SEC Free-Riding Case: The Instant Deposit Credit Controls Broker-Dealers Need to Test

TL;DR

• The SEC says Mayur Baviskar initiated $377,200 in unfunded deposits at nine broker-dealers, traded more than $1.4 million on instant credit, and withdrew $6,078.16 in profits.
• The proposed settlement includes a $50,000 civil penalty, disgorgement, prejudgment interest, an antifraud injunction, and a conduct-based injunction, all subject to court approval.
• The control problem is bigger than a bounced transfer: instant credit, trading permission, ACH-return data, withdrawal controls, and customer-level surveillance must operate as one system.
• Broker-dealers should test whether repeat failed-funding behavior can move across accounts, payment methods, or affiliates without triggering a documented restriction decision.

Nine broker-dealers allegedly extended instant deposit credit to the same trader while the money behind his transfers was not there—or was stopped before settlement.

That is the practical punch line of the SEC free-riding case against Mayur Baviskar. The dollar profit was small. The control path was not. According to the SEC, Baviskar initiated $377,200 in unfunded deposits from March 2019 through September 2024, used provisional credit to purchase and sell more than $1.4 million in securities, and withdrew $6,078.16 in trading profits.

For a broker-dealer risk team, this is not primarily a story about a $50,000 penalty. It is a test of whether the firm’s funding, trading, withdrawal, and fraud systems can recognize one customer exploiting the seams between them.

What the SEC free-riding complaint alleges

The SEC’s August 26 litigation release describes a repeated sequence:

1. Baviskar initiated a deposit into a brokerage account.
2. The broker-dealer extended instant credit while the transfer was pending.
3. He allegedly bought and sold securities using that credit.
4. The underlying transfer failed because the source account lacked sufficient funds or because a stop-payment order was placed.
5. He allegedly withdrew trading profits before the broker-dealer could contain the exposure.

The SEC says the activity reached nine different broker-dealers. It also says those firms would not have extended instant credit or permitted the trades had they known the transfers would reverse.

The five-year time span matters. A one-off insufficient-funds return can be customer error. Repeated unfunded deposits, stop-payment instructions, trading on provisional credit, and profit withdrawals form a different pattern. The firm needs a control that distinguishes the first from the second without treating every returned transfer as fraud.

The filed complaint alleges violations of Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5. Baviskar signed a consent without admitting the complaint’s allegations. Any final judgment remains subject to court approval.

Proposed monetary outcome

The proposed judgment would also permanently enjoin Baviskar from violating the cited antifraud provisions and impose a conduct-based injunction. A same-day TradeInformer report independently summarized the SEC’s figures and the alleged use of instant credit across nine firms.

Why instant deposit credit creates a cross-system risk

Investor.gov’s definition is straightforward: in a cash account, an investor must pay for a security before selling it. Buying and selling before paying is free-riding, which is not permitted under Federal Reserve Regulation T and may require a 90-day cash-account freeze.

But a product flow rarely looks that clean in the data.

The deposit service knows a transfer is pending. The trading platform sees available buying power. The ACH processor later receives a return or stop-payment result. The withdrawal service decides whether proceeds can leave. Fraud operations sees cases. Compliance may see only the escalations that survive all those handoffs.

A control can be perfectly configured inside each component and still fail end to end.

The human editorial reality: ownership gets messy here. Product owns the instant-credit experience. Treasury or payments operations owns ACH returns. Brokerage operations owns account restrictions. Fraud owns suspicious behavior. Compliance owns the supervisory conclusion but may not control any of the systems needed to enforce it.

If the RACI says everyone is consulted and nobody is accountable for the end-to-end decision, that is the gap to fix first.

The control test broker-dealers should run

Do not respond with a policy reminder that “free-riding is prohibited.” Test the actual path.

1. Reconstruct provisional-credit exposure at the customer level

The control should calculate current exposure across all pending deposits, not evaluate each deposit alone. It should also aggregate linked accounts using the firm’s approved identifiers: customer ID, tax ID, verified bank account, device, address, and other links permitted by policy and law.

A workable evidence artifact is a daily report with:

• customer and linked-account identifiers;
• all unsettled deposits and their age;
• provisional buying power granted;
• securities purchased with that buying power;
• sale proceeds and withdrawal attempts;
• prior ACH returns, stop payments, and restrictions;
• current disposition and named reviewer.

Starter trigger: route a customer for review when a second deposit fails within a rolling 90-day window and the customer traded on provisional credit before either failure. That is not an industry benchmark. Calibrate it against at least six months of internal return data, document the false-positive rate, and lower the threshold where loss history supports it.

2. Separate collected cash from provisional buying power

The front end may show one “cash available” number. The control layer should not.

Maintain distinct balances for:

• collected cash;
• pending deposits;
• provisional buying power;
• settled sale proceeds;
• withdrawable cash.

Then document exactly which balance each action may use. A customer might be allowed to trade with provisional buying power while being prohibited from withdrawing proceeds until the deposit clears. If the product permits both actions immediately, risk acceptance should be explicit, approved, and tied to exposure limits.

3. Make ACH returns change permissions, not just balances

An ACH return should trigger more than a ledger correction. The response workflow should evaluate whether to:

• revoke unused provisional buying power;
• block new instant-credit deposits;
• hold withdrawals where legally and contractually permitted;
• restrict the account to collected funds;
• review linked accounts and funding sources;
• open a fraud or supervisory case;
• preserve the event trail for escalation.

