The Business Conduct Committee of the National Futures Association (or NFA), the self-regulatory organization for the US derivatives industry, has issued a complaint against Retail FX broker OANDA Corporation.

OANDA has 30 days to respond to the NFA’s complaint. Assuming that the complaint then reaches a formal proceeding, OANDA faces possible expulsion or suspension for a specified period from NFA membership, plus a monetary fine not to exceed $500,000 for each violation found. The complaint contains five such violations.

OANDA is the second largest Retail FX broker in the US, holding about $195 million of client funds.

The NFA complaint notes the following. In May 2018, OANDA was acquired by a subsidiary of a private equity firm (CVC Capital Partners). The acquisition closed in October 2018. Starting at about the time of the acquisition, NFA said it noted an increase in the number and degree of deficiencies occurring at the firm.

As alleged in more detail below, NFA identified these areas of deficiency to OANDA on separate occasions in 2018 and 2019 and instructed the firm to correct the deficiencies. At the same time, NFA also notified OANDA of the seriousness of these deficiencies and that continued deficiencies could subject the firm to disciplinary action.

When NFA examined OANDA again in 2020, the firm had repeat deficiencies in several of the areas that NFA had identified previously to the firm.

COUNT 1

During NFA’s 2020 exam of OANDA, NFA learned that a US-based OANDA customer had contacted the firm and complained that his account was hacked. The customer informed OANDA that, without his authorization, $5,000 had been
transferred out of his account and into a UK bank account he did not recognize. Prior to that unauthorized transfer, an unknown individual had added a UK bank account to the U.S. customer’s profile with OANDA.

The addition of a new, out-of-country account to a customer’s profile was suspicious activity covered under the red flags set out in OANDA’s AML procedures. Additionally, the request to transfer funds to an account that differed from the one the customer had used to deposit funds into his OANDA account was also suspicious activity covered under the red flags set out in OANDA’s AML procedures.

OANDA’s AML procedures required staff who observed red flags with respect to an account to report the suspicious activity to the firm’s AML Compliance Officer immediately.

However, OANDA staff failed to abide by the firm’s AML procedures and failed to notify OANDA’s AML Compliance Officer immediately of the suspicious activity set out above.

After the customer complained to the firm, OANDA then filed a SAR and issued a $5,000 credit to the customer.

OANDA’s failure to abide by its AML procedures was a repeat deficiency from NFA’s 2018 exam. Specifically, the 2018 exam revealed that OANDA failed to follow its AML policies and procedures. For example, the firm failed to flag any accounts that initiated three or more deposits per week, contrary to the firm’s AML policy. In those instances where OANDA flagged an account, the firm’s review of the accounts was insufficient given that the activity was sometimes not reviewed for a month or more after the suspicious activity had occurred. OANDA also opened customer accounts that were considered high risk based on the parameters set forth in its AML procedures and did not have any method to track or supervise these accounts.

Although OANDA undertook corrective action after the 2018 exam, such corrective action was insufficient, as NFA’s 2020 exam revealed the firm was still failing to follow its AML procedures.

By reason of the foregoing acts and omissions, OANDA is charged with violating
NFA Compliance Rule 2-9(c).

COUNT 2

NFA’s 2020 exam revealed the ISSP, dated April 2019, that OANDA used was patently insufficient. 27. For example, the ISSP did not include numerous required sections, including training, risk assessment, incident response, and access controls. Beyond the deficiencies apparent in the ISSP, OANDA also failed to provide all required employees with training on the ISSP. Specifically, in the period tested, OANDA had failed to train at least 20 employees who should have received ISSP training.

Additionally, OANDA failed to implement safeguards for risks it had identified, contrary to its ISSP and NFA requirements.

Finally, as alleged above in Count 1, an OANDA customer informed the firm that $5,000 had been stolen from his OANDA account in a hack. Yet OANDA failed to file the required notice with NFA regarding this cybersecurity incident that involved its commodity interest business and resulted in a loss of customer funds. OANDA’s failure to adopt and implement an adequate ISSP, including its failure to abide by the training requirement, is a repeat violation from NFA’s 2018 exam.

Specifically, the 2018 exam found that OANDA’s ISSP lacked numerous required elements, although many of these were different than the required elements missing from the April 2019 ISSP. Additionally, the 2018 exam revealed that OANDA had failed to provide required training to employees on its ISSP. Although OANDA undertook corrective action after the 2018 exam to address these deficiencies, such corrective action was insufficient, as NFA’s 2020 exam revealed the firm was still maintaining an inadequate ISSP and still failing to train employees as required.

By reason of the foregoing acts and omissions, OANDA is charged with violating NFA Compliance Rule 2-36(e).

COUNT 3

OANDA has established procedures for the handling and resolution of customer complaints, as required by the Interpretive Notice to NFA Compliance Rule 2-36(e), entitled “Forex Transactions.” OANDA’s customer complaint procedures require the firm’s customer service personnel to flag customer communications as complaints when certain criteria are met. Communications that have been flagged as complaints are then reviewed by OANDA’s compliance department on a weekly basis.

