NASDAQ PHLX LLCLETTER OF ACCEPTANCE, WAIVER AND CONSENT
NO. 2015045755504
TO:

Nasdaq PHLX LLC
c/o Department of Enforcement
Financial Industry Regulatory Authority (“FINRA”)

RE:

John Grifonetti, Respondent
Former General Securities Principal
CRD No. 3040205

Pursuant to Rule 9216 of Nasdaq PHLX LLC (“Phlx”) Code of Procedure, I, Respondent John
Grifonetti (“Grifonetti” or “Respondent”) submit this Letter of Acceptance, Waiver and Consent(“AWC”) for the purpose of proposing a settlement of the alleged rule violations described
below. This AWC is submitted on the condition that, if accepted, Phlx will not bring any future
actions against Respondent alleging violations based on the same factual findings describedherein.
I.
ACCEPTANCE AND CONSENT
A.

Respondent hereby accepts and consents, without admitting or denying the findings, andsolely for the purposes of this proceeding and any other proceeding brought by or on
behalf of Phlx, or to which Phlx is a party, prior to a hearing and without an adjudicationof any issue of law or fact, to the entry of the following findings by Phlx:
BACKGROUND
Grifonetti entered the securities industry in 1998. In July 2011, Grifonetti and several
business partners founded broker-dealer Bayes Capital LLC (CRD No. 159644) (“Bayes”
or the “firm”). Bayes became registered with Phlx on June 15, 2015. Grifonetti registeredwith Phlx as, inter alia, a General Securities Principal (“GP”) at Bayes on June 15, 2015.
Bayes filed a Uniform Request for Broker-Dealer Withdrawal (Form BDW) on May 4,
2018, and its registration with Phlx was terminated on June 1, 2018. Grifonetti’s
registration with Phlx at Bayes was also terminated on June 1, 2018. On July 2, 2018, thefirm filed a Form U5 on behalf of Grifonetti. On May 22, 2019, FINRA sent a letter to
Grifonetti providing written notice of inquiry to Grifonetti on behalf of FINRA and Phlx,
among others, for the conduct at issue here.
Grifonetti is not currently employed in the securities industry and is not registered or
associated with any Phlx member firm. He remains subject to Phlx’s jurisdiction pursuant
to Phlx Rule 9110(d).

RELEVANT DISCIPLINARY HISTORY
Grifonetti does not have any disciplinary history with the U.S. Securities and Exchange
Commission (“SEC”), any state securities regulators, Phlx, or any other self-regulatoryorganization (“SRO”).
OVERVIEW
Between November 2014 and July 2, 2018, Bayes was a small firm that had
approximately five employees. Grifonetti, who served as the firm’s Chief Executive
Officer (“CEO”) and Chief Compliance Officer (“CCO”) from November 2014 throughDecember 2016, and a business partner (the “Business Partner”), who succeeded
Grifonetti as the firm’s CEO and CCO, were two primary decision-makers at the firm. At
all relevant times, Grifonetti delegated to his Business Partner responsibility forestablishing and maintaining the firm’s supervisory system in relation to achieving
compliance with rules prohibiting manipulative trading and compliance with Rule 15c3-5of Section 15(c)(3) of the Securities Exchange Act of 1934 (the “Market Access Rule”).
Grifonetti, however, failed to take reasonable steps to ensure that his Business Partner
was properly qualified to discharge these functions and failed to implement a reasonablesystem of follow-up and review to ensure that his Business Partner was reasonably
discharging these functions.
The firm’s business was initially limited to agency trading on behalf of institutionalcustomers. In November 2014, Grifonetti and his Business Partner expanded the firm’s
business to include providing direct market access for an unaffiliated broker dealer(“BD1”). BD1’s customers included unregistered foreign day trading entities. One of
BD1’s customers was an unregistered foreign-day trading entity and non-FINRA/SRO
member, Customer X, which was under common ownership and control with the firm’s
third-party, market access control vendor (the “Market Access Control Vendor”).
Although this expanded business significantly changed Bayes’s business activities andtrading volume, the firm failed to reasonably enhance the firm’s supervisory system,
including its written supervisory procedures (“WSPs”), to achieve compliance withapplicable federal securities laws and regulations and Phlx rules prohibiting manipulative
trading. The firm also failed to establish and implement a system of risk management
controls and WSPs reasonably designed to manage the financial, regulatory, and otherrisks of this business. As a result of these failures, Customer X, first through BD1, thenthrough another introducing broker (“BD2”), and later as a direct customer of the firm,
engaged in various forms of potentially manipulative trading, including, but not limited2

