In the Matter of : AND CEASE-AND-DESIST PROCEEDINGS,

 
 
 
 
 
 
 
 
 
     
  
                        
   
     
                        
                                    
 
 
 
  
 
 
 
  
  
UNITED STATES OF AMERICA 

Before the
 
SECURITIES AND EXCHANGE COMMISSION 

SECURTIES EXCHANGE ACT OF 1934 
Release No. 64220 / April 7, 2011 
ADMINISTRATIVE PROCEEDING 
File No.  3-14328 
______________________________ 
: ORDER INSTITUTING ADMINISTRATIVE 
In the Matter of : AND CEASE-AND-DESIST PROCEEDINGS,  
:            PURSUANT            TO            SECTIONS 15(b) AND 21C   
Marc A. Ellis, : OF THE SECURITIES EXCHANGE 
: ACT OF 1934, MAKING FINDINGS, AND 
Respondent.            :            IMPOSING REMEDIAL SANCTIONS AND  
:            A            CEASE-AND-DESIST            ORDER            
______________________________: 
I. 
The  Securities  and  Exchange  Commission  (“Commission”)  deems  it  appropriate  and  in  
the  public  interest  that  public  administrative  and  cease-and-desist  proceedings  be,  and  hereby  
are,  instituted  pursuant  to  Sections  15(b)  and  21C  of  the  Securities  Exchange  Act  of  1934  
(“Exchange Act”) against Marc A. Ellis (“Ellis” or “Respondent”). 
II. 
In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of  Settlement  (the  “Offer”)  which  the  Commission  has  determined  to  accept.    Solely  for  the  
purpose  of  these  proceedings  and  any  other  proceedings  brought  by  or  on  behalf  of  the  
Commission,  or  to  which  the  Commission  is  a  party,  and  without  admitting  or  denying  the  
findings  herein,  except  as  to  the  Commission’s  jurisdiction  over  him  and  the  subject  matter  of  
these proceedings, which are admitted, Respondent consents to the entry of this Order Instituting 
Administrative  and  Cease-and-Desist  Proceedings  Pursuant  to  Sections  15(b)  and  21C  of  the  
Securities  Exchange  Act  of  1934,  Making  Findings,  and  Imposing  Remedial  Sanctions  and  a  
Cease-and-Desist (“Order”), as set forth below. 

  
 
 
 
 
 
 
 
 
   
 
 
 
 
 
 
 
 
 
  
 
 
 
 
                                                
 
      
 
III. 
On the basis of this Order and Respondent’s Offer, the Commission finds that
1
: 
Summary 
These  proceedings  arise  out  of  violations  by  GunnAllen  Financial,  Inc.  (“GunnAllen”),  
formerly  a  Tampa,  Florida-based  broker-dealer,  of  Rule  30(a)  of  Regulation  S-P  (17  C.F.R.  §  
248.30(a)) (the “Safeguard Rule”).  The Safeguard Rule requires broker-dealers to, among other 
things,   adopt   written   policies   and   procedures   reasonably   designed   to   protect   customer   
information  against  unauthorized  access  and  use.    Although  GunnAllen  maintained  written  
supervisory procedures for safeguarding customer information, they were inadequate and failed 
to  instruct  the  firm’s  supervisors  and  registered  representatives  how  to  comply  with  the  
Safeguard   Rule.      As   Chief   Compliance   Officer   (“CCO”),   Ellis   was   charged   with   the   
responsibility  of  maintaining  and  reviewing  the  adequacy  of  GunnAllen’s  procedures  for  
protecting  customer  information.    However,  after  the  theft  of  three  laptop  computers  and  a  
registered representative’s computer password credentials put customer information collected by 
GunnAllen  at  risk  of  unauthorized  access  and  use,  Ellis  did  not  direct  the  firm  to  revise  or  
supplement its policies and procedures for safeguarding customer information.  As a result, Ellis 
aided and abetted and caused GunnAllen’s violations of the Safeguard Rule. 
Respondent 
1. Ellis, 44, resides in Dix Hills, New York.  From July 2005 through February 2009, 
Ellis served as CCO of GunnAllen. 
GunnAllen Financial, Inc. 
2. GunnAllen had a principal place of business in Tampa, Florida and was registered with  
the  Commission  as  a  broker-dealer  from  March  1986  to  April  2010.    The  firm  operated  mostly  
under  an  independent  contractor  model  and  maintained  franchise  offices  nationwide.     In  April  
2010,  GunnAllen  discontinued  its  operations,  filed  for  bankruptcy,  and  submitted  a  Broker-
Dealer  Withdrawal,  or  “BDW”,  Form  with  the  Commission  withdrawing  its  registration.    The  
withdrawal became effective on June 11, 2010.           
GunnAllen’s Safeguard Procedures 
3. Rule 30(a) of Regulation S-P, or the Safeguard Rule, requires every broker and dealer  
registered   with   the   Commission   to   adopt   written   policies   and   procedures   that   address   
administrative,  technical,  and  physical  safeguards  for  the  protection  of  customer  records  and  
information,  and  that  are  reasonably  designed  to:  (1)  insure  the  security  and  confidentiality  of  
 The findings herein are made pursuant to Respondent’s Offer of Settlement and are not binding on any other 
person or entity in this or any other proceeding. 
2
 
