Broker-Dealer Faces $45M SEC Penalty for Multiple Compliance Violations

The Case

A broker-dealer will pay $45 million to settle charges brought by the SEC related to multiple regulatory failures, including inadequate procedures to protect customers from identity theft, failure to address cybersecurity risks, and failure to maintain required records. 

The SEC also found that the firm failed to provide accurate trading data and follow short sale rules. These charges come in addition to a Wells notice received by the firm last year regarding potential enforcement action against its cryptocurrency business.

Regulatory Implications

The SEC’s enforcement action in this case underscores key regulatory priorities:

• Identity Theft Protection and Fraud Detection: Broker-dealers must implement effective procedures to detect and investigate suspicious activity. Failure to respond to identity theft risks can cause significant penalties.
  
  

• Cybersecurity and Data Protection Failures: The SEC continues to scrutinize firms that do not properly secure customer data. Failing to address known vulnerabilities exposes firms to regulatory action.
  
  

• Books and Records Compliance: Maintaining electronic records in a format that prevents unauthorized alteration or deletion is a fundamental requirement under federal securities laws. The SEC is actively enforcing violations in this area.
  
  

• Short Selling and Trade Reporting Violations: As in this case, inaccurate trade data and non-compliance with short sale regulations can trigger enforcement actions.
  
  

• Ongoing Cryptocurrency Scrutiny: The Wells notice regarding the firm’s crypto business signals that firms operating in digital assets remain under heightened regulatory oversight.

Practical Guidance for Firms

To mitigate similar regulatory risks, firms should consider the following:

Cybersecurity and Data Protection:

• Regularly assess system vulnerabilities and remediate known risks without delay.

• Strengthen controls to protect customer accounts from unauthorized access.

Identity Theft Prevention and Monitoring:

• Implement clear, documented protocols for investigating suspicious transactions.

• Train employees on fraud detection and escalation procedures.

Books and Records Compliance:

• Maintain electronic records in a format that prevents unauthorized deletion or modification.

• Periodically review recordkeeping procedures to confirm alignment with SEC requirements.

Short Sale and Trade Reporting Compliance:

• Verify that trading data submitted to regulators is accurate and complete.

• Conduct internal audits of compliance with short sale regulations.

InnReg helps broker-dealers and fintech firms strengthen compliance in areas such as identity theft prevention, cybersecurity governance, and regulatory recordkeeping. Our team provides customized solutions to enhance firms' fraud detection capabilities.