The Municipal Securities Rulemaking Board (MSRB) provides these answers to frequently asked questions (FAQs) to enhance market participants’ understanding of permissible and impermissible uses of social media as part of their municipal securities business or municipal advisory activities under MSRB Rule G-21, on advertising by brokers, dealers or municipal securities dealers (collectively, “dealers”), and under MSRB Rule G-40, on advertising by municipal advisors (Rule G-21, together with Rule G-40, the “advertising rules”). These FAQs can assist dealers and municipal advisors (collectively, “regulated entities”) with their compliance with the MSRB’s advertising rules.

In developing these FAQs, the MSRB has been mindful of the potential burden on a regulated entity if there were to be unnecessary inconsistencies between any adopted MSRB social media guidance and similar guidance issued by other regulators that may be applicable to other aspects of the regulated entity’s business. To that end, and to the extent practicable, the MSRB has endeavored to align these FAQs with the social media guidance published by the U.S. Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority, Inc. (FINRA).[1]

The FAQs discuss compliance with MSRB rules; regulated entities are reminded that they also may be subject to the rules of other financial regulators, including state regulators. Further, a regulated entity’s use of social media to conduct municipal securities or municipal advisory activities is optional, and the responsibilities that follow from that social media usage are not new here. In particular, a regulated entity should consider its ability to comply with the existing recordkeeping requirements under the federal securities laws and incorporated into MSRB rules when determining whether to use social media to conduct municipal securities or municipal advisory activities and whether to permit its associated persons to use social media to conduct municipal securities or municipal advisory activities.

Background

Rule G-21 and Rule G-40, effective as of the date of these FAQs, set forth general provisions, address professional advertisements by the relevant regulated entity and require principal approval, in writing, for advertisements by regulated entities before their first use.

These FAQs were initially developed in 2019 as a result of requests for guidance regarding the use of social media by a regulated entity under MSRB Rules G-21 and G-40 and were updated thereafter. These FAQs provide the requested guidance.

Consistent with MSRB Rule D-11, references in the FAQs to a dealer, municipal advisor or regulated entity generally include the associated persons of such dealer, municipal advisor or regulated entity.[2]

Use of Social Media

1.     Is social media use by a regulated entity relating to its municipal securities business or municipal advisory activities considered advertising under the MSRB’s advertising rules?

Yes, depending on the facts and circumstances. With limited exceptions, any material that relates to (i) the products or services of the dealer, (ii) the services of the municipal advisor, or (iii) the engagement of a municipal advisory client by the municipal advisor, may constitute an advertisement under the MSRB’s advertising rules, if it is:

• published or used in any electronic or other public media; or
• written or electronic promotional literature distributed or made generally available to either customers or municipal entities, obligated persons, municipal advisory clients or the public.

To the extent that the use of social media, including blogs, microblogs and social and professional networks, by a regulated entity is deemed advertising based on its content and distribution, that advertising would be subject to all applicable provisions of Rules G- 21 and G-40. Those provisions include content standards and a requirement that an advertisement be pre-approved by a principal before its first use.

Further, dealers and municipal advisors should bear in mind that “posts” or “chats” on social media, including those deemed advertising, are subject to all other applicable MSRB rules.

Those rules include:

• MSRB Rule G-17, on conduct of municipal securities and municipal advisory activities;
• MSRB Rule G-27, on supervision;
• MSRB Rule G-44, on supervisory and compliance obligations of municipal advisors;
• MSRB Rule G-8, on books and records to be made by brokers, dealers, municipal securities dealers, and municipal advisors; and
• MSRB Rule G-9, on retention of records.    

2.     Can an associated person’s personal social media use be deemed “advertising” that is subject to the MSRB’s advertising rules?

Potentially, yes. An associated person’s personal social media use would not per se be advertising that is subject to the MSRB’s advertising rules. Whether an associated person’s personal social media use is advertising depends on whether the content of the social media relates to (i) the products or services of the dealer, (ii) the services of the municipal advisor, or (iii) the engagement of a municipal advisory client by the municipal advisor, as relevant.