1

 
  
  
 
 
  
 
 
  
 
 
     
 
  
    
  
  
  
 
 
 
 
 
 
 
customer  records  and  information;  (2)  protect  against  any  anticipated  threats  or  hazards  to  the  
security  or  integrity  of  customer  records  and  information;  and  (3)  protect  against  unauthorized  
access  to  or  use  of  customer  records  or  information  that  could  result  in  substantial  harm  or  
inconvenience to any customer. 
4. Between July 2005 and February 2009, GunnAllen’s policies and procedures addressing  
the  protection  of  customer  information  were  contained  in  its  Written  Supervisory  Procedures  
Manual  (the  “Manual”).   Specifically,  the  Manual  included  a  provision,  less  than  a  page  long,  
entitled  “Safeguarding  Information.”    This  provision  was  general  and  vague  and,  for  several  
reasons,  failed  to  set  forth  policies  and  procedures  reasonably  designed  to  protect  customer  
information, as required by the Safeguard Rule.  First, the provision simply recited the Safeguard 
Rule  verbatim  and  provided  examples  of  safeguards  that  “may  be  adopted”  by  GunnAllen,  but  
did not specify any safeguards actually adopted by the firm, or otherwise require any of the listed 
safeguards  be  adopted.    Second,  the  provision  also  failed  to  instruct  GunnAllen’s  registered  
representatives  how  to  protect  customer  information  or  enumerate  the  steps  that  they  needed  to  
take to ensure compliance with the Safeguard Rule.  Moreover, the provision lacked procedures 
addressing the follow-up of breaches or potential breaches in customer information uncovered by 
GunnAllen  and  its  registered  representatives.    Finally,  the  provision  repeatedly  referred  to  a  
“Designated  Principal”  charged  with,  among  other  things,  monitoring  and  annually  testing  the  
firm’s  safeguards  and  identifying  reasonably  foreseeable  risks  warranting  improvements  or  
adjustments  to  the  safeguards.    However,  the  Manual  failed  to  identify  the  “Designated  
Principal” by name or position and, in fact, GunnAllen did not appoint a “Designated Principal.”   
Breaches in GunnAllen’s Customer Records 
5. The inadequacy of GunnAllen’s procedures for protecting customer information and the   
firm’s  failure  to  comply  with  the  Safeguard  Rule  became  apparent  between  August  2006  and  
February  2008.   During  that  period,  laptop  computers  belonging  to  three  GunnAllen  registered  
representatives    and    the    computer    password    credentials    belonging    to    a    fourth    were    
misappropriated  from  the  firm.    Although  no  reports  of  misuse  of  customer  information  as  a  
result  of  any  of  the  incidents  subsequently  arose,  the  thefts  jeopardized  the  confidentiality  and  
integrity of customer information maintained by the firm and placed some information at risk of 
unauthorized use that could have resulted in substantial harm or inconvenience to customers.   
6. The first laptop computer was stolen in August 2006 from a GunnAllen franchise office 
in  the  Orlando,  Florida  area.    The  laptop  contained  contact  records  reflecting  the  names,  
addresses,  and  telephone  numbers  and,  in  many  instances,  spouses,  dates  of  birth  and  social  
security  numbers  of  approximately  1,120  of  the  firm’s  customers.    GunnAllen  filed  a  report  of  
the  theft  with  local  police  and  considered,  but  did  not  send,  a  letter  to  the  affected  customers  
notifying them of the theft.  The firm did not take any further steps concerning the matter and the 
laptop was never recovered. 
3
 