OANDA’s customer complaint procedures also require information about the complaint to be documented, including a description of the complaint resolution. Yet contrary to OANDA’s written customer complaint procedures, NFA’s 2020 exam revealed that the firm’s customer service personnel frequently failed to flag customer communications as complaints, even though the communications met the complaint criteria outlined in OANDA’s procedures.

Because these complaints were never flagged at the customer service level, they were never escalated to compliance personnel for review as set out in the customer complaint procedures. Additionally, the 2020 exam revealed that OANDA repeatedly failed to adequately document customer complaints and their resolution, contrary to OANDA’s customer complaint procedures.

The 2018 exam of OANDA had also revealed that the firm repeatedly failed to properly flag and document customer complaints and their resolution. Although OANDA undertook corrective action regarding the handling of customer
complaints after both the 2018 and 2020 exams, this corrective action was insufficient.

OANDA continues to fail to flag customer communications as complaints when required, hindering compliance review of those complaints. For example, on at least three occasions after the 2020 exam concluded, OANDA customers complained to the firm, but the firm failed to properly flag these complaints.

By reason of the foregoing acts and omissions, OANDA is charged with further violating NFA Compliance Rule 2-36(e).

COUNT 4

Over an approximately one-month period in January and February 2020, OANDA submitted six daily forex reports to NFA that contained inaccurate unrealized profit/loss (UPL) figures. Each of the six reports set forth UPL figures that had been copied exactly from the previous day’s daily forex report. OANDA corrected the reports after the filing deadline had passed.

OANDA’s failure to make accurate filings under NFA Financial Requirements Section 13 is a repeat deficiency.

For example, in 2019, OANDA made a total of 12 inaccurate daily forex reports—including reports with inaccurate UPL figures. OANDA self-corrected some of these inaccuracies before the filing deadline had passed, but others were only corrected when NFA prompted OANDA do to so.

NFA’s 2018 exam also found OANDA reported inaccurate information in its monthly forex reports. In that case, the firm had migrated to a new back office system but failed to include all accounts, which resulted in inaccurate figures being reported throughout the reports. To remediate, OANDA had to refile its January 2018 through September 2018 monthly reports.

In addition to its inaccurate filings under Financial Requirements Section 13, OANDA also previously failed to make timely filings under other NFA Financial Requirements. For example, despite being undercapitalized for a four-month period starting in April 2019, the firm did not file notice of its capital shortfall with NFA until August 21, 2019.

Additionally, OANDA delayed filing notice with NFA until September 5, 2019 that the firm violated its equity withdrawal restriction level by making dividend payments in April and May 2019.

NFA sent OANDA a warning letter on September 30, 2019 regarding the 2019 inaccurate filings under Financial Requirements Section 13 and late filings under other Financial Requirements, among other issues. In response, OANDA represented it was taking corrective action, including hiring additional staff and purchasing computing resources.

However, this corrective action was insufficient, as OANDA continued to make inaccurate daily forex filings in 2020, as alleged in paragraph 48 above.

By reason of the foregoing acts and omissions, OANDA is charged with violating NFA Financial Requirements Section 13.

COUNT 5

As alleged above, OANDA failed to meet its obligation to diligently supervise its forex business and its employees.

Over the last two years, NFA identified the areas of deficiency to OANDA and instructed the firm to correct the deficiencies. Concurrently, NFA informed the firm of the seriousness of the deficiencies and that continued deficiencies could subject the firm to disciplinary action.

Nevertheless, NFA found that OANDA continued to fail to abide by its AML procedures; to adopt and enforce an adequate ISSP, including providing required training on the ISSP; to implement its written supervisory system for handling and resolving customer complaints; and to make accurate daily forex filings to NFA.

As with every other deficiency alleged in this Complaint, OANDA’s failure to supervise is itself a repeat deficiency. NFA advised OANDA in a letter dated March 4, 2019 that the firm was failing to adequately supervise its activities. NFA again advised OANDA in a letter dated September 30, 2019 that the firm’s repeated deficiencies raised concerns about its commitment to ensuring compliance at all times with its regulatory obligations.

Yet, despite these repeated admonitions, OANDA has failed to diligently supervise its employees and forex activities to ensure compliance with NFA requirements.

By reason of the foregoing acts and omissions, OANDA is charged with violating NFA Compliance Rule 2-36(e).

CONCLUSION

As we note above, as per NFA rules NFA must file a written answer to the Complaint with NFA within thirty days of the date of the Complaint. Failure to file an answer shall be deemed an admission of the facts and legal conclusions contained in the Complaint. Failure to respond to any allegation shall be deemed an admission of that allegation. Failure to file an Answer as provided above shall be deemed a waiver of hearing.

POTENTIAL PENALTIES, DISQUALIFICATION AND INELIGIBILITY

At the conclusion of the proceedings conducted in connection with the issuance of this Complaint, NFA may impose one or more of the following penalties:

(a) expulsion or suspension for a specified period from NFA membership;

(b) bar or suspension for a specified period from association with an NFA
Member;

(c) censure or reprimand;

(d) a monetary fine not to exceed $500,000 for each violation found; and

(e) order to cease and desist or any other fitting penalty or remedial action not inconsistent with these penalties.