First, WHO does the CCPA affect?

The CCPA will affect fund managers who do business in California AND either (i) have at least $25 million of annual gross revenue; (ii) buy, sell, share or receive personal data; or (iii) receive over half of their revenue from the sale of personal data of California residents. Most fund managers who do business in California will not meet any of these prongs. The few managers who the CCPA will affect will likely fall under prong (i) – those who do business in California and have at least $25 million in annual gross revenue.

In calculating the $25 million in annual gross revenue, fund managers operating with a bifurcated management structure (separate management company and general partner entities) will likely have to aggregate the revenues of the general partner and management entities. The CCPA expands the definition of a “business” to entities who control or are in common control with another business and which share a common branding. In this case, if the threshold is met across both management entities, each entity will be subject to the provisions of the CCPA. If the general partner and investment manager do not share common branding, our view is that the revenues of the entities will not need to be aggregated.

Second, WHAT information does the CCPA cover?

The CCPA generally covers “personal information” that identifies, relates to, describes, associates with, directly or indirectly, a particular institutional or prospective client. This information includes, without limitation, names, addresses, email addresses, social security numbers, driver’s license or state issued ID number and passport numbers.

Typically, fund managers maintain the personal information of (i) their own employees (ii) individual clients (iii) institutional or entity clients and (iv) prospective clients. Fund managers may be relieved to learn that, due to certain statutory exemptions, information collected (i) about manager’s employees, (ii) via certain business to business transactions and (iii) about individual clients (if a manager is an SEC Registered Investment Adviser), does not constitute personal information and as a result, does not fall under the scope of the CCPA. Thus, the CCPA will generally only cover personal information of a fund manager’s (i) entity or institutional clients and (ii) prospective clients.

The CCPA exempts from coverage all data pre-empted by the Gramm-Leach-Bliley Act (the “GLBA”), which only applies to SEC Registered Investment Advisers (each, an “RIA”). The GLBA protects nonpublic personal information that is provided by a consumer to a financial institution in connection with obtaining financial products/services from the institution. The GLBA’s definition of nonpublic personal information differs from the definition of personal information under the CCPA, and is limited to individual investor information. Thus, while certain individual investor information may be pre-empted from the scope of the CCPA, personal information of entity investors, institutional investors and prospective investors is not within the scope of the GLBA and as such, will be covered by the CCPA.

Third, HOW should fund managers comply?

To the extent that clients or client prospects of fund managers are protected by the CCPA, their rights include the right to request disclosure of information that is collected and shared, the right to delete personal information and the right to non-discrimination. To ensure such compliance with the CCPA, we recommend that managers within the scope of the CCPA take the below actions:

• • Fund managers must broadly be prepared to promptly respond to California client rights and requests including clients’ rights to (i) access specific personal information (ii) data portability (iii) data deletion and (iv) non-discrimination for exercise of any CCPA right. Once a fund manager has received a verifiable consumer request from a client, it must be prepared to disclose and deliver the required information to the client within 45 days.

• • Typical privacy policies currently used by fund managers may need to be updated to (i) inform clients of their rights under the CCPA and instructions on how to exercise those rights and (ii) reword and incorporate as a comprehensive list all personal information (including drivers licenses, passport numbers or any other personal identifiers) collected and shared with service providers (such as the fund administrator, auditor, legal/regulatory service providers and I.T. providers). RIAs should also distribute their annual privacy policy update to all clientele in January.

• • Fund managers operating a website which collects personal information (either through an online portal access, cookies or other website function) must publish a separate CCPA compliant privacy disclosure on such website relating to the collection and use of such personal information. Many fund managers do not collect personal information on their websites, and thus will not need to include such privacy disclosure on their webpage.

• • Fund managers should consider updating their agreements with their fund administrator and possibly other service providers that have access to covered information of clients to include a representation from the service provider that it is in compliance with CCPA regulations.

