SEC alleges Virtu Financial Inc. "Failed to Adequately Establish, Maintain, and Enforce Reasonably Designed Information Barriers to Prevent Proprietary Traders from Misusing Nonpublic Customer Post-Trade Information"

TLDRS:

• This matter relates to false and misleading statements by Defendant VFI and its subsidiary VAL, an SEC registered broker-dealer that processes approximately 25% of market orders placed by retail investors in the U.S., and VAL’s associated failure to establish, maintain, and enforce policies and procedures reasonably designed to prevent the misuse of material, nonpublic information
• Virtu repeatedly — and falsely — told their institutional customers and the public that VAL used “information barriers” and “systemic separation between business groups” in order to safeguard these customers’ MNPI. In fact, VAL did not place this information behind information barriers that safeguarded MNPI. During a 15-month period, virtually all employees at VAL and its affiliate broker-dealers could access MNPI regarding its customers’ trades, which included the name of the customer, the name of the security purchased by the customer, the side (buy or sell), the execution price, and the execution volume.
• Virtu provided access to this information, regardless of whether the employee had a valid business need for such information. Such trading information, when collected in this form, constitutes MNPI, and access to such MNPI could be valuable to a trader.
• For example, a trader could observe that VAL had executed the orders of a large institutional customer throughout the day, understand that the same customer may follow a similar trading pattern over the next day or days, and take advantage of such information by trading ahead of the customer’s subsequent orders.
• Developing...

The customer-specific, and virtually real-time, post-trade information contained in the FS Database would be valuable to a proprietary trader because it would, among other things, provide insights into which VAL customers were trading in the market (and in what securities) at present, as well as the direction and size of each customer’s order flow. Additionally, because large orders by VAL’s institutional customers could be broken up into smaller orders placed over one day or several days, such post-trade information could provide further material, nonpublic insight into orders that may be forthcoming in a particular security.

VAL’s Automated Systems and Policies Were Not Reasonably Designed, Maintained, or Enforced to Detect or Prevent the Misuse of MNPI in the FS Database:

Litigation Release:

As alleged in the SEC's complaint, Virtu Americas and its affiliates operated two businesses that it purported to have walled off from each other: an order execution service for large institutional customers, whereby Virtu Americas executed customer orders, typically for a commission, and a proprietary trading business, through which Virtu Americas bought and sold securities for its own accounts and benefit. From approximately January 2018 through the beginning of April 2019, however, Virtu Americas allegedly failed to safeguard a database that contained all post-trade information generated from customer orders routed to, and executed by, Virtu Americas, including customer identifying information and other material nonpublic information. The SEC’s complaint alleges that this database was accessible to practically anyone at Virtu Americas and its affiliates, including their proprietary traders, through two sets of widely known and frequently shared generic usernames and passwords. Virtu Americas’ failure to safeguard this information created significant risk that its proprietary traders could misuse it or share it outside Virtu Americas. For example, a Virtu Americas proprietary trader allegedly could observe that Virtu Americas had executed the orders of a large institutional customer throughout the day, understand that the same customer may follow a similar trading pattern over the next days, and take advantage of such information by trading ahead of the customer’s subsequent orders.

Nonetheless, during this fifteen-month period when Virtu Americas failed to establish, maintain, and enforce policies and procedures reasonably designed to prevent the misuse of that information, Virtu misled customers about the existence and adequacy of such information barriers. As alleged in the SEC’s complaint, in some instances Virtu overstated the controls, barriers and processes it had in place to secure its institutional customers’ post-execution trade data, and in others falsely represented to those customers that only employees with a need to see such information – a group that did not include proprietary traders – could do so. Following these false and misleading statements, a number of institutional customers continued to use Virtu Americas to execute their orders, resulting in significant commissions for Virtu Americas.

The SEC’s complaint, filed in U.S. District Court for the Southern District of New York, alleges that Virtu violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933, and that Virtu Americas violated Section 15(g) of the Securities Exchange Act of 1934, and seeks permanent injunctive relief, disgorgement with prejudgment interest, and civil penalties.

