US SEC Charges Virtu For Not Protecting Confidential Customer Data

Virtu describes the lawsuit as retaliation for the company’s public criticism of the SEC’s market structure rule proposals.

The US SEC (Securities and Exchange Commission) has filed charges against broker-dealer Virtu Americas LLC and its parent company, Virtu Financial Inc, for misleading customers into believing it properly safeguarded their confidential information.

According to the SEC, Virtu Americas and its affiliates were supposed to have their order execution service for large institutional customers and their proprietary trading business walled off from each other. But from January 2018 until April 2019, Virtu Americas failed to safeguard a database that contained all post-trade information generated from customer orders routed to and executed by Virtu Americas.

The SEC’s complaint said the database contained the names, prices and volumes of securities customers bought and sold, customer identifying information, and other material nonpublic information. The database was allegedly accessible to “practically anyone” at Virtu Americas and its affiliates, including proprietary traders, through two sets of “widely known and frequently shared generic usernames and passwords”.

“Virtu Americas’ failure to safeguard this information created significant risk that its proprietary traders could misuse it or share it outside Virtu Americas,” the SEC said. For example, proprietary traders could observe the orders of a large institutional customer executed throughout the day, understand the customer’s trading pattern, and use such information to trade ahead of the customer in subsequent days.

The SEC said Virtu also misled customers about the existence and adequacy of information barriers. In some instances, the company overstated the controls, barriers and processes it had in place, and in other cases it falsely represented to customers that only certain employees – not proprietary traders – could access said data.

Gurbir Grewal, director of the SEC’s Division of Enforcement said Virtu Americas handled around a quarter of all market orders placed by US retail investors at the time, yet proprietary traders had “nearly unfettered access” to material nonpublic information that could be “abused for personal gain”.

Despite “the absence of any critical safeguards whatsoever” around this information, Virtu “repeatedly misled” customers about how it was protecting the data “to generate significant commissions”, he added. The enforcement action seeks to hold Virtu accountable and also send a “strong message” to firms about the need to protect against and prevent the misuse of material nonpublic information, Grewal said.

The SEC’s complaint, filed in US District Court for the Southern District of New York, seeks permanent injunctive relief, disgorgement with prejudgment interest, and civil penalties.

Virtu’s response

In a statement, Virtu noted that the SEC does not allege that any data was ever accessed or used in an inappropriate manner, only that its policies and procedures were not reasonably designed and certain statements were false.

Virtu calls the possibility that a broader group of employees than intended was able to access the confidential information “hypothetical”, adding that it self-disclosed this possibility to the SEC voluntarily and that it occurred “for a limited period of time” during the migration of a newly acquired business to a consolidated back-office database.

During this time, other controls and policies mitigated the risk of unauthorised access or use, Virtu said. Further, the company said it fully cooperated with the SEC’s investigation, supplying more than 30,000 documents to the regulator over a three-year period “none of which indicate any improper use or access”.

Virtu said it has “continuously maintained policies and procedures that were and are reasonably designed” to prevent the misuse of confidential information, and that its public statements about its policies and procedures were true and accurate.

The company describes the lawsuit as retaliation for Virtu’s public criticism of the SEC’s market structure rule proposals released in December 2022 and Virtu’s lawsuit against the SEC to seek records related to the rulemaking process.

“Unfortunately, the SEC’s position appears to be driven by politics and headlines rather than the facts and the law. We will always seek to act rationally and manage risk and exposure responsibly on behalf of our firm and our investors,” Virtu said.

“We look forward to vigorously defending ourselves in court against these meritless allegations while maintaining our focus on serving clients and markets globally and creating long-term value for our shareholders.”