 
 
 
  
      
 
 
 
 
     
  
  
 
 
 
 
  
 
 
 
 
 
 
7. In January 2007, a GunnAllen franchise office in the Scottsdale, Arizona area uncovered 
evidence  that  a  registered  representative  who  the  firm  had  terminated  almost  a  year  earlier  had  
misappropriated  another  employee’s  computer  password  credentials  and  was  monitoring  the  
employee’s   e-mails,   including   those   exchanged   with   customers,   from   a   remote   location.   
GunnAllen’s  IT  Department  was  notified  about  the  compromised  password  and  subsequently  
confirmed that the terminated representative had gained unauthorized access to the firm’s e-mail 
system and had been accessing the employee’s e-mail for at least three months and, possibly, as 
much  as  a  year.    GunnAllen  directed  its  employees  in  the  franchise  office  to  change  their  
computer password credentials and planned to implement an automated program, already under 
development,  requiring  employees  on  a  firm-wide  basis  to  periodically  change  their  computer  
password credentials.  The firm did not take any additional steps concerning the matter and did 
not contact criminal authorities although recommended by its IT Department.        
8. Further, in February 2008, laptop computers were misappropriated from two GunnAllen  
registered  representatives  in  separate  incidences.  The  representatives  reported  the  thefts  to  
GunnAllen  and  informed  the  firm’s  IT  Department  that  the  laptops  did  not  hold  any  customer  
information.    GunnAllen  did  not  take  any  further  steps  concerning  the  thefts  and  the  laptop  
computers were never recovered. 
9. GunnAllen’s  senior  managers,  including  Ellis  and  the  firm’s  General  Counsel,  learned  
of  the  aforementioned  thefts,  but  no  single  person  or  department  directed  or  coordinated  the  
firm’s responses to the thefts.  As a consequence, GunnAllen failed to assess what, if any, risks 
the  thefts  posed  to  its  customers  and  failed  to  take  follow-up  and  remedial  steps  recommended  
by  its  employees.    For  example,  after  the  theft  of  the  first  laptop  computer,  a  dispute  arose  
between  GunnAllen’s  General  Counsel  and  its  IT  Department,  as  to  which  department  was  
responsible  for  sending  a  letter  to  the  affected  customers  notifying  them  of  the  theft.    A  senior  
GunnAllen  officer  subsequently  sent  an  e-mail  to  the  General  Counsel  and  Ellis,  who  was  
serving as the firm’s CCO, stating that the letter should be sent to the affected customers, but it 
was never mailed. 
Ellis Failed to Address GunnAllen’s 