• For example, an associated person of a regulated entity “posts” the following on his personal social media that is viewable by the public rather than a selected audience:

Let’s help our children! ABC Youth Group is having a car wash to raise funds for a new basketball court on May 18th at 3:00 pm at XYZ address. Get your car washed and help out.

The content in the “post” in the above example does not relate to (i) the products or services of the dealer, (ii) the services of the municipal advisor, or (iii) the engagement of a municipal advisory client by the municipal advisor. Even though the “post” is publicly available, the “post” would not be advertising that is subject to the MSRB’s advertising rules.

Similarly, an associated person may hyperlink from his or her personal social media to content on his or her dealer’s or municipal advisor’s social media. The “hyperlinking” by the associated person to the regulated entity’s social media would not constitute an advertisement if that hyperlinked content does not relate to the matters referenced in the preceding paragraph.[3]

• For example, a “post” from associated person FGH’s personal social media contains a hyperlink to an article on municipal advisor ABC’s website about an animal shelter rebuilding after recent flooding. The “post” is viewable by the public.

The “post” would not be advertising that is subject to the MSRB’s advertising rules. The “post,” although it contains a hyperlink to a regulated entity’s website, links to content that does not relate to the municipal advisory services of the municipal advisor or the engagement of a municipal advisory client by a municipal advisor.

By contrast, to the extent that an associated person of a dealer or municipal advisor engages in advertising, as defined by Rules G-21 and G-40, on his or her personal social media, that advertising would be subject to the requirements of the MSRB’s advertising rules.

• For example, an associated person of ABC municipal advisor posts the following on his or her personal social networking page that is viewable by the general public:

I’m happy to be part of the team! ABC municipal advisor was rated the best in XYZ state for airport financings during 2017 according to DEF rating service. ABC municipal advisor has great experience in airport financings, and can help you with your next project.

The “post” would be an advertisement, as defined in Rule G-40(a)(i). The content of the electronically distributed “post” (i) promotes the expertise and experience of ABC municipal advisor and solicits inquiries about its services and (ii) is generally available to municipal entities, obligated persons, municipal advisory clients or the public. As such, even though the advertisement was “posted” on the associated person’s personal social networking page, the “post” would be subject to the requirements of Rule G-40 as well as all other applicable MSRB rules. See question 1.

3.    Do the MSRB’s advertising rules apply to hyperlinked content on an independent third-party website from a regulated entity’s website?

The MSRB’s advertising rules would apply to hyperlinked content on an independent third-party’s website from a regulated entity’s website in those instances where the regulated entity either:

• involved itself in the preparation of content on that third-party website— this is known as entanglement;[4]; or
• implicitly or explicitly approved or endorsed the content on that third-party website —this is known as adoption.[5]

Accordingly, if a regulated entity either becomes entangled with or adopts the hyperlinked content, the regulated entity has obligations under MSRB’s advertising rules for that content.

• For example, on its website, ABC dealer states that XYZ municipal entity has a great article about the financing for its new school (ABC dealer was the underwriter for that financing), and ABC dealer provides a hyperlink to that article.

In this case, ABC dealer, by stating it was a great article, would have adopted the article on XYZ’s website, and the content of that article would be subject to Rule G-21. Further, depending on the facts and circumstances, ABC may have adopted the article by linking to its specific content even without stating that the article was a great article. See question 4. A regulated entity should consider whether the context of the hyperlink and the content of the hyperlinked information together create a reasonable inference that the regulated entity has approved or endorsed the hyperlinked information.[6]

Similarly, a regulated entity may become entangled with hyperlinked content.

