On 16 January 2025, the United States Securities and Exchange Commission (US SEC) announced order instituting administrative and cease-and-desist proceedings, pursuant to section 21c of the United States Securities Exchange Act of 1934 and sections 203(e) and 203(k) of the United States Investment Advisers Act of 1940, making findings, and imposing remedial sanctions and a cease and-desist order and settled charges against Two Sigma Investments LP and Two Sigma Advisers LP (collectively, Two Sigma) for breaching fiduciary duties and failing to address known vulnerabilities in their investment models. The firms also faced charges for violating whistleblower protection rules. As part of the settlement, Two Sigma agreed to pay $90 million in civil penalties and voluntarily reimbursed $165 million to impacted funds and accounts.
The US SEC’s findings revealed that from March 2019 to October 2023, Two Sigma was aware of material vulnerabilities in its algorithmic investment models but failed to take reasonable steps to address them. These deficiencies allowed unauthorised changes to model parameters, leading to both underperformance and overperformance in client portfolios. Two Sigma was also found to have required departing employees to sign agreements that impeded whistleblowers from reporting possible securities law violations, breaching federal whistleblower protections.
Two Sigma Investments LP and Two Sigma Advisers LP is a quantitative hedge fund manager with $84 billion under management, relies heavily on sophisticated algorithmic models for investment decisions. In 2019, employees identified security vulnerabilities in a database storing key model parameters, highlighting risks that unauthorised personnel could alter these parameters. Despite proposed solutions, Two Sigma delayed implementing changes until May 2022, following an incident where a database error disrupted trading operations.
Between November 2021 and August 2023, a Two Sigma employee made unauthorised changes to model parameters, impacting client investments. While some funds overperformed by $400 million, others underperformed by $165 million, prompting Two Sigma to reimburse affected investors. Two Sigma violated whistleblower protection rules by requiring employees in separation agreements to affirm they had not filed complaints with regulatory agencies. This provision, which was in effect until February 2024, posed barriers to reporting potential securities violations.
To address the violations, Two Sigma has agreed to a cease-and-desist order, censure, and payment of $45 million in penalties per firm. In response to the US SEC’s findings, Two Sigma also undertook extensive remedial efforts, including updating its model governance policies, revising separation agreements, and enhancing employee training on whistleblower protections. The firm further cooperated fully with the US SEC’s investigation, facilitating access to evidence and internal processes.
The vulnerabilities were first identified in March 2019, but comprehensive corrective measures were not implemented until late 2023. The US SEC initiated its investigation in 2022, leading to voluntary repayments by Two Sigma in December 2023 and January 2024. The final settlement was announced on 16 January 2025.
(Source: https://www.sec.gov/newsroom/press-releases/2025-15, https://www.sec.gov/files/litigation/admin/2025/34-102207.pdf)
