Security, data and compliance in Reg BI (Regulation Best Interest) Tracker

How Reg BI (Regulation Best Interest) Tracker protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Representatives see their own clients, supervisors their own representatives, and reviewing is separate from recommending.

Client data protection

Client profile data is limited to the roles that need it; product and administrator roles do not see it.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, recommendation, decision and change is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• SEC Regulation Best Interest (17 CFR 240.15l-1)
• SEC Form CRS Relationship Summary (17 CFR 240.17a-14)
• SEC Rules 17a-3 and 17a-4 (broker-dealer books and records)
• FINRA Rule 3110 (Supervision)
• FINRA Rule 2111 (Suitability)
• NAIC Suitability in Annuity Transactions Model Regulation (#275)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for firms that need them.
• Dedicated environment: A single-tenant environment for firms whose policies require isolation, scoped in the proposal.
• Embedded in advisor tools: Recommendation capture can be launched from your CRM or order entry screens so representatives do not switch systems.

Limitations

• The Tracker does not decide whether a recommendation is in the client's best interest. Representatives, supervisors and compliance make that judgment; the Tracker records it and the evidence.
• Checks depend on the completeness of client profile, product and cost data supplied from your systems.
• It does not produce or file Form CRS. It records delivery of the version your firm has prepared.
• It does not cover investment adviser fiduciary obligations under the Advisers Act on its own, although dual registrants can record advisory recommendations in it.
• It is designed for US broker-dealer requirements. Suitability rules in other countries are not included.
• It is not an order management system and does not block trades; flags are routed for review according to your procedures.
• Firm rules and thresholds are your firm's decisions; the Tracker records and applies them but does not set them.
• Product and cost data from third-party vendors is subject to your own licences with those vendors.