Inadequate Procedures for Safeguarding Customer information
 
10. While  serving  as  CCO  of  GunnAllen  from  July  2005  to  February  2009,  Ellis  was  
responsible  for  implementing  and  maintaining  policies  and  procedures  ensuring  the  firm’s  
compliance  with  Regulation  S-P,  including  the  Safeguard  Rule  mandating  broker-dealers  to  
adopt  written  policies  and  procedures  reasonably  designed  to  protect  customer  records  and  
information.    Ellis  was  also  responsible  for  reviewing  the  adequacy  of  GunnAllen’s  written  
supervisory procedures contained in the Manual, including those concerning the Safeguard Rule. 
Ellis, with the assistance of the firm’s Assistant Chief Compliance Officer, directed and oversaw 
GunnAllen’s annual reviews of its written supervisory procedures in 2007 and 2008.            
4
 

 
 
 
  
 
 
 
 
 
 
 
  
  
  
 
 
                                                
 
         
      
11. Ellis was notified of the laptop computer theft which occurred in August 2006 and the  
discovery of the misappropriated computer password credentials in January 2007 by e-mail after 
the  events  occurred.    He  was  also  orally  informed  of  at  least  one  of  the  two  laptop  computer  
thefts  shortly  after  the  event  occurred  in  February  2008.    These  thefts  and  GunnAllen’s  limited  
response  or  follow-up  repeatedly  revealed  the  firm’s  policies  and  procedures  for  safeguarding  
customer  information  to  be  inadequate.    Nevertheless,  and  despite  supervising  two  annual  
reviews  of  GunnAllen’s  written  supervisory  procedures,  Ellis  failed  to  direct  the  firm  to  
supplement the Safeguarding Information provision in the Manual or to adopt additional written 
policies  and  procedures  to  protect  customer  information  and  ensure  GunnAllen’s  compliance  
with the Safeguard Rule.         
12. As a result of the conduct described above, Ellis willfully
2
 aided and abetted and caused 
GunnAllen’s violations of Rule 30(a) of Regulation S-P under the Exchange Act, which requires 
written  policies  and  procedures  that  address  administrative,  technical,  and  physical  safeguards  
for  the  protection  of  customer  information  that  were  reasonably  designed  to:  (1)  insure  the  
security  and  confidentiality  of  customer  records  and  information;  (2)  protect  against  any  
anticipated  threats  or  hazards  to  the  security  or  integrity  of  customer  records  and  information;  
and  (3)  protect  against  unauthorized  access  to  or  use  of  customer  records  and  information  that  
could result in substantial harm or inconvenience to any customer.    
IV. 
In view of the foregoing, the Commission deems it appropriate and in the public interest 
to impose the sanctions agreed to in Respondent’s Offer. 
Accordingly,  pursuant  to  Sections  15(b)  and  21C  of  the  Exchange  Act,  it  is  hereby  
ORDERED that: 
A. Respondent Ellis cease and desist from committing or causing any violations and any 
future violations of Rule 30(a) of Regulation S-P under the Exchange Act. 
B. Respondent Ellis is censured. 
C. Respondent Ellis shall, within ten days of the entry of this Order, pay a civil money  
penalty of $15,000 to the United States Treasury.  If timely payment is not made, additional 
interest shall accrue pursuant to 31 U.S.C. 3717.  Such payment shall be: (A) made by wire 
transfer, United States postal money order, certified check, bank cashier’s check, or bank money 
order; (B) payable to the Securities and Exchange Commission; (C) hand-delivered or mailed to 
the Office of Financial Management, Securities and Exchange Commission, Operations Center, 
6432 General Green Way, Alexandria, VA  22312-0003; and (D) submitted under cover letter 
that identifies Ellis as a Respondent in these proceedings, the file number of these   
A willful violation of the securities laws means merely “that the person charged with the duty knows what he is 
doing.”  Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir. 2000) (quoting Huges v. SEC, 174 F.2d 969, 977 (D.C. Cir. 
1949).  
5
 
2 

 
 
 
 
        
 
proceedings, a copy of which cover letter and wire transfer, money order or check shall be sent 
to  Teresa  J.  Verges,  Assistant  Regional  Director,  Miami  Regional  Office,  Securities  and  
Exchange Commission, 801 Brickell Avenue,  Suite 1800, Miami, FL 33131. 
By the Commission. 
Elizabeth M. Murphy 
       Secretary 
6
 

