A Math Equation for Regulatory Violations
Does crime[1] pay? Maybe?
If you’re subject to regulatory requirements, maybe the formula is:
The cost of a program reasonably designed to comply with them x
the likelihood that you get caught not complying,
weighed against
the financial penalties resulting from an enforcement action +
staff time and outside counsel fees you have to devote to any investigation(s) +
the costs of any third-party consultants or monitors that have to be engaged +
the admittedly hard-to-quantify costs of any reputational harm that ensues.
As far as your options in how to treat the regs, I guess you have several. You could:
(a) Ignore them, running the risk that you get caught and suffer the consequences;
(b) Study the letter of the law and corresponding enforcement actions and scholarly literature (or, really, law firm memos) and build out a compliance plan that is appropriately staffed and provided with enough resources to work;
(c) Kind of make a show of complying, cross your fingers, and hope for the best.
If the total number in blue text is higher than the total in red text, I suppose you choose (a) or (c). It’s inexpensive for a while! Anway, it seems like OTC Link took (c)?
What is an ATS?
According to the SEC’s administrative order issued on Monday, OTC Link’s “sole line of business is its operation of three ATS platforms.” But what is an ATS? If you have to know that for your work then this blog post is too limited for you and won’t be helpful. But you may not be in that group. A 2010 paper at the International Monetary Fund says, “ATS’s are computer-automated order-matching systems that offer exchange-like trading opportunities at lower costs but are often subject to lower disclosure requirements and different trading rules.” So an ATS is sort of like a national securities exchange with fewer regulatory requirements. Stocks and bonds are not listed there, but they can be traded there. High-frequency traders use them a lot to get microsecond-level speed advantages on their trades.
What is OTC Link?
OTC Link is registered as a broker-dealer and runs these three ATS’s: OTC Link ATS, OTC Link ECN, and OTC Link NQB. Many companies that used to be known as Pink Sheets companies and don’t meet the minimum listing requirements for trading on the NYSE or the Nasdaq will trade on these ATS’s. As the SEC says on its website, “Many of these companies do not file periodic reports or audited financial statements with the SEC, making it difficult for the public to find current, reliable information about those companies.” One can imagine shenanigans being conducted at those companies.
The Bank Secrecy Act says:
Meanwhile, and slightly oversimplified, the Bank Secrecy Act requires broker-dealers such as OTC Link to file suspicious activity reports (“SARs”) documenting patterns of transactions involving funds of at least $5,000 that the B-D has reason to suspect:
a. involves funds derived from illegal activities or was intended or conducted to disguise or hide funds or assets derived from illegal activities;
b.is designed to evade any requirement of the BSA;
c. has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage and the broker-dealer knows of no reasonable explanation for the transaction after examining the available facts; or
d. involves the use of the broker-dealer to facilitate criminal activity.
See 31 C.F.R. § 1023.320(a)(2) (the “SAR Rule”). Rule 17a-8, in turn, requires B-D’s to comply with the reporting requirements of the BSA.
What the SEC says happened . . .
Did OTC Link file the SARs it was supposed to file under these rules? The SEC says (Though it may not be true. Who knows?) it did not and instead between March 2020 and May 2023:
“Despite tens of thousands of higher risk microcap and penny stock securities transactions conducted daily through the OTC Link ATS Platforms, . . . OTC Link failed to establish a reasonably designed AML surveillance program for its transactions, which resulted in its failure to file SARs . . . in connection with numerous suspicious transactions.”
OTC Link’s AML department consisted of its Chief Compliance Officer, who doubled as the Anti-Money Laundering Compliance Officer, and a junior-level compliance associate. The AML officer was responsible for monitoring compliance with its AML obligations and for filing SARs, but between January 1, 2020 and June 30, 2021, allocated only about two hours per month to this task.
