Wavemark Capital SEC Settlement: The Use-of-Proceeds Controls Behind a $9.6M Mobile Home Offering

TL;DR

• The SEC alleged that Wavemark Capital and founder Michael Ayala raised about $9.6 million from nearly 100 investors for mobile homes—and bought no mobile homes.
• Proposed monetary remedies total $9,791,085: $8,817,909 in disgorgement, $736,725 in prejudgment interest, and a $236,451 civil penalty for Ayala, all subject to court approval.
• The useful compliance lesson is narrower than “watch for fraud”: prove that offering proceeds reached the assets and activities described to investors.
• Run a proceeds-to-asset reconciliation, test affiliate transfers, verify ownership independently, and trace distributions to operating cash before closing the review.

The sharpest fact in the Wavemark Capital SEC settlement is not the promised 12% to 14% annual return. It is simpler: the SEC says investors supplied $9.6 million to buy and install mobile homes, yet the defendants bought none.

On September 21, 2026, the SEC filed a settled civil action against Austin-based Wavemark Capital, LLC and its founder and CEO, Michael Ayala. According to SEC Litigation Release No. 26643, nearly 100 investors purchased promissory notes in Wavemark Income Fund, LLC between approximately October 2021 and February 2025. They were told their money would purchase mobile homes for parks owned by Ayala-controlled affiliates.

The SEC alleges the money instead went to Ponzi-like payments, sales commissions, debts, and operating expenses at affiliated entities. That makes this more than another offering-fraud headline. It is a clean test of whether a compliance program can answer one basic question with evidence: Did investor cash go where the offering documents said it would go?

What the SEC alleged in the Wavemark Capital case

The offering story was tangible. Wavemark allegedly promised to use investor money to purchase mobile homes, install them in affiliated parks, and generate returns through rentals and home sales. The notes offered guaranteed annualized returns between 12% and 14%.

The SEC’s complaint, filed as SEC v. Michael Ayala and Wavemark Capital, LLC, No. 26-cv-02599 in the Western District of Texas, alleges a very different cash flow. The agency says:

• Wavemark and Ayala raised approximately $9.6 million from nearly 100 investors.
• No mobile homes were purchased with the offering proceeds.
• Investor money funded Ponzi-like payments to other investors.
• Proceeds also paid sales commissions, debts, and operating expenses associated with Ayala’s affiliates.
• The conduct ran from approximately October 2021 through February 2025.

Those are allegations, not admissions. Wavemark and Ayala consented to proposed final judgments without admitting the allegations, and the judgments are subject to court approval.

That distinction matters. Compliance write-ups should not turn “alleged” into “found” because a case settled. It is a small drafting discipline that prevents legal overstatement in board materials, risk assessments, and training.

The proposed Wavemark Capital settlement, by the numbers

The proposed judgments would also permanently enjoin both defendants from violating Securities Act Section 17(a), Exchange Act Section 10(b), and Rule 10b-5. Ayala would receive a conduct-based injunction as well.

The dollar total should not distract from the control problem. A firm can produce polished decks, signed subscriptions, bank statements, and payment records while still failing to prove the central representation made to investors. The missing artifact here would have been a defensible chain from each dollar raised to an actual mobile home acquired, installed, and available to generate the promised economics.

Why a use-of-proceeds control must end at the asset

A weak review compares total capital raised with a management budget. A stronger review traces money through the bank. A defensible review continues to the underlying asset or service.

For a tangible-asset offering, the chain should look like this:

The human failure point is usually ownership. Finance assumes the business confirmed the asset. Operations assumes accounting validated the payment. Compliance checks the offering language but never receives the asset register. Everyone performed a task; nobody proved the full assertion.

Assign one control owner—usually the controller or fund CFO—for the end-to-end reconciliation. Compliance should challenge and test it, not become the bookkeeper. Internal audit should independently reperform a sample based on risk, including affiliate payments, round-dollar transfers, and disbursements made shortly before investor distributions.

Four controls that would surface the alleged pattern

1. Reconcile proceeds to eligible uses every month

Build a roll-forward with beginning cash, subscriptions, approved disbursements, distributions, fees, and ending cash. Every disbursement needs an eligible-use code tied to the governing offering document.

A workable starter trigger is to escalate any uncoded disbursement, any affiliate payment not expressly contemplated by the offering, and any material monthly variance between planned and actual deployment. “Material” should be calibrated to the offering’s size and historical activity rather than copied from a generic benchmark.

The evidence is not a checked box. Retain the reconciliation, source bank data, reviewer comments, corrections, and dated approval.

2. Independently verify the asset population

Invoices prove that someone generated an invoice. They do not prove an asset exists, belongs to the fund, or reached the location claimed.

For mobile homes, a realistic verification pack would include manufacturer and model, serial or vehicle identification number where applicable, title or ownership evidence, seller identity, payment reference, delivery location, installation status, and an exception field. The reviewer should obtain at least one ownership or location artifact independently of the person who initiated the purchase.

