The SEC's complaint alleges that the database in question was accessible to practically anyone at Virtu Americas and its affiliates, including their proprietary traders, through two sets of widely known and frequently shared generic usernames and passwords.
"Virtu Americas' failure to safeguard this information created significant risk that its proprietary traders could misuse it or share it outside Virtu Americas," the SEC said in a news release.
However, the SEC did not allege that any data was ever accessed or used in an inappropriate manner during this time period.
But Virtu did, the SEC said in its complaint, mislead customers about the existence and adequacy of information barriers to safeguard information.
"Defendants repeatedly — and falsely — told their institutional customers and the public that VAL (Virtu Americas) used 'information barriers' and 'systemic separation between business groups' in order to safeguard these customers' MNPI (material, nonpublic information)," the SEC complaint said.
Gurbir Grewal, director of the SEC's enforcement division, said in a statement that "at a time when Virtu Americas handled around a quarter of all market orders placed by retail investors in the U.S., we allege that proprietary traders had nearly unfettered access to material nonpublic information about its institutional customers' trades — information which could be abused for personal gain. Despite the absence of any critical safeguards whatsoever around this information, we further allege that Virtu repeatedly misled institutional customers and the market about how Virtu Americas was protecting this valuable data to generate significant commissions."
In a statement of its own, Virtu said it "rejects the SEC's allegations and underlying theory that the temporary hypothetical possibility of access by a broader group of Virtu employees rendered its policies and procedures 'unreasonable.' Virtu has continuously maintained policies and procedures that were and are reasonably designed to prevent the misuse of confidential information — consistent with its obligations under applicable laws — and public statements made regarding its policies and procedures were true and accurate."
The broker-dealer also said that during a routine SEC exam in 2019, it voluntarily disclosed to SEC staff that certain post-trade data in its back-office database was hypothetically accessible to a broader group of employees than intended during the time period mentioned in the SEC complaint.
"We are disappointed by the SEC's decision to bring this action," said Douglas Cifu, Virtu's CEO, in the statement. "Despite our belief that these allegations are meritless, we engaged in good faith settlement discussions with the SEC to bring this matter to a reasonable resolution. Unfortunately, the SEC's position appears to be driven by politics and headlines rather than the facts and the law."
Virtu said the SEC ramped up its investigation after the broker-dealer publicly criticized the agency's proposed market structure rules, which were unveiled in December 2022, and filed a lawsuit against the SEC to seek records under the Freedom of Information Act related to the rule-making process.
