Broker-Dealer Settles SEC Charges for Failing to Maintain Trading System Security Policies

A broker-dealer that operates an alternative trading system for over-the-counter securities settled SEC charges for failing to maintain written policies and procedures required to protect the security and resiliency of its trading systems.

According to the Order, the firm was an "SCI entity" under Regulation Systems Compliance and Integrity ("Regulation SCI") during the relevant period. The SEC found that the firm lacked written policies and procedures reasonably designed to maintain adequate capacity, integrity, resiliency, availability, and security for its systems to support operational capability and promote fair and orderly markets.

The SEC stated that its Division of Examinations examined the platform several times and repeatedly cited the firm for failing to establish and enforce required policies, including those for system security, access control, and application vulnerability management. Despite these notices, the SEC found that the firm failed to promptly remediate the deficiencies. For example, the SEC noted that an access control policy first flagged as a draft in 2016 remained in draft form during subsequent examinations in 2019 and 2022, and was still not formally established as of fiscal year 2023.

The SEC found that the firm willfully violated 17 CFR 242.1001 ("Obligations related to policies and procedures of SCI entities").

The firm agreed to a censure, a cease-and-desist order, and a $575,000 civil money penalty.