Pete Rock, CLU, FLMI Director, Operational Compliance Currin Compliance Services, Inc.

1. Regulatory Update: From Suitability to Privacy, and a bit in between Pete Rock, CLU, FLMI Director, Operational Compliance Currin Compliance Services, Inc.

2. WHO is this guy?

3. Pete Rock, CLU, FLMI Began operational & compliance insurance work in 1984 Held multiple compliance leadership positions for large commercial insurer Held CCO position for nationwide insurance distributor; and Deputy CCO for a Fraternal Benefit Society

4. Suitability: Ever growing, ever changing

5. Suitability Hot topic since failure of DOL Fiduciary Rule NY leading the way with Reg 187 amendment NAIC is moving closer to a new model regulation SEC’s Regulation BI FINRA likely to create a Notice to Members DOL may not be done

6. New York, new York, a ‘heck’ of a state

7. Biggest Changes • Enhanced Supervision & Training requirements • Life Insurance • Post-issue ‘sales’ transactions

8. Final Regulation • Annuities: • August 1, 2019 • Life Insurance: • February 1, 2020

9. New Supervision Rules: Insurers

10. New Supervision Rules: Insurers (CONT)

11. Duties of insurers/producers

12. Product Knowledge Sales Transaction: 224.4(g) “A producer shall not make a recommendation to a consumer to enter into a sales transaction about which the producer has inadequate knowledge.” In-force Transaction: 224.5(e) “A producer shall not make a recommendation to a consumer to enter into an in-force transaction about which the producer has inadequate knowledge.” Insurer responsibility and supervision: 224.6 “An insurer shall be responsible for ensuring that every producer recommending any transaction with respect to the insurer’s policies is adequately trained to make recommendations in accordance with the provisions of this Part, but an insurer shall not be required to warrant that a producer is acting in the consumer’s best interest.”

13. Section 224.5 Required Product Disclosures In-force transactions There is a reasonable basis to believe the consumer has been reasonably informed of the relevant features of the policy and potential consequences of the in-force transaction, both favorable and unfavorable. Only applicable when a recommendation has been made Applies only in cases where commissions are generated above renewal or persistency

14. To Sum it up • Annuity changes took place in August. By now you should have: • Enhanced training for your sales force, product and otherwise • Changed your information collection process to include new required data • New client disclosures showing favorable/unfavorable reasons for recommended transaction • An approach to monitor in-force ‘sales’ transactions • Put into place new supervisory structure • Getting ready for life insurance suitability requirements in February 2020

15. Not to be ignored: naic

16. What is new with the NAIC model? • Currently, 45 states and DC have adopted much of the existing two primary models • Working group completed a new draft regulation September 17, looking for comments by September 30 • Significant changes to the model, based on Iowa’s recommended four obligation approach: • Care • Disclosure • Conflict of interest • Documentation

17. Best Interest Obligations A producer, when making a recommendation of an annuity, shall act in the best interest of the consumer under the circumstances known at the time the recommendation is made, without placing the producer’s or the insurer’s financial interest ahead of the consumer’s interest. A producer is deemed to comply with this subsection by satisfying the following obligations regarding care, disclosure, conflict of interest and documentation

18. Changes to existing model • Creates a conflict of interest disclosure requirement • Provides Producer Relationship Disclosure Form • Explicitly does not create a fiduciary relationship • Contemplating incorporating responsibilities into in-force transactions where recommendations were made • New insurer requirements include: • Steps to ensure the producer has provided appropriate information to consumer • Procedures to identify and address issues when a consumer refuses to provide required information • Establish and maintain reasonable procedures to identify and eliminate any sales contests, sales quotas, bonuses, and non-cash compensation that are based on the sales of specific annuities or specific types of annuities within a limited period of time

19. Next Steps Generally receiving positive feedback from the industry Likely to be a few more tweaks to the working group draft based on comments Next working group call in early October Draft will go to larger ‘A’ committee for review and likely discussed at the NAIC Fall Committee meeting in Austin in December

20. Hey sec – yeah you know me

21. What is the SEC Regulation BI? • Adopted June 5, 2019 • Designed to: • enhance and clarify the standards of conduct applicable to broker-dealers and investment advisers, • help retail investors better understand and compare the services offered and • make an informed choice of the relationship best suited to their needs and circumstances and foster greater consistency in the level of protections provided by each regime, particularly at the point in time that a recommendation is made.

22. Form CRS • The Form CRS Relationship Summary requires RIA’s & B/D’s to provide retail investors: • Simple, easy-to-understand information about the nature of their relationship with their financial professional.   • Facilitate layered disclosure, the format of the relationship summary allows for comparability among the two different types of firms in a way that is distinct from other required disclosures.  • Includes a link to a dedicated page on the Commission’s investor education website, Investor.gov, which offers educational information about broker-dealers and investment advisers, and other materials.

23. THE DOL – the big agency that could

24. The DOL…again?!? • Planned for release in December • Likely concentrated on ERISA plans and definition of fiduciary, but unclear • Working with SEC to develop the plan • Likely will not be implemented until late 2020 or early 2021, if at all

25. Where do we go from here?

26. Where do we go from here? Recommendations Next Steps NY’s Reg 187 - Life Insurance New disclosures How/who will do the review? Assess replacement process Implement training mandates NAIC Model will require disclosures and additional work Likely adopted in 2020, DOL Need to monitor carefully • Look at your current standard of care program(s) • Be sure NY changes have been implemented for annuities, and plans for life • If applicable, adapt to SEC Regulation BI • Monitor regulatory change, especially NAIC model

27. SHhh…that’s private!

28. California, here we come!

29. California Consumer Privacy Act (CCPA) • Passed earlier this year • Mirrors in many ways the EU’s General Data Protection Regulation (GDPR) • Goes into effect January 1, 2020 • Enforcement will begin July 1, 2020 • Applies to companies domiciled in California AND to those with customers in CA

30. Which entities need to comply to CCPA? In general, the CCPA applies to entities conducting business in California that either directly or indirectly control the collection of personal information of residents in that state and meet one or more of the following criteria: • have annual gross revenues in excess of $25 million, adjusted for inflation; • derive 50 percent or more of their annual revenues from selling consumers’ personal information; or • annually buy, receive for a commercial purpose, sell or share the personal information of 50,000 or more consumers, households or devices.

31. What information is subject to CCPA? The CCPA defines personal information very broadly as information about a California resident that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

32. What information is subject to CCPA? The CCPA requires covered entities to disclose, upon request from the consumer: • what is being collected, sold or disclosed; • the source of that information; • the business purposes for collecting or selling it; and • the categories of third parties with which the information is shared. The CCPA gives consumers the right to access a copy of their personal information “in a readily useable format that allows the consumer to transmit [the] information from one entity to another entity without hindrance.” Companies also must honor a consumer’s request to delete their personal information absent certain defined circumstances.

33. How to comply with the CCPA? If your company is subject to the act: • Begin work now to review your current privacy practices and start working on adapting to the reg • Even if your company is GDPR compliant, work may still need to be done. • Fines for non-compliance are steep, up to $2,500 per violation, which may be interpreted as ‘per insured’ • Likely to have ‘ripple’ effect through other states

34. New York again?!?!

35. New York’s Privacy Act • Enacts the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared; creates a special account to fund a new office of privacy and data protection. • Currently in the state’s Senate Consumer Protection Committee

36. What else?

37. What Else? Regulatory Change Monitoring Elder & Vulnerable Persons Abuse Account Take Overs 2017 CSO product filings AML independent reviews & SARs filings

38. Questions?