Designated 3rd Party Services for Microsoft’s Office 365
Microsoft’s Office 365 has become an extremely versatile and cost-effective platform to manage email, email retention, SharePoint, Skype and e-Discovery searches. However, the SEC in Rule 17a-4 requires that broker dealers retain a Designated 3rd Party (D3P) that can search and produce records if called upon by a regulatory agency.
17a-4, llc has developed a D3P services offering for broker dealers retaining records on Office 365. The D3P coverage applies to Office 365 email, third-party data such as Bloomberg and Reuters and compliance documents which are retained on SharePoint sites.
Designated 3rd Party Services and Methodology
In order to fulfill our D3P obligations, 17a-4 llc will:
Review the administrative policies in Office 365 to ensure the necessary settings.
Review audit logs to ensure administrators have not changed the settings.
Audit the Office 365 archive to verify regulated emails have been retained.
Verify compliance libraries on SharePoint have the necessary settings.
Designated 3rd Party Services (Rule 17a-4(f)(3)(vii))
We provide both Letters of Notification (SEC Rule 17a-4(f)(2)(ii)) and Letters of Undertaking (SEC Rule 17a-4(f)(3)(vii)) as well as CFTC Letters under 17 CFR 1.31.
Included in our D3P services is an annual review of an electronic archive including:
Test audits of retained data in the electronic archive
Review of procedures to separate broker dealer records from other institutional records
Assessment of current policy to cull privileged emails for efficient productions
Review of steps to facilitate access to records
Disposition recommendations and best practices
Periodic calls to discuss Rule 17a-4 options and best practices
When called upon by a regulator, 17a-4 will provide evidence of the request to our client and arrange for either recorded WebEx or on premise access to assist in the production of the requested records.
Regulatory Productions and Search Assistance
17a-4 llc has worked with many clients and regulators on archive productions and understands how to construct searches so only items responsive to the regulatory request are produced.
If engaged to preform regulatory production searches, 17a-4 can attest to the validity of the production without requiring in-house resources.