 
 
 
 
   
  
 
 
 
 
   
  
 
 
 
 
 
                                                                                                                                                                                                                        
  
      
 
Service List 
Rule 141 of the Commission's Rules of Practice provides that the Secretary, or another 
duly authorized officer of the Commission, shall serve a copy of the Order Instituting 
Administrative and Cease-and-Desist Proceedings, Pursuant to Sections 15(b) and 21C of the 
Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a Cease-
and-Desist Order ("Order") on the Respondent and his legal agent. 
The attached Order has been sent to the following parties and other persons entitled to 
notice: 
Honorable Brenda P. Murray 
Chief Administrative Law Judge 
Securities and Exchange Commission 
100 F Street, N.E. 
Washington, DC 20549-2557                                                
Teresa J. Verges, Esq. 
Miami Regional Office 
Securities and Exchange Commission 
801 Brickell Avenue, Suite 1800 
Miami, FL  33131 
Marc A. Ellis 
c/o Debra A. Jenks, Esq. 
Schwed McGinley & Kahle  
11410 North Jog Road, Suite 100 
Palm Beach Gardens, FL 33418 
Debra A. Jenks, Esq. 
Schwed McGinley & Kahle  
11410 North Jog Road, Suite 100 
Palm Beach Gardens, FL 33418 
7
 

UNITED STATES OF AMERICA 

Before the
 

SECURITIES AND EXCHANGE COMMISSION 


SECURTIES EXCHANGE ACT OF 1934 
Release No. 64220 / April 7, 2011 

ADMINISTRATIVE PROCEEDING 
File No. 3-14328 
______________________________ 

: ORDER INSTITUTING ADMINISTRATIVE 
In the Matter of : AND CEASE-AND-DESIST PROCEEDINGS,  

: PURSUANT TO SECTIONS 15(b) AND 21C   
Marc A. Ellis, : OF THE SECURITIES EXCHANGE 

: ACT OF 1934, MAKING FINDINGS, AND 
Respondent. : IMPOSING REMEDIAL SANCTIONS AND  

: A CEASE-AND-DESIST ORDER 
______________________________: 

I. 

The Securities and Exchange Commission (“Commission”) deems it appropriate and in 
the public interest that public administrative and cease-and-desist proceedings be, and hereby 
are, instituted pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934 
(“Exchange Act”) against Marc A. Ellis (“Ellis” or “Respondent”). 

II. 

In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of Settlement (the “Offer”) which the Commission has determined to accept.  Solely for the 
purpose of these proceedings and any other proceedings brought by or on behalf of the 
Commission, or to which the Commission is a party, and without admitting or denying the 
findings herein, except as to the Commission’s jurisdiction over him and the subject matter of 
these proceedings, which are admitted, Respondent consents to the entry of this Order Instituting 
Administrative and Cease-and-Desist Proceedings Pursuant to Sections 15(b) and 21C of the 
Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a 
Cease-and-Desist (“Order”), as set forth below. 



 

 

 
 

 

 
 

 
 

 

 

 
 

 
 

 
 

 
 

  
 

 
 

 

                                                 
      

 

III. 

On the basis of this Order and Respondent’s Offer, the Commission finds that1: 

Summary 

These proceedings arise out of violations by GunnAllen Financial, Inc. (“GunnAllen”), 
formerly a Tampa, Florida-based broker-dealer, of Rule 30(a) of Regulation S-P (17 C.F.R. § 
248.30(a)) (the “Safeguard Rule”). The Safeguard Rule requires broker-dealers to, among other 
things, adopt written policies and procedures reasonably designed to protect customer 
information against unauthorized access and use.  Although GunnAllen maintained written 
supervisory procedures for safeguarding customer information, they were inadequate and failed 
to instruct the firm’s supervisors and registered representatives how to comply with the 
Safeguard Rule.  As Chief Compliance Officer (“CCO”), Ellis was charged with the 
responsibility of maintaining and reviewing the adequacy of GunnAllen’s procedures for 
protecting customer information.  However, after the theft of three laptop computers and a 
registered representative’s computer password credentials put customer information collected by 
GunnAllen at risk of unauthorized access and use, Ellis did not direct the firm to revise or 
supplement its policies and procedures for safeguarding customer information.  As a result, Ellis 
aided and abetted and caused GunnAllen’s violations of the Safeguard Rule. 

