee. Net returns are defined as gross returns minus the fees and expenses you pay the advisor. There’s a pretty clear definition. And it provides guidance around how you can use a model fee. But it doesn’t really require it in the rule itself. However, Footnote 590–and this is why it was so controversial—said that if the fee to be charged to the intended audience is anticipated to be higher than the actual fees charged, the advisor must use the model fee that reflects the anticipated fee to be charged in order not to violate the rule’s general prohibitions.” – Chris Mulligan

15:24 – “So risk alerts are a really important part of the Division of Examinations. And, you know, they really express what the Staff is seeing on examinations, right? So the priorities come out every year and receive a lot of attention. You know, the reality is the priorities are often very similar year to year. They sort of focused on the issues that, you know, everyone generally knows they’re going to focus on. And it doesn’t talk about the results. Like, what did you actually find on these exams. And that’s where the risk alerts really come in and I think are really terrific docume...

Welcome back to the Compliance In Context podcast! On today’s show, we will be serving up everything you need to know about Regulation S-P and the upcoming compliance date for many firms—what are the new requirements, what are firms doing to prepare, and best practices on implementation. To help guide us through the conversation, we are very pleased to welcome in Kristin Snyder and Charu Chandrasekhar from Debevoise Plimpton. In our Headlines section, we review the 2026 Examination Priorities from the SEC Division of Exams, and finally, we close up today with another installment of History Has Your Back, where we examine what an old quote from an NBA superstar can teach us about conducting annual compliance reviews and the compliance profession.

Show

Headlines

• Reviewing the 2026 SEC Examination Priorities

Interview with Kristin Snyder and Charu Chandrasekhar

• Overview of the Reg S-P Amendments
• What are some of the key considerations firm should consider when implementing the new requirements of Reg S-P into their policies and procedures?
• What are some best practices if firms decide to build in the relevant provisions of Reg S-P into other sections of the firm’s compliance manual?
• What about recordkeeping provisions? How does disposal impact other policies and procedures?
• How can firms properly establish vendor risk management in the wake of the new Reg S-P requirements?
• How are firms successfully navigating the 72-hour notification requirements?
• If you were starting a firm from scratch, what are some additional best practices firms should consider when developing their broader information security and cybersecurity framework?
• What can we expect from the exam staff coming out of the shutdown?
• What would we expect the SEC to do now that the rule is live?

History Has Your Back

• Quote from Giannis Antetokounmpo regarding success versus failure at work.

Quotes

09:00 – “So the amendments, which went into effect in May of 2024. And then as we've all noted, the compliance dates are coming up for large institutions on December 3rd and then for smaller institutions later in the year into 2026 in June. The amendment is actually required, and have brought to bear, a number of significant changes. At a very high level, they now require under the amended reg SP covered institutions and the covered institutions are defined to include broker-dealers, registered investment companies, registered investment advisors, funding portals, and transfer agents must now adopt a formal incident response program and have written policies and procedures that are reasonably designed to detect and respond to and recover from any unauthorized access to or use of customer information. There's a notification requirement that now exists if sensitive customer information was or was reasonably likely to have been accessed or used with that authorization. And I think that the notification provisions are really what's significant for firms, because that notification has to be made as soon as practicable, but no later than 30 days after the advisor becomes aware of a breach.” – Kristen

15:00 – “We've seen it actually done in a combination in which you see a lot of compliance manuals have a section on privacy, on cybersecurity. There's usually a reference to Reg S-P and its obligations. But then actually to implement the reg, the policies and procedures need to live in several different areas, like incident response. That's pure cybersecurity. And so you're likely going to have cybersecurity specific procedures in terms of just drafting the notice, getting it out t...