Credit Suisse failed to adhere to the principles of good business practice in that on Nov. 14, 2007, beginning at approximately 3:40 p.m., a Credit Suisse proprietary algorithm routed hundreds of thousands of cancel/replace requests to the New York Stock Exchange for orders that had been previously generated by the algorithm, but, due to an unforeseen programming issue, were never sent by the algorithm. The unusually large amount of cancel/replace messages contributed to the over-queuing of message traffic in all of the securities, approximately 975 in total, traded at five posts on the NYSE Trading Floor. Messages, including new orders, modifications of orders, and cancellation requests were frozen in queue and could not be immediately processed. These five posts could not be closed on time, ultimately closing between 4:10 p.m. and 4:27 p.m.

Credit Suisse violated NYSE Rule 342 by failing to properly supervise the development and implementation of the firm’s proprietary algorithm, particularly with respect to certain revisions to the algorithm that contributed to the Nov. 14 incident. The firm also failed to properly monitor the operation of the algorithm, as evidenced by the fact that the firm was unaware that hundreds of thousands of messages sent by the algorithm were being rejected by NYSE systems until being notified of the issue by NYSE Regulation the following day. These failures by the firm also constituted a bad business practice in violation of NYSE Rule 401.

Cutler Group L.P., an NYSE Arca Options trading permit holder, failed to

• preserve certain electronic communications in the required format;
• maintain a complete and accurate list of accounts in which its employees had a direct or indirect financial interest;
• obtain, maintain and review monthly account statements for accounts in which its employees had a direct or indirect financial interest;
• file a complete and accurate annual acknowledgment attestation with the exchange;
• appropriately conduct background checks of its associated persons; and
• establish, maintain, and/or enforce appropriate written policies and procedures for supervision and control, including a separate system of follow-up and review, with respect to certain of the foregoing areas.

The NYSE found the following violations:

• Section 17(a)(1) of Exchange Act, and Rules 17a-4(b)(4) and 17a-4(f) thereunder, and NYSE Arca Options Rule 11.16(a) by failing to preserve business-related e-mail and instant messages in non-rewriteable, non-erasable format, and by failing to preserve business-related fax communications
• NYSE Arca Options Rule 11.3—Commentary .03 by failing to maintain complete and accurate list of accounts in which employees had direct or indirect financial interest, and by failing to obtain, maintain and review monthly account statements for accounts in which employees had direct or indirect financial interest;
• NYSE Arca Options Rule 11.3(a) by failing to establish, maintain, or enforce adequate written policies and procedures reasonably designed to prevent misuse of material, non-public information by employees;
• Section 17(a)(1) of Exchange Act, and Rule 17a-3(a)(12) thereunder, and NYSE Arca Options Rule 11.16(a), by failing to appropriately conduct and document background checks of employees prior to employment, and by failing to properly retain and preserve manually signed Forms U-4;
• NYSE Arca Options Rule 11.18 by failing to establish, maintain, and/or enforce appropriate written policies and procedures for supervision and control, including separate system of follow-up and review, in following areas:
  • (a) conducting and documenting background checks of employees prior to employment, including maintaining complete and accurate signed Forms U-4;
  • (b) retention in proper format and review of business-related e-mails, instant messages and faxes sent or received by employees; and
  • (c) prevention of misuse of material, non-public information by employees .