The U.S. Securities and Exchange Commission settled an enforcement action against Morgan Stanley & Co. Inc. and Morgan Stanley DW Inc. over its lax protection of inside information.

The SEC alleged that, despite the legal requirements to do so, Morgan Stanley for years failed to maintain and enforce adequate written policies and procedures to prevent the misuse of material nonpublic information, commonly referred to as inside information.

“Due to a systemic breakdown in this critical compliance function, Morgan Stanley failed to conduct any surveillance of a massive number of employee accounts held at the firm and trading in certain securities in those and other accounts,” it said. “Moreover, Morgan Stanley’s written policies failed to provide adequate guidance to Morgan Stanley personnel charged with conducting surveillance, and the company employed inadequate controls with respect to certain aspects of its Watch List maintenance.”

As part of the settlement, Morgan Stanley has agreed to pay a $10 million penalty. The firms agreed, without admitting or denying the commission’s findings, to the entry of an order censuring them, ordering them to cease and desist, and ordering them to pay a $10 million penalty.

The commission order also requires Morgan Stanley to retain an independent consultant to conduct a comprehensive review of the firm’s policies, practices and procedures to prevent the misuse of material nonpublic information and to conduct a comprehensive review of its proposed methodologies and procedures for its retrospective surveillance of trading in all accounts and all securities that should have been but were not surveilled by the firm over the past four years. If it uncovers evidence tending to show that trading in violation of its policies against misuse of material nonpublic information occurred the firm shall promptly provide such information to the commission staff.

“Establishing and enforcing adequate written policies and procedures to detect potential insider trading at securities firms is vital,” said Linda Chatman Thomsen, director of the SEC’s Division of Enforcement. “Firms must devote sufficient resources and attention to this critical area. Neglecting this compliance function is not an option.”

Once the initial problems in surveillance were discovered, Morgan Stanley conducted a review of its surveillance processes and began to take steps to correct the identified deficiencies. It also cooperated with the staff in its investigation and timely reported its findings as additional surveillance issues were identified, the SEC reported.