FINRA Regulatory Notice 20-21 serves as a critical advisory regarding the obligations of member firms when utilizing third-party vendors and outsourcing core business functions. As firms increasingly rely on external technology and service providers to handle sensitive data, regulatory scrutiny has tightened.
The CFA Institute provides a structured checklist for firms to ensure they align their internal governance with these expectations. The primary focus is on ensuring that outsourcing does not diminish a firm's ability to remain compliant with FINRA rules, particularly regarding books and records, supervision, and cybersecurity protocols.
To adhere to the standards outlined in the context of Regulatory Notice 20-21, firms are encouraged to evaluate their vendor management program through the following pillars:
The Global Investment Performance Standards (GIPS) are the gold standard for investment performance reporting. A major challenge for many firms is the accurate calculation of Internal Rate of Return (IRR) and other performance metrics while maintaining compliance with these voluntary but industry-standard guidelines.
GIPS requires that time-weighted returns be used for most portfolios, but for private equity, real estate, and other closed-end funds, the Money-Weighted Return (MWR)typically expressed as IRRis the preferred metric. Firms must ensure the following:
Integrating the requirements of FINRA 20-21 with GIPS compliance creates a robust operational framework. When firms use third-party performance calculation software, they must treat those vendors as critical service providers under the FINRA 20-21 mandate. This means the vendors methodology for calculating IRR must be audited, and the firm must maintain oversight to ensure that the data fed into these calculations is accurate and complete.
Compliance officers are encouraged to utilize the CFA Institutes resources to map vendor performance metrics against regulatory reporting mandates. By doing so, firms protect their reputation and ensure that their performance claimswhich are the lifeblood of asset management marketingare verifiable and defensible under regulatory audit.