Clients, Friends, Associates:

The first quarter of each year is typically a busy time for both investment managers and services providers.  The first quarter of 2019 was no exception.  Now that many of the filing deadlines have passed, and audit work should be completed (or nearly so), we enter the second quarter of 2019 with regulatory changes and developments on the horizon.  Below is a brief overview of some items that we hope will help you stay on top of the business and regulatory landscape in the coming months.

****

SEC Matters

SEC Publishes Examination Priorities for 2019.  On December 20, 2018, the SEC announced its Examination Priorities for this year.  In 2019, the SEC intends to place emphasis on matters concerning digital assets, cybersecurity, and matters of importance to retail investors, including fees, expenses, and conflicts of interest.  Specifically, the SEC will focus on (i) compliance and risks in critical market infrastructure; (ii) retail investors, including seniors and those saving for retirement; (iii) FINRA and MSRB; (iv) cybersecurity; and (v) anti-money laundering programs.  We recommend speaking with your compliance firm to ensure your books and records as well as operations are in compliance with the securities rules.

SEC Adopts Final Rules Allowing Exchange Act Reporting Companies to Use Regulation A.  Regulation A provides an exemption from registration under the Securities Act for offerings of securities up to $50 million within a 12-month period.  On December 19, 2018, the SEC amended Regulation A to enable companies that are subject to the reporting requirements of Section 13 or 15(d) of the Securities Exchange to use Regulation A.  The amendments also permit such reporting companies to meet their Regulation A ongoing reporting obligations through their Securities Exchange Act reports.

SEC Proposes Rule Changes for Fund of Fund Arrangements.  On December 19, 2018, the SEC voted to propose a new rule and related amendments designed to streamline and enhance the regulatory framework for fund of fund arrangements.  The SEC’s proposal would allow a fund to acquire the shares of another fund in excess of the limits of Section 12(d)(1) of the Investment Company Act without obtaining an individual exemptive order from the SEC.  To rely on the rule, funds must comply with conditions designed to enhance investor protection, including conditions restricting the ability of funds to improperly influence other funds, charge excessive fees, or create overly complex fund of fund structures.

SEC Takes Action Against Robo-Advisers.  On December 21, 2018, the SEC settled proceedings against two robo-advisers for making false statements about investment products and publishing misleading advertising.  The proceedings were the SEC’s first enforcement actions against robo-advisers, which provide automated, software-based portfolio management services.

SEC Opens Registration in Compliance Outreach Seminar. The SEC will be sponsoring a seminar on May 16, 2019 as part of its compliance outreach program. The program seeks to aid chief compliance officers and other investment adviser or investment company personnel in the development of their compliance programs. The seminar will be held in Pittsburgh, Pennsylvania, and the topics include 2019 exam and enforcement priorities, common deficiencies, cybersecurity, and what to expect in an examination. Those interested in attending the seminar may register here.

CFTC Matters 

CFTC Releases a Primer about Smart Contracts. On December 11, 2018, LabCFTC, the CFTC’s hub for engagements with the FinTech innovation community, released a primer to help explain smart contract technology and related risks and challenges. The primer looks to provide a definition for smart contracts by looking at smart contract history, characteristics, and potential application in daily life.

NFA Adopts Proficiency Requirements for Swap-Related Associated Persons. On March 25, 2019, the NFA adopted an interpretive notice regarding its amendments to NFA Bylaw 301 and NFA Compliance Rule 2-24 which will implement changes to the NFA’s Swaps Proficiency Requirements. These new rules will go into effect on January 1, 2020 and will require all Associated Persons who engage in, or supervise activities involving, swaps at futures commission merchants, introducing brokers, commodity pool operators, commodity trading advisers, swap dealers, and major swap participants to take and pass a proficiency exam. The exam tests both market knowledge and knowledge of regulatory requirements, and there is no grandfathering provision within the new requirements. The new rules provide for two tracks of testing: the Long Track for swap dealers and the Short Track for all others. The NFA’s Swaps Proficiency Requirements must be completed by January 31, 2021.

