1 

 National Examination Risk Alert

By the Office of Compliance Inspections and Examinations1

Volume II, Issue 2 February 27, 2012 

Strengthening Practices for Preventing and 

Detecting Unauthorized Trading and Similar

Activities 

Introduction

Unauthorized trading or other unauthorized activities are not a 

new problem. Such activities may cause firms and investors to 

incur losses, and subject firms to legal, regulatory and 

reputational risks. While broker-dealers and investment advisers 

are subject to different regulatory requirements, their risk 

exposures can be similar.2

• “rogue” or other unauthorized trading or trade execution 

in customer or client or proprietary accounts; 

In this Alert, we use the term 

“unauthorized trading” to refer broadly to a range of activities, 

including: 

• exceeding firm limits on position exposures, risk tolerances and losses; 

• intentional mismarking of positions; and

• creating records of nonexistent (or sham) transactions. 

The staff recommends that in any review of business practices and internal controls, firms 

should seek to identify any circumstances that might permit an individual (or group of 

 

1

 The Securities and Exchange Commission (“SEC”), as a matter of policy, disclaims responsibility for any 

publication or statement by any of its employees. The views expressed herein are those of the staff of the 

Office of Compliance Inspections and Examinations, in coordination with other SEC staff, including in the 

Division of Trading and Markets, and do not necessarily reflect the views of the Commission or the other 

staff members of the SEC. This document was prepared by the SEC staff and is not legal advice.

2

 With regard to broker-dealers, see FINRA Regulatory Notice 08-18 dated April 2008 (the “FINRA 

Notice”) that addressed risks and set forth a non-exclusive set of practices designed to prevent or mitigate 

the risk of unauthorized trading. With regard to registered investment advisers, see Compliance Programs 

of Investment Companies and Investment Advisers, Advisers Act Release No. 2204 (December 17, 2003), 

68 F.R. 74714 (Dec. 23, 2004). 

Key Takeaways: 

This Risk Alert encourages firms to 

review their controls designed to 

prevent unauthorized trading and 

other unauthorized activities. 

Unauthorized activities may 

include a range of activities. Thus, 

controls should address: potential 

unauthorized trading for the firm’s 

own account or for a customer or 

client account; position 

mismarking; exceeding trading 

limits; personal trading activities 

of associated persons or other 

employees; and creation and 

maintenance of inaccurate or 

altered records.
2 

individuals) to engage in or conceal unauthorized transactions. Such individuals may include 

traders, trader assistants, portfolio managers, brokers, investment advisers, order placement 

personnel or trading desks, (collectively, “traders”), as well as mid-or back-office, risk 

management and other personnel. 

One critical element in mitigating the risks posed by unauthorized trading is to have 

independent and mutually reinforcing controls. Toward this end, firms may want to consider 

actively engaging such control functions as operational risk, audit, legal and compliance to work 

closely with management in performing an independent identification of risks and practices that 

could permit unauthorized trading. A fresh review of reports of past unauthorized trading 

incidents suffered by the industry may be illustrative in this effort. It may also be appropriate to 

review and/or test internal controls on a regular basis as well as assessing their adequacy to 

prevent unauthorized trading in light of internal business changes and current market conditions, 

among other factors. 

Upon identifying any potential weaknesses that could enable unauthorized trading, firms 

should consider working closely with the above-mentioned control functions to develop 

enhanced controls and processes to address such weaknesses. Management and nonmanagement employees should be appropriately trained to identify unauthorized activity. Firms 

also should carefully consider how best to facilitate proper and immediate escalation of any 

detected activity without fear of retaliation. 

