Enforcement Actions
Financial Industry Regulatory Authority (FINRA)
CASES OF NOTE
2011
NOTE: Stipulations of Fact and Consent to Penalty (SFC); Offers of Settlement (OS); and Letters of Acceptance Waiver, and Consent (AWC) are entered into by Respondents without admitting or denying the allegations, but consent is given to the described sanctions & to the entry of findings. Additionally, for AWCs, if FINRA has reason to believe a violation has occurred and the member or associated person does not dispute the violation, FINRA may prepare and request that the member or associated person execute a letter accepting a finding of violation, consenting to the imposition of sanctions, and agreeing to waive such member's or associated person's right to a hearing before a hearing panel, and any right of appeal to the National Adjudicatory Council, the SEC, and the courts, or to otherwise challenge the validity of the letter, if the letter is accepted. The letter shall describe the act or practice engaged in or omitted, the rule, regulation, or statutory provision violated, and the sanction or sanctions to be imposed.
Morgan Stanley & Co. Incorporated
AWC/2009017072302

A former associated person and employee of Morgan Stanley in its New York Position Services Group (NYPS) misappropriated approximately $2.5 million from the firm, institutional firm customers and a firm counterparty by entering, or causing to be entered, numerous false journal entries into the firm’s electronic system to transfer and credit money associated with corporate actions.

The former employee entered, or caused to be entered, into the firm’s electronic system requests for checks to be issued to his shell corporation against the suspense and/or fee accounts that he was using to misappropriate funds. The former employee entered some check requests himself, which NYPS employees that reported to him later approved. The former employee caused employees who reported to him to enter check requests, and he used the identification number and password of another NYPS employee who reported to him to enter the remaining check requests; he later approved all of the check requests.

Failed Oversight/Review

Morgan Stanley failed to establish and implement an adequate system of follow-up and review of journal entries and adequate procedures for reviewing and approving check requests related to corporate actions.

No review procedures

The firm did not have any procedure to review the former associated person’s check requests and journal entries.

In addition, the firm failed to properly supervise the former associated person and failed to detect that he entered, or caused to be entered, false check requests and false journal entries related to corporate actions, which allowed him to misappropriate approximately $2.5 million from the firm, its institutional customers and a firm counterparty.

SOMJ

The firm introduced a new system, the Summary of Manual Journals (SOMJ), to replace the review of all journal entries and require the review and approval of journal entries that the firm determined to be high priority. Furthermore, these journal entries remained on the SOMJs until a supervisor reviewed and approved them, and the former associated person was assigned to review and approve all high-priority journal entries flagged on the SOMJs, including his own.

Security Flaw

The firm assigned some NYPS supervisors, all of whom reported directly to the former associated person, to review and approve journal entries flagged on SOMJs, but nobody was assigned to review high-priority journal entries entered by anyone not on one of those teams, including the former associated person. The firm failed to have a system to inform NYPS management if journal entries flagged on the SOMJs were not approved. The former associated person made numerous journal entries, some of which were flagged as high-priority; he approved several of them; many were not reviewed and were listed on the SOMJs pending approval at the time of his termination.

Check Requests

Check requests NYPS personnel entered were required to be approved by another NYPS employee, but the firm did not require the person approving the check to be a supervisor or have supervisory responsibility; as a result, NYPS associates approved check requests an NYPS supervisor entered, and entered check requests on a supervisor’s behalf, which the supervisor subsequently approved. In addition, FINRA determined that the firm did not require any review to determine if the check request was associated with a corporate action and the approver simply ensured that all the required information was included in the check request.

Morgan Stanley & Co. Incorporated : Censured; Fined $375,000
Tags: Checks  Supervision  
Bill Singer's Comment
That's quite a hole in Morgan Stanley's security protocol -- and lucky for them, they only got dinged for $2.5 million.  These "nested loop' types of failures are not uncommon and typically you have policies/procedures that have been amended and revised over time that inadvertently result in a given supervisor reviewing his/her own transactions without any secondary oversight.  At some point, Compliance Departments should consider bringing in a third-party to go through their written policies and procedures to see if a fresh set of eyes uncovers any supervisory dead-ends or conflicts.
Enforcement Actions
Search in Cases of Note : FINRA
Months
 
Cases of Note : FINRA Archive
Tags