Interesting fine. A simple data-feed snafu between a research department and a clearing firm led to a host of customer-related mistakes and ultimately a regulatory action that has cost Citigroup Inc. at least $11.5 million in penalties, and highlighted the risk involved in managing data. Firms commonly rely on third parties and software or technology solutions to provide such essential services as custodial and clearing services. Often the task of the connecting of software and data feeds between external vendors and firms or even departments within a firm can be challenging. Failing to get all of the data captured or transferred completely and accurately can be disastrous as it can have a ripple-effect into other areas. Compliance departments must be certain such relationships and technological solutions are seamless and 100 percent reliable. Therefore, robust compliance and information technology (IT) testing of such systems is critical. On December 28, 2017 the Financial Industry Regulatory Authority (FINRA) announced a Letter of Acceptance Waver and Consent (AWC) where Citigroup Global Markets Inc. agreed to settle charges it displayed the incorrect research ratings on hundreds of stocks for nearly five years. The incorrect ratings caused other missteps resulting in harm to retail investors. This review examines what went wrong, with an emphasis on how an IT problem turned into a regulatory issue and how it might have been prevented, or at the very least caught earlier. What went wrong FINRA said Citigroup would sometimes display to customers, brokers and supervisors incorrect ratings, such as "buy" instead of "sell," while in other cases it would display ratings for companies it did not cover, or no ratings at all. As a result, brokers solicited thousands of transactions and negligently made inaccurate statements premised on incorrect ratings, and many customers ended up owning stocks with "sell" ratings despite a prohibition on such ownership, FINRA said. The inaccuracies occurred on 1,800 stocks, or 38 percent of the equities covered by the firm from 2011 to 2015 according to FINRA. The incorrect ratings appeared in an internal online platform used by brokers to make recommendations to customers as well as in client account statements and email alerts. Because brokers relied on the research ratings and designated the ratings as a principal source of recommendations for the clients, the inaccurate ratings had a significant impact on clients. Furthermore, the firm's written supervisory procedures (WSPs) instructed brokers to document and justify suitability rationale if they solicited securities transactions contrary to the research ratings. Also, in some managed accounts customers paid an asset-based fee and gave discretion to brokers to invest their portfolios consistent with the ratings. Those guidelines prohibited portfolios from holding sell-rated securities. To monitor compliance with the ratings exception reports were generated to alert supervisors of solicited transactions inconsistent with the ratings. Despite notifications from firm personnel and brokers of the conflicting recommendations as early as 2011 and 2012, the firm failed to discover the entire scope of the issues until December 2015, when a broker once again reported the ratings differences. After recognizing the broader ratings-display issue, the firm fixed the problem and self-reported it to FINRA. FINRA said the errors stemmed from problems with an electronic data feed, and Citigroup failed to fix on a timely basis the wrongly displayed ratings, despite "numerous" red flags. The bank's actual research reports and ratings were not affected. "The display and use of incomplete and inaccurate research ratings can have widespread, adverse consequences to customers," FINRA Enforcement Chief Susan Schroeder said in a statement. "Firms should react quickly to address those errors." The settlement According to the consent document, Citigroup did not admit or deny wrongdoing, but the sanctions reflected its cooperation, including its decisions to report the rating issues and compensate customers, FINRA said. Citigroup spokeswoman Danielle Romero-Apsilos said the bank was pleased to resolve the matter. In assessing its $5.5 million fine, FINRA said it credited the bank unit with self-reporting the issue and with providing "substantial" assistance to the self-regulatory organization’s investigators. FINRA also ordered Citigroup to reimburse "at least" $6 million to affected customers who had received inaccurate research ratings. FINRA also charged Citi with supervisory violations, noting that it failed to "timely or adequately" address ratings accuracy issues that were reported to it by brokers and other employees. Takeaways and suggestions In the four-year period where the inaccurate ratings occurred in emails and in account platforms, the actual research reports displayed the correct ratings. Brokers and supervisors, and likely some customers made inquiries as to which rating was correct. However, these "red flags" as FINRA cited were not addressed in a timely manner. The settlement stated that Citigroup "failed to timely correct the inaccurately displayed ratings, despite numerous red flags alerting various individuals across the firm to ratings inaccuracies for several securities. The firm also failed to conduct testing reasonably designed to verify the accuracy of research ratings data that it used and distributed." This should serve as a reminder to compliance departments and IT departments that such internal notifications of discrepancies can reflect a larger systemic problem and must be diligently and thoroughly resolved. The magnitude of the aggregate $11.5 million fine is eye-catching, particularly considering the lack of intent and that the cause of the problem was a technology snafu. However, the $6 million reimbursement component of the penalty could possibly grow as customers and brokers conduct a closer review of purchases and sales that may have been linked to the error. It is certainly possible that a broker sold a stock as a result of an incorrect rating, thus missing out on significant gains in the recent bull market. Calculating the actual damages or the opportunity losses of stocks that may not have been purchased may be an inexact science and could leave the firm and its brokers at risk of potential arbitration claims. As in an earlier case involving Calvert Mutual Funds where the firm attempted to "do the right thing" by reimbursing affected clients where a fund's net asset value was miscalculated, the calculation methodology and process for reimbursement must be ironclad and thoroughly reviewed and executed. The same must be done in this instance with Citigroup. Despite Citigroup's self-reporting and cooperation, the $5.5 million penalty for a technology failure is significant. Other settled cases where technology failures resulted in violations, where there was no damage or harm to customers have been significantly less. Clearly FINRA is sending a message that when clients are affected the penalty will be greater. The consent document mentions a prior settled action that occurred in April 2012. FINRA fined Citigroup $725,000 for failing to comply with the "2003 Global Research Analyst Settlement" which led to the SEC adopting Regulation Analyst Certification (Reg AC) and to (FINRA's predecessor), NASD adopting Rule 2711. FINRA says Rule 2711 fosters objective research by insulating analysts from pressure to tailor their reports to the interests of current or prospective investment banking clients. Most of the errors cited by FINRA in the 2012 fine occurred between 2007 and early 2010 and were also caused by "programming and technical errors," the regulator said. Perhaps this second offense in the area of technology failures related to research contributed to the larger fine. The Citigroup case serves as a reminder of how a simple software or data-feed error with no intent to harm clients can result in a series of regulatory missteps and ultimately harm clients. The nearly five-year time lapse and missed "red flags" were also prominently mentioned by FINRA. Routine testing and earlier notifications may have helped resolve the technology problem much sooner. (Todd Ehret is a Senior Regulatory Intelligence Expert for Thomson Reuters Regulatory Intelligence based in New York.)