By Katanga Johnson and Kanishka Singh
WASHINGTON (Reuters) -The U.S. Securities and Exchange Commission (SEC) on Wednesday charged lenders JPMorgan (NYSE:JPM) and UBS as well as online broker TradeStation for deficiencies relating to the prevention of customer identity theft, the agency said.
Without admitting or denying the SEC's findings, each firm agreed to pay the following penalties: JPMorgan $1.2 million, UBS $925,000, and TradeStation $425,000, the SEC said in a statement.
Between at least January 2017 to October 2019, the firms’ identity theft prevention programs did not include reasonable policies and procedures to surface red flags in connection with customer accounts, the SEC said in its order.
The firms also lacked reasonable policies and procedures to respond appropriately to detected identity theft red flags, or to ensure that the programs were updated periodically to reflect changes in identity theft risks to customers.
"Today's actions are reminders that broker-dealers and investment advisers must design and operate identity theft prevention programs that are appropriately tailored to their businesses and update them in response to the increased threat and changing nature of identity theft," said Carolyn Welshhans, of the SEC Enforcement Division's Crypto Assets and Cyber Unit.