Merrill Lynch to pay $300K for failing to ‘promptly’ produce audit trail data

According to the CFTC’s order, issued Tuesday, Merrill Lynch for nearly three years failed to produce reliable audit trail data requested by the Division of Enforcement. The data produced in response to these requests were “both significantly delayed and flawed,” the CFTC’s order states. Namely, even after the Division agreed to limit the scope of the requests, Merrill Lynch did not produce any audit trail data until January 2017—more than 18 months after the initial requests, the CFTC said.

“Moreover, this production was incomplete and required a supplemental production in February 2017,” the order states. “Thereafter, the Division identified numerous issues with the audit trail data produced, which included unpopulated fields. After numerous discussions and reproduction of data to correct the issues, the Division was led to believe that the production of audit trail data was complete.”

In December 2017—more than two years after the initial document requests were made— Merrill Lynch “identified a significant gap in the audit trail data that had been produced,” the CFTC said. It ultimately located and produced the missing audit trail data in January 2018.

Among its compliance failures—and a lesson for compliance officers—is that Merrill Lynch “did not have a process in place to locate account numbers or order entry operator identification numbers,” the CFTC said. “Instead, operations personnel simply worked from memory when searching for the data.”

“As this case shows, the CFTC will hold registrants accountable for their regulatory obligations,” said James McDonald, director of the CFTC’s Division of Enforcement. “Record-keeping requirements are important for regulatory and enforcement purposes, and the failure to produce reliable audit trail data here impeded a CFTC investigation.”

In addition to imposing the monetary penalty, the order notes Merrill Lynch has already taken steps to revise its internal process for responding to regulatory data requests, including, but not limited to, designating personnel to interpret regulatory data requests, the source of the information, and the timing for the response; locate and provide the data; and independently assess the data extraction process and results.