Ron Yehuda Itin (CRD #2344151, Tenafly, New Jersey)

July 12, 2024 – An AWC was issued in which Itin was suspended from association with any FINRA member in any principal capacity for three months and required to requalify by examination as a General Securities Principal by passing the requisite examination prior to acting in that capacity with any FINRA member. In light of Itin’s financial status, no monetary sanction has been imposed. Without admitting or denying the findings, Itin consented to the sanctions and to the entry of findings that he failed to establish and implement a supervisory system reasonably designed to detect and prevent fraudulent fund transmittals and identify theft. The findings stated that Itin was his member firm’s designated person responsible for establishing, maintaining, and enforcing its supervisory systems. However, Itin failed to reasonably design his firm’s supervisory system, including WSPs, to achieve compliance with the firm’s regulatory obligations, and failed to reasonably supervise these two areas. The firm’s WSPs were generic and were not tailored to the firm’s business. The firm began receiving trading instructions and withdrawal requests from a customer’s email address, sent by hackers who had gained unauthorized access to it. The firm received multiple requests to liquidate securities in the customer’s joint account, and to transfer nearly the entire value of the account to outside bank accounts. Itin was aware of these email communications and instructions and knew that the registered representative servicing the account had not spoken with the customer to confirm the authenticity of those instructions. Itin also knew that the representative was concerned about a possible email hack. Despite this, Itin reviewed and approved multiple request forms submitted by the hackers, without ever speaking to or communicating with the customer, or requiring contact with the customer through any method other than the hacked email account, even when presented with numerous red flags. These red flags included, among other things, the hackers’ refusal to contact the firm via telephone to verify the requested transactions, and their insistence that the firm accept order and wire instructions by email only. As a consequence of ltin’s approval of multiple request forms and failure to identify, investigate and address the red flags detailed above, the hackers were able to transfer nearly the full value of the account to outside bank accounts that they controlled, causing the majority of funds in the account to be stolen. The findings also stated that Itin caused his firm to violate SEC Regulation S-ID. Itin failed to develop a program that satisfied the requirements of Regulation S-ID. The firm’s WSPs referenced identity theft but did not contain guidance to identify or detect it. Instead, the WSPs stated that the firm’s information technology (IT) department would prohibit unauthorized access to the firm’s systems in the event of a customer complaint of identity theft, when, in fact, the firm did not have an IT department. The suspension is in effect from July 15, 2024, through October 14, 2024. (FINRA Case #2019064497301)