Broker-Dealer Settles SEC Charges Over Customer Information Access Failures

The U.S. District Court for the Southern District of New York entered a final judgment against a broker-dealer for failing to establish policies and procedures reasonably designed to prevent misuse of customers' material nonpublic information.

According to the Amended Complaint, during the relevant period, the firm operated both proprietary trading and trade execution businesses, but allowed virtually all employees, including proprietary traders, to access customers' post-trade information stored in a database using a widely known generic username and password. The SEC alleged the database contained customer-identifying information, security names, trade sides, execution prices, and volumes. The SEC alleged that despite knowing proprietary traders had access, the firm increased the allowed number of simultaneous logins rather than restricting access and did not track who logged into the database or what information proprietary traders extracted, contrary to its purported prohibition on trader access to customer post-trade information.

The SEC further alleged that the firm and its parent company made materially false and misleading statements to customers and the public regarding information barriers. The SEC said that in customer due diligence questionnaires, public presentations, and in a letter to customers, the companies stated they maintained procedures to segregate and protect sensitive customer data when they did not. The SEC said that the firm falsely told customers that only employees with a business need could access confidential information and that the firm employed information barrier processes to review system entitlements.

The final Consent judgment permanently enjoins the firm from violating Exchange Act Section 15(g) ("Registration and regulation of brokers and dealers") and orders payment of a $2,500,000 civil penalty. The Commission dismissed with prejudice all other claims against the firm and all claims against its parent company, including claims under Securities Act Sections 17(a)(2) ("Fraudulent Interstate Transactions") and 17(a)(3). The firm consented to the judgment without admitting or denying the allegations.