The Compliance Reports the Public Is Not Meant to See

Key Takeaways

• Confidential Remediation Reports: SEC settlements with financial firms have required independent compliance reviews whose findings are generally intended to remain nonpublic, limiting outside visibility into corrective efforts.
• Extensive Oversight Requirements: SG Americas Securities and Centaurus Financial faced detailed remediation obligations, including independent assessments, follow-up reviews, implementation requirements, and compliance certifications.
• Partial Public Disclosure: FINRA records revealed specific recommendations made to Centaurus Financial and the firm's reported implementation of those measures, although the documents did not establish the final outcome of its SEC-mandated review.
• Regulatory Obligations Remain Enforceable: The SEC rejected requests from 16 firms to ease previously agreed remediation requirements in April 2025, and a federal appeals court upheld the agency's denial of one firm's challenge in August 2026.
• Questions About Transparency: The available records do not establish that regulators failed to follow up or that firms neglected remediation, but they leave significant questions about the completion and effectiveness of corrective measures unanswered publicly.

Deep Dive

When the Securities and Exchange Commission settled with SG Americas Securities in August 2023, one paragraph of the order concerned a document that did not yet exist. The firm had agreed to hire a consultant to test its repairs and to send the written results to the Commission’s staff. The order said the report was intended to remain nonpublic, with four exceptions, including a court order, the parties’ written agreement, a Commission determination that disclosure would further its duties, or a legal requirement. It gave the reasons. The report would likely contain confidential commercial information, and publication could discourage cooperation or impede government investigations.

The same order, issued on August 8, directed SG Americas to pay $35 million for failing to preserve business communications that employees had conducted on personal phones. Staff at every level had used text messages, WhatsApp and Signal, and the order found that supervisors had broken the firm’s rules along with everyone else. SG Americas, an indirect subsidiary of Société Générale, admitted the facts and acknowledged that its conduct violated the securities laws. The practice dated to at least January 2019, and the Commission found that the missing messages had likely deprived it of evidence in several investigations in which the firm had answered subpoenas. The Commodity Futures Trading Commission, acting the same day, ordered Société Générale and SG Americas to pay a further $75 million.

The consultant’s assignment shows what the Commission thought had failed. The review had to cover the firm’s policies, its training, its surveillance and the technology it was installing, including whether employees would actually use it. It also had to examine how the firm had disciplined past violators, and whether penalties had been applied consistently across business lines and seniority levels. In a firm where group heads and managing directors were among the offenders, that was the pointed question. The rest followed a familiar sequence. The report went to the firm and to SEC staff, and the firm had to adopt the recommendations, with the consultant’s view prevailing in a dispute. A year later the consultant would assess progress again, the firm’s internal audit group would conduct its own audit, and the firm would certify compliance with supporting evidence.

The confidentiality clause is narrower than it first appears. It sits in the paragraph describing the initial report. The paragraphs creating the one-year report and the internal audit report do not repeat it, though both also go to SEC staff, and the order does not provide for either to be published. The omission may carry little practical weight, since nothing suggests the staff would release them. But the text draws the distinction.

The Same Terms, Repeated

SG Americas was one of eleven firms the Commission announced that August day, with combined penalties of $289 million. Each admitted the facts in its order and agreed to retain an independent consultant. Seven weeks later, on September 29, the agency announced ten more firms and $79 million in penalties. Interactive Brokers and an affiliate agreed to pay $35 million, Robert W. Baird $15 million, and William Blair and an affiliated adviser $10 million, with smaller penalties for Nuveen Securities, Fifth Third Securities and Perella Weinberg and its affiliates. These firms also agreed to retain consultants.

The announcements described the violations and the penalties in detail and said little about what the reviews would show. There are sound reasons for that. A consultant examining a financial institution sees client information, internal investigations and the workings of its surveillance systems. Employees may also speak more freely to a reviewer when their answers are not bound for publication.

Fifteen Months in Lexington

A different SEC case shows what the follow-up looks like when the underlying failure is not recordkeeping. In February 2023 the Commission settled charges against Centaurus Financial, a California broker-dealer and investment adviser, its Lexington, South Carolina branch manager, Ricky Mantei, and a registered representative, Atul Makharia. The order found that between June 2016 and July 2019, eight representatives at the Lexington branch recommended variable interest rate structured products to 94 retail customers for whom they were unsuitable. The products had maturities of fifteen years or more, paid contingent interest that could fall to zero after an initial fixed period, and put principal at risk. The customers were 65 or older, most had a net worth under $500,000, and they generally wanted income.

The supervision findings are the part the consultant was asked to test. Centaurus’s written procedures called for extra suitability reviews of older customers and required structured-product training, and the order found that the firm had no mechanism to check that either was happening. None of the representatives had completed formal structured-product training. The respondents neither admitted nor denied the findings, apart from the Commission’s jurisdiction. Centaurus paid a $750,000 penalty plus $4,876 in disgorgement and $623 in interest, and the three respondents’ payments, $1.1 million in all, went into a fair fund for harmed investors.

The undertakings were built around implementation, not design. A consultant would review the firm’s policies, its controls and its recordkeeping at the Lexington branch. Centaurus had to adopt the recommendations and was bound by the consultant’s view if the firm, the consultant and the staff could not agree. A year after the order, the consultant would begin a second review of how the changes had been carried out. Its follow-up report, due to the staff within fifteen months, had to say whether the firm had fully complied with each recommendation. Fifteen months from February 6, 2023 fell in May 2024. The reports were made nonpublic on the same four-exception terms, and Centaurus had to certify compliance in writing.

A later public document says more than the order. In March 2024, FINRA published a notice under SEC Rule 19h-1 approving Centaurus’s continued membership despite a statutory disqualification triggered by the order’s supervision finding. The notice recounts that the firm’s consultant had finished its review and drafted an initial report with two recommendations. One was to amend the order form so that a structured-product purchase funded by selling another one is flagged and explained in writing. The other was to measure concentration against liquid net worth instead of total net worth. The firm told FINRA it had adopted both and was in full compliance with the order’s undertakings. FINRA attached conditions of its own, including principal pre-approval of structured note and certificate-of-deposit purchases, annual training and quarterly compliance certifications.

The notice reports what the firm said, not an independent finding, and it predates the follow-up report due in May 2024. I found nothing later on that report. A search of SEC and FINRA publications through November 3, 2026 turned up a separate SEC order from February 2025, in which Centaurus paid $160,000 over recommendations of GWG Holdings L Bonds to 18 retail customers and its failure to enforce its own training requirements. That conduct ran from June 2020 to April 2021, before the 2023 order and in a different product, so it says nothing about whether the Lexington remediation held. The SEC’s page for the 2023 matter records fair-fund activity through March 2026 and says nothing about the consultant. The order lets staff extend deadlines, so the public record does not show whether the follow-up report arrived on time, whether the consultant found any recommendation unfulfilled, or whether the staff accepted the firm’s certification. Those are separate questions from whether the work was done, and the absence of a public report is not evidence that it was neglected.

FINRA’s April 2024 notice for SG Americas says less. It records that the firm had retained a consultant and represented that it was complying with the undertakings, and it describes no findings.

What the Regulator Can See

The confidentiality of these reports is not a lack of supervisory authority. Both orders send the consultant’s reports to SEC staff, let the staff demand further evidence and extend deadlines, and bar the firm from replacing the consultant without approval. The consultants review and recommend. The firm selects and pays them, the staff can object to the choice, and the firm has to follow their recommendations. They do not run the compliance program, and enforcement and examination remain with the Commission.

