Supreme Alliance Llc

Allegations: WITHOUT ADMITTING OR DENYING THE FINDINGS, THE FIRM CONSENTED TO THE SANCTIONS AND TO THE ENTRY OF FINDINGS THAT IT FAILED TO DEVELOP AND IMPLEMENT A WRITTEN IDENTITY THEFT PREVENTION PROGRAM (PROGRAM) REASONABLY DESIGNED TO DETECT, PREVENT, AND MITIGATE IDENTITY THEFT IN CONNECTION WITH OPENING OR MAINTAINING CUSTOMER ACCOUNTS. THE FINDINGS STATED THAT THE FIRM'S PROGRAM FAILED TO INCLUDE REASONABLE POLICIES AND PROCEDURES TO IDENTIFY OR DETECT RED FLAGS OF IDENTITY THEFT, AND ITS PROCEDURES FOR RESPONDING TO SUSPECTED IDENTITY THEFT WERE NOT TAILORED TO ITS BUSINESS. ALTHOUGH NOTFORMALLY TITLED IDENTITY THEFT PREVENTION PROGRAM, THE FIRM HAD WRITTEN PROCEDURES IN PLACE TO RESPOND TO RED FLAGS OF IDENTITY THEFT. THE PROGRAM FAILED TO PROVIDE ASSOCIATED PERSONS ANY GUIDANCE REGARDING STEPS TO TAKE IN THE EVENT HEOR SHE SUSPECTED THAT AN INCIDENT OF IDENTITY THEFT HAD OCCURRED. MOREOVER, THE FIRM'S PROGRAM CONSISTED OF GENERIC POLICIES AND PROCEDURES AND WAS NOT TAILED TO THE FIRM'S ACTUAL BUSINESS MODEL. THE FINDINGS ALSO STATED THAT UPON LEARNING OF AN EMAIL SECURITY BREACH INVOLVING THE FIRM EMAIL ACCOUNT OF THE FIRM'S CEO AND CCO, THE FIRM FAILED TO IMPLEMENT THE PROCEDURES SET FORTH IN ITS PROGRAM TO MITIGATE THE RISK OF IDENTITY THEFT DUE TO THE EXPOSURE OF ITS CUSTOMERS' IDENTIFYING INFORMATION TO AN UNAUTHORIZED THIRD PARTY. THE FIRM'S CEO AND CCO BEGAN TO RECEIVE HUNDREDS OF NOTIFICATIONS IN HIS FIRM EMAIL ACCOUNT MAILBOX STATING THAT EMAIL MESSAGES SENT FROM HIS FIRM ACCOUNT COULD NOT BE DELIVERED TO A CERTAIN EXTERNAL EMAIL ADDRESS. ALTHOUGH THE FIRM'S CEO AND CCO DIDNOT RECOGNIZE THE EXTERNAL EMAIL ADDRESS, HE IGNORED THEUNDELIVERABLE NOTIFICATIONS. HE FORWARDED ONE OF THEUNDELIVERABLE MESSAGES TO THE FIRM'S OUTSIDE EMAIL VENDOR, INFORMING THE VENDOR THAT HE HAD RECEIVED MORE THAN 100 SUCH MESSAGES. THE VENDOR INFORMED HIM THERE WAS AN AUTOMATED RULE SET UP ON HIS FIRM EMAIL ACCOUNT THAT BLIND-COPIED ALL EMAILS HE RECEIVED TO THE EXTERNAL EMAIL ADDRESS. THE VENDOR FURTHER INFORMED HIM THAT HIS FIRM EMAIL ACCOUNT HAD LIKELY BEEN COMPROMISED. THE FIRM FAILED TO TAKE STEPS TO MITIGATE THE RISK OF IDENTITY THEFT RESULTING FROM THE INCIDENT. FOR EXAMPLE, AT THE TIME IT DISCOVERED THE BREACH, THE FIRM MADE NO EFFORT TO DETERMINE HOW MANY EMAILS HAD BEEN BLIND COPIED TO THE UNAUTHORIZED ACCOUNT, OR