Playing Catch-up in E-archiving~Many Firms Still Need IT Boost to Meet e-Communications Requirements

By Carol E. Curtis, Securities Industry News

February 18, 2008

Changes to the U.S. Federal Rules of Civil Procedure (FRCP), requiring companies to have enterprisewide retention policies for all electronic communications, went into effect on Dec. 1, 2006. As the deadline approached, observers predicted a sea change in corporate attitudes toward e-communications archiving. The new rules will cause companies to "formalize and staff information management programs," said research firm Gartner in October 2006.

More than one year later, the revised FRCP--along with Securities and Exchange Commission rules and guidance from the Financial Industry Regulatory Authority (Finra)--are prodding financial services firms to develop comprehensive e-archiving policies, but many are not complying, experts say. Some firms are not fully aware of the requirements; others may be feeling cost pressures or have been lulled into complacency by their information technology team.

A lot of companies "think they are in compliance," says Matthew Smith, president and COO of Torrance, Calif.-based software provider LiveOffice Corp. Firms looked at Finra's guidance on the review and supervision of e-communications, issued Dec. 7, "and said, We need to back up our e-mail.' Then their IT person tells them [their system is] OK. But they need to save two copies, stored in Worm," or write once, read many, format. "Without that, you are out of compliance."

As firms get up to speed on regulatory and legal requirements, says Smith, they will be in the market for compliance technology, much of it from third-party service providers like LiveOffice. "Outsourcing is an insurance policy," he notes. Being out of compliance "makes everybody look bad."

Increased Oversight

Beyond the reputational risk, ineffective e-records management can be expensive. In December 2002, the SEC signaled a period of stricter oversight by fining five bulge-bracket firms a total of $8.25 million for failing to preserve e-mail communications as required by the agency's Rule 17a-4.

"The genesis for industry growth was the 2002 SEC clampdown," says Sean Hegarty, product manager for digital archives at Boston-based data storage company Iron Mountain. While expansion has since slowed, "there is still money to be made," asserts Hegarty.

"In many cases, vendors are helping to drive trends--they develop the technology as one or two examiners ask for it," says Stephen Marsh, CEO of Smarsh, a Portland, Ore.-based technology provider. "The regulations are not changing so much. What is changing are expectations about supervision. Technology is causing regulators to demand more from e-mail reviews. E-mails are expected to be turned over in a day's time."

Examiners are also looking for evidence that policies are being followed. "Finra examiners want proof that you are doing the supervision," he says. "It is not enough to have policies and procedures." As a result, technology providers are increasingly focused on audit trails, notes Marsh.

Solutions are also being developed for a broader range of e-communications. The new Finra guidelines extend well beyond e-mail, covering instant messaging, text messaging, Web-based e-mail and device-to-device messaging, which has spurred a new wave of archiving systems.

Also driving innovation are new policies designed to include everyone in the organization. "A lot of financial services firms only archived a small number of people," explains Smith of LiveOffice. "Now they need to archive everybody. If not, it has the appearance of destroying information."

Iron Mountain is "seeing broader policies, where everything gets archived," adds Hegarty. The company has 250 clients in financial services, including many large broker-dealers.

Room for Growth

As firms refine and expand their policies and procedures, substantial opportunities remain for vendors. The e-communications archiving industry is "nowhere near critical mass," Smith contends. "The many companies who are still not in compliance don't know how affordable it is."

In a May report, "E-mail Active Archiving Market Update," Stamford, Conn.-based Gartner predicted that new e-mail archiving license sales will reach $459 million in 2008--up from $315 million last year--and will hit $1 billion by 2011. "The market continues to experience good growth," the report said, even as technology is adjusted to meet changing requirements, and lower-priced solutions capture a bigger share.

Smith asserts that firms are increasingly outsourcing the archiving function. "In uncertain times, there is less of an up-front investment," he says. "There is also consistent cost--your firm is not in the archiving business. The trend to cut costs is helpful to us, as is the complexity of managing an archiving system. Clients do not want to get into this business. A partner can get you up and going painlessly." LiveOffice provides clients with Web-based access to their archives.

Across all industries, Smith anticipates that 20 percent to 25 percent of companies will outsource the function. In financial services, "The bulge-bracket firms all do it in-house," he says. "But for independent broker-dealers, it makes more sense to outsource because of their independent sales force. Smaller companies tend to outsource."

Smith says that outsourcing costs approximately $10 per e-mail address per month. For a firm of ten employees, that comes to about $1,000 to $2,000 a year, he notes. Larger firms have lower average costs because of volume discounts.

Bill Tolson, director of legal and regulatory solutions marketing at Mimosa Systems, a supplier of information management systems, says that, for e-mail archivers, "the big problem is, what are all the data types I need to collect? There are so many types of sub-data, such as calendar entries and message attributes. That is all information that can be asked for."

Clients implement Mimosa's products in their data centers. The Santa Clara, Calif.-based company offers an e-mail archiving solution for Microsoft Exchange and is readying a content-monitoring system. Mimosa has customers in financial services, government and the health care industry.

"The biggest differentiator is that we capture all the data--contacts, calendar, movements in the system," says Tolson. "The data set is much richer."

The reputation and trustworthiness of service providers is particularly important in this field, say experts. In the event of suspected violations, financial firms bear the responsibility for e-recordkeeping inadequacies. "On the broker-dealer side, we are not liable," says Smith. "We have tools in place that allow the auditors to go in. This is an important issue for broker-dealers. You want to find a firm with an excellent track record, because it becomes a close and trusted relationship."