NOTE: Stipulations of Fact and Consent to Penalty (SFC); Offers of Settlement (OS); and Letters of Acceptance Waiver, and Consent (AWC) are entered into by Respondents without admitting or denying the allegations, but consent is given to the described sanctions & to the entry of findings. Additionally, for AWCs, if FINRA has reason to believe a violation has occurred and the member or associated person does not dispute the violation, FINRA may prepare and request that the member or associated person execute a letter accepting a finding of violation, consenting to the imposition of sanctions, and agreeing to waive such member's or associated person's right to a hearing before a hearing panel, and any right of appeal to the National Adjudicatory Council, the SEC, and the courts, or to otherwise challenge the validity of the letter, if the letter is accepted. The letter shall describe the act or practice engaged in or omitted, the rule, regulation, or statutory provision violated, and the sanction or sanctions to be imposed.

MBSC Securities Corporation, BNY Mellon Capital Markets LLC and BNY Mellon Securities LLC
AWC/2010021312001

The Firms failed to ensure that emails were retained and timely reviewed.

The Firms, all subsidiaries of the same parent company, implemented a new, third party system for email archiving and review. In order for the emails to be archived consistent with the requirements of SEC Rule 17a-4 and NASD Rule 3110, the firms relied on their personnel to properly code new and existing email accounts to ensure that emails were journaled from users’ email accounts in the new system, and when email accounts were incorrectly coded, the affected users’ emails were not retained consistent with SEC and NASD rules. Instead, both sent and received emails were retained for 30 days, unless an individual employee double-deleted the email (in which case it would not have been retained at all); after 30 days, any emails remaining in an individual employee’s email inbox or outbox would be retained for an additional 30 days; and all emails would be deleted from the new system after 60 days (unless the auto-delete function was disabled), and additionally, would not have appeared in the new system for compliance department reviews, unless an email user whose account was properly coded sent or received the email message.

The Firms did not properly code certain email accounts and did not have written guidance to ensure that all email accounts for associated persons of each firm were properly recorded, nor did the firms have evidence that they conducted any testing of the new system to ensure that email accounts were being set up properly to capture emails for compliance with SEC Rule 17a-4 and NASD Rule 3110. As a result of the failure to retain emails, the firms also failed to timely review emails of affected users. In addition, FINRA determined that the failure to properly archive and review emails was discovered after a MBSC Securities Corporation compliance department employee searched for an electronic copy of an email he knew to have existed, and failed to locate it; prior to that event, the firms did not know that they were failing to properly archive and review emails.

Moreover, following the discovery of the retention and review problem at the firms, the firms’ parent company retained an outside consultant to assess the scope of the retention failure, and the outside consultant determined that there were 725 affected users between the three firms, for whom emails were not retained consistent with SEC and NASD rules. Furthermore,  the outside consultant estimated that the three firms may have lost as many as 4 million emails through the failure to properly code email accounts for journaling to the new system. 

In determining the appropriate sanctions in this matter, FINRA took into consideration that the firms self-reported to FINRA their failure to review and retain certain emails and the steps the firms took to remedy those deficiencies.

MBSC Securities Corporation, BNY Mellon Capital Markets LLC and BNY Mellon Securities LLC: Censured; Fined $300,000 joint/several

Tags: Email  Third Party Vendor