WHETHER CUSTOMERS' IDENTIFYING INFORMATION HAD BEEN EXPOSED. IT WAS NOT UNTIL FINRA STAFF INQUIRED ABOUT EMAIL COMMUNICATIONS WITH THIS EXTERNAL EMAIL ADDRESS DURING THE FIRM'S CYCLE EXAM, THAT THE FIRM ATTEMPTEDTO DETERMINE THE SCOPE OF THE BREACH. TO DATE, THE FIRM HAS NOT NOTIFIED ANY CUSTOMERS WHOSE IDENTIFYING INFORMATION WAS EXPOSED BECAUSE OF THE INCIDENT. APPROXIMATELY 17,000 EMAILS WERE BLIND COPIED FROM THE FIRM'S CEO AND CCO'S FIRM EMAIL ACCOUNT TO THE UNAUTHORIZED EXTERNAL EMAIL ADDRESS. AT LEAST200 OF THE BLIND-COPIED EMAILS CONTAINED IDENTIFYING INFORMATION RELATING TO THE FIRM'S CUSTOMERS, INCLUDING CUSTOMERS' SOCIAL SECURITY, ACCOUNT NUMBERS, DRIVER'S LICENSE NUMBERS, AND DATES OF BIRTH. TWENTY-ONE OF THE EMAILS CONTAINING CUSTOMER IDENTIFYING INFORMATION WERE BLIND COPIED PRIOR TO THE DATE THE FIRM'S CEO AND CCO BEGAN TO RECEIVE MESSAGES THAT THE EMAILS TO THE EXTERNAL ADDRESSES COULD NOT BE DELIVERED. Status: Final Sanction Detail: FINE OF $65,000 ASSESSED AGAINST THE APPLICANT, TO BE PAID THROUGH FINRA'S INSTALLMENT PAYMENT PLAN. Summary: THE FIRM SETTLED THIS MATTER WITHOUT ADMITTING OR DENYING THE ALLEGATIONS TO AVOID THE UNCERTAINTIES OF LITIGATION.

Allegations: WITHOUT ADMITTING OR DENYING THE FINDINGS, THE FIRM CONSENTED TO THE SANCTIONS AND TO THE ENTRY OF FINDINGS THAT IT FAILED TO DEVELOP AND IMPLEMENT A WRITTEN IDENTITY THEFT PREVENTION PROGRAM (PROGRAM) REASONABLY DESIGNED TO DETECT, PREVENT, AND MITIGATE IDENTITY THEFT IN CONNECTION WITH OPENING OR MAINTAINING CUSTOMER ACCOUNTS. THE FINDINGS STATED THAT THE FIRM'S PROGRAM FAILED TO INCLUDE REASONABLE POLICIES AND PROCEDURES TO IDENTIFY OR DETECT RED FLAGS OF IDENTITY THEFT, AND ITS PROCEDURES FOR RESPONDING TO SUSPECTED IDENTITY THEFT WERE NOT TAILORED TO ITS BUSINESS. ALTHOUGH NOT FORMALLY TITLED IDENTITY THEFT PREVENTION PROGRAM, THE FIRM HAD WRITTEN PROCEDURES IN PLACE TO RESPOND TO RED FLAGS OF IDENTITY THEFT. THE PROGRAM FAILED TO PROVIDE ASSOCIATED PERSONS ANY GUIDANCE REGARDING STEPS TO TAKE IN THE EVENT HE OR SHE SUSPECTED THAT AN INCIDENT OF IDENTITY THEFT HAD OCCURRED. MOREOVER, THE FIRM'S PROGRAM CONSISTED OF GENERIC POLICIES AND PROCEDURES AND WAS NOT TAILED TO THE FIRM'S ACTUAL BUSINESS MODEL. THE FINDINGS ALSO STATED THAT UPON LEARNING OF AN EMAIL SECURITY BREACH INVOLVING THE FIRM EMAIL ACCOUNT OF THE FIRM'S CEO AND CCO, THE FIRM