• For example, CDE municipal advisor assists XYZ issuer with the preparation of a press release about a financing to build a new school. The press release discusses how the financing method will save taxpayer dollars, but does not mention CDE municipal advisor. CDE municipal advisor then posts a hyperlink on its website to the press release on XYZ issuer’s website.

In this case, CDE municipal advisor, because it helped prepare the press release, would have become entangled with the press release, and the hyperlinked content would be an advertisement subject to Rule G-40.

See Question 7 for discussion regarding third-party posts.

4.    What factors are relevant for a regulated entity to consider as it determines whether it has adopted the hyperlinked content on an independent third-party’s website?

While non-exclusive, some factors to consider are:[7]

• Does the context suggest that the regulated entity has approved or endorsed the hyperlinked content? The regulated entity may want to consider its disclosure about the hyperlink and what a reader may imply by the location and presentation of the hyperlink. For example:

  • Does the regulated entity state that it approves or endorses the prominently-featured hyperlinked content (in which case, the regulated entity would have adopted the hyperlinked content), or does the regulated entity have a portion of its website that links to recent general news articles and provides hyperlinks to the websites of various newspapers or magazines (depending on the facts and circumstances, in most cases, the regulated entity would not have adopted such content)?[8]

  • Does the hyperlinked content indicate a degree of selective choice by the regulated entity, such as a hyperlink to a specific news article that is laudatory of the regulated entity, as compared to a hyperlink to the website of the newspaper?[9]

  • Does the regulated entity provide an explanation about the source of a hyperlinked article and why the regulated entity is hyperlinking to it in order to avoid the inference that the regulated entity is adopting the hyperlinked content?[10]

  Although a regulated entity’s hyperlink to specific independent third-party content may indicate adoption of that content, if the hyperlinked content itself is not an advertisement, the regulated entity’s hyperlink to that content would not be an advertisement under Rules G-21 and G-40.

  • For example, ABC dealer includes a hyperlink on its website to an article regarding the importance of saving for college on an independent third- party’s website. The article does not identify any particular 529 savings plan, any dealer, or any municipal security.

  In this case, ABC dealer hyperlinks to an article that is purely educational. Because the hyperlinked content does not address ABC dealer or a municipal security offered through ABC dealer, the hyperlinked content would not be an advertisement, and ABC dealer’s hyperlink to that content would not be an advertisement that is subject to Rule G-21.

• Does the hyperlink create customer or municipal advisory client confusion? The regulated entity may want to consider whether a customer or municipal advisory client would be confused and not fully appreciate that the hyperlink is to third-party content. Does the regulated entity provide disclosure to explain that the hyperlink is to third-party content?[11]

• Is the hyperlink to content that is not controlled by the regulated entity and is the hyperlink ongoing? When a regulated entity links to content that is hosted by an independent third-party that is not controlled or influenced by the regulated entity, that content may not be advertising subject to the MSRB’s advertising rules if the hyperlink is “ongoing.”

  An “ongoing” link is one which: (i) is continuously available to visitors to the regulated entity’s website; (ii) visitors to the regulated entity’s site have access to even though the independent third-party site may or may not contain favorable material about the regulated entity; and (iii) visitors to the regulated entity’s website have access to even though the independent third-party’s website may be revised.[12] A regulated entity may not have adopted the content on the independent third-party’s website if the link is “ongoing.”

However, where a regulated entity has become entangled with the hyperlinked content on a third-party website (to the extent that hyperlinked content otherwise meets the definition of an advertisement), that hyperlinked content would be an advertisement under Rules G-21 and G-40 and the regulated entity must consider all applicable provisions of the MSRB’s advertising rules, including with respect to the hyperlinked content.[13] Therefore, a regulated entity should not include hyperlinked content on its website if there are any red flags that indicate that the hyperlinked content contains false or misleading material.[14]

5.    May a regulated entity use a disclaimer alone to disclaim potential MSRB rule violations for hyperlinked content on an independent third-party website?