The SEC’s investigation was conducted by Alexandra M. Arango and David Bennett of the Market Abuse Unit, and supervised by David A. Becker, Paul Kim, Joseph Sansone, and Carolyn M. Welshhans. The litigation will be led by Damon Taaffe under the supervision of James Carlson and James Connor. The Division of Examinations conducted an examination that contributed to the investigation.

Press Release:

The Securities and Exchange Commission today filed charges against broker-dealer Virtu Americas LLC and its parent company, Virtu Financial Inc. (collectively, Virtu), for making materially false and misleading statements and omissions regarding information barriers to prevent the misuse of sensitive customer information.

As alleged in the SEC's complaint, Virtu Americas and its affiliates operated two businesses that it purported to have walled off from each other: an order execution service for large institutional customers, whereby Virtu Americas executed customer orders, typically for a commission, and a proprietary trading business, through which Virtu Americas bought and sold securities for its own accounts and benefit. From approximately January 2018 through the beginning of April 2019, however, Virtu Americas allegedly failed to safeguard a database that contained all post-trade information generated from customer orders routed to, and executed by, Virtu Americas, including customer identifying information and other material nonpublic information. The SEC’s complaint alleges that this database was accessible to practically anyone at Virtu Americas and its affiliates, including their proprietary traders, through two sets of widely known and frequently shared generic usernames and passwords. Virtu Americas’ failure to safeguard this information created significant risk that its proprietary traders could misuse it or share it outside Virtu Americas. For example, a Virtu Americas proprietary trader allegedly could observe that Virtu Americas had executed the orders of a large institutional customer throughout the day, understand that the same customer may follow a similar trading pattern over the next days, and take advantage of such information by trading ahead of the customer’s subsequent orders.

Nonetheless, during this fifteen-month period when Virtu Americas failed to establish, maintain, and enforce policies and procedures reasonably designed to prevent the misuse of that information, Virtu misled customers about the existence and adequacy of such information barriers. As alleged in the SEC’s complaint, in some instances Virtu overstated the controls, barriers and processes it had in place to secure its institutional customers’ post-execution trade data, and in others falsely represented to those customers that only employees with a need to see such information – a group that did not include proprietary traders – could do so. Following these false and misleading statements, a number of institutional customers continued to use Virtu Americas to execute their orders, resulting in significant commissions for Virtu Americas.

“At a time when Virtu Americas handled around a quarter of all market orders placed by retail investors in the U.S., we allege that proprietary traders had nearly unfettered access to material nonpublic information about its institutional customers’ trades – information which could be abused for personal gain,” said Gurbir S. Grewal, Director of the SEC’s Division of Enforcement. “Despite the absence of any critical safeguards whatsoever around this information, we further allege that Virtu repeatedly misled institutional customers and the market about how Virtu Americas was protecting this valuable data to generate significant commissions. Today’s enforcement action not only holds Virtu accountable for its failings, but also sends a strong message to firms that they must do much more than use shared, generic usernames and passwords to protect against and prevent the misuse of material nonpublic information.”

“Virtu allegedly painted a materially misleading picture as to the safeguards it had in place to protect its customers’ confidential information, even when customers specifically asked about the firm’s handling of their post-trade information,” said Carolyn M. Welshhans, Associate Director of the SEC’s Enforcement Division. “As our enforcement action shows, the SEC is committed to ensuring that firms provide accurate information for customers to make their investment decisions.”

The SEC’s complaint, filed in U.S. District Court for the Southern District of New York, alleges that Virtu violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933, and that Virtu Americas violated Section 15(g) of the Securities Exchange Act of 1934, and seeks permanent injunctive relief, disgorgement with prejudgment interest, and civil penalties.

The SEC’s investigation was conducted by Alexandra M. Arango and David Bennett of the Market Abuse Unit, and supervised by David A. Becker, Paul Kim, Joseph Sansone, and Ms. Welshhans. The litigation will be led by Damon Taaffe under the supervision of James Carlson and James Connor. The Division of Examinations conducted an examination that contributed to the investigation.