to, layering 1 and spoofing. 2
Accordingly, during the period from June 15, 2015 through June 1, 2018 (the “Relevant
Period”), Grifonetti violated Phlx Rules 748 and 707.
FACTS AND VIOLATIVE CONDUCTApplicable Rules
1. Phlx Rule 748 requires, inter alia, members to establish, maintain, and enforce WSPs,
and a system for applying such WSPs, to supervise the types of businesses in which
members engage in and to supervise the activities of all registered representatives,
employees, and associated persons. The WSPs and the system for applying suchprocedures must be reasonably designed to prevent and detect, insofar as practicable,
violations of the applicable securities laws and regulations, including the Phlx ByLaws and rules. Phlx Rule 748 also requires that persons with supervisory control
reasonably discharge their duties and obligations in connection with such supervisionand control to prevent and detect, insofar as practicable, violations of the applicablesecurities laws and regulations, including the Phlx By-Laws and rules.
2. Phlx Rule 748(c) requires members to “make reasonable efforts to determine thateach person with supervisory control . . . is qualified by virtue of experience ortraining to carry out his or her assigned responsibilities.”
3. Phlx Rule 707 prohibits an associated person from engaging in conduct inconsistent
with just and equitable principles of trade. A violation of Phlx Rule 748 also
constitutes a violation of Phlx Rule 707.
4. In 2010, the SEC adopted the Market Access Rule to require that broker-dealers withmarket access appropriately control the risks associated with market access, so as notto jeopardize their own financial condition, that of other market participants, theintegrity of trading on the securities markets, and the stability of the financial system.
The Market Access Rule establishes specific requirements for broker-dealers
providing market access, including that such firms establish, document, and maintaina system of risk management controls and supervisory procedures reasonably
1

Layering is a form of market manipulation that typically includes placement of multiple limit orders on one side of
the market at various price levels at or away from the National Best Bid and Offer (“NBBO”) that are intended tocreate the appearance of a change in the levels of supply and demand. In some instances, layering involves placing
multiple limit orders at the same or varying prices across multiple exchanges or other trading venues. An order isthen executed on the opposite side of the market and most, if not all, of the multiple limit orders are immediately
cancelled. The purpose of the multiple limit orders that are subsequently cancelled is to induce, or trick, othermarket participants to enter orders due to the appearance of interest created by the orders such that the trader is able
to receive a more favorable execution on the opposite side of the market.

2

Similar to layering, spoofing involves placement of non-bona fide orders, generally inside the existing NBBO, with
the intention of briefly triggering some type of response from another market participant, followed by cancelation of
the non-bona fide order, and the entry of an order on the other side of the market.

