Two Sigma's Four-Year Delay in Addressing Investment Model Vulnerabilities

Two Sigma, a prominent New York-based investment adviser, has been charged by the Securities and Exchange Commission (SEC) for breaching its fiduciary duties by failing to reasonably address known vulnerabilities in its investment models for over four years. The SEC alleges that Two Sigma's delay in addressing these issues resulted in significant negative impacts on clients' investment returns.



According to the SEC's order, Two Sigma employees identified and recognized vulnerabilities in certain investment models as early as March 2019. However, the firm waited until August 2023 to address these issues. During this period, Two Sigma failed to adopt and implement written policies and procedures to address the vulnerabilities and failed to supervise one of its employees who made unauthorized changes to more than a dozen models used in live trading.

The unauthorized changes resulted in certain funds and separately managed accounts (SMAs) overperforming by more than $400 million, while other funds and SMAs underperformed by approximately $165 million. Two Sigma voluntarily repaid impacted funds and accounts $165 million during the SEC's investigation to address these losses.



The SEC's order finds that Two Sigma willfully violated the antifraud provisions of the Investment Advisers Act of 1940 and the Advisers Act's compliance rule, as well as Rule 21F-17(a) under the Securities Exchange Act of 1934, which prohibits impeding an individual from communicating with SEC staff about a possible securities law violation. Without admitting or denying the SEC's findings, Two Sigma agreed to a cease-and-desist order imposing a censure and a penalty of $45 million each, totaling $90 million.

The SEC's charges against Two Sigma serve as a reminder of the importance of robust compliance programs, especially as investment advisers increasingly rely on models and advanced technology when investing client assets. When an investment adviser identifies material vulnerabilities to its core investment operations that may substantially impact client returns, it must address those vulnerabilities promptly and fully. Doing nothing for years, as Two Sigma did, is not the answer.

In light of this case, investment advisers should review their compliance programs and ensure they have adequate policies and procedures in place to address known vulnerabilities in their investment models. Additionally, they should provide proper supervision and oversight of their employees to prevent unauthorized changes to investment models. By taking these steps, investment advisers can minimize operational risks and protect their clients' interests.