FINRA recently settled an action against a registered representative of a broker-dealer for alleged violations regarding the safeguarding and use of private consumer data. The broker accepted and consented to the settlement without admitting or denying FINRA’s findings regarding the alleged violations.
The stockbroker was employed by Merrill Lynch for several years. In January 2014, he resigned from his position there to take a job with Edward Jones. Before resigning, he sent an email, titled “Vacation,” from his Merrill Lynch account to his personal account, purportedly to conceal the transfer of Merrill Lynch clients’ sensitive personal information. He knew this violated Merrill Lynch policy, and his email contained sensitive information regarding numerous Merrill Lynch customers and their accounts.
After starting at Edward Jones, the stockbroker attempted to access the information. Once Merrill Lynch learned of the transfer, it notified Edward Jones, which prohibited its registered representatives from bringing in information regarding their prior firms’ customers. Upon receiving this notice, Edward Jones terminated the stockbroker’s employment.
FINRA determined that the stockbroker caused Merrill Lynch to violate Regulation S-P and FINRA Rule 2010. Regulation S-P requires that firms establish policies and procedures to protect customer information and records. FINRA Rule 2010 requires that members observe “high standards of commercial honor and just and equitable principles of trade.” FINRA fined the stockbroker $5,000 and suspended him for 10 business days.
This action should remind broker-dealers and associated persons that:
- Private consumer data compiled by a representative in the course of his employment and stored on a firm’s system is subject to the supervision and care of that firm. Representatives have no right to freely transfer this data outside of firm policy.
- Access to clients’ private personal information should be restricted to necessary employees.
- Upon receiving notice that an employee is resigning or leaving involuntarily, the employer should immediately restrict and terminate access to any customer information.
- Even if there is no direct pecuniary harm, broker-dealers and representatives can still be sanctioned for having improper policies and procedures.
- A written policy in accordance with Regulation S-P must be implemented and monitored. Having and appropriately enforcing written policies safeguarding information may potentially shield the entity from liability.
- Systems for monitoring and detecting the transfer of consumer information should be set up and reported to management.
This list is not exhaustive, but should serve as a reminder that FINRA, in accordance with the SEC, is adamant about implementing guidance and pursuing violations to better protect consumers from cyber-risks and data breaches.
©2026 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.