If the asset register says 40 homes and independent records support 31, the finding is not “documentation needs improvement.” Nine assets are unverified. Open an issue with a named owner, due date, interim restriction, and escalation path.

3. Treat affiliate transfers as exceptions, not routine cash movement

The SEC alleges offering money paid debts and operating expenses related to Ayala-controlled affiliates. Affiliate structures make ordinary-looking payments harder to interpret because the receiving entity may share an owner, address, staff, or bank relationship.

Maintain a related-party inventory and match every payee against it before release. Require documented business purpose, authority under the offering terms, conflict approval, and evidence of value received. The approver should be independent of the person benefiting from the transfer.

Also test payment splitting. Three transfers just below an approval threshold can represent one decision. Group payments by payee, date, invoice, and business purpose before applying the threshold.

4. Prove distributions came from operating economics

A payment to an investor is not evidence that an investment performed. In a Ponzi structure, the payment itself helps sustain the story.

The SEC’s Investor.gov Ponzi scheme guidance identifies overly consistent returns and high returns with little or no risk among common warning signs. The Wavemark release says the notes promised guaranteed annualized returns of 12% to 14%.

For each distribution cycle, produce a source-of-distribution schedule. Separate operating cash, asset-sale proceeds, reserves, borrowing, and new subscriptions. If new investor money is supporting distributions, stop treating the variance as a treasury matter. Escalate it to the CCO, CFO, and legal counsel before the next payment or capital raise.

The Monday-morning testing plan

This review does not need a six-month transformation program. It needs a controlled start.

Days 1–10: establish the population

• The controller exports all offering bank activity directly from the financial institution.
• Fund operations produces the investor ledger, disbursement ledger, asset register, and distribution history.
• Legal identifies the exact use-of-proceeds and related-party language in every active offering document.
• Compliance reconciles investor inflows to subscriptions and identifies every payee that is an affiliate, salesperson, executive, lender, or unknown party.

Days 11–30: test existence and cash use

• Internal audit or an independent tester selects all high-risk disbursements plus a documented sample of ordinary asset purchases.
• The tester traces payment to contract, invoice, independent asset evidence, delivery, and ledger posting.
• Finance prepares a distribution-funding analysis by payment date.
• The CCO opens findings for unsupported assets, unauthorized uses, unexplained affiliate transfers, and unreproducible investor statements.

Days 31–60: contain and remediate

• Legal determines whether disclosures, subscriptions, distributions, or affiliate payments must pause while exceptions are resolved.
• Finance implements payee screening and eligible-use coding in the payment workflow.
• Operations adds independent asset verification before an acquisition is marked complete.
• The issue owner documents root cause. “Human error” is not enough; identify whether the failure involved authority, segregation, data, review design, or management override.

Days 61–90: validate the fix

• A reviewer independent of remediation reperforms the proceeds-to-asset reconciliation.
• Compliance checks that every exception has evidence, an owner, a due date, and a disposition.
• Internal audit tests whether split payments and affiliate aliases bypass the new workflow.
• The risk committee receives unresolved exposure, not just the percentage of actions labeled complete.

That last point matters. Closing an action because a register was created does not close the risk if assets remain unverified. The same distinction appears in this site’s guide to keeping findings open until the underlying risk is actually resolved.

What this case adds to private-placement due diligence

Investor accreditation and signed subscription documents do not validate the issuer’s use of cash. The SEC’s updated Investor Bulletin on private placements under Regulation D explains that private placements can involve limited disclosure and restricted securities. For intermediaries and advisers, that makes source evidence more important, not less.

The practical due-diligence request is specific:

1. Obtain the complete bank population, not screenshots selected by management.
2. Reconcile cash raised to the investor ledger.
3. Reconcile eligible disbursements to independently verified assets.
4. Identify every affiliate and commission payment.
5. Recalculate distributions and identify their funding source.
6. Compare investor statements with the general ledger and asset register.
7. Document exceptions and stop conditions before testing starts.

This is also where prior enforcement reviews can help. The Jay Lucas private-equity fraud case focuses on concentrated cash authority and fund disbursements. The Croft and Frost $64 million offering case shows why a warning signal needs an owned escalation path. Wavemark adds the asset-existence layer: trace the money all the way to the thing investors were told they owned.

So what should be different after the Wavemark Capital SEC settlement?

Do not add “review use of proceeds” to a quarterly checklist and call it fixed. Define the assertion, the evidence, the exception trigger, and the person authorized to stop cash movement.

The first deliverable should be a one-page proceeds-to-asset exception report. Include dollars raised, dollars deployed to verified assets, dollars paid to affiliates or commissions, unsupported amounts, distributions by funding source, remediation owner, and next decision date. If management cannot reproduce those numbers from source records, that is the first finding.

For teams turning the review into tracked corrective actions, the Issues Management Tracker & Template provides the issue log, root-cause fields, remediation plan, closure evidence, and validation workflow.