After the Firm became aware of deficiencies in its system for maintaining and preserving emails, and after approval of an AWC arising from the firm’s failure to maintain an adequate system for retaining emails, the firm’s response to correct the deficiencies was inadequate. The firm retained a vendor to provide services with respect to its email system, including, ostensibly, to provide email retention services; however, the firm never took steps, including after it executed the AWC, to test or ascertain whether or not the vendor had implemented a system to store email in a non-erasable, non-rewritable format. The firm did not store emails in a non-erasable, non-rewritable format; instead, the firm’s vendor merely established a “compliance folder” on the firm’s computer network where emails were automatically forwarded, and the vendor apparently maintained “spam” emails the firm received in a separate folder. This system permitted firm employees to delete emails from the “compliance folder.”
During the course of a cycle examination, the staff requested that the firm produce certain emails of a firm registered representative and, in response to the request, the firm was able to provide only “spam” emails the firm retained. The firm discovered its email retention deficiencies only after FINRA staff brought them to the firm’s attention. In addition, the firm intended to employ electronic storage media for its email retention but it failed to provide the required Member’s Notice to FINRA pursuant to SEC Rule 17a-4(f)(2)(i); failed to ensure that its third-party vendor provided the undertakings required by SEC Rule 17a-4(f)(3)(vii); and failed to file the required notice, and its third-party vendor did not provide an undertaking until FINRA staff brought the failures to the firm’s attention.