SEC social media ruling: What it means for banks

SEC's investigation of Netflix social media case results in new freedom to release company financial and related developments via Twitter, Facebook, and more.

On April 2, the Securities and Exchange Commission announced that it was not going to initiate enforcement action against Reed Hastings, the CEO of Netflix, who had last year posted a company milestone on his personal Facebook profile without first informing investors.

The ruling, which cleared Netflix, was good news for other companies, too.

In its Report of Investigation, the SEC indicated that all companies--including banks - are free to use social media channels to announce key company information, as long as they comply with Regulation Fair Disclosure (Regulation FD), and inform investors about which social media channels will be used to disseminate such information.

So what does this mean for banks? How will the SEC ruling impact their use of social media, and what should they do to protect themselves from the associated risks?

Paradigm shift in shareholder communication

According to a recent study conducted by the University of Massachusetts Dartmouth¹, 75% of Fortune 500 commercial banks have corporate Twitter accounts, while 70% have a Facebook page. For most of these institutions, social media represents a way to connect with customers on a more personal level, generate new business, and market their products and services.

Yet, the customer is almost always the target audience. A 2012 survey by the Conference Board and Stanford University found that only 14.4% of companies communicate with their shareholders via social media.

There could be many reasons for this. Many organizations prefer traditional forms of communication. Others are still trying to get a grip over the risks associated with social media. But most have been plagued by uncertainty about the applicability of Regulation FD and the SEC's 2008 Guidance on social media.

Fortunately, this issue has been resolved with the SEC's Report of Investigation, which provides clear guidelines governing the use of social media for speaking to shareholders and other investors. Now banks can confidently disclose material information on Facebook or Twitter, and engage shareholders in a real-time dialog. For banks, whose products are highly regulated--and in particular, the product disclosures describing the products--the road ahead is complex and challenging indeed.

Staying out of trouble as issues settle down

Given the many risks associated with using social media to disclose information, here are a few best practices for banks to keep in mind:

• Establish an official social media account

Many banks have social media accounts distributed across multiple channels (such as Facebook, Twitter, and YouTube).  Others deliberately create more than one official corporate page on a single channel (e.g., multiple Twitter handles) in the hopes that this will give them more exposure.

But when it comes to disclosing company information, it's best to establish one single, overarching social media account per channel, so as to prevent confusion among shareholders. Banks need to post the same information at the same time across all designated social media channels for complete transparency.

• Design comprehensive social media policies

Social media usage on behalf of an organization needs to be governed by clear and comprehensive policies, so that employees, for instance, don't create multiple "official" accounts without permission, or think that the SEC ruling gives them the freedom to publish sensitive company information as they choose. 

These policies should be accompanied by training programs for both employees and third-party associates. They should also be reviewed regularly, and updated in response to organizational changes, market trends, or new regulations.

Banks also need to get very serious about employees' personal social media pages, which may also be used as an outlet for communicating the bank's corporate or customer information. By requiring frequent certification of stringent social media policies, banks will be able to create a defense against legal penalties.

• Implement robust security measures

Social media channels are especially vulnerable to cybersecurity attacks. Now that companies are allowed to post key business information such as financial data, it is very likely that this information could be manipulated and falsified by cyber attackers.

One of the ways that banks can protect themselves is by establishing a core group of professionals who will (a) control the content that goes on social media, (b) ensure that it is represented accurately, (c) monitor the page or account continuously, and (d) implement advanced firewalls and other data security technologies.

• Continually assess and mitigate social media risks

In the wake of the SEC ruling, banks are confronting additional legal, compliance, operational, and reputational risks. Without proper oversight or control over these risks, banks put themselves in danger of attracting lawsuits, regulatory penalties, and reputational damage.

Just a few months ago, the Federal Financial Institutions Examination Council proposed guidelines on how to deal with social media risks. [Editor's note: Read a summary of ABA's comments about the proposed guidance here.] At a broad level, the proposed guidelines encourage banks to have a robust risk management program for identifying, measuring, monitoring, and controlling social media risks. Regular audits, oversight of social media posts, third-party due diligence, and streamlined incident management are some of the processes that experts believe are critical to social media risk management.

• Standardize social media communication

While the SEC has not established any standards for how information should be communicated over social media, banks should standardize their own communication processes, templates, and formats.

Take Twitter, for instance. It can be quite challenging for banks to post financial results within just 140 characters. One way to deal with this is by defining, at the management level, what aspects of financial results should be stated on Twitter, and how many different tweets should be used. This makes it easier for social media users to post information, and for shareholders to know how much and what kind of data they can expect to see.

Where to go next

Both the SEC and Exam council have acknowledged and legitimized social media as an acceptable form of communication.

It's now up to banks to take the ruling forward, and use it to leverage optimal value from their social media strategies--but not before implementing a comprehensive risk and compliance management program.

Social media is a great tool. But it must be used carefully and judiciously, ideally complementing existing forms of communication, rather than replacing them.

About the author

Footnotes

^{1 "}Social Media Surge by the 2012 Fortune 500: Increased Use of Blogs, Facebook, Twitter and More." Conducted By  Nora Ganim Barnes, Ph.D.; Ava M. Lescault, MBA; and Justina Andonian, Charlton College of Business Center for Marketing Research, University of Massachusetts Dartmouth.

² "What do Corporate Directors and Senior Managers Know about Social Media" - by David F. Larcker, Sarah M. Larcker, and Brian Tayan

[This article was posted on April 12, 2013, on the website of Banking Exchange, www.bankingexchange.com, and is copyright 2013 by the American Bankers Association.]