NFA Amends its Interpretive Notice on Information Systems Security Programs. In March 2016, the NFA issued an interpretive notice requiring each member to adopt a written information systems security program (ISSP) to combat and effectively respond to unauthorized access of their information technology systems. On January 7, 2019, the NFA announced that it amended the notice to provide more clarification on ISSP approval and the corresponding training requirements for members. Additionally, the amended notice now requires NFA members (other than FCMs) to notify the NFA when certain cybersecurity incidents occur. The amendments to the March 2016 notice became effective April 1, 2019.

NFA Adopts Interpretive Notice Regarding CPO Internal Controls Systems. On April 1, 2019 the NFA adopted an interpretive notice applicable to CPO NFA members that have the ability to control customer funds. The notice specifically requires these CPO NFA members to implement an internal controls framework meant to protect customer funds and provide reasonable assurance that the CPO is in compliance with all CFTC and NFA rules, especially rules regarding maintenance of books and records for each commodity pool.

CFTC Announces 2019 Examination Priorities. On February 12, 2019, the CFTC announced its 2019 examination priorities–the first time the CFTC has done so in its history. In the announcement, the Division of Market Oversight (DMO), the Division of Swap Dealer and Intermediary Oversight, and the Division of Clearing and Risk each summarized their respective priorities. Of note, one of the DMO’s 2019 priorities include cryptocurrency surveillance practices.

Digital Asset Matters

SEC Commissioner Discusses Regulatory Considerations Concerning Digital Assets.  On February 8, 2019, SEC Commissioner Hester Peirce provided remarks concerning regulation and innovation.  Commissioner Peirce stated that digital asset tokens sold for use in a functioning network, rather than as investment contracts, fall outside the definition of securities.  Commissioner Peirce also acknowledged the uncertainty of the regulatory environment concerning digital assets as well as the novel challenges presented by digital asset trading platforms.  Additionally, Commissioner Peirce suggested that there will be further development of the digital asset regulatory environment in 2019.

SEC Issues a Public Statement on Digital Assets as Investment Contracts. On April 3, 2019, the SEC released a public statement discussing whether digital assets are considered securities by virtue of being offered and sold as investment contracts. The public statement references both a published framework of analysis by FinHub and a response to a no-action request by the Division of Corporation Finance. FinHub’s published framework identifies the relevant factors in determining whether a digital asset is offered or sold as an investment contract. Further, the no-action letter demonstrates the type of digital asset that the Division of Corporation Finance would not consider an investment contact or, accordingly, a security.

District Court Reconsiders Previous Ruling, Grants SEC Preliminary Injunction.  Last November, in what was seen as a victory for ICO issuers, a District Court denied the SEC’s attempt to obtain a preliminary injunction against a digital asset company, holding that the SEC failed to prove the company’s token was a security.  On February 14, 2019, the District Court reversed its position and granted a preliminary injunction to the SEC, holding that the contents of the company’s website, whitepaper, and social media posts concerning the company’s ICO constituted an offer of securities.

CFTC is Seeking Comments on Digital Asset Mechanics and Markets.  On December 11, 2018, the CFTC announced it is seeking public comment and feedback to better inform the CFTC’s understanding of the underlying technology, opportunities, risks, mechanics, use cases, and markets for virtual currencies beyond Bitcoin, namely Ether and its use on the Ethereum Network.  The CFTC is seeking to understand the similarities and distinctions between Ether and Bitcoin, as well as Ether-specific opportunities, challenges, and risks.

ICO Issuer Settles Unregistered ICO Charges After Self-Reporting to the SEC. On February 20, 2019, the SEC announced a settlement regarding an unregistered ICO by a company that raised over $12 million in digital assets in late 2017 to finance its operations. In the summer of 2018, the company self-reported to the SEC and cooperated with the SEC’s investigation. The SEC stated that it did not impose a penalty on the company because the company self-reported, agreed to compensate investors, and will register the tokens in compliance with securities laws.

