FINRA's Ceros Financial Case: Personal Email and Data

Updated October 2026. First published July 2024.

In February 2024, FINRA censured Ceros Financial Services, Inc. and fined it $75,000 in a Letter of Acceptance, Waiver, and Consent (AWC No. 2021073201301). Ceros, a FINRA member since 1995 with 116 registered representatives in 18 branch offices, neither admitted nor denied the findings.

The case started with FINRA's 2021 exam of the firm and covers three failures. From January 2018 through June 2021, Ceros didn't reasonably supervise representatives' use of personal email for business and didn't keep those emails. Over the same period, it had no written policies to protect customer records and information, as Regulation S-P requires. And from January 2018 to the date of the AWC, it had no written identity theft prevention program under Regulation S-ID.

The fine is small. The facts are worth reading because Ceros had a control in place, and the AWC shows exactly where it fell short.

A Warning That Only Fired One Way

Ceros's written procedures prohibited representatives from emailing customers from personal addresses. By March 2018, FINRA had told the firm that at least one representative was regularly using personal email for business.

The firm's main response was a list of employees' personal email addresses. When an email from one of those addresses reached the firm's system, the system sent an automated warning. Four things limited that control:

By June 2021, the list had 16 personal addresses for the firm's 88 associated individuals.
No warning went out when someone sent email from the firm's system to a listed personal address.
No written procedure described the process.
Email between a representative's personal account and a customer never touched the firm's system, so the list couldn't see it.

Ceros sent at least 67 warnings, some to the same people more than once. It didn't review the flagged communications unless they happened to meet other review criteria, and it didn't treat them as a sign that other business email was escaping capture. Apart from the warnings and one letter, it took no other steps to stop the practice.

FINRA found that some business emails were never kept because they went directly between a representative's personal account and a customer. Ceros can't say how many. Because it never captured those emails, it never reviewed them, as Rule 3110(b)(4) requires for correspondence. The violations were Exchange Act Section 17(a), Rule 17a-4, and FINRA Rules 4511, 3110, and 2010.

A repeated warning to the same person is a red flag, and Rule 3110 requires a firm to reasonably investigate red flags and act on what it finds. An automated warning email can't do that for you. Ceros now keeps a firm-wide list of personal addresses and blocks all email to and from them.

Customer Data Went to Personal Inboxes

The same email traffic carried customer information out of the firm. More than 10,000 emails passed between known employee personal addresses and Ceros addresses during the period, and the firm had no procedure for reviewing them to protect customer information. The AWC gives three examples:

One employee sent information on at least 256 customers to a personal address: account numbers and names, addresses, margin call details, available balances, and account statements.
A supervisor sent trade blotters with 516 customers' account numbers, names, addresses, and trade information to a personal address.
Another employee sent about 500 account numbers, names, and average daily balances to a personal address.

Once the data left the firm's system, Ceros couldn't monitor or protect it. That was the Regulation S-P Rule 30(a) violation: no written policies and procedures reasonably designed to keep customer records and information secure. Ceros now encrypts emails that contain personally identifiable information, and its email reviews now search for it.

Regulation S-P has changed since. Under amendments the SEC adopted in May 2024, a firm's written policies must include an incident response program to detect, respond to, and recover from unauthorized access to or use of customer information. With limited exceptions, affected individuals must get notice as soon as practicable, and no later than 30 days after the firm learns their sensitive information was, or is reasonably likely to have been, accessed or used without authorization. FINRA's reminder gives the compliance dates: December 3, 2025 for larger entities and June 3, 2026 for smaller ones. Both have passed. If your firm can't see customer data leaving through personal email, it can't judge whether an incident has happened.

No Identity Theft Program at All

Regulation S-ID requires a firm to develop and carry out a written identity theft prevention program that identifies red flags, detects them, and responds to them. Ceros had to comply by November 2013. It had no program and relied on its privacy policy, which said nothing about those steps. As part of the settlement, a senior manager who is a registered principal had 60 days to certify in writing that the firm had fixed the Regulation S-ID problems and put a written program in place.

What to Check

Test your personal-email controls in both directions: mail from a personal address into the firm, and mail from the firm out to a personal address.
Compare the number of people on any personal-address list with your headcount, and decide how the list gets built and kept current.
Route repeat warnings to a supervisor who has to close them out in writing.
Count emails between firm addresses and known personal addresses. Ceros's count passed 10,000, and the customer data in this case left in emails from the firm's system to personal addresses.
Confirm you have a written Regulation S-ID program that is more than a privacy policy, and that your Regulation S-P incident response program covers data sent outside the firm by employees.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.