an agency-only brokerage firm that provided its customers with technology and direct market access to a variety of different stock and options exchanges.
offered its direct market access customers the ability to trade directly on multiple securities exchanges under Lime's exchange memberships, using one of Lime's unique four-letter codes, or market participant identifiers ("MPIDs"). Lime's direct market access customers included foreign and domestic trading entities and other institutional clients. As the broker-dealer offering direct market access to customers, Lime had supervisory obligations for their trading activity entered through the Firm.
6. Layering typically includes placement of multiple limit orders on one side of the market at various price levels that are intended to create the appearance of a change in the levels of supply and demand. In some instances, layering involves placing multiple limit orders at the same or varying prices across multiple exchanges or other trading venues. An order is then executed on the opposite side of the market and most, if not all, of the multiple limit orders are immediately cancelled. The purpose of the multiple limit orders that are subsequently cancelled is to induce, or trick, other market participants to enter orders due to the appearance of interest created by the orders such that the trader is able to receive a more favorable execution on the opposite side of the market.7. Similar to layering, spoofing involves placement of non-bona fide orders, generally inside the existing national best bid or offer, with the intention of briefly triggering some type of response from another market participant, followed by cancellation of the non-bona fide order, and the entry of an order on the other side of the market.8. Ramping includes trading practices designed to artificially increase or decrease the price of a security prior to the open or close for the benefit of resting order interest, i.e., placing unexecuted on-open or on-close orders in advance of an exchange's opening or closing cross.9. Marking involves attempting to influence the opening or closing price of a security by effecting purchases or sales at or near the open or close of normal trading hours. Such activity can artificially inflate or depress the closing price for the security.
12. Lime's WSPs identified the Surveillance System and described the exception reports that it generated for potentially manipulative trading by direct market access customers. The WSPs stated how often Lime's Chief Compliance Officer ("CCO") or the CCO' s designee should review exception reports and required that reviews be documented. But the WSPs did not describe how to conduct the reviews, the factors to consider in reviewing the exception reports for potentially manipulative trading activity, or how the reviews of exception reports were supervised by the Firm. Nor did the WSPs explain under what circumstances the reviewer should escalate concerns regarding any alert in an exception report for direct market access customers' trading activity or instead close an alert with no further action.13. During the Review Period, Lime's practice was to place reviewed Surveillance System alerts in one of three categories: "watch," "investigation," or "no further action." The WSPs required that all "watch" alerts be "explained" in the Surveillance System's comment field. The WSPs, however, did not state any factors to consider when placing an alert under "watch" status, what the reviewer should explain about the "watch" alert in the comment field, or how the Firm should supervise such alerts. Moreover, the WSPs provided no guidance concerning alerts placed under "investigation" or those closed with "no further action." Lime's WSPs and its supervisory system failed to include factors to consider in determining when such determinations were appropriate or how such determinations would be supervised.
14. Beginning in December 2014, and through the end of the Review Period, Lime tasked a single analyst with manually reviewing the Surveillance System alerts. Lime delegated to the analyst authority to investigate and close out surveillance alerts, but did not provide the analyst with any written guidance or explanation of the factors to consider in reviewing the alerts and determining alert categories or dispositions. Before joining the Firm, the analyst had not used the Surveillance System or conducted surveillance for all the forms of potentially manipulative trading identified by the Surveillance System.
15. During the Review Period, Lime failed to reasonably respond to red flags of potentially manipulative trading by the Firm's direct market access customers. These red flags included thousands of Surveillance System alerts that were generated by two such customers, including the following:
a. Customer A, a foreign investment fund, generated over 900 Surveillance System alerts for potential layering or spoofing between March 2015 and July 2016. Each time that Lime's analyst questioned Customer A about an alert, the analyst accepted the customer's explanation of the trading and closed the alert with no further action.b. Customer B, a domestic investment fund, generated over 1,000 Surveillance System alerts, including over 500 alerts for possible ramping and marking the close, between December 2014 and July 2016. Each time that Lime's analyst questioned Customer B about an alert, the analyst accepted the customer's explanation of the trading and closed the alert with no further action.