3designed to manage the financial, regulatory, or other risks of its business. The
Market Access Rule further specifies the required elements for risk management
controls and supervisory procedures and mandates that the controls and procedures be
under the direct and exclusive control of the broker-dealer.
5. In the Adopting Release of the Market Access Rule, as well as subsequent guidance,
the SEC explained that the Market Access Rule requires market access providers to
perform “appropriate due diligence” on their market access control vendors. The due
diligence may include, inter alia, a review of publicly available information about theownership and material business relationships of market access control vendors andmarket access customers, follow up on any information that may indicate a lack of
independence between market access control vendors and market access customers,
and requests to market access control vendors and market access customers to certify
their independence from each other. 3
Grifonetti and his Business Partner Launched Bayes’s
Direct Market Access Business Without Conducting Appropriate
Due Diligence on the Market Access Control Vendor, BD1 and Customer X
6. Between November 2014 and July 2, 2018, Bayes was a small firm that provided
direct market access to U.S. securities markets for several of its customers. Grifonetti
was both an owner of the firm and its CEO and CCO until December 2016. After
stepping down as CEO and CCO, he remained an owner and a GP at the firm.
Grifonetti and his Business Partner, who was the firm’s Head of Trading prior to
becoming the firm’s CEO and CCO in December 2016, were two primary decisionmakers at the firm in all aspects of the firm’s business until December 2016.
7. Prior to November 2014, the firm conducted an agency-only business for a handful of
institutional customers. The firm did not provide direct market access, and waslooking into new business lines to generate additional revenue.
8. In mid-2014, the Market Access Control Vendor presented the firm with a potentiallylucrative package deal: Bayes would receive order flow routed from BD1 and its
customers, including Customer X, so long as it used the Market Access Control
Vendor’s proprietary risk management system and controls to manage the firm’s
direct market access business. The package deal proposed by the Market AccessControl Vendor should have raised concerns for Grifonetti and his Business Partner
about potential conflicts of interest between the Market Access Control Vendor andCustomer X per the guidance set forth in the Adopting Release of the Market Access
Rule.
9. For instance, prior to Bayes providing direct market access to BD1 and Customer X,
3E.g., SEC, Risk Management Controls for Brokers or Dealers with Market Access, Release No. 34-63241 (Nov. 3,2010); see also SEC Division of Trading and Markets, Responses to Frequently Asked Questions Concerning Risk
Management Controls for Brokers or Dealers with Market Access (Apr. 15, 2014), available athttps://www.sec.gov/divisions/marketreg/faq-15c-5-risk-management-controls-bd.htm.

4

Grifonetti and his Business Partner received emails and other documents showing that
the Market Access Control Vendor and Customer X were under common ownershipand control. Neither Grifonetti nor his Business Partner, however, took reasonable
steps to mitigate the potential conflict of interest posed by allowing Customer X toroute order flow through the Market Access Control Vendor’s proprietary pre-traderisk controls.
10. In November 2014, without conducting appropriate due diligence with respect to thepotential conflict of interest between the Market Access Control Vendor andCustomer X, nor collecting any due diligence documentation relating to BD1,
Grifonetti and his Business Partner launched Bayes’s direct market access businesspursuant to the package deal proposed by the Market Access Control Vendor. Thus,
Bayes began providing direct market access to day-trading groups that routed orders
through BD1, including Customer X. The firm agreed to carve out an exception in the
Routing Services Agreement with BD1 pursuant to which the firm would not charge
any fees for routing Customer X’s orders.
11. BD1, and in particular Customer X, immediately became the primary source of order
flow and revenue to Bayes. In 2015 and 2016, order flow from BD1 generated over
92 percent of the firm’s total commissions, with order flow from Customer X alone
constituting approximately 60 percent of that order flow. The trading volume resulted
in discounts and preferential pricing at various exchanges, which made this order
flow more lucrative to the firm. Further, the revenues earned by the firm routing order
flow from BD1, including Customer X, dwarfed revenues it earned from othercustomers.
Grifonetti Failed to Establish and Maintaina Reasonably Designed Supervisory System and WSPs
to Manage and Supervise the Firm’s Direct Market Access Business
12. Pursuant to Bayes’s WSPs dated December 2014, which Grifonetti approved, he was
responsible for establishing and maintaining the firm’s supervisory system andpolicies and procedures for all areas of the firm, including market access. Until hestepped down as CEO and CCO in December 2016, however, Grifonetti delegatedthis responsibility to his Business Partner.
13. Although the delegation of supervisory responsibility is not improper, there has to bea reasonable system in place for review of the delegated responsibility. First, Phlx
Rule 748(c) requires the use of reasonable efforts to determine that all supervisorypersonnel are qualified, either by virtue of experience or training, to carry out theirassigned responsibilities. This “is an ongoing obligation.” 4 Second, supervisors musttake reasonable action to ensure delegated functions are properly executed. “[I]t is‘not sufficient for the person with overarching supervisory responsibility to delegate
supervisory responsibility to a subordinate, even a capable one, and then simply wash
4

See NASD Notice to Members 99-45, at 298 (June 1999).