Although the company conducted an ICO after the SEC released the DAO Report on July 25, 2017, the SEC’s decision to forgo fining the company suggests the SEC’s approach to the digital asset space is to focus on fraudulent conduct rather than stifling innovation in the space.

Nasdaq Offers Bitcoin and Ethereum Liquid Indices.  As of February 25, 2019, Nasdaq is offering spot Bitcoin and Ethereum indices, quoted in USD, based on real-time prices.  This move by Nasdaq, which lists over 3,300 companies and carries out approximately 1.8 billion trades per day, could serve as a step towards mainstream adoption of digital assets.

Florida Court Rules Direct Sales of Bitcoin Constituted Money Transmission.  On January 30, 2019, the Third District Court of Appeals in Florida held that an individual’s sale of Bitcoin for cash constituted money transmission and the sale of a payment instrument.  The Court held that since the seller was not licensed to act as a money services business, he could be charged with engaging in unlawful money transmitter services in connection with sales of Bitcoin for cash.

JPMorgan Creates Digital Asset Payment Coin.  On February 14, 2019, JPMorgan announced that it is the first U.S. bank to create and successfully test a digital coin representing a fiat currency, JPM Coin.  JPMorgan claims the JPM Coin will be used to make instantaneous payments using blockchain technology.  While JPMorgan claims that the JPM Coin is designed for institutional use and not for public investment, the company hopes to further develop JPM Coin’s utility in the future.

Other Matters 

FINRA Issues Panel Decision Regarding Transaction-Based Compensation. On January 29, 2019, FINRA’s Department of Enforcement released its decision in an enforcement hearing involving transaction-based compensation. In the decision, FINRA found that the respondent violated such  rules by paying compensation to (i) an unregistered finder’s non-member, unregistered entity and (ii) non-member, unregistered entities owned by its brokers. Additionally, FINRA held that the respondent failed to reasonably supervise its business and had inadequate written supervisory procedures that neither prevented nor detected deficiencies.

Atlanta Panel.  On April 24, 2019, Cole-Frieman & Mallon will be co-hosting a panel with Harneys and Trident Fund Services at Atlanta Tech Village.  The panel will cover developing topics in the investment management space including developments in the digital asset space, the rise of cannabis, and qualified opportunity zone funds.

Qualified Opportunity Zones.  This continues to be a hot topic:

Qualified Opportunity Fund Panel.  In February, Cole-Frieman & Mallon and Anderson Tax hosted a panel regarding qualified opportunity zone funds.  The panel addressed the tax and legal considerations that investment managers and investors should be aware of when creating or investing in a qualified opportunity zone fund.

IRS Holds a Public Hearing on Qualified Opportunity Funds.  On February 14, 2019, the IRS held a public hearing seeking input related to the first round of proposed rulemaking it issued in October 2018.  In the next round of proposed rules, the IRS is expected to provide (i) clarity on the definition of qualified opportunity zone business; (ii) data reporting requirements; (iii) clarity on interactions with other tax incentives; and (iv) guidance on interim gain reinvestment.  Further rule clarifications are expected in Spring 2019.

****

Compliance Calendar.

Clients, Friends, Associates:

We hope that you had an enjoyable summer. The past quarter saw further interest in digital assets from regulators, as well as enforcement actions and indications of possible regulatory changes. In the traditional investment management space, this summer saw a continuation of the bull market. As we move into the fourth quarter, we would like to provide an overview of items we hope will help you stay up-to-date with regulatory developments.

In addition to the discussion below, we would like to announce a couple of firm-related items:

• CoinAlts Fund Symposium. In September, preceded by a well-attended Women in Crypto networking event sponsored by Coinbase, founding sponsor Cole-Frieman & Mallon hosted its third successful full day Symposium in San Francisco. Speakers including keynote Tim Draper, founder of Draper Associates, DFJ and the Draper Venture Network and Joe Eagan of Polychain Capital explored issues key to fund managers and investors in the digital asset space.

