SEC Brings First Identity Theft Enforcement Actions Since 2018

On July 27, 2022, the SEC charged three broker dealers for violations of the Identity Theft Red Flags Rule (also known as “Regulation S-ID”), with penalties ranging from $425,000 to $1,200,000.¹  The regulation requires that certain financial institutions, including broker-dealers, investment advisers, and investment companies, implement and administer a written Identity Theft Prevention Program (“ITPP” or “Program”) that is “designed to detect, prevent and mitigate identity theft” in connection with the opening of a “covered account” or any existing “covered account.”²  None of the orders stemmed from actual identity theft incidents or stated customer harm, but were instead based on alleged program deficiencies. The settlements' release in one day parallels last year's SEC multi-matter settlement concerning Regulation S-P and may signify a trend of increased scrutiny.