FINRA Settles With Merrill Lynch Rep Who Tried To Sell Customer Information

April 11, 2017

By way of spoiler alert, today's Blog features the FINRA regulatory settlement of a former Merrill Lynch rep who allegedly took home confidential customer information involving 100 accounts, and, after leaving the firm and the industry, tried to sell the info for $10,000. Not a lot in that fact pattern to engender much sympathy for the guy. In fact, Bill Singer is wondering why FINRA seems to have pulled its punch when sanctioning this respondent.

Case In Point

For the purpose of proposing a settlement of rule violations alleged by the Financial Industry Regulatory Authority ("FINRA"), without admitting or denying the findings, prior to a regulatory hearing, and without an adjudication of any issue, Ryan Wallace submitted a Letter of Acceptance, Waiver and Consent ("AWC"), which FINRA accepted. In the Matter of Ryan Wallace, Respondent (AWC 2015047832501, April 7, 2017).

The AWC asserts that Wallace was first registered in 2010; and by 2013, he was registered with FINRA member firm Merrill Lynch, Pierce, Fenner & Smith, Incorporated. The AWC asserts that Wallace did not have any prior disciplinary history with FINRA, any state securities agency, the Securities and Exchange Commission, or any other self-regulatory organization.

Home Work

The AWC alleges that while registered with Merrill Lynch during May 2015, Wallace took home documents that contained "non-public" customer personal information, among which was

a list of the approximately 100 customers in his book of business, and detailed their names, addresses, phone numbers, social security numbers and the amount of money invested in each customer account. . .

SIDE BAR: Regulation S-P prohibits firms from disclosing "nonpublic personal information" about a customer unless the customer receives proper notice and an opportunity to opt out. Non-public personal information generally means any information provided by customers to a broker-dealer to obtain any product or service. It includes, but is not limited to, account numbers, social security numbers, birth dates, and account balances. READ the FULL-TEXT of Regulation S-P

FINRA deemed that Wallace's conduct caused Merrill Lynch to violate Regulation S-P and constituted a violation of FINRA Rule 2010.

A Matter of Aggravation

The AWC asserts that Wallace left the employ of Merrill Lynch on May 15, 2015, and presently remains unassociated with any FINRA member firm. In order to ensure that I properly convey the next regulatory violation, I offer you this verbatim extract from the AWC:

Wallace aggravated his misconduct after he left the Firm. On or about September 15, 2015, when Wallace no longer was employed in the securities industry, Wallace offered to sell to an RR at another FINRA registered broker-dealer, for $10,000, the Firm documents and list of non-public personal information he had taken from Merrill Lynch regarding his customers. To entice the RR to make the purchase, Wallace emailed to the RR a one-page Firm document containing nonpublic personal information of 42 of his former Merrill Lynch customer accounts.

FINRA deemed that Wallace's conduct violated FINRA Rule 2010.


By way of recap, I read the AWC as highlighting three distinct issues:

  1. While employed at Merrill Lynch, Wallace removed non-public customer personal information ("his book of business" of 100 firm accounts) from the firm's control and took the data home.
  2. About four months after removing the customer information at a time when he was no longer in the industry, Wallace offered to sell the data for $10,000 to a registered representative associated with another FINRA member firm.
  3. In furtherance of his effort to sell the confidential information, Wallace emailed to the other rep non-public confidential information about 42 of his 100 former Merrill Lynch customers.

In accordance with the terms of the AWC, FINRA imposed upon Wallace a $10,000 fine and a five-month-suspension from association with any FINRA regulated firm in all capacities.

Bill Singer's Comment

The AWC alleges that Wallace "offered to sell" the customer data for $10,000. I think that such an assertion imposes a disclosure obligation upon FINRA, which unfortunately, the self-regulatory organization did not accept. Pointedly, the AWC should have answered these questions:

  1. How did FINRA and/or Merrill Lynch learn about the removal of customer information?
  2. How did FINRA and/or Merrill Lynch learn about the proposed solicitation by Wallace?
  3. Did any money exchange hands between the other rep and Wallace? (If "yes," then indicate the amount; if "no," then indicate that fact.)
  4. Did the sale get consummated and was discovered after that fact?
  5. Did the other rep disclose the proposed solicitation to his employer firm or any regulator, or, in the alternative, is that rep also being charged with the improper attempt to purchase (or with the actual purchase of) the cited information?
Finally, as to the imposed sanctions, I sincerely do not understand how FINRA justified the five-month-suspension. Although many of these Reg SP cases are settled for a fine and suspensions of three months and less, I was expecting that Wallace would be hit with a Bar. The AWC injected the term "aggravated" into the case when it characterized Wallace's post-industry-employment efforts to sell confidential customer information. I concur with FINRA as to the exacerbating nature of Wallace's conduct.

Accepting the allegations in the AWC without question, we have what looks like the conversion of Merrill Lynch's property, the misuse of confidential customer information, and the intention to profit from the wrongful removal and sale of said information. What aspect of that should re-open the door to a registered or associated capacity for Wallace? Frankly, I was expecting either a Bar or at least an 18-month suspension with an obligation to requalify by way of examination. Not saying that there may not be mitigating factors that prompted FINRA to pull its punch; but if they exist, they should have been spelled out.

Also READ:

SEC Cites Stockbroker Over Confidentiality of Inherited Accounts
Lost Lavatory Laptop Lands Sterne Agee In Crapper
Anticipating Stockbroker Fined For Taking Client Files Home
Taking Customer Data Spreadsheet Doesn't Compute For Stockbroker
Broker Sends Email With Attached Excel Customer File