FAILED TO IMPLEMENT THE PROCEDURES SET FORTH IN ITS PROGRAM TO MITIGATE THE RISK OF IDENTITY THEFT DUE TO THE EXPOSURE OF ITS CUSTOMERS' IDENTIFYING INFORMATION TO AN UNAUTHORIZED THIRD PARTY. THE FIRM'S CEO AND CCO BEGAN TO RECEIVE HUNDREDS OF NOTIFICATIONS IN HIS FIRM EMAIL ACCOUNT MAILBOX STATING THAT EMAIL MESSAGES SENT FROM HIS FIRM ACCOUNT COULD NOT BE DELIVERED TO A CERTAIN EXTERNAL EMAIL ADDRESS. ALTHOUGH THE FIRM'S CEO AND CCO DID NOT RECOGNIZE THE EXTERNAL EMAIL ADDRESS, HE IGNORED THE UNDELIVERABLE NOTIFICATIONS. HE FORWARDED ONE OF THE UNDELIVERABLE MESSAGES TO THE FIRM'S OUTSIDE EMAIL VENDOR, INFORMING THE VENDOR THAT HE HAD RECEIVED MORE THAN 100 SUCH MESSAGES. THE VENDOR INFORMED HIM THERE WAS AN AUTOMATED RULE SET UP ON HIS FIRM EMAIL ACCOUNT THAT BLIND-COPIED ALL EMAILS HE RECEIVED TO THE EXTERNAL EMAIL ADDRESS. THE VENDOR FURTHER INFORMED HIM THAT HIS FIRM EMAIL ACCOUNT HAD LIKELY BEEN COMPROMISED. THE FIRM FAILED TO TAKE STEPS TO MITIGATE THE RISK OF IDENTITY THEFT RESULTING FROM THE INCIDENT. FOR EXAMPLE, AT THE TIME IT DISCOVERED THE BREACH, THE FIRM MADE NO EFFORT TO DETERMINE HOW MANY EMAILS HAD BEEN BLIND COPIED TO THE UNAUTHORIZED ACCOUNT, OR WHETHER CUSTOMERS' IDENTIFYING INFORMATION HAD BEEN EXPOSED. IT WAS NOT UNTIL FINRA STAFF INQUIRED ABOUT EMAIL COMMUNICATIONS WITH THIS EXTERNAL EMAIL ADDRESS DURING THE FIRM'S CYCLE EXAM, THAT THE FIRM ATTEMPTEDTO DETERMINE THE SCOPE OF THE BREACH. TO DATE, THE FIRM HAS NOT NOTIFIED ANY CUSTOMERS WHOSE IDENTIFYING INFORMATION WAS EXPOSED BECAUSE OF THE INCIDENT. APPROXIMATELY 17,000 EMAILS WERE BLIND COPIED FROM THE FIRM'S CEO AND CCO'S FIRM EMAIL ACCOUNT TO THE UNAUTHORIZED EXTERNAL EMAIL ADDRESS. AT LEAST200 OF THE BLIND-COPIED EMAILS CONTAINED IDENTIFYING INFORMATION RELATING TO THE FIRM'S CUSTOMERS, INCLUDING CUSTOMERS' SOCIAL SECURITY, ACCOUNT NUMBERS, DRIVER'S LICENSE NUMBERS, AND DATES OF BIRTH. TWENTY-ONE OF THE EMAILS CONTAINING CUSTOMER IDENTIFYING INFORMATION WERE BLIND COPIED PRIOR TO THE DATE THE FIRM'S CEO AND CCO BEGAN TO RECEIVE MESSAGES THAT THE EMAILS TO THE EXTERNAL ADDRESSES COULD NOT BE DELIVERED. Status: Final Sanction Detail: A FINE OF $65,000 ASSESSED AGAINST THE APPLICANT, TO BE PAID THROUGH FINRA'S INSTALLMENT PAYMENT PLAN. Summary: THE FIRM SETTLED THIS MATTER WITHOUT ADMITTING OR DENYING THE ALLEGATIONS TO AVOID THE UNCERTAINTIES OF LITIGATION.