SEC Charges Virtu Americas With Inadequate Data Security and Misleading Institutional Clients

The Securities and Exchange Commission (SEC) has taken legal action against Virtu Americas LLC, a broker-dealer, and its parent company, Virtu Financial Inc. (collectively referred to as Virtu), for allegedly making materially false and misleading statements and omissions concerning their information barriers meant to prevent the misuse of sensitive customer data.

As detailed in the SEC’s complaint, Virtu Americas and its affiliates claimed to maintain a strict separation between two core businesses: one providing order execution services for large institutional clients, wherein Virtu Americas executed customer orders for a commission, and the other conducting proprietary trading activities, where Virtu Americas bought and sold securities for its own gain. However, between approximately January 2018 and early April 2019, Virtu Americas purportedly neglected to secure a database containing all post-trade information derived from customer orders routed to and executed by the company. This database encompassed customer identification data and other critical nonpublic information.

The SEC’s complaint alleges that this database was easily accessible to almost anyone within Virtu Americas and its affiliated entities, including proprietary traders, using two sets of widely known and frequently shared generic usernames and passwords. Virtu Americas’ failure to safeguard this information introduced a significant risk that its proprietary traders could misuse or disseminate it beyond the company’s confines. For instance, a Virtu Americas proprietary trader could potentially monitor the execution of a large institutional customer’s orders throughout the day, anticipate the customer’s trading patterns in subsequent days, and exploit this information by trading ahead of the customer’s future orders.

Despite this lapse in security over a fifteen-month period, during which Virtu Americas allegedly failed to establish, uphold, and enforce policies and procedures designed to prevent the misuse of this information, the company provided customers with misleading information about the existence and effectiveness of these information barriers. The SEC’s complaint outlines instances where Virtu overstated the controls, safeguards, and processes in place to protect the post-execution trade data of its institutional customers. Additionally, Virtu falsely conveyed to these customers that only employees with a legitimate need to access such information, a group excluding proprietary traders, had access to it. As a result of these deceptive statements, several institutional customers continued to entrust Virtu Americas with their order executions, resulting in significant commissions for the company.

The SEC’s complaint, filed in the U.S. District Court for the Southern District of New York, alleges violations of Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 by Virtu and a violation of Section 15(g) of the Securities Exchange Act of 1934 by Virtu Americas. The SEC seeks permanent injunctive relief, disgorgement with prejudgment interest, and civil penalties as remedies.