LavaFlow, a unit of Citigroup that operates an alternative stock trading venue, agreed to pay $5 million to settle charges that it failed to protect the confidential trading data of its customers, the Securities and Exchange Commission said on Friday. The payment includes a $2.85 million penalty that the S.E.C. said was the largest it had levied against an alternative trading system.
The action comes during a period of increased scrutiny on different aspects of the stock market, including high-frequency traders and private trading venues known as dark pools. In early June, the S.E.C. announced that Liquidnet Holdings, a firm that operates a dark pool, agreed to pay $2 million over charges that it improperly used customer data in marketing.
Later that month, the New York State attorney general accused Barclays of lying to customers of its dark pool about the activities of high-frequency traders there. (Barclays asked a court to dismiss the lawsuit on Thursday.)
LavaFlow neither admitted nor denied the S.E.C.’s accusations on Friday. A spokesman for Citigroup, Scott Helfman, said in an email: “We are pleased to put this matter behind us.”
The trading system that LavaFlow runs is known as an electronic communications network. Unlike a dark pool, where buy and sell orders are concealed, the LavaFlow market displayed a bit more information about pending orders. At the same time, however, it promised its customers not to share their trading data with third parties.
But from 2008 to 2011, the S.E.C. said, this confidential trading data was accessed by a different Citigroup subsidiary called Lava Trading. Among various functions, Lava Trading ran a “smart” order routing service that customers used to get a favorable execution for their trades. It also was a channel by which these customers — largely brokerage firms — connected to the LavaFlow market.
The S.E.C. asserted that LavaFlow improperly allowed Lava Trading to use data about the customers’ orders, helping the Lava Trading software make decisions about order routing. The agency said the order router executed trades of more than 400 million shares during this period.
The LavaFlow customers whose data was being used were also customers of Lava Trading, the S.E.C. said. But importantly, they thought their data would remain within the LavaFlow market, and they were “entitled to expect no unauthorized disclosure of their confidential trading information to any entity outside” the market, the agency said in its order.
In addition, the S.E.C. asserted LavaFlow allowed Lava Trading to act as a broker-dealer during a period when it was not registered as such. LavaFlow agreed to give up $1.8 million in payments earned by Lava Trading during that period.
“Operators of alternative trading systems must protect confidential subscriber data and take steps to ensure that affiliates do not improperly use order information,” Andrew J. Ceresney, the director of the S.E.C.’s enforcement division, said in a statement. “We will continue to hold accountable firms that fail to follow the rules applicable to off-exchange venues.”