SEC Slaps BD for Failing to File Suspicious Activity Reports

“Although GWFS concluded that the personal identifying information was not obtained in connection with any breach of GWFS’ systems, the bad actors frequently were in possession of electronic login information — such as user names, email addresses, and passwords — of the plan participants,” the order states.

GWFS detected most of these attempts before the bad actors could request a distribution from a plan participant’s account, but some incidents involved successful distributions, according to the order.

These attempts, whether or not funds were ultimately withdrawn, are referred to as “account takeovers.”

During the Relevant Period, GWFS failed to implement its anti-money laundering program consistently in practice.

As a result, GWFS, according to the SEC: failed to file approximately 130 SARs, including in cases when it had detected external bad actors gaining, or attempting to gain, access to the retirement accounts of participants in the employer-sponsored retirement plans it serviced; and omitted, from approximately 297 SARs it did file, information it knew, and was required to report, about the suspicious activity and suspicious actors.

The Bank Secrecy Act requires broker-dealers to file SARs with FinCEN to report a transaction (or pattern of transactions of which the transaction is a part) conducted or attempted by, at, or through the broker-dealer involving or aggregating funds or other assets of at least $5,000.