Respondent 

1. Ellis, 44, resides in Dix Hills, New York.  From July 2005 through February 2009, 
Ellis served as CCO of GunnAllen. 

GunnAllen Financial, Inc. 

2. GunnAllen had a principal place of business in Tampa, Florida and was registered with  
the Commission as a broker-dealer from March 1986 to April 2010.  The firm operated mostly 
under an independent contractor model and maintained franchise offices nationwide.  In April 
2010, GunnAllen discontinued its operations, filed for bankruptcy, and submitted a Broker-
Dealer Withdrawal, or “BDW”, Form with the Commission withdrawing its registration.  The 
withdrawal became effective on June 11, 2010.           

GunnAllen’s Safeguard Procedures 

3. Rule 30(a) of Regulation S-P, or the Safeguard Rule, requires every broker and dealer  
registered with the Commission to adopt written policies and procedures that address 
administrative, technical, and physical safeguards for the protection of customer records and 
information, and that are reasonably designed to: (1) insure the security and confidentiality of 

 The findings herein are made pursuant to Respondent’s Offer of Settlement and are not binding on any other 
person or entity in this or any other proceeding. 

2
 

1



 

 

 

 
 

 

 
 

 

 
 

     
 

 

 
 
 

  

 
 

 
 
 
 
 

customer records and information; (2) protect against any anticipated threats or hazards to the 
security or integrity of customer records and information; and (3) protect against unauthorized 
access to or use of customer records or information that could result in substantial harm or 
inconvenience to any customer. 

4. Between July 2005 and February 2009, GunnAllen’s policies and procedures addressing  
the protection of customer information were contained in its Written Supervisory Procedures 
Manual (the “Manual”). Specifically, the Manual included a provision, less than a page long, 
entitled “Safeguarding Information.” This provision was general and vague and, for several 
reasons, failed to set forth policies and procedures reasonably designed to protect customer 
information, as required by the Safeguard Rule.  First, the provision simply recited the Safeguard 
Rule verbatim and provided examples of safeguards that “may be adopted” by GunnAllen, but 
did not specify any safeguards actually adopted by the firm, or otherwise require any of the listed 
safeguards be adopted. Second, the provision also failed to instruct GunnAllen’s registered 
representatives how to protect customer information or enumerate the steps that they needed to 
take to ensure compliance with the Safeguard Rule.  Moreover, the provision lacked procedures 
addressing the follow-up of breaches or potential breaches in customer information uncovered by 
GunnAllen and its registered representatives.  Finally, the provision repeatedly referred to a 
“Designated Principal” charged with, among other things, monitoring and annually testing the 
firm’s safeguards and identifying reasonably foreseeable risks warranting improvements or 
adjustments to the safeguards.  However, the Manual failed to identify the “Designated 
Principal” by name or position and, in fact, GunnAllen did not appoint a “Designated Principal.”   

Breaches in GunnAllen’s Customer Records 

5. The inadequacy of GunnAllen’s procedures for protecting customer information and the   
firm’s failure to comply with the Safeguard Rule became apparent between August 2006 and 
February 2008. During that period, laptop computers belonging to three GunnAllen registered 
representatives and the computer password credentials belonging to a fourth were 
misappropriated from the firm.  Although no reports of misuse of customer information as a 
result of any of the incidents subsequently arose, the thefts jeopardized the confidentiality and 
integrity of customer information maintained by the firm and placed some information at risk of 
unauthorized use that could have resulted in substantial harm or inconvenience to customers.   

