FOLLOW US

Minneapolis, MN - Financial services company Thrivent Investment Management Inc. has agreed to pay $325,000 to resolve allegations by the Financial Industry Regulatory Authority (FINRA) that it failed to maintain adequate controls to prevent its registered representatives from forging customer signatures over a seven-year period.

In a May letter of acceptance, waiver, and consent, Minneapolis-headquartered Thrivent agreed to pay the fine and to enhance its compliance procedures. The firm did not admit or deny the claims that, since 2017, at least 15 representatives had forged over 120 customer names on more than 260 firm documents, including account records and investment instructions.

FINRA noted that the alleged forgeries were not conducted "in furtherance of an unauthorized activity," and that customers were neither harmed nor complained about the conduct. However, Thrivent's actions still violated the regulator's rules.

"Thrivent failed to have a reasonable system to supervise electronic signatures and maintained inaccurate records," FINRA stated in the letter, while acknowledging that the firm had self-reported the issue.

The enforcement action focuses on Thrivent's systems that allow representatives and customers to remotely sign documents.

After a customer electronically signed a document, Thrivent would receive a signature completion record. This record included the email addresses that sent and received the document, the cell phone numbers that received codes for two-factor authentication associated with the filing, and the numerical IP address of the device used to electronically sign the documents, according to FINRA.

However, Thrivent's supervisory systems were "not reasonably designed to detect possible instances of electronic signature forgery or falsification," because the firm did not outline how supervisors should assess the authenticity of an electronic signature. As a result, the firm did not reasonably investigate certain red flags in the certificates of completion, such as when a representative sent the email with the electronic signature link from their work email to their personal email address.

In some cases, records indicated employees received the associated two-factor authentication codes on their own cell phones, and in other cases, the same IP address was associated with both the Thrivent worker sending the email and the individual who signed it electronically.

The enforcement action follows a pair of filings from Thrivent notifying the self-regulatory organization that it had terminated certain employees, according to FINRA.