No, the MSRB generally would not view a disclaimer alone as sufficient to insulate a regulated entity from potential MSRB rule violations related to hyperlinked content on an independent third-party website that the regulated entity knows or has reason to know is materially false or misleading. A regulated entity that hyperlinks to content that the regulated entity knows or has reason to know is materially false or misleading may violate Rules G-17, G-21 and/or G-40.[15]

6.    Do the MSRB’s advertising rules apply to linked content within independent third- party content to which a regulated entity hyperlinked?

No, Rules G-21 and G-40, in general, would not apply to linked content within content to which the regulated entity linked (“secondary links”). However, to avoid triggering the application of Rules G-21 and G-40:

• The regulated entity must not have adopted or become entangled with the content in the secondary link – See question 3;
• The regulated entity must have no influence or control over the content in the secondary links – See question 4;
• The original linked content must not be a mere vehicle for the secondary links or not rely completely on the information available in the secondary links; and

• The regulated entity must not know or have reason to know that the information contained in the secondary links contains any untrue statement of material fact or is otherwise false or misleading.[16] A regulated entity should not include a link on its website if there are any red flags that indicate that the hyperlinked website contains false or misleading content.[17]

Third-Party Posts

7.    Do Rules G-21 and G-40 apply to posts by a customer, municipal entity client or another third-party (collectively, “third-party posts”) on a regulated entity’s or its associated person’s social networking page?

In general, no. Rules G-21 and G-40 generally would not apply to posts by a third-party on a regulated entity’s or its associated person’s social networking page. The post would not be considered material that is published, distributed or made available by the dealer or municipal advisor.

Notwithstanding, Rules G-21 and G-40 may apply to such third-party posts under certain circumstances. For example, Rules G-21 and G-40 would apply to such posts if the dealer or municipal advisor becomes entangled with or adopts the content of such posts. See also question 3.

• Entanglement. A regulated entity becomes entangled with a post by a third-party on the regulated entity’s social networking page if the regulated entity has involved itself with the preparation of the third-party content.[18] For example, a regulated entity or its associated person may become entangled with a third-party post if the regulated entity or its associated person pays for or solicits a third-party to post certain comments on the regulated entity’s social networking page.

• Adoption. A regulated entity adopts the content of the third-party post if the regulated entity explicitly or implicitly approves or endorses the content.[19] A regulated entity or its associated person may adopt a third- party post if it “likes,” “shares,” or otherwise indicates approval or endorsement of the content.

See question 3 above for a discussion of hyperlinked content on an independent third- party website; see question 4 above for a discussion of the non-exclusive factors to consider when determining whether a regulated entity or its associated person has adopted third-party content.

8.    May a municipal advisory client post positive comments about its experience with the municipal advisor on the municipal advisor’s social media page without such post being a testimonial under Rule G-40?

As with question 7 above, if a municipal advisory client posts positive comments on a municipal advisor’s social media page and the municipal advisor does not become entangled with or adopt that content, the municipal advisor could allow such content on its social media page. This would be true even if the municipal advisory client’s comments were to include a testimonial.

If the municipal advisor paid for or solicited a municipal advisory client to post positive comments about its experience with the municipal advisor on the municipal advisor’s social media page, that post would be deemed to be an advertisement by the municipal advisor that contains a testimonial within Rule G-40.

Specifically, by paying for or soliciting positive comments from a third-party, the municipal advisor would become entangled with those comments, and the posting of those third-party comments on the municipal advisor’s social media page would be deemed to be an advertisement by the municipal advisor that contains a testimonial. Accordingly, the municipal advisor would need to ensure that the advertisement meets the requirements of Rule G-40 and that the requisite disclosures under Rule G-40(a)(iv)(G)(2)(b) are clearly and prominently posted to the social media page in close proximity to the testimonial.