6. The first laptop computer was stolen in August 2006 from a GunnAllen franchise office 
in the Orlando, Florida area. The laptop contained contact records reflecting the names, 
addresses, and telephone numbers and, in many instances, spouses, dates of birth and social 
security numbers of approximately 1,120 of the firm’s customers.  GunnAllen filed a report of 
the theft with local police and considered, but did not send, a letter to the affected customers 
notifying them of the theft.  The firm did not take any further steps concerning the matter and the 
laptop was never recovered. 

3
 



 

 
 

 

  

 

 
 

 
   

 

 

 

 
 

 
 

 
 

 
 
 
 

7. In January 2007, a GunnAllen franchise office in the Scottsdale, Arizona area uncovered 
evidence that a registered representative who the firm had terminated almost a year earlier had 
misappropriated another employee’s computer password credentials and was monitoring the 
employee’s e-mails, including those exchanged with customers, from a remote location. 
GunnAllen’s IT Department was notified about the compromised password and subsequently 
confirmed that the terminated representative had gained unauthorized access to the firm’s e-mail 
system and had been accessing the employee’s e-mail for at least three months and, possibly, as 
much as a year. GunnAllen directed its employees in the franchise office to change their 
computer password credentials and planned to implement an automated program, already under 
development, requiring employees on a firm-wide basis to periodically change their computer 
password credentials. The firm did not take any additional steps concerning the matter and did 
not contact criminal authorities although recommended by its IT Department.        

8. Further, in February 2008, laptop computers were misappropriated from two GunnAllen  
registered representatives in separate incidences. The representatives reported the thefts to 
GunnAllen and informed the firm’s IT Department that the laptops did not hold any customer 
information.  GunnAllen did not take any further steps concerning the thefts and the laptop 
computers were never recovered. 

9. GunnAllen’s senior managers, including Ellis and the firm’s General Counsel, learned 
of the aforementioned thefts, but no single person or department directed or coordinated the 
firm’s responses to the thefts.  As a consequence, GunnAllen failed to assess what, if any, risks 
the thefts posed to its customers and failed to take follow-up and remedial steps recommended 
by its employees.  For example, after the theft of the first laptop computer, a dispute arose 
between GunnAllen’s General Counsel and its IT Department, as to which department was 
responsible for sending a letter to the affected customers notifying them of the theft.  A senior 
GunnAllen officer subsequently sent an e-mail to the General Counsel and Ellis, who was 
serving as the firm’s CCO, stating that the letter should be sent to the affected customers, but it 
was never mailed. 

Ellis Failed to Address GunnAllen’s 

Inadequate Procedures for Safeguarding Customer information
 

10. While serving as CCO of GunnAllen from July 2005 to February 2009, Ellis was 
responsible for implementing and maintaining policies and procedures ensuring the firm’s 
compliance with Regulation S-P, including the Safeguard Rule mandating broker-dealers to 
adopt written policies and procedures reasonably designed to protect customer records and 
information.  Ellis was also responsible for reviewing the adequacy of GunnAllen’s written 
supervisory procedures contained in the Manual, including those concerning the Safeguard Rule. 
Ellis, with the assistance of the firm’s Assistant Chief Compliance Officer, directed and oversaw 
GunnAllen’s annual reviews of its written supervisory procedures in 2007 and 2008.            

4
 



 

 
 

 

 
 

 

 

 

 

 
  

  
  

 
 

                                                 
         

      

11. Ellis was notified of the laptop computer theft which occurred in August 2006 and the  
discovery of the misappropriated computer password credentials in January 2007 by e-mail after 
the events occurred.  He was also orally informed of at least one of the two laptop computer 
thefts shortly after the event occurred in February 2008.  These thefts and GunnAllen’s limited 
response or follow-up repeatedly revealed the firm’s policies and procedures for safeguarding 
customer information to be inadequate.  Nevertheless, and despite supervising two annual 
reviews of GunnAllen’s written supervisory procedures, Ellis failed to direct the firm to 
supplement the Safeguarding Information provision in the Manual or to adopt additional written 
policies and procedures to protect customer information and ensure GunnAllen’s compliance 
with the Safeguard Rule.         

