This Notice addresses investment advisers using third-party platforms to access and manage held-away client assets.
The Securities Division is aware that some state-registered investment advisers may be utilizing a platform that allows them to access and manage held-away 401(k) accounts. Access is obtained through the use of the investment adviser client’s unique username and password, and without the knowledge of or permission from the 401(k) custodian.
Investment advisers should be aware that the Securities Division has determined that this use of a third-party platform is likely a dishonest or unethical business practice.
The applicable provisions and a discussion of them is set out below.
Statutes and Rules:
Revised Code of Washington (“RCW”) 21.20.020. Unlawful act of person advising another.
(1) It is unlawful for any person who receives any consideration from another party primarily for advising the other person as to the value of securities or their purchase or sale, whether through the issuance of analyses or reports or otherwise:
- (c) To engage in any dishonest or unethical practice as the director may define by rule.
Washington Administrative Code (“WAC”) 460-24A-220. Unethical business practices – investment advisers and federal covered advisers.
If you are an investment adviser, investment adviser representative, or a federal covered adviser, you are a fiduciary and have a duty to act primarily for the benefit of your clients. If you are a federal covered adviser, the provisions of this subsection apply to the extent that the conduct alleged is fraudulent, deceptive, or as otherwise permitted by the National Securities Markets Improvement Act of 1996 (Pub. L. No. 104-290). While the extent and nature of this duty varies according to the nature of the relationship with the client and the circumstances of each case, in accordance with RCW 21.20.020 (1)(c) and 21.20.110 (1)(g) you must not engage in dishonest or unethical business practices including, but not limited to, the following:
- (21) Engaging in conduct or any act, indirectly through or by another person, which would be unlawful for such person to do directly under the provisions of the Securities Act of Washington, chapter 21.20 RCW, or any rule or regulation thereunder.
- (26) Accessing a client’s account by using the client’s own unique identifying information (such as username and password).
Discussion:
The Securities Division is aware of at least one platform that allows investment advisers to access and manage held-away accounts. For the investment adviser to gain access to the accounts through the third-party platform, the investment adviser instructs their client to give their username and password to the third-party platform. The platform then instructs the client on how to address multi-factor authentication on the custodian’s site. The third-party platform does not have any known agreements with the largest 401(k) custodians. In many cases, it appears that custodians are unaware that the third-party platform is accessing accounts using usernames and passwords assigned to other people. In other instances, the custodian has attempted to restrict access to its site by the platform.
Use of Client’s Username and Password
An investment adviser engages in dishonest or unethical behavior as defined by WAC 460-24A-220(26) when they use their client’s unique username and password to access their client’s account. While the investment adviser does not necessarily handle the client’s username and password in this circumstance, it is also a dishonest or unethical business practice for an investment adviser to engage in conduct through another person that would be unlawful for the investment adviser to engage in. In this case, investment advisers direct their client to provide their username and password to a third party. Investment advisers are then able to access the client’s held-away accounts because the third-party platform accesses the account using the client’s username and password. In this way, investment advisers directly or indirectly access their client’s held-away account using the client’s unique username and password.
Conclusion:
An investment adviser’s use of a third-party platform to access their client’s held-away accounts may be a dishonest or unethical business practice if it requires the investment adviser to access the account by directly or indirectly using the client’s unique username and password.