The Financial Industry Regulatory Authority ("FINRA") has released a regulatory notice giving guidance on application of the communications rules to use of social media sites by a firm or its personnel. This notice only applies to use of social media for business purposes; it does not apply to social media for personal purposes.

Recordkeeping Requirements

The notice makes clear that a firm is required to retain all records of communications on a social media site that relate to the firm's "business as such." Thus, before a firm allows its personnel to use social media sites for business purposes, it must be sure that it can retain records of all those communications as required by Rules 17a-3 and 17a-4 of the Securities Exchange Act of 1934 and NASD Rule 3110. Some technology companies are developing systems that would allow firms to retain such records. However, FINRA does not endorse any particular technology and does not represent that any technology currently exists.

Suitability Responsibilities

Any recommendation of securities made by a firm or its personnel through social media sites does trigger NASD Rule 2310 regarding suitability of recommendations to customers. This requires the person making the recommendation to have reasonable grounds for believing that the security is appropriate for every investor to whom the recommendation is made. For example, if an employee recommends a security through a posting on Facebook or Twitter, he or she must be sure that the security is appropriate for each and every person with the ability to view the posting. With some social media sites, this would be almost impossible because of the multitude of people who can view postings. Thus, FINRA considers the best practice to be prohibition of all postings on social media sites that recommend specific securities unless a registered principal has approved the posting beforehand.

Public Appearances and Interactive Electronic Forums

FINRA also gives guidance on which social media activities constitute "interactive electronic forums" and which social media postings constitute an advertisement under NASD Rule 2210. Rule 2210 requires that a registered principal approve each advertisement prior to its use. However, prior principal approval is not required for unscripted communications with the public that occur in an interactive electronic forum.2

FINRA considers static content on social media sites to be an advertisement for the purpose of Rule 2210. Static content would include static posts or hyperlinks on a blog as well as profile, background, and wall information on a social media site.

Some content, however would be considered an interactive electronic forum. This content in social media includes real-time interactive communication on a blog (i.e. live chat), or interactive posts on sites like Twitter or Facebook. The distinction is whether real-time interactive communication is taking place; the mere fact that a Facebook page or blog is updated frequently does not change its category from advertisement to interactive electronic forum.

Supervisory Requirements

Even if a communication takes place in an interactive forum, supervisory requirements under NASD Rule 3010 still apply. This supervision must be designed to ensure that the communications do not violate the requirements of the communication rules. FINRA suggests that firms adopt supervisory procedures similar to those laid out in Regulatory Notice 07-59. That notice suggested using risk-based principles to determine the extent of review necessary as well as implementing a system of post-use review such as sampling or lexicon-based search methods to monitor employees' electronic media use.

Like other electronic and traditional means of communications, some social media communications must always be reviewed by a supervisor. These include communications between research and nonresearch departments concerning the content of a report (NASD Rule 2711(b)(3)(a) and NYSE Rule 472(b)(3)), identification and reporting of customer complaints (NASD Rule 3070(c) and NYSE Rule 351(d)), and the identification of order errors and other account designations changes (NASD Rule 3110(j) and NYSE Rule 410).

Firms must also adopt policies to ensure that employees and associated persons who participate in social media sites for business purposes are appropriately supervised, receive all necessary training, and do not present an undue compliance risk. Any person who is associated with the firm but not subject to firm supervision should not be engaging in business communications on social media sites on behalf of the firm. Firms should also have monitoring programs assuring that associated persons are complying with the firms' policies. If the firm's policies are violated, the violator should be subject to disciplinary procedures.

Third-Party Posts

Third-party posts on social media sites are not considered communications with the public, so the prior approval, content, and filing requirements of NASD Rule 2210 do not apply. However, if a firm is (1) involved in the preparation of the content posted or (2) implicitly or explicitly endorses or approves the content, Rule 2210 does apply. For example, the SEC has ruled that a firm is responsible for third-party content when it is hyperlinked to the firm's website on the theory that the firm approved or endorsed the content. This would also likely apply to third-party content posted on a social media site maintained by the firm or its employee, such as a Facebook page.

FINRA suggests that the best practice for firms would be to monitor the content of third-party posts to either mitigate the appearance that the firm is adopting the content or to screen for offensive content on its page. A firm might also be able to distance itself from third-party posts by inserting a disclaimer informing customers that third-party posts do not reflect the opinions of the firm and have not been reviewed by the firm for completeness or accuracy.