• CFM San Francisco. We are delighted to announe our overflowing San Francisco team will shortly relocate to expanded premises at 255 California Street.

****c

SEC Matters

SEC Chairman Hints at Changes in Investor Standards. On August 29, Securities and Exchange Commission (“SEC”) Chairman Jay Clayton spoke at the Nashville 36|86 Entrepreneurship Festival. He discussed issues the SEC is focused on or intends to focus on, including initial coin offerings (“ICOs”), promoting capital formation for public companies or companies considering going public, and rethinking the SEC’s current private offering exemption framework. Of note, Chairman Clayton stated that the SEC should explore how the current private offering exemption landscape could be simplified and streamlined. In particular, the Chairman noted that the SEC should examine the possibility of focusing on factors beyond investor wealth (i.e. accredited investor status), such as investor sophistication or investment amount.

SEC Releases Best Execution Deficiencies Alert. On July 11, the Office of Compliance Inspections and Examinations of the SEC released an alert outlining common deficiencies observed in examinations of advisers’ “best execution” obligations. These requirements come from the Investment Advisers Act of 1940, as amended, and impose a duty on advisers to execute trades so that total costs and proceeds are most favorable to clients. While best execution obligations depend on the facts of each situation, the SEC observed the following common deficiencies:

• Not Performing Reviews – advisers were unable to provide evidence that they periodically and systematically reviewed the broker-dealers used to execute transactions.
• Not Considering Materially Relevant Factors in Broker-Dealer Services – advisers did not consider the full range and quality of broker-dealers’ services.
• Not Seeking Other Broker-Dealers – advisers often used only one broker-dealer for all of their clients without evaluating the services, quality, and costs of others.
• Not Disclosing Best Execution Practices – advisers did not fully disclose best execution practices to their clients.
• Not Disclosing Soft Dollar Arrangements – soft dollar arrangements (i.e. commissions in exchange for brokerage and research services) were not fully and fairly disclosed in advisers’ Form ADVs.
• Not Properly Allocating Mixed Use Products and Services – advisers did not properly allocate the costs of mixed use products or services (i.e. products or services obtained using soft dollars, where that product or service is also used for non-investment purposes, such as accounting or marketing). Additionally, advisers did not properly document the reasons for mixed use product or service allocations.
• Inadequate Policies and Procedures – advisers lacked policies, had insufficient internal controls, or did not have policies tailored to their investment strategy.
• Not Following Policies and Procedures – advisers failed to follow their own best execution policies and procedures.

In light of the deficiencies listed above, advisers should review their best execution policies and procedures, and contact legal counsel or a compliance professional with any questions.

Hedge Fund Adviser Charged with Short-and-Distort Scheme. On September 12, the SEC charged a hedge fund advisor with illegally profiting from a “short-and-distort” scheme. The adviser is alleged to have released false information about a public pharmaceutical business after shorting the company. The adviser allegedly used reports, interviews, and social media to spread false claims that, for example, the pharmaceutical company was “teetering on the brink of bankruptcy”. The SEC is seeking a permanent restraining order, disgorgement of ill-gotten gains, and civil penalties.

SEC Charges Adviser for Risky Investments and Secret Commissions. On July 18, the SEC charged an adviser and its CEO with misleading investors by putting their capital in risky investments and secretly pocketing large commissions from such investments. The adviser and CEO are accused of misleading investors about the risks of the investments, overbilling, concealing financial conflicts, and violating the anti-fraud and registration provisions of federal securities laws. The SEC is seeking a permanent injunction, disgorgement of ill-gotten gains and losses avoided plus prejudgment interest, and civil monetary penalties. 