5

his hands of the matter until a problem is brought to his attention . . . . Implicit is the
additional duty to follow-up and review that delegated authority to ensure that it isbeing properly exercised.’” 5
14. Grifonetti had no experience in establishing or managing a direct market accessbusiness. He wholly relied on his Business Partner and a compliance consultant hiredby the firm to consult on such issues to establish the firm’s risk controls under theMarket Access Rule, as well as to supervise and conduct trade surveillance of Bayes’s
market access business and customer trading activity. But Grifonetti failed to use
reasonable efforts to ensure that his Business Partner was properly qualified to fulfill
his supervisory duties. And, in fact, his Business Partner lacked experience andtraining in supervising direct market access order flow and in setting reasonable pretrade risk controls for such order flow.
15. Grifonetti also failed to implement a system of follow up and review. In addition, he
failed to take reasonable steps to determine if his Business Partner was reasonably
exercising this delegated authority. As such, Grifonetti’s delegation of supervisory
responsibility was not reasonable.
16. Without a reasonable delegation, Grifonetti was required to take reasonable steps toachieve compliance with applicable Phlx rules and federal securities laws andregulations, by establishing and maintaining the firm’s supervisory system, policies
and procedures with respect to the firm’s direct market access business, including thefirm’s WSPs; to reasonably investigate red flags of potential misconduct (including
potentially manipulative trading); and to take reasonable action when such
misconduct has occurred.
17. Before Grifonetti and his Business Partner launched the firm’s direct market accessbusiness, FINRA had issued public guidance regarding risks related to foreign day
traders manipulating U.S. markets. 6
18. In establishing the firm’s market access controls and throughout the Relevant Period,
the Business Partner instead relied on guidance from the Market Access Control
Vendor when setting its pre-trade controls to filter trading activity of direct market
access customers, including Customer X. Further, the Market Access Control Vendor
had the ability, without requiring input or approval from Bayes, to suspend or reenable access at an account level through its platform. The Market Access Vendor
also had the exclusive ability to make intraday adjustments to the financial
management controls within its platform. Separately, the firm relied on guidancefrom BD1 with respect to setting the firm’s market access controls and limits forindividual accounts, including specifically with respect to Customer X.
19. Further, Bayes’s supervisory system relied on (a) the Market Access Control
5

In re Pellegrino, 2008 SEC LEXIS 2843, at *47 (S.E.C. Dec. 19, 2008).

6

See FINRA’s 2013 Priorities Letter (Jan. 11, 2013); see also FINRA’s 2014 Priorities Letter (Jan. 2, 2014).

6

Vendor’s pre-trade risk controls, (b) the firm’s ability to view order and trading
activity in real time, and (c) the Business Partner’s manual review of reports
generated by the vendor of rejected orders as the firm’s supervisory system withrespect to potentially manipulative trading activity by direct market access customers.
Between December 2014 and January 2016 alone, however, BD1 routed more than
305 million orders through Bayes. 7 During the same time period, there were morethan 5.4 million rejected orders on a pre-trade basis from BD1, a substantial portionof which may have related to potential layering or spoofing activity from Customer
X. Despite the massive volume of rejected orders, there is only one documented
instance in which Bayes contacted BD1 in relation to a review of a rejection report.
20. Bayes failed to conduct post-trade reviews for potentially manipulative trading bydirect market access customers until approximately May 2016, after FINRA alerted
the firm of its obligation to do so. Thereafter, Bayes hired a compliance analyst to be
responsible for implementing and conducting the firm’s post-trade reviews. The
analyst, however, had no relevant experience or background in trade surveillance.
21. In July 2016, Grifonetti approved updated WSPs. Until Grifonetti approved the July
2016 WSPs, the firm’s WSPs did not address conflicts of interest with third-party
vendors. The July 2016 WSPs were updated to include procedures requiring the firm
to assure itself that a third-party provider of risk management controls is not an
affiliate, and is otherwise independent of, any market access customer of the firm.
Despite the new procedures, which Grifonetti approved, the firm continued to provide
market access to Customer X using the Market Access Control Vendor’s risk
management controls.
Grifonetti Failed to Reasonably Supervise Order Flow from BD1
22. In September 2015, less than a year after launching its direct market access business,
Bayes started to receive the first of many regulatory inquiries regarding the firm’s
market access controls, supervisory procedures, and surveillances to detect andprevent potentially manipulative trading activity by direct market access customers.
23. Then, in February 2016, BD1 was censured and fined in settled disciplinary
proceedings brought by FINRA and multiple exchange SROs for, inter alia, BD1’s
failure to supervise direct market access customers for potential layering, spoofing,and other trading violations. The disciplinary proceedings against BD1 were public,
yet Bayes failed to perform any additional scrutiny of BD1’s customers’ accountactivity routed through Bayes.
24. On February 29, 2016, FINRA notified Bayes, including Grifonetti, that it had
determined that the firm’s pre-trade risk management controls were not in compliancewith the Market Access Rule, that the firm did not conduct reasonable post-trade7