12. As a result of the conduct described above, Ellis willfully2 aided and abetted and caused 
GunnAllen’s violations of Rule 30(a) of Regulation S-P under the Exchange Act, which requires 
written policies and procedures that address administrative, technical, and physical safeguards 
for the protection of customer information that were reasonably designed to: (1) insure the 
security and confidentiality of customer records and information; (2) protect against any 
anticipated threats or hazards to the security or integrity of customer records and information; 
and (3) protect against unauthorized access to or use of customer records and information that 
could result in substantial harm or inconvenience to any customer.    

IV. 

In view of the foregoing, the Commission deems it appropriate and in the public interest 
to impose the sanctions agreed to in Respondent’s Offer. 

Accordingly, pursuant to Sections 15(b) and 21C of the Exchange Act, it is hereby 
ORDERED that: 

A. Respondent Ellis cease and desist from committing or causing any violations and any 
future violations of Rule 30(a) of Regulation S-P under the Exchange Act. 

B. Respondent Ellis is censured. 

C. Respondent Ellis shall, within ten days of the entry of this Order, pay a civil money  
penalty of $15,000 to the United States Treasury.  If timely payment is not made, additional 
interest shall accrue pursuant to 31 U.S.C. 3717.  Such payment shall be: (A) made by wire 
transfer, United States postal money order, certified check, bank cashier’s check, or bank money 
order; (B) payable to the Securities and Exchange Commission; (C) hand-delivered or mailed to 
the Office of Financial Management, Securities and Exchange Commission, Operations Center, 
6432 General Green Way, Alexandria, VA  22312-0003; and (D) submitted under cover letter 
that identifies Ellis as a Respondent in these proceedings, the file number of these   

A willful violation of the securities laws means merely “that the person charged with the duty knows what he is 
doing.”  Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir. 2000) (quoting Huges v. SEC, 174 F.2d 969, 977 (D.C. Cir. 
1949).  

5
 

2 



 

 

 

 
        

 

proceedings, a copy of which cover letter and wire transfer, money order or check shall be sent 
to Teresa J. Verges, Assistant Regional Director, Miami Regional Office, Securities and 
Exchange Commission, 801 Brickell Avenue,  Suite 1800, Miami, FL 33131. 

By the Commission. 

Elizabeth M. Murphy 
       Secretary  

6
 



 

 
 
 

   

  
 
 

 
 

   
  

 

 
 

 

 

   
  
      
 

Service List 

Rule 141 of the Commission's Rules of Practice provides that the Secretary, or another 
duly authorized officer of the Commission, shall serve a copy of the Order Instituting 
Administrative and Cease-and-Desist Proceedings, Pursuant to Sections 15(b) and 21C of the 
Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a Cease-
and-Desist Order ("Order") on the Respondent and his legal agent. 

The attached Order has been sent to the following parties and other persons entitled to 
notice: 

Honorable Brenda P. Murray 
Chief Administrative Law Judge 
Securities and Exchange Commission 
100 F Street, N.E. 
Washington, DC 20549-2557  

Teresa J. Verges, Esq. 
Miami Regional Office 
Securities and Exchange Commission 
801 Brickell Avenue, Suite 1800 
Miami, FL  33131 

Marc A. Ellis 
c/o Debra A. Jenks, Esq. 
Schwed McGinley & Kahle  
11410 North Jog Road, Suite 100 
Palm Beach Gardens, FL 33418 

Debra A. Jenks, Esq. 
Schwed McGinley & Kahle  
11410 North Jog Road, Suite 100 
Palm Beach Gardens, FL 33418 

7