CFTC/NFA Matters 

CFTC Chairman Outlines Increased CFTC Enforcement. On October 2, the Commodities Futures Trading Commission (“CFTC”) Chairman Christopher Giancarlo summarized the CFTC’s increased enforcement efforts from the prior fiscal year in a speech to the Economic Club of Minnesota. These efforts include:

• Enforcement Actions – in the prior fiscal year, the CFTC filed approximately 25% more enforcement actions than each of the prior three fiscal years.
• Large-Scale Matters – the CFTC has increased enforcement actions against large-scale matters (i.e. matters that threaten basic market integrity). In the CFTC’s last fiscal year, it brought more than three times the average number of large-scale actions as the previous administration.
• Manipulative Conduct – the CFTC has brought more than five times the previous average number of actions against manipulative conduct in the past fiscal year. Such conduct includes fraud, spoofing (i.e. bidding with the intent to cancel before execution), and the use of technology to manipulate order books.
• Accountability – the CFTC has prioritized individual accountability, and approximately 70% of the past fiscal year’s cases involved charges against individuals who committed illegal acts.
• Partnership with Criminal Enforcement – the CFTC has filed “far more actions in parallel” with criminal law enforcement partners than in any previous year.
• Whistleblower Awards – with respect to whistleblowers, the CFTC has strengthened protections, granted a record number of awards, and received a record number of tips and complaints.

With these increased enforcement efforts in mind, managers of funds subject to CFTC jurisdiction should ensure they are up-to-date with CFTC filings and regulations.

CTA Associated Person and Introducing Broker Charged with Fraud. On August 10, the CFTC settled charges against an associated person of a commodity trading adviser (“CTA”) and introducing broker. The charges were based on a fraudulent trading scheme where the trader entered unauthorized commodities trades in customers’ accounts, transferred profitable trades to his own account, and left losses in the clients’ accounts. The settlement included a cease and desist order, a permanent ban from engaging in trading with any CFTC-registered entity, and a $100,000 civil monetary penalty.

Digital Asset Matters

Regulators continued to show interest and initiate enforcement actions in the digital asset space. Below is a summary of certain key digital asset items from the third quarter. For a complete review of these and other crypto developments, please consult our Third Quarter Digital Asset Regulatory Items blog post.

SEC Charges Digital Asset Hedge Fund Manager. On September 11, the SEC announced the settlement of charges against a digital asset hedge fund and its manager. The charges include misleading investors, offering and selling unregistered securities, and failing to register the hedge fund as an investment company. After being contacted by the SEC, the fund offered rescission and disclosed its previous misstatements to investors. The settlement included cease-and-desist orders, censure, and a $200,000 penalty. This is the first action the SEC has taken against a digital asset fund based on violations of the investment company registration requirements.

SEC Charges ICO Platform for Operating as Unregistered Broker-Dealer. On September 11, the SEC settled charges against an ICO platform. The business was charged with failing to register as a broker-dealer, as well as offering and selling unregistered securities. This is the SEC’s first charge against an unregistered broker-dealer in the digital asset space following the SEC’s 2017 DAO Report, which cautioned anyone offering or selling digital assets to comply with federal securities laws.

New York Attorney General Releases Report on Digital Asset Exchanges. On September 18, the Office of the Attorney General of New York (the “OAG”) released a report summarizing a crypto exchange fact-finding initiative. Based on the digital asset exchanges examined, the OAG outlined three primary areas of concern: potential conflicts of interest, lack of anti-abuse controls, and limited customer fund protection.

NFA Requires CPOs and CTAs to Disclose Digital Asset Activity. On July 20, the National Futures Association (“NFA”) released a notice that imposed new disclosure requirements on futures commission merchants, commodity pool operators (“CPOs”), and CTAs that are NFA members engaged in certain digital asset activities. The new disclosures cover, for example, the volatility and cybersecurity risks of digital assets. Additional details are available in our recent blog post.

Offshore Matters

Cayman Islands Delays AML Officer Deadline. Under new Cayman Islands requirements, investment funds that conduct business in or from the Cayman Islands must appoint individuals to new anti-money laundering officer positions. The Cayman Islands Monetary Authority (“CIMA”) has delayed certain deadlines for funds that launched prior to June 1, 2018:

• CIMA-Registered Cayman Funds – registered funds still must have appointed the new officers by September 30, 2018, but now do not need to confirm the identity of the officers via CIMA’s Regulatory Enhanced Electronic Forms Submission (“REEFS”) portal until December 31, 2018.
• Unregistered Cayman Funds – unregistered funds do not need to appoint the new officers until December 31, 2018, and they do not need to confirm the identity of these officers via the REEFS portal.

Funds formed on or after June 1, 2018 must have appointed the officers (and confirmed such officers through REEFS for registered funds) at launch. The new roles must be filled by individuals, and some service providers may be willing to provide individuals to serve such roles. We recommend fund managers discuss anti-money laundering compliance with offshore counsel and the fund’s administrator.

Other Matters 

FINRA Warns of Regulator Impersonators. On July 13, FINRA issued a warning that persons claiming to be working for FINRA have been calling firms and attempting to obtain confidential information. In particular, FINRA warned that the use of overseas telephone numbers or email addresses indicates a likely scam, as well as emails from suspicious domains that do not end with “@finra.org” and that contain attachments or embedded links. If you have questions about the legitimacy of purported FINRA communications, contact your FINRA Coordinator.

New York Issues Sexual Harassment Compliance Mandate. Managers with operations in New York State and New York City should be aware of recent changes to employers’ obligations with respect to sexual harassment. Effective October 9, 2018, all employers in New York State are required to adopt a sexual harassment prevention policy equal to or greater than the standards of the state-issued model policy. Additionally, New York State employers must provide sexual harassment prevention training annually that is equal to or greater than the state-created model. This training must be completed by current employees by January 1, 2019, and by new hires within 30 days of being hired. Managers that may be subject to these new requirements can learn more on New York State’s Combating Sexual Harassment in the Workplace website. New York City has also implemented similar training requirements for employers with 15 or more employees, which will take effect on April 1, 2019. Additionally, effective September 6, 2018, New York City employers must post a sexual harassment poster and distribute a fact sheet to new employees.

SEC Charges Firm for Deficient Cybersecurity. On September 26, the SEC settled charges against a broker-dealer/investment adviser based on the firm’s deficient cybersecurity procedures after parties posing as contractors accessed customers’ personal information. The charges are a reminder of the importance of maintaining strong cybersecurity policies and procedures. Firms should be aware that cybersecurity is an on-going obligation and has become a focus of the SEC.

IRS Ends Voluntary Disclosure Program. On September 28, the Internal Revenue Service ended the 2014 Offshore Voluntary Disclosure Program (“OVDP”). U.S. taxpayers are required to report and pay taxes on certain offshore assets and face potential stiff criminal and civil penalties for failing to do so, and the OVDP was designed to offer taxpayers certain protections from these penalties. Fund managers with unreported foreign assets that were not able to meet the September 28, 2018 deadline should discuss their options with tax counsel.

New Law Expands Disclosure and Approval Requirements for Investments by Foreign Entities. On August 13, the Foreign Investment Risk Review Modernization Act (“FIRRMA”) was signed into law. It expands the scope of investments by non-U.S. investors in critical domestic tech companies that must be disclosed to and approved by the federal government in an effort to strengthen national security. An example investment within the scope of FIRRMA is an investment by a non-U.S. entity in a tech company that gives the investing entity access to material non-public technical information. While there are limits and exemptions to the scope of FIRRMA and the typical fund will not need to worry about its new requirements, venture funds with foreign limited partners or foreign co-investors should be mindful of the expanded approval requirements.

****

Compliance Calendar. As you plan your regulatory compliance timeline for the coming months, please keep the following dates in mind: