U.S. regulators have settled with an alternative trading system (ATS) over allegations that it failed to protect clients’ confidential trading data.

New York-based LavaFlow Inc. (which is owned by Citigroup Financial Products) agreed to pay US$5 million to settle charges from the U.S. Securities and Exchange Commission (SEC). The settlement includes a US$2.85 million penalty that the SEC says is its largest ever against an ATS.

The firm settled without admitting or denying the SEC’s findings. It consented to an order that requires it to pay US$1.8 million in disgorgement and US$350,000 in prejudgment interest, in addition to the penalty assessed by the commission. The order also censures LavaFlow and requires the firm to cease and desist from committing or causing the violations.

According to the SEC’s order settling the case, LavaFlow allowed an affiliate operating a smart order router to access and use confidential information from the non-displayed orders of the ATS’s subscribers. It says that the router was located outside of the firm’s operations, and that LavaFlow “did not have adequate safeguards and procedures to protect the confidential information” that the router accessed.

It notes that the affiliate only used the confidential trading data for other subscribers, but “the firm did not obtain consent from its subscribers to use their confidential information in this way, nor did LavaFlow disclose the use in its regulatory filings with the SEC.” The SEC also reports that the firm eventually discontinued the practice, but that the router executed more than 400 million shares over three years based partly on the data.

“Operators of alternative trading systems must protect confidential subscriber data and take steps to ensure that affiliates do not improperly use order information,” said Andrew Ceresney, director of the SEC’s enforcement division. “We will continue to hold accountable firms that fail to follow the rules applicable to off-exchange venues.”