If the municipal advisor did not pay, directly or indirectly, for the testimonial, but liked, shared or commented on a post from a third-party, the municipal advisor would have adopted those comments and the posting of those third-party comments on the municipal advisor's social media page would be deemed an advertisement by the municipal advisor that contains a testimonial. Accordingly, the municipal advisor would need to ensure that the advertisement meets the requirements of Rule G-40 and that the requisite disclosures under Rule G-40(a)(iv)(G)(2)(b) are clearly and prominently posted to the social media page in close proximity to the testimonial.

Recordkeeping

9.    Must regulated entities retain records of “posts,” “chats,” text messages or messages sent through messaging applications related to the regulated entity’s business conducted through social media?

Yes, the MSRB’s recordkeeping and record retention requirements apply to all written, including electronic, communications sent or received as well as records of advertisements under the MSRB’s advertising rules.

Specifically, for dealers, Rule G-9(b)(viii)(C) requires that “all written and electronic communications received and sent, including inter-office memoranda, relating to the conduct of the activities of such municipal securities broker or municipal securities dealer with respect to municipal securities” be retained. Similarly, Rule G-9(h)(i) requires that a municipal advisor retain records, which include, among other things, originals or copies of all written and electronic communications received and sent, including inter-office memoranda, relating to municipal advisory activities.[20] Neither the technology used for the communication nor the distinction between a communication made through a device issued by the regulated entity or its associated person’s personal device is determinative for this analysis. See questions 10 and 11 regarding supervision.

Supervision[21]

10.    Should a regulated entity consider establishing policies and procedures as part of its supervisory system to address the use of social media by the regulated entity and its associated persons?

Yes, given that recordkeeping requirements apply to electronic communications, a regulated entity should establish policies and procedures to address the use by the regulated entity and its associated persons of social media.[22] As a baseline, those policies and procedures would reflect the regulated entity’s permitted and/or prohibited practices. Such permitted practices may include restrictions on the use of certain technologies or the prohibition of the use of social media to engage in municipal securities business or municipal advisory activities. Further, the supervisory system for a regulated entity that permits the use of social media would address all applicable MSRB rules, including, but not limited to:

• The MSRB’s advertising rules;
• Rule G-17;
• Rule G-8; and
• Rule G-9.

See question 1.

11.    What are some factors that a regulated entity should consider as it develops policies and procedures about the use of social media?

As with any policy and procedure, a regulated entity’s social media policies and procedures would be tailored to reflect, among other things, its size, organizational structure and the nature and scope of its municipal securities or municipal advisory activities. Social media policies and procedures are not expected to be “one size fits all.”

Among the factors that a regulated entity should consider as it develops social media policies and procedures are:

Usage Restrictions. While some regulated entities may prohibit an associated person from engaging in municipal securities business or municipal advisory activities through social media, other regulated entities may permit the use of social media for such purposes. A regulated entity that permits the use of social media by its associated persons, in whole or in part, should consider providing associated persons with a clear and concise list of permitted social media for the conduct of municipal securities business or municipal advisory activities. That list also may include any restrictions to the use of particular social media (for example, a regulated entity may permit certain messaging applications to be used only for internal communications among the regulated entity and its associated persons). If applicable, a regulated entity should consider making the list of permitted social media widely available and easily accessible to its associated persons.[23]

Further, recognizing the need to have policies and procedures that are reasonably designed to ensure compliance with MSRB rules as well as with other applicable securities laws and regulations, and in light of the pace of technology innovations, a regulated entity that permits the use of social media should consider periodically reviewing its list of permitted social media. As part of that review, the regulated entity should determine whether any updates to the list of permitted social media would be warranted.[24]

Along with the list of permitted social media, the regulated entity should consider addressing the consequences of non-compliance with its social media policies and procedures.[25]

Training and Education. The regulated entity’s social media policies and procedures may address the training that the regulated entity will provide related to those policies and procedures. For example, will the training include an initial training as well as training that is required on a periodic basis? In addition, a regulated entity’s training on social media may address various topics likely to occur such as an explanation of the differences between business and personal social media use and how the lines between business and personal social media usage could be blurred. For example, an associated person could receive a request on his or her personal social media relating to municipal securities business or municipal advisory activities. A regulated entity may want to consider how the associated person should respond to such a request.

