SEC sues Virtu Financial, accusing it of leaving consumer data vulnerable

By Bill Peters

Virtu says the agency didn't actually accuse the company of any inappropriate use of that data, and says the suit 'appears to be driven by politics'

The Securities and Exchange Commission on Tuesday said it sued financial firm Virtu Financial Inc., accusing the market maker and trading-execution company of leaving customer trading data vulnerable to misuse, misleading customers on its data protections and taking in commissions regardless.

In response, Virtu Financial (VIRT) said it had been in talks to settle the matter, and that the SEC sued after the company was unable to reach an agreement. But it defended its data-protection protocols and called the agency's allegations "meritless." It also said the agency didn't actually accuse the company of any inappropriate use of that data, and said the suit "appears to be driven by politics."

Shares of Virtu Financial were down 7.1% after hours on Tuesday.

The SEC, in a complaint, said its charges focused on a period that ran from January 2018 to April 2019.

The complaint said broker-dealer Virtu Americas -- a part of Virtu Financial -- ran two businesses that the company said were walled off from each other. One of those businesses was an order-execution service for big institutional investors, where Virtu Americas generally got a commission for orders. The other was a proprietary trading business, where Virtu Americas traded securities for its own accounts and gains.

However, the agency alleged, Virtu Americas over that period "failed to safeguard a database that contained all post-trade information generated from customer orders routed to, and executed by, Virtu Americas, including customer identifying information and other material nonpublic information." The SEC alleged that database, thanks to frequently-shared generic usernames and passwords, was open to "practically anyone" at Virtu Americas and its affiliates, including its proprietary traders.

The SEC alleged that Virtu's "failure to safeguard this information created significant risk" that its proprietary traders could share customer data or harness its customers' trading behavior to their own advantage. And the agency said that Virtu at times overstated the security measures it had in place to protect institutional investors' trade data. But it said that following those "false and misleading" statements, institutional investors continued to execute orders via Virtu, leading to hefty commissions for Virtu Americas.

The SEC is asking the defendants to give up any gains made from the alleged activity and pay civil penalties.

"At a time when Virtu Americas handled around a quarter of all market orders placed by retail investors in the U.S., we allege that proprietary traders had nearly unfettered access to material nonpublic information about its institutional customers' trades -- information which could be abused for personal gain," Gurbir S. Grewal, director of the SEC's enforcement division, said in a statement.

"Despite the absence of any critical safeguards whatsoever around this information, we further allege that Virtu repeatedly misled institutional customers and the market about how Virtu Americas was protecting this valuable data to generate significant commissions," he continued.

"Virtu allegedly painted a materially misleading picture as to the safeguards it had in place to protect its customers' confidential information, even when customers specifically asked about the firm's handling of their post-trade information," Carolyn Welshhans, associate director of the SEC's enforcement division, said in a statement.

Virtu, in a statement on Tuesday, said it had been responding to requests for information from the SEC over the matter. In a filing in July, Virtu said it had received a notice, and that it expected the SEC to file an action against the company. But it said the lawsuit "focuses on hypothetical internal access to data."

"Significantly, the SEC does not allege, and there is no evidence to indicate, that any data was ever accessed or used in an inappropriate manner," the company said in a statement.

It also said that it "continuously maintained" policies to prevent misuse of confidential information. And while it said that "hypothetical accessibility" on some trade data "was self-identified" during a routine SEC exam, it took steps to strengthen controls.

Virtu also said that the SEC's action followed public criticism the company made of certain proposed regulations and a lawsuit it filed against the agency intending to seek more detail about its rulemaking process.

"Unfortunately, the SEC's position appears to be driven by politics and headlines rather than the facts and the law," Chief Executive Douglas A. Cifu said in a statement.

"We will always seek to act rationally and manage risk and exposure responsibly on behalf of our firm and our investors," he continued. "Therefore, under these circumstances, we look forward to vigorously defending ourselves in court against these meritless allegations while maintaining our focus on serving clients and markets globally and creating long-term value for our shareholders."

-Bill Peters

This content was created by MarketWatch, which is operated by Dow Jones & Co. MarketWatch is published independently from Dow Jones Newswires and The Wall Street Journal.

(END) Dow Jones Newswires

09-12-23 1911ET

Copyright (c) 2023 Dow Jones & Company, Inc.