Return reason matters. An administrative return is different from insufficient funds or a stop-payment instruction. Build the decision table by return code and customer history, then have Legal and Operations validate what restrictions the customer agreement supports.

4. Detect evasion across firms where the data allows it

No broker-dealer can see a customer’s activity at eight competitors from its own ledger. That limitation should be stated clearly in the control assessment rather than hidden behind a generic “customer monitoring” assertion.

What the firm can do is detect migration across its own accounts and channels, preserve high-quality case data, and define when suspicious patterns warrant escalation under applicable fraud, AML, or supervisory procedures. For broader fraud-information sharing, start with the legal analysis and purpose limitation; do not assume an information-sharing mechanism covers a particular event.

This same coverage question shows up in other securities controls. The recent analysis of FINRA’s low-priced securities cases explains why surveillance fails when activity sits outside the system’s effective scope. The pattern is different, but the design lesson is identical: map what the control can see and document what it cannot.

5. Test the control with an adversarial scenario

Have Internal Audit, Compliance Testing, or the second-line Operational Risk team run a controlled scenario in a non-production environment:

1. initiate a deposit that qualifies for instant credit;
2. trade using the provisional balance;
3. simulate an insufficient-funds return;
4. attempt a second deposit from another verified funding account;
5. sell the position and attempt a withdrawal;
6. repeat through a linked brokerage account;
7. inspect every alert, permission change, case, and audit log.

Pass/fail should be based on evidence, not whether someone on the call says the system “would catch it.”

The site’s fraud KRI guide is useful here, but do not copy generic thresholds into production. For this use case, track failed-funding rate, repeat failed-funder count, provisional-credit exposure, blocked-withdrawal value, alert aging, and loss avoided. Calibrate each against internal history and keep the change log.

A 30/60/90-day remediation plan

Days 1–30: establish the fact pattern

Owner: Head of Brokerage Operations, with Fraud Risk and Compliance.

• Map the deposit-to-withdrawal data flow.
• Identify every place provisional funds are represented as available cash.
• Pull six months of ACH returns, stop-payment events, instant-credit trades, and withdrawals.
• Quantify customers with repeated failed funding and activity across linked accounts.
• Open issues for any missing data feeds, undocumented thresholds, or controls that rely on manual memory.

Deliverable: one end-to-end process map, a customer-level exposure report, and an approved list of control gaps.

Days 31–60: close the permission gaps

Owner: Brokerage Product and Engineering, with Operations sign-off.

• Separate collected, provisional, settled, and withdrawable balances in decision logic.
• Implement return-code-specific restrictions.
• Add cumulative exposure caps across pending deposits and linked accounts.
• Create a documented exception path for legitimate customers.
• Route material exceptions to named supervisory owners with due dates.

Deliverable: tested rules, decision tables, release notes, and exception records.

Days 61–90: prove the control works

Owner: Compliance Testing or Internal Audit.

• Execute the adversarial scenario above.
• Sample both alerted and non-alerted returned deposits.
• Trace every sampled event from deposit initiation through final case disposition.
• Compare request logs to case tickets so reviewers cannot close alerts without addressing actual activity.
• Report residual gaps and overdue remediation to the risk committee.

Deliverable: a test report with sample IDs, evidence references, exceptions, owners, and target dates. Broker-dealers managing larger remediation portfolios should keep the findings connected to the same issue-governance discipline described in the Canaccord Genuity enforcement breakdown.

What to check Monday morning

1. Can one customer receive instant credit from two pending deposits at once?
2. Does a stop-payment return automatically affect trading and withdrawal permissions?
3. Are linked brokerage accounts included in cumulative exposure?
4. Can sale proceeds leave before the funding source settles?
5. Is a second failed deposit treated differently from a first?
6. Can Fraud Operations see the complete funding-trading-withdrawal timeline in one case?
7. Who signs off when Product wants a higher instant-credit limit?
8. What evidence proves the restriction fired at the right time?

The SEC’s Baviskar case is useful because the alleged conduct is mechanically simple. That removes the usual excuse that only an exotic fraud model could have spotted it. The hard part is connecting systems and owners before a customer turns provisional credit into withdrawable money.

Use the RCSA Template to document the funding, trading, withdrawal, and surveillance controls as one end-to-end assessment rather than four separate checklists.

FAQ

What did the SEC allege Mayur Baviskar did?

The SEC alleged that Baviskar initiated $377,200 in unfunded deposits at nine broker-dealers, traded more than $1.4 million in securities using instant credit, and withdrew $6,078.16 in profits. The allegations cover March 2019 through September 2024.

What is free-riding in a brokerage cash account?

Investor.gov says free-riding occurs when an investor buys and sells a security in a cash account before paying for the purchase. Regulation T does not permit it, and the broker may have to freeze the cash account for 90 days.

How much is the proposed SEC settlement?

The proposed monetary components total $57,992.57: $6,078.16 in disgorgement, $1,914.41 in prejudgment interest, and a $50,000 civil penalty. The final judgment is subject to court approval, and Baviskar consented without admitting the allegations.

What is the most important control after an unfunded brokerage deposit?

Make the failed funding event change customer permissions. The response should evaluate provisional buying power, new deposits, trading, withdrawals, linked accounts, and escalation together. A ledger reversal by itself does not contain the behavior.

Should every ACH return trigger an account freeze?

No. Returns have different causes, and a single event may be an error. Use a documented decision table that considers the return reason, repeat behavior, trading on provisional credit, withdrawal attempts, linked accounts, and prior restrictions. Calibrate thresholds to internal history and review false positives.