In view of the volume of the order flow, neither real-time nor manual review of order and trading activity werereasonable here.

7

analysis, and that the firm had failed to demonstrate direct and exclusive control of its
direct market access business.
25. Further, Grifonetti received information that should have put him on notice of thecommon ownership and controls of the Market Access Control Vendor and Customer
X. He nonetheless failed to take reasonable steps to ensure that the Market AccessControl Vendor was independent from Customer X and failed to perform reasonablefollow-up and review to ensure that his Business Partner was reasonably discharging
this obligation.
26. Despite the multiple red flags regarding potentially manipulative activity as describedabove, all of which Grifonetti knew or should have known related to potentiallymanipulative activity involving order flow routed through BD1, Bayes failed toperform reasonable supervisory oversight on order flow from BD1. As a result, thepotentially manipulative activity continued. Grifonetti again failed to conduct
reasonable follow up and review of his Business Partner to determine if he wasreasonably discharging his delegated supervisory obligations in light of thesepotential red flags.
Grifonetti Failed to Reasonably Supervise Order Flow from BD2
27. In October 2016, Customer X moved its account from BD1 to BD2. Grifonetti and his
Business Partner thereupon established a market access arrangement with BD2, andBD2 started sending order flow to Bayes, including from Customer X.
28. BD2 had previously been censured and fined in a settled disciplinary proceedingbrought by an exchange SRO in February 2015 for, inter alia, failing to havereasonable supervisory procedures and controls in place designed to achievecompliance with rules against potentially manipulative trading practices by market
access customers. The disciplinary proceeding against BD2 was also public, yet
Bayes failed to perform any additional scrutiny of BD2’s customers’ account activity
routed through Bayes.
29. Despite the disciplinary proceeding against BD2, which Grifonetti knew or shouldhave known about, Grifonetti failed to take reasonable steps to determine if his
Business Partner was performing appropriate due diligence or implementing
reasonable supervisory oversight on order flow from BD2.
Despite Red Flags, Bayes Agreed to Take on Customer X
as a Direct Customer of Bayes
30. In or about January 2017, BD2 requested that Bayes agree to have Customer X route
its order flow directly to Bayes, rather than through BD2, because BD2 stated that itwas concerned about risks relating to Customer X’s order flow. Although Grifonetti
stepped down as CEO of Bayes in December 2016, he remained a GP at the firm.

831. Despite concerns about potentially problematic order flow from Customer X andknowledge of the common ownership of Customer X and the Market Access Control
Vendor, the firm agreed to take on Customer X as a direct customer of the firm. As aresult, Customer X continued to route potentially manipulative trades to U.S. trading
markets through Bayes.
32. It was only in May 2017, after Grifonetti and others at Bayes attended a meeting with
FINRA and several exchange SROs regarding Customer X’s problematic order flow,
when Bayes terminated its relationship with Customer X. Bayes nonethelesscontinued providing direct market access to other customers until the firm ceased tooperate in July 2018.
33. Based on the foregoing, Grifonetti violated Phlx Rules 748 and 707.
B.

I also consent to the imposition of the following sanction:
A censure, a principal bar, a 12-month suspension in all capacities and a total fine of$75,000, of which $8,333.33 shall be paid to Phlx. 8
I agree to pay the monetary sanction upon notice that this AWC has been accepted andthat such payment is due and payable. I have submitted a Payment Information form withmy billing contact information for payment of the fine imposed.
I specifically and voluntarily waive any right to claim that I am unable to pay, now or at
any time hereafter, the monetary sanction imposed in this matter.
I understand that if I am barred or suspended from associating with any Phlx member, I
become subject to a statutory disqualification as that term is defined in Section 3(a)(39)of the Securities Exchange Act of 1934, as amended. Accordingly, I may not be
associated with any Phlx member in any capacity, including clerical or ministerial
functions, during the period of the bar or suspension. See Phlx Rule 8310 and IM-8310-1.
I also understand that if I am barred or suspended from associating with any Phlx
member in a principal capacity, I become subject to a statutory disqualification as thatterm is defined in Section 3(a)(39) of the Securities Exchange Act of 1934, as amended.
Accordingly, I may not be associated with any Phlx member in a barred capacity, during
the period of the bar or suspension. See Phlx Rule 8310 and IM-8310-1. Furthermore,because I am subject to a statutory disqualification during the bar, if I remain associatedwith a member firm in a non-barred capacity, an application to continue that association
may be required.

8
The remainder of the fine shall be paid to FINRA, Cboe BZX Exchange, Inc., Cboe BYX Exchange, Inc., Cboe
EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., The Nasdaq Stock Market LLC and Nasdaq BX, Inc.

9

The sanctions imposed herein shall be effective on a date set by FINRA staff. Pursuant to
IM-8310-3(e), a bar or expulsion shall become effective upon approval or acceptance of
this AWC.
II.
WAIVER OF PROCEDURAL RIGHTS
I specifically and voluntarily waive the following rights granted under Phlx’s Code of Procedure:A.

To have a Formal Complaint issued specifying the allegations against me;

B.

To be notified of the Complaint and have the opportunity to answer the
allegations in writing;C.

To defend against the allegations in a disciplinary hearing before a hearing panel,to have a written record of the hearing made and to have a written decision issued;andD.

To appeal any such decision to the Exchange Review Council and then to the SEC
and a U.S. Court of Appeals.

Further, I specifically and voluntarily waive any right to claim bias or prejudgment of the Chief
Regulatory Officer, the Exchange Review Council, or any member of the Exchange Review
Council, in connection with such person’s or body’s participation in discussions regarding theterms and conditions of this AWC, or other consideration of this AWC, including acceptance orrejection of this AWC.
I further specifically and voluntarily waive any right to claim that a person violated the ex parteprohibitions of Rule 9143 or the separation of functions prohibitions of Rule 9144, in connection
with such person’s or body’s participation in discussions regarding the terms and conditions of
this AWC, or other consideration of this AWC, including its acceptance or rejection.
III.
OTHER MATTERS
I understand that:A.

Submission of this AWC is voluntary and will not resolve this matter unless anduntil it has been reviewed and accepted by FINRA’s Department of Enforcement
and the Exchange Review Council, the Review Subcommittee, or the Office ofDisciplinary Affairs (“ODA”), pursuant to Phlx Rule 9216;

B.

If this AWC is not accepted, its submission will not be used as evidence to prove
any of the allegations against me; and

10

C.

D.

If accepted:
1.

This AWC will become part of my permanent disciplinary record and may
be considered in any future action brought by Phlx or any other regulator
against me;

2.

Phlx may release this AWC or make a public announcement concerning
this agreement and the subject matter thereof in accordance with Phlx
Rule 8310 and IM-8310-3; and3.

I may not take any action or make or permit to be made any publicstatement, including in regulatory filings or otherwise, denying, directly or
indirectly, any finding in this AWC or create the impression that the AWC
is without factual basis. I may not take any position in any proceedingbrought by or on behalf of Phlx, or to which Phlx is a party, that isinconsistent with any part of this AWC. Nothing in this provision affects
my right to take legal or factual positions in litigation or other legal
proceedings in which Phlx is not a party.

Respondent may attach a Corrective Action Statement to this AWC that is astatement of demonstrable corrective steps taken to prevent future misconduct.
Respondent understands that he may not deny the charges or make any statementthat is inconsistent with the AWC in this Statement. This Statement does notconstitute factual or legal findings by Phlx, nor does it reflect the views of Phlx or
its staff.

11

May 29, 2020