Recordkeeping and Record Retention. As noted in question 1, it is possible that social media posts relating to the regulated entity’s municipal securities business or municipal advisory activities would be subject to the MSRB’s recordkeeping and record retention rules. A regulated entity should consider its recordkeeping and record retention obligations as it designs its social media compliance policies and procedures.[26]

Monitoring. As a regulated entity develops its social media policies and procedures, the regulated entity should consider how it will monitor for compliance with those policies and procedures. For example, a regulated entity may determine to more frequently monitor various social media activities based on the potential risks that the regulated entity has determined may be associated with those activities. See question 12 below for a discussion of various factors that the regulated entity may want to consider as it develops its policies and procedures. As a reminder, a regulated entity’s supervisory procedures concerning social media should address not only the MSRB’s advertising rules, but all applicable MSRB rules and other applicable federal securities laws and regulations.

12.    What factors may be important in determining the effectiveness of policies and procedures concerning social media?

As noted in question 10, MSRB Rules G-27 and G-44 generally require that a regulated entity establish, implement and maintain a supervisory system that is reasonably designed to achieve compliance with MSRB rules as well as with other applicable federal securities laws and regulations. To help test whether that goal is being met with regard to its social media compliance policies and procedures, a regulated entity may want to consider the following non-exclusive factors:

• Content standards. A regulated entity should consider whether there are certain risks associated with content created by the regulated entity for its social media and whether that content may create regulatory issues. For example, non-solicitor municipal advisors owe a fiduciary duty to their municipal entity clients. Is the social media content consistent with that duty (e.g., such as content that contains information on specific municipal advisory activity or a recommendation regarding that activity)? Further, if the social media content contains a testimonial, does that content include the requisite disclosures set forth in the MSRB’s advertising rules?
• Monitoring of third-party sites. To the extent that the regulated entity permits the use of social networking sites, a regulated entity should consider how it will monitor for compliance with the regulated entity’s social media policies and procedures on those sites.
• Criteria for approving participation in social networking sites. A regulated entity should consider whether to develop standards relating to social networking participation. For example, at a minimum, a regulated entity must ensure compliance with record retention requirements. As the regulated entity develops its criteria for approving the use of certain sites, the regulated entity also should address whether it has a process in place for revoking approval to participate in a particular social networking site should certain circumstances change.
• Personal social networking sites. A regulated entity should address whether the regulated entity or its associated persons may engage in municipal securities business or municipal advisory activities on personal social networking sites.
• Enterprise-wide sites. A regulated entity that is a part of a larger financial services organization should consider whether it needs to develop usage guidelines reasonably designed to prevent the larger financial services organization in organizational-wide advertisements from violating the MSRB’s advertising rules.

[1] See, e.g., National Examination Risk Alert, Office of Compliance Inspections and Examinations, U.S. Securities and Exchange Commission (Jan. 4, 2012) (“2012 Risk Alert”); Exchange Act Release No. 58288 (Aug. 1, 2008); FINRA Regulatory Notice 17-18 (Apr. 2017); and FINRA Regulatory Notice 19-31 (Sep. 2019). These materials are identified for reference and such reference is not intended to suggest that regulated entities that are not subject to the guidance issued by the SEC or FINRA are responsible for compliance with that guidance. In addition, the MSRB does not intend for the guidance provided by these FAQs to modify or otherwise affect the guidance contained in any of the referenced materials published by the SEC or FINRA.

[2] Rule D-11 provides that:

Unless the context otherwise requires or a rule of the Board otherwise specifically provides, the terms “broker,” “dealer,” “municipal securities broker,” “municipal securities dealer,” “bank dealer,” and “municipal advisor” shall refer to and include their respective associated persons. Unless otherwise specified, persons whose functions are solely clerical or ministerial shall not be considered associated persons for purposes of the Board’s rules.

