SEC Hits JPMorgan, UBS, TradeStation for Identity Theft Violations

The Securities and Exchange Commission on Wednesday separately charged J.P. Morgan Securities LLC, UBS Financial Services Inc., and TradeStation Securities, Inc. for deficiencies in their programs to prevent customer identity theft, violating the SEC’s Identity Theft Red Flags Rule, or Regulation S-ID.

According to the SEC’s orders, from at least January 2017 to October 2019, the firms’ identity theft prevention programs “did not include reasonable policies and procedures to identify relevant red flags of identity theft in connection with customer accounts or to incorporate those red flags into their programs.”

The SEC’s orders also found that the firms’ programs “did not include reasonable policies and procedures to respond appropriately to detected identity theft red flags, or to ensure that the programs were updated periodically to reflect changes in identity theft risks to customers.”

Carolyn Welshhans, acting chief of the SEC Enforcement Division’s Crypto Assets and Cyber Unit, said in a statement that Regulation S-ID “is designed to help protect investors from the risks of identity theft.”

Welshhans added, “Today’s actions are reminders that broker-dealers and investment advisors must design and operate identity theft prevention programs that are appropriately tailored to their businesses and update them in response to the increased threat and changing nature of identity theft.”