OTC Link’s AML policies claimed to focus “its oversight of red flags and suspicious activity efforts into the activity of the FINRA Member Broker Dealers arranging transactions through the Firm’s ATSs.” The policies noted some red flags associated with potential microcap fraud, but did not specifically mention trading patterns that are typical of the microcap space, including apparent wash or cross trades, or transactions involving subscribers who were publicly known to be the subject of criminal, civil, or regulatory actions. Maybe unsurprisingly, OTC Link didn’t do active surveillance for or do further investigation into these patterns that its AML policies did not mention. Otherwise, the policies threw up their metaphorical hands in saying “[s]ince the firm does not have customer information or insight into the client (or retail broker) entering orders the firm is somewhat limited in its ability to identify fraud.”
Though OTC Link used automated surveillance to identify other forms of potentially suspicious trading activity on its ATS platforms, “it did not allocate sufficient compliance and operations resources to review the vast majority of these alerts generated from its automated surveillance system.” None of the alerts resulted in further investigation.
If only “OTC Link had in place reasonably designed AML Policies to surveil transactions conducted through its OTC Link ATS Platforms for red flags regarding potential suspicious trading activity,” everything would have been okay! “It would have identified the above-referenced suspicious transactions concerning potentially unlawful and manipulative trading (including possible spoofing, layering, wash trading, pre-arranged trading, and sudden spikes in volume coupled with significant volatility) that would have required the filing of numerous SARs.”
Utimately, OTC Link’s lack of reasonably designed AML policies resulted in its failure to file a single SAR in connection with numerous transactions that it should have had reason to suspect involved possible fraudulent activity or had no business or apparent lawful purpose. Even after OTC Link told Enforcement staff that it had identified seven separate instances of suspicious activity, it didn’t actually file the corresponding SARs until Enforcement staff inquired about their whereabouts.
In October 2023, OTC Link added two staff members to its AML compliance team and retained a consultant to review its AML program and make recommendations to improve its AML policies. To settle this matter, it will continue retaining the consultant for a year in addition to the corresponding reports and agreeing to the reports’ findings after that. OTC Link is paying a civil money penalty of $1.19 million.
What was the right choice?
What should OTC Link have done? From our options at the top, it seems to have chosen (c), make a show, cross fingers, and hope for the best. Should it have chosen (b), do the good compliance program? That’s always the “best” answer. It’s certainly the answer everyone is supposed to say. It may have been the economically correct answer here, too.
Costs of Compliance
What would (b) have cost? Probably not $1.19 million. The order says OTC Link was devoting single-digit hours per month to its AML program. Reviewing and escalating the alerts generated from its automated surveillance system likely would have resulted in filed SARs and would not have been cost-prohibitive.
Also, it doesn’t seem like the risk of discovery was low. OTC Link was sitting on top of a good deal of risk. That is, the microcap space is historically problematic and harbors a lot of fraudulent activity. All of it is circulating through these ATS’s. There could be some off-market transactions, but I don’t know where else these companies would trade. At some point some of it is going to surface and become the subject of an offering fraud or something worse and people are going to wonder, “Hmmm, where were the SARs on this?” And OTC Link is running the ATS platforms where the transactions happen. Yes, other broker-dealers direct trades to these platforms, but OTC Link itself is also a broker-dealer subject to Rule 17a-8. It’s not just a business owner or coordinator that owns the market and can rely on others to do the due diligence on the trading activity underneath.
Costs of Getting Caught
What were the costs on the other side of the equation? The only one we know with certainty is the $1.19 million civil penalty. The staff time and outside counsel fees devoted to responding to the investigation would have been substantial. The costs of the third-party AML consultant – ostensibly voluntary at first but really mandatory and now prescribed by the order for at least another year – will certainly be high as well. The reputational harm here is not good, but maybe OTC Link is okay with this.
It does seem like OTC Link should have chosen (b) or some form of it to avoid this situation. It’s just math!
In re OTC Link LLC (SEC Administrative Order)
List of ATS’s as of July 31, 2024
Investor.gov description of over-the-counter securities
“Opaque Trades”, Finance & Development, March 2010, Volume 47, Number 1
[1] We’re really talking about regulatory violations, though. Do regulatory violations pay? That doesn’t have the same ring to it.