The Commission has also treated the undertakings as live obligations. In 2025, sixteen firms that had settled between September 2023 and September 2024, including Baird and William Blair from the September round, asked the Commission to replace the two-year consultant process with a one-time internal audit, end the discipline reporting and drop the order to comply. The Commission denied the motions on April 14, 2025, reasoning that the firms had agreed to their terms and that more lenient later settlements did not justify reopening them. Commissioner Hester Peirce dissented.

One of the sixteen, Apex Clearing, took the denial to court. On August 25, 2026, the Fifth Circuit denied its petition in an unpublished opinion. The court reviewed the denial under the arbitrary-and-capricious standard and found that the Commission had treated Apex’s motion like others and explained its reasons. It acknowledged that the firms settling in January 2025 received lighter terms, and said that did not make the denial unlawful. The court did not rule on the merits of the undertakings themselves.

Peirce’s dissent also explains why FINRA’s notices exist at all. The twelve settlements announced in January 2025 required an internal audit rather than a consultant, and in her account the undertakings were voluntary, so those firms had no continuing-membership application to file. The channel that disclosed Centaurus’s two recommendations therefore depends on an order making remediation mandatory.

A Different Kind of Regulator

Britain’s Financial Conduct Authority closes cases with a different instrument, and the two systems are not mirror images. The Santander case concerns anti-money-laundering controls at a bank, the SEC cases concern recordkeeping and supervision at broker-dealers, so the comparison here is about how each regulator documents remediation.

In December 2022 the FCA fined Santander UK £107,793,300 for weaknesses in the controls on its business banking customers between December 31, 2012 and October 18, 2017. The figure reflects a 30 percent settlement discount, and the notice puts the undiscounted penalty at £153,990,400. An internal audit report had told Santander of significant problems on the first day of that period. The changes it made, the FCA found, were not comprehensive or timely enough. The notice traces the failures through one account, opened by a money transmission business that described itself as a translation firm, which carried about £269 million before the bank closed it in 2017.

The notice also records what followed. In mid-2017 the board and senior management decided on a wholesale restructuring of the bank’s financial crime operations, and a remediation program with outside consultants began that autumn. The FCA said it recognized the scale of the work. Santander told the public it had overhauled its systems and had more than 4,400 people on financial crime.

The notice contains no undertaking comparable to the SEC’s, which follows from how the FCA works. It can require a firm to commission a skilled person’s report, and information firms give it is confidential by statute, with disclosure permitted only in limited circumstances. The notice’s silence on follow-up review does not mean none occurred. A final notice is not where supervisory follow-up would appear, and much of it would be confidential. In Santander’s case the public record is the regulator’s findings and the bank’s own account of its fix.

What Remains Unanswered

The orders reviewed here create mechanisms to test whether remediation worked and put the results in front of SEC staff. They give the public neither the consultants’ conclusions nor any point at which someone announces that the work is finished. FINRA’s notices fill part of the gap, relaying what a firm says it has done and, in Centaurus’s case, two of its consultant’s recommendations. None of this shows that the SEC failed to follow up or that either firm failed to do the work. The documents do not reach that far in either direction.

A public statement that the required reviews were completed, and whether material deficiencies remained, would not require releasing a consultant’s report. The orders already let the Commission authorize disclosure at its discretion, and the records reviewed here show no instance of it. Whether that should change is a policy question.

The SG Americas file holds a more concrete lead. The plan of heightened supervision attached to FINRA’s notice was replaced by an amended plan dated July 2, 2025. The 2024 version required annual training, approved-channel lists, disclosure of unapproved channels and written discipline procedures. The amended version drops those and keeps the record-keeping and certification provisions. It is written to expire when FINRA receives the firm’s final certifications under the SEC order, and the order requires those within 60 days of the firm completing its undertakings. The notice does not explain the change. The same expiry wording appears in the plan FINRA approved for Regions Securities that month, so it looks like a standard term. That makes the point more useful. FINRA’s oversight of these firms ends on a dated event, and the date the firm told FINRA its work was complete, if it has, sits in a file that no public document I found reproduces.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey