The SEC’s recent order instituting administrative and cease-and-desist proceedings (OIP) against registered investment advisers Two Sigma Investments LP and Two Sigma Advisers LP illustrates significant risks for investment model providers whose employees have access to the algorithmic investment models that drive firms’ investment decisions.
Two Sigma, a prominent quantitative investment adviser managing more than $150 billion, employs computer-based algorithmic models to guide investment decisions across private funds and separately managed accounts. The SEC alleged that, beginning in 2019, Two Sigma knew that certain of its employees had unfettered access to a database storing the models’ parameters, i.e., variable inputs that impact the model’s stock predictions. Employees had warned the firm’s senior management of such access; however, Two Sigma allegedly delayed implementing effective safeguards until the vulnerabilities materially impacted investment performance.
According to the SEC, between 2021 and 2023, one employee made dozens of unauthorized changes to the model parameters, which materially affected 14 of Two Sigma’s live trading models — models developed by either the employee or those reporting directly to him. These changes caused the models to deviate significantly from intended investment strategies and resulted in an approximately $165 million loss for some clients and more than $400 million in unintended gains for others.
The OIP alleged that Two Sigma willfully violated the anti-fraud provisions of the Investment Advisers Act of 1940. Without admitting or denying wrongdoing, Two Sigma consented to a cease-and-desist order, censure, and a $90 million civil penalty. Two Sigma cooperated with the SEC staff and took remedial actions during its investigation, which included repaying the negatively impacted and underperforming client funds in the total amount of approximately $165 million. So the firm paid a hefty total price, despite the fact that the OIP acknowledged its cooperation and remedial efforts.
The SEC’s action against Two Sigma highlights a perhaps underappreciated risk for providers of investment models, especially where a provider’s compensation arrangements could incentivize employee tampering. Certainly, such providers must maintain and enforce strong model access controls and compliance policies, and diligently supervise employees who could impact critical investment processes. Moreover, in light of the substantial damage to investors that may result from corrupted investment models, it also behooves funds and investment advisers that rely on investment models provided by other firms to consider whether they should take any additional steps to satisfy themselves as to the adequacy of such third parties’ practices and procedures to protect their models’ integrity.