Some Insights

Highlighted below are some insights from the Commission’s National Examination Program that 

may help firms identify risks and strengthen their practices for preventing and detecting 

unauthorized trading. This Alert is not intended as a comprehensive summary of all supervisory 

and compliance matters pertaining to unauthorized trading; rather, it discusses certain measures 

that may assist firms in complying with their supervisory and compliance obligations. Firms are 

encouraged to consider the practices described below in assessing their own procedures and 

implementing improvements that will best protect the firm and its clients. Firms are cautioned 

that these factors and suggestions are not exhaustive, and they constitute neither a safe harbor nor 

a “checklist.” Other practices besides those highlighted here may be appropriate as alternatives 
3 

or supplements to such practices. The adequacy of compliance or supervisory controls can be 

determined only with reference to the profile of the specific firm and the specific facts and 

circumstances. 3

 Front Office Supervision: The firm’s supervisory structure, both on the trading desk 

and across the firm, is its most important control. Strong and effective business line 

supervision at all levels is essential both to promote an overall culture of compliance and 

to detect and prevent unauthorized trading. Below are some elements that can be 

considered when a firm assesses its supervision systems.

 

 

• Define independent and clear reporting lines. This should include making provision 

for mutually reinforcing checks and balances, so that more than one person and chain 

of control are responsible for monitoring the integrity of a business activity. 

• Knowledge of Complex Securities/Trading Strategies: In order to provide effective 

front office supervision, it is important for those within the chain of management and 

supervision to have an appropriate understanding of the complex products and trading 

strategies employed by the firm’s traders. 

• Discussions with Direct and Indirect Reports: Beyond systems-based trading reviews, 

direct and indirect supervisors (as appropriate) should engage in discussions with 

traders, portfolio managers and others and review their trading portfolios or account 

positions on a holistic basis, focusing on any positions that seem atypical or 

anomalous given the trading strategy or client mandate. Additional discussions and 

scrutiny may be required with traders responsible for larger trading books or portfolios, 

or with lesser experienced traders. 

• Structuring of incentives. Consider how well compensation packages and other 

incentives for traders and their supervisors are aligned with responsible risk-taking. 

• Disaggregation of functions. Discourage aggregating functions in one trader or desk 

(e.g., trade execution, booking, clearance, etc.) 

• Management “Open-Door” Policy: Firms may want to instruct traders that, if any 

position begins to lose value in an unanticipated way, the best course of action is to 

promptly raise the matter with management. An affirmative “open-door” policy that 

encourages early reporting of unrealized or unexpected losses may permit 

 

3

 The functions performed by traders vary among businesses and among firms. Traders typically may 

perform trade execution functions while other aspects of the lifecycle of the transaction, such as booking, 

clearing and settling a trade, are handled by other personnel or departments. However, there may be 

situations where traders have some role in such other functions. The practicality of some of the practices

described below may depend in part on the specific role performed by a given set of traders, as well as by 

factors such as their compensation structure, the manner in which trades are cleared and settled, etc. 
4 

management to identify and address problems before they manifest themselves in 

greater harm to the firm and/or its clients or customers. 

• Trading and Booking Systems Reviews: In addition to discouraging aggregation of 

trading and post-trade functions (as discussed above), only certain individuals should 

be granted access to these systems (including for the prevention of insider trading and 

other violations of securities laws and rules). It is therefore appropriate for 

supervisors (either directly, through a control function, or more formally through their 

audit department) to periodically review which traders and other persons have access 

to particular trading books to determine that their access conforms to their business 

needs. In particular, the supervisor may want these reviews to focus on ensuring that 

employees’ “legacy” access is removed so that only the appropriate personnel have 

the ability to book trades into particular portfolios. 

 

• Potential Additional Controls and Scrutiny: Supervisors, legal/compliance and 

operational risk personnel may find it prudent to assess the need for specific 

additional controls or heightened scrutiny. Some of these controls may lend 

themselves to daily monitoring. 

o By way of example, some additional controls or heightened scrutiny that could be 

monitored on a daily or intra-day basis may focus on: 

 trade breaks, unfilled bids and offers, paper tickets and changes in venues 

where trades are executed; 

 changes in trading patterns;

 concentrated risks; 

 audit trails; 

 unusual or high volume of error account activity (e.g., cancel/corrects);

 aged inventory monitoring; 

 manual trade adjustments; 

 unexplained or uncorrelated profitability to a specific book or investment 

mandate, profile or risk tolerance for a particular trader or client; 

 instances where trades are inappropriately reported to the tape but not 

cleared, and vice versa; and

 concentrations of profitable or unprofitable trades, or patterns of trades 

and offsetting trades, with the same counterparty. 

o Other controls or areas for heightened scrutiny that may also be considered for 

monitoring on a regular basis include 

 frequency of risk limit breaches;

 frequent requests for trade limit increases for the same counterparty;

 reasons for and patterns in remote access to trading accounts; 

 robustness and integrity of controls for trade capture, confirmation and 

validation; and

 incentives created by compensation arrangements or promotion criteria.
5 

o Where anomalies are identified that suggest the need for additional analysis and 

investigation, steps that firms may wish to consider include

 review of personal and family investments and trading accounts, to the 

extent that the firm requires that these be available to it for surveillance; 

 review of changes in lifestyle that may evidence an unexplainable increase 

in wealth; and

 collection and review of email, phone logs and other communications such 

as text messages or social networking activities, to the extent that the firm 

requires these to be available for surveillance. 

 Transfer of Personnel into Trading Positions: Firms may from time to time offer a 

trading desk position to personnel from other areas in the firm. Providing employees 

new opportunities in different areas of the firm may be positive in many respects. At the 

same time, personnel from areas such as operations, finance or risk control groups that 

move into trading desk positions may take with them awareness of any idiosyncratic 

process “workarounds” or procedural weaknesses that could be exploited to hide 

unauthorized activity. Firms may wish to take this into account in assessing internal 

controls and securities safeguards on systems, as well as in supervisors being alert to any

“red flag” indicators of possible unauthorized trading. In all events, firms are encouraged 

to determine that all systems access permitted as part of an employee’s prior position is 

terminated prior to any trading by such a transferred individual employee. Some firms 

terminate all system entitlements, other than payroll-related entitlements, for employees 

who transfer functions. By treating such employees as a “new hire” with respect to 

system entitlements, firms have greater assurance that such employees no longer have 

inappropriate access to mid-or back-office systems. Also, on a periodic basis, 

supervisors may want to engage a control function or the firm’s audit department to 

verify that unneeded system access has been properly terminated. 

 Extended Settlements/“Rolling” of Positions: Both extended settlement trades and 

apparent client or firm positions that are rolled over many times can be cause for 

potential concern. Firms may wish to consider carefully the development of special 

supervisory reviews, exception reports or other tools to review transactions that feature 

extended settlements or “rolls” of positions, based on frequency, length of settlement 

extensions or extensions that are inconsistent with normal or standard conventions 

applicable to the particular trading instruments. In some cases, it may be appropriate to 

contact the client/counterparty to ensure that such person knows the trades as well. As a 

particularly strong control and a parallel safeguard to its order management system, some 

firms require a verbal independent confirmation by a designated mid- or back-office

person of each extended settlement trade, within minutes of the order being created.

 Trade Confirmations: Broker-dealers of course are required to give or send 

confirmations of securities transactions to their customers.4

 

4

 Securities Exchange Act Rule 10b-10. 

 However, inter-company 

 
6 

transactions where confirmations may not be present and certain delays in obtaining 

client signatures or authorizations (if any are required) may merit additional scrutiny

(e.g., for confirmations of many securities-based derivative transactions) to ensure that 

such absence or delay is not hiding unauthorized trading. Similarly, the street-side 

“comparison” process should also be reviewed to ensure that it is not being used to 

facilitate or hide unauthorized trading. Management may want to consider providing 

training to middle and operations personnel to emphasize the need to receive timely 

signed confirmation acknowledgements and when to escalate backlogs. 

 Mandatory Vacations: Policies requiring mandatory vacations without remote access to 

trading accounts have been adopted by many firms, requiring traders and perhaps certain 

other personnel to be out of the office for a period of time (e.g., 10 consecutive business 

days), without any out-of-office access to the firm. This policy, however, may not 

necessarily on its own bring any unauthorized trading to light, especially if fictitious 

trades have been booked to the firm. For firms that adopt such mandatory vacation 

policies, supervisors may consider how best to assign the management of the trader’s 

portfolio(s) to another trader during the trader’s absence. For example, it may be prudent 

to assign the book to another supervisor or to a “peer” trader, as opposed to a lessexperienced trader. Similarly, a supervisor may want to do a special review of an absent 

trader’s portfolio(s) during expiration to detect any unusual activity. More generally, 

firms may wish to consider limiting or eliminating the type of remote trade-book access 

(e.g., electronic, phone) that traders have while away from the office.

 Independent Trading Reviews: Firms should consider actively engaging their audit 

department and/or control functions such as their compliance department and their 

financial, credit and operational risk units to periodically check trading strategy, business 

performance and risk profile.5

 Independent valuation, and validation, of trading positions 

including any hedging transactions, is an important control. Also, with respect to 

“strategies,” it is important to validate whether traders are actually following a prescribed 

strategy and whether the performance risk of each strategy is appropriate for the firm’s 

risk profile.

 Silo Systems: An additional risk area faced by many firms is that transaction information

may exist in multiple automated or other recordkeeping systems. These situations could 

exist due to: (1) legacy acquisitions; (2) the use of multiple trading platforms; and (3) the 

use of various security types. The existence of multiple systems may make it difficult to 

observe, manage, identify and report on transactions seamlessly across a firm. Firms 

may, as appropriate, work to align disparate systems either through robust reporting, data 

migration or middleware products to ensure “full picture” monitoring.

 Control Testing: Finally, it may be appropriate to periodically test the controls designed 

to identify unauthorized trading activities. Tests may need to be conducted and reviewed 

 

5

 Risk profile includes market, credit, liquidity, trading supervision and operational risk including review of 

operational incidents, if any.
7 

by supervisors, or their designees, and, if appropriate, those independent of the businesses 

with knowledge and experience in both trading various securities and the systems used to 

support various trading desks.

 “Tone From the Top”: Past unauthorized trading incidents and regulatory guidance6

underscore the need for a firm’s culture of compliance to be one that is articulated and 

followed by top-level senior management and one that emphasizes honesty, integrity, 

accountability and responsible risk-taking, as well as the need for rigorous supervisory 

and compliance control systems that emphasize quick and proper escalation without fear 

of retaliation. Financial firms operate in an environment focused on performance but must 

also create a culture where personnel can acknowledge that the firm’s reputation and 

financial well-being is a shared responsibility. Traders should report unexpected and unusual 

losses early in order to prevent such losses from becoming worse, and potentially becoming 

disastrous. Non-trading personnel should be trained to be sensitive to suspicious activities 

and encouraged to quickly escalate any activity that seems unusual or inconsistent with 

compliance, financial and operational controls. Management should not tolerate any activity 

designed to discourage employees from quickly escalating concerns, such as bullying or 

inappropriately relying on seniority to impede openness. 

Conclusion 

The risks posed by unauthorized trading are a permanent concern to financial institutions 

and regulators. The staff hopes that the observations shared above will be helpful to firms in 

strengthening their compliance and supervisory controls regarding unauthorized trading. 

The staff also welcomes comments and suggestions about how the Commission’s 

examination program can better fulfill its mission to promote compliance, prevent fraud, monitor 

risk, and inform SEC policy. 

If you suspect or observe activity that may violate the federal securities laws or otherwise 

operates to harm investors, please notify us at 

http://www.sec.gov/complaint/info_tipscomplaint.shtml. 

 

6

 FINRA has emphasized the importance of not ignoring unauthorized trading merely because it proved to be 

profitable, as well as the importance of a “tone at the top” from senior management that establishes a strong 

corporate culture of compliance. FINRA Notice, supra note 2, at 1, 6.