[3] For example, such hyperlinked content may include information about a charity event sponsored by the dealer or municipal advisor, a human interest article, an employment opportunity, or employer information covered by state and federal fair employment laws. See, e.g., FINRA Regulatory Notice 17-18 (Apr. 2017) at 4.

[4] See, e.g., Exchange Act Release No. 58288 (Aug. 1, 2008) at 32, 73 FR 45862 (Aug. 7. 2008) at 45870 (the “2008 release”); Exchange Act Release No. 42728 (Apr. 28, 2000), 65 FR 25843 (May 4, 2000) at 25848 (the “2000 release”).

[5] Id.

[6] 2008 release at 34.

[7] See 2008 release at 33; 2000 release at 25849.

[8] See 2008 release at 34; 2000 release at 25849.

[9] See 2008 release at 35.

[10] Id.

[11] See 2008 release at 36; 2000 release at 25849.

[12] See FINRA Regulatory Notice 17-18 (Apr. 2017) at 5.

[13] See MSRB Notice 2018-14 (Jun. 27, 2018).

[14] See FINRA Regulatory Notice 11-39 (Aug. 2011) at 3.

[15] See 2008 Release at 36-37; 2000 Release at 25849.

[16] See FINRA Regulatory Notice 17-18 at Q:4; see Q:5.

[17] See FINRA Regulatory Notice 11-39 (Aug. 2011) at 3.

[18] See 2008 release at 32; 2000 release at 25848-49; FINRA Regulatory Notice 10-06 (Jan. 2010) at 7-8. The MSRB’s definition of the entanglement and adoption theories is consistent with the definition of those theories set forth by the SEC and FINRA in those materials.

[19] Id.

[20] Rule G-8(h)(i) requires municipal advisors to make and keep current all books and records described in Rule 15Ba1-8(a) under the Exchange Act. Particularly, Rule 15Ba1- 8(a)(1) requires that municipal advisors make and keep true, accurate, and current “originals or copies of all written communications received, and originals or copies of all written communications sent, by such municipal advisor (including inter-office memoranda and communications) relating to municipal advisory activities, regardless of the format of such communications.”

[21] While many regulated entities may find the guidance in these FAQs useful when establishing their supervisory systems, each regulated entity should develop a supervisory system that is tailored to its own business model, recognizing that some considerations may not apply in the same manner for every firm and others may not apply at all.

[22] In part, Rules G-27(b) and Rule G-44(a) require that a regulated entity establish a supervisory system to supervise the municipal securities and municipal advisory activities of the regulated entity and its associated persons. In general, a supervisory system includes:

1. compliance policies and procedures that describe the practices that associated persons must adhere to in order to meet the standards of conduct established by the regulated entity consistent with applicable securities laws and regulations, including MSRB rules; and
2. written supervisory procedures that describe the practices that the supervisory personnel follow in order to reasonably ensure that associated persons meet the standards of conduct and the regulated entity can evidence a supervisory system.

[23] See, e.g., 2012 Risk Alert at 3; FINRA Regulatory Notice 07-59 (Dec. 2007) at 7.

[24] See, e.g., 2012 Risk Alert at 4.

[25] See FINRA Regulatory Notice 07-59 (Dec.2007) at 7; see also National Exam Program Risk Alert, Observations from Investment Adviser Examinations Relating to Electronic Messaging, Office of Compliance Inspections and Examinations, U.S. Securities and Exchange Commission (modified Dec. 14, 2018) available at https://www.sec.gov/ocie/announcement/ocie-risk-alert-electronic-messaging (“2018 Risk Alert”) at 4.

[26] See FINRA Regulatory Notice 07-59 (Dec. 2007) at 6-7; 2018 Risk Alert at 3-4.