Wedbush misreported 43 times more transactions than Jefferies—but paid 2.9 times the penalty

Wedbush Securities misreported data for at least 51.8 million transactions in its electronic blue-sheet submissions, 43.2 times the 1.2 million affected transactions in the SEC’s later case against Jefferies. Yet Wedbush’s $1.9 million civil penalty was only 2.92 times Jefferies’ $650,000. The mismatch is not evidence that one firm obtained a bargain. It exposes why raw transaction counts are an unreliable penalty denominator: the orders cover different error structures, histories, remediation and self-reporting, and the SEC does not publish a per-transaction tariff.[1][2][3][4]

The comparison is still revealing when its limits are preserved. The relevant periods are similar but not identical—March 2018 through December 2023 for Wedbush and July 2018 through July 2024 for Jefferies. Both firms admitted the SEC’s findings. Both orders concern the same core duties under Exchange Act Section 17(a)(1) and Rules 17a-4(j) and 17a-25. And both publish enough denominators to show that “transactions affected,” “submissions deficient,” “error types” and “penalty” describe different dimensions of the failure.[1][3]

Every count in the table is a published lower bound. “At least” means the ratios are approximations, not exact rankings. A submission can contain many transactions, and one coding defect can repeat across millions of rows. Conversely, a small number of rows can carry fields that are unusually important to a particular investigation. The orders do not assign a harm weight to each field or transaction.[1][3]

What a blue sheet is—and why the row count matters

Electronic blue sheets are standardised responses to regulator requests for customer and proprietary trading records. The SEC uses them to identify buyers and sellers, reconstruct trading and support surveillance and enforcement work, including insider-trading and market-manipulation inquiries. The system replaced paper questionnaires historically printed on blue paper. Rule 17a-25 requires broker-dealers to submit specified transaction information electronically when requested.[5]

The records can include the security, execution date, quantity, side, price, account number, market, broker identifiers and other fields needed to connect a trade to the right account and context. A file can be syntactically accepted yet still be substantively wrong if a field is omitted, mapped to the wrong code, expressed in the wrong currency or populated with an indicator that changes how the trade is interpreted. That is why a blue-sheet case is not simply a late-filing case.[1][3][5]

The SEC says inaccurate data can undermine investigations, examinations and market reconstructions. That statement should not be inverted into a claim that the published errors actually defeated a named investigation; neither order identifies a particular prosecution that failed. The demonstrated risk is that regulators cannot reliably reconstruct activity when the broker’s source data, mapping or output logic is incomplete.[1][3]

Wedbush’s transaction total was dominated by repeated system errors

The Wedbush order identifies seven coding or programming error types. One group omitted approximately 2.5 million transactions entirely. Another left nearly 1.2 million transactions with incomplete branch-office or registered-representative codes. Three related errors omitted or misreported transaction-type identifiers for at least 48.1 million transactions. Smaller but still consequential categories included more than 53,400 transactions marked solicited when they should have been unsolicited and at least 21,500 options transactions misidentified as short sales.[3]

Those categories explain how seven error types could reach 51.8 million rows. The number does not mean 51.8 million separate human mistakes. A persistent mapping or programming defect can replicate the same wrong field across a high-volume output population. Nor can the listed categories simply be added to reproduce the published total without checking overlap: one transaction could contain more than one error.[3]

Wedbush’s order also records two prior blue-sheet disciplinary matters, a 2007 New York Stock Exchange case and a 2015 FINRA proceeding. The SEC does not publish a mathematical uplift tied to that history, but its inclusion distinguishes the record from a first-time technical failure. Wedbush admitted the findings, accepted a censure and cease-and-desist order, and paid $1.9 million.[3][4]

Jefferies had fewer affected rows but more error types

Jefferies’ nine error types affected at least 1.2 million transactions across at least 7,700 submissions. The order says the causes included manual errors and coding or programming problems in systems operated by Jefferies or vendors assisting its reporting process. Examples included non-conforming large-trader identifiers, incorrect broker-dealer status for customers, trades reported in foreign currency rather than US dollars and an average-price indicator incorrectly attached to single-execution trades.[1]

This profile is broader by error category but much smaller by row count. It illustrates another denominator problem: counting error types treats a defect affecting one field and a defect affecting millions of records as one each. Counting transactions does the opposite, allowing one repeated code error to dominate the total. Neither number alone describes investigative significance or control quality.[1][3]

Jefferies identified and self-reported seven of its nine error types after regulatory inquiries had begun. It retained a consultant, built a governance and control framework, introduced daily autonomous validation, formed an EBS governance committee and working group, and resubmitted a substantial portion of corrected records. Wedbush self-reported three of seven error types and developed an in-house validation system and dedicated regulatory-submission teams. The orders say the SEC considered remediation, but they do not quantify a discount for any particular measure.[1][2][3][4]

The self-reporting fractions—about 42.9% for Wedbush and 77.8% for Jefferies—are descriptive, not penalty formulas. An error found internally may differ in duration or importance from one found by a regulator. The timing of disclosure also matters. The public record supports the fact that Jefferies identified a larger share of its listed error types; it does not prove how many penalty dollars that saved.[1][3]

Per-transaction penalty arithmetic produces the wrong intuition

Dividing the penalties by affected transactions yields about 3.7 cents for Wedbush and 54.2 cents for Jefferies. On that crude metric, Jefferies’ figure is roughly 14.8 times higher. Dividing by deficient submissions produces a much closer result: about $97 per Wedbush submission and $84 per Jefferies submission. Neither quotient is a regulatory rate card. The swing merely demonstrates that the chosen denominator controls the apparent severity.[1][3]

A defensible comparison must therefore stop short of saying Wedbush paid less “per violation.” The orders use “willfully” in the securities-law sense and find violations of the same reporting provisions, but the public documents do not identify the Commission’s internal penalty model. They also do not publish the number of regulator requests, investigations affected, days each defect persisted, corrected rows eventually accepted or resources needed to reconstruct the data.[1][3]

Vendor involvement does not transfer the broker’s duty

Both orders mention vendors as possible contributors to coding or programming problems. Neither treats outsourcing as a defence. The requested data remains the broker-dealer’s regulatory submission. A robust control therefore cannot stop at confirming that a vendor produced a file. It needs independent reconciliations from source records to output, field-level reasonableness tests, population completeness checks, version control for technical specifications and exception reporting when a mapping changes.[1][3][5]

The error patterns show why daily validation can add value only if it is genuinely autonomous. A check that repeats the production system’s assumptions can certify the same defect. Useful independence means comparing totals and key fields against separate source systems, testing known edge cases, detecting sudden distribution changes and sampling records back to account and execution data. The SEC orders do not certify either firm’s current controls; they record the remediation represented and considered in resolving the cases.[1][3]

What the comparison establishes

The record proves that Wedbush admitted seven error types affecting at least 51.8 million transactions and paid $1.9 million, while Jefferies admitted nine types affecting at least 1.2 million transactions and paid $650,000. It proves Wedbush’s row count was about 43 times larger but its penalty only about 2.9 times larger. It does not prove that the SEC values one inaccurate transaction at a particular amount, that all errors had equal investigative consequence or that one firm’s programme is now superior.[1][2][3][4]

The original finding is the denominator mismatch itself. A blue-sheet programme can fail across submissions, rows, fields, error types, time and investigations. The Wedbush–Jefferies comparison shows that no single headline count captures all of them. For boards and compliance teams, the practical metric is not how many defects exist in the code repository. It is whether independent controls can prove that every requested transaction is present, every consequential field is mapped correctly and every correction can be reproduced before regulators have to discover the gap.[1][3][5]

Report an error or submit an update