Rialto Markets LLC, a New York-based broker-dealer specializing in private placements, has been fined $50,000 by the Financial Industry Regulatory Authority (FINRA) for failing to implement adequate cybersecurity safeguards and supervisory systems.

The case stems from a data breach between November 2021 and February 2022, during which an unauthorized third party accessed a company email account, exposing sensitive customer data and facilitating a fraudulent transfer of over $1 million.

‍

What Happened

According to FINRA, Rialto Markets failed to establish and maintain a proper supervisory system, including written supervisory procedures (WSPs), to protect customer information.

Key failures included:

• No multi-factor authentication (MFA) for employee email accounts
  
  
• Lack of audit logs or alerts for suspicious activity
  
  
• No detection of email forwarding rules or unauthorized IP address access
  
  

As a result, an unauthorized user had unrestricted access to a firm employee’s email for over three months. The attacker gained access to the nonpublic personal information (NPI) of more than 4,400 clients, including Social Security numbers and addresses.

Worse still, the hacker used the email access to divert over $1 million from the firm’s escrow agent to a fraudulent bank account. Some funds were later recovered, and the escrow agent covered the remaining losses.

‍

What Went Wrong

Despite earlier recommendations from FINRA, Rialto Markets failed to:

• Implement key data loss prevention tools
  
  
• Update or enforce cybersecurity protocols
  
  
• Respond quickly to the breach - only discovering it after the funds were stolen
  
  

The firm’s failure to act resulted in violations of:

• FINRA Rules 3110 and 2010
  
  
• The Safeguards Rule, which governs the protection of customer data
  
  

Rialto Markets has since taken corrective measures, including enabling MFA and real-time email monitoring. The firm also offered free credit monitoring to affected clients and notified all relevant regulatory bodies.

‍

Lessons for Prop Firms

Though Rialto Markets does not operate as a prop firm, this case offers critical takeaways for the proprietary trading space:

• Operational security is non-negotiable, especially when handling client data or funds
  
  
• Even small lapses - like missing MFA or weak email monitoring - can lead to major regulatory penalties and reputational damage
  
  
• As many prop firms expand into capital raising, client acquisition, and third-party funding models, safeguarding sensitive data becomes a core compliance issue
  
  

Regulatory Takeaways

This action by FINRA is the latest in a growing trend of enforcement cases focused on cybersecurity failures, not just market conduct. It signals that even non-executional issues, like email hygiene and supervisory systems, are fair game for scrutiny.

Prop firms - especially those operating internationally or under a hybrid B2B/B2C model - would be wise to review their own data protection policies in light of these developments.

‍

Stay with PropInsider for real-world compliance updates and case studies that impact the trading space.

‍