“From December 2012 to October 2020, the firm’s supervisory system, including its written supervisory procedures, was not reasonably designed to supervise associated persons’ access to SPS account data or the transmittal of funds from international SPS accounts.”

💡 FINRA found Fidelity’s oversight inadequate for the entire duration of the fraud, not just isolated moments.

“The firm used a workflow management tool to log, track, and oversee these changes, but it did not monitor for or prevent associated persons from accessing or changing data without tracking it through the workflow management tool.”

💡 Fidelity had the tool but chose not to enforce its use, letting employees evade all oversight.

“When the associated person changed the international SPS account data and linked those accounts to the domestic SPS account, the plan participant listed as the owner appeared to be employed by multiple companies in various industries. The firm did not identify or investigate why the owner of the domestic SPS account appeared to be associated with multiple plan sponsors.”

💡 A basic anomaly check would have caught the fraud, but Fidelity performed no such review.

“During the relevant period, however, outgoing money movements from international SPS accounts were not included in that system or in any other firm surveillance program. Thus, the unauthorized checks and wire transfers described above were not subject to review or monitoring by the firm.”

💡 Fidelity had surveillance technology but deliberately excluded international accounts, a cost-cutting decision that enabled theft.

“The firm discovered the associated person’s conversion after an international SPS plan participant contacted the firm with questions regarding transfers out of his account.”

💡 After eight years and 266 transactions, Fidelity caught the fraud only because a victim noticed and complained.

“In December 2015, Fidelity entered into an AWC with FINRA (No. 2014041374401), through which it consented to findings that the firm violated NASD Rules 3010 and 3012(a)(2)(B)(i) and FINRA Rule 2010 by failing to prevent or detect the conversion of funds from nine of its customers.”

💡 This was not Fidelity’s first fund conversion failure; the firm had been sanctioned for nearly identical supervisory lapses five years earlier.

“Beginning in December 2020, the firm enhanced its supervision of associated persons’ access to SPS account data by further restricting associated persons’ ability to make changes and updates to the data, implementing a technology protocol that requires changes to plan participant data to be logged in the workflow management tool, and implementing additional quality control oversight for SPS account data.”

💡 Fidelity implemented adequate controls only after discovery, proving these safeguards were always feasible but not prioritized.

“In Regulatory Notice 09-64 (November 2009), FINRA reminded member firms that ‘[a]s part of their duty to safeguard customer assets and to meet their supervisory obligations, FINRA firms must have and enforce policies and procedures governing the withdrawal or transmittal of funds or other assets from customer accounts.'”

💡 Fidelity had clear regulatory guidance for over a decade but chose not to apply it to international accounts.

“In 37 international SPS accounts, the associated person was able to use his data access to change the plan participant’s name to his own name or the name of a domestic SPS account he created and controlled and then link the international SPS account to (1) banking instructions for checks in his own name sent to a P.O. Box address located in his home state that he controlled or (2) wire instructions for the domestic SPS account he created and controlled.”

💡 The mechanics of the fraud were simple name and address changes, which basic validation controls would have prevented.

“After changing international SPS account data, as described above, the associated person impersonated the plan participants through Fidelity’s online SPS plan participant portal using the data he improperly accessed to liquidate some or all of their holdings.”

💡 The thief used Fidelity’s own customer portal to execute unauthorized sales, a process the firm never flagged or reviewed.

“The firm subsequently implemented a process to surveil all outgoing money movements from international SPS accounts.”

💡 By implementing surveillance after the fraud, Fidelity admitted such monitoring was always possible but not done.

“The firm terminated the associated person, voluntarily notified FINRA of the misconduct prior to filing a Form U5 for the individual, initiated an internal investigation, and shortly thereafter made full restitution to the affected plan participants.”

💡 Fidelity’s quick restitution and cooperation were credited in the settlement, effectively reducing consequences for years of negligence.

“Specifically, the associated person caused 83 unauthorized checks to be issued from international SPS accounts totaling approximately $380,000 and made 183 unauthorized wire transfers from international SPS accounts to the domestic SPS account totaling approximately $378,000.”

💡 The sheer volume of transactions over eight years shows the fraud was not a brief lapse but a sustained failure of supervision.

“From December 2012 to October 2020, by failing to have a reasonably designed system, including WSPs, to supervise its associated persons’ access to SPS account data, Fidelity violated FINRA Rule 3110, NASD Rules 3010 and 3012, and FINRA Rule 2010.”

💡 FINRA’s finding covers the entire fraud period, establishing that Fidelity’s system was deficient from day one.

“Because Fidelity did not monitor or prevent changes to SPS account data that were not logged in its workflow management tool, its system, including WSPs, was not reasonably designed to prevent unauthorized access and changes to SPS account data, including changes to plan participants’ addresses.”

💡 NASD Rule 3012 required validation of address changes; Fidelity’s system failed to meet this basic safeguard.