SEC Fines Zoe Financial $450,000: The Algorithm Wasn't the Control

TL;DR

• The SEC fined Zoe Financial $450,000 over referral conflicts tied to its Zoe Wealth platform and misleading disclosures about how recommendations were made.
• Zoe’s algorithm did not consider platform use. The gap was outside the model: clients selected advisers beyond the algorithm’s initial matches approximately 46% of the time after salespeople supplied additional recommendations.
• The practical lesson is blunt: an algorithm cannot be presented as the control when employees can route around it without equivalent rules, logging, training, and testing.
• CCOs should map the complete recommendation journey—automated output, sales follow-up, overrides, compensation, and disclosure—and test it as one system.

The SEC’s Zoe Financial enforcement action is not really a story about a bad algorithm. It is a story about what happened after the algorithm finished.

On September 28, 2026, the Securities and Exchange Commission announced settled charges against registered investment adviser Zoe Financial Inc.. The firm agreed, without admitting or denying the SEC’s findings, to a censure, a cease-and-desist order, and a $450,000 civil penalty.

The order’s sharpest fact is buried in the operating process. Zoe used an algorithm to match prospective clients with advisers. But during the relevant period, clients hired an adviser outside the algorithm’s initial matches approximately 46% of the time. In those cases, a salesperson had supplied one or more additional recommendations.

That human layer mattered because Zoe also had a financial interest in growing Zoe Wealth, its asset-management platform. The algorithm did not consider whether an adviser used Zoe Wealth. Salespeople, however, operated in a process where platform adoption and referrals were commercially connected. The SEC found that the resulting conflict was not adequately disclosed.

For compliance teams building algorithmic recommendation, lead-routing, marketplace, or referral controls, that is the useful angle: the controlled perimeter must include every path that can change the customer’s outcome—not just the code.

What the SEC’s Zoe Financial order actually found

Zoe launched its referral service in approximately February 2018. Prospective clients completed a questionnaire with information such as age, goals, assets, location, and income. An algorithm compared those answers with advisers in Zoe’s network and displayed one or more ranked matches.

According to the SEC’s seven-page Order Instituting Proceedings, Advisers Act Release No. 7019, network advisers agreed to pay Zoe a portion of the advisory fees collected if a referred client hired them. The network ranged from approximately 128 to 225 advisers during the period covered by the order.

The automated match was only the first route through the process. If a prospect did not schedule a meeting, Zoe salespeople typically followed up. They often suggested additional advisers, and the order says salespeople lacked specific guidance or training on which factors they could or could not consider when making those suggestions.

Then the economics changed.

In approximately January 2023, Zoe launched Zoe Wealth, offering sub-advisory services, onboarding assistance, and back-office support to advisers. For part of the relevant period, Zoe charged advisers an additional platform fee. The order says Zoe also benefited more broadly as additional clients and assets increased the platform’s enterprise value.

The SEC documented several facts showing how that incentive entered the referral environment:

• Zoe encouraged network advisers to use Zoe Wealth.
• Employees linked platform adoption to additional referrals in conversations with advisers.
• One former vice president told an adviser he would not call it a “quid pro quo,” but firms using Zoe Wealth were “just going to get more referrals.”
• As the period continued, Zoe told advisers that refusing to adopt Zoe Wealth could lead to removal from the referral network.
• By the end of 2024, Zoe had separated from most advisers that would not use the platform.

The order does not say the matching algorithm ranked Zoe Wealth users more highly. It says the opposite: the algorithm did not consider platform use. But salespeople frequently entered the recommendation process after the initial output, and Zoe had an incentive to send business toward platform users.

That distinction is the whole case from a controls perspective.

The disclosure timeline—and why the first update was not enough

The SEC’s findings cover approximately January 2023 through December 2024. The disclosure record evolved in three stages:

This is a useful reminder for whoever owns Form ADV drafting: describing an operating requirement is not the same as explaining the economic incentive behind it.

The SEC’s Instructions for Part 2 of Form ADV require advisers to prepare a narrative brochure in plain English. The practical test is whether a client can understand why the firm may favor one recommendation over another and how that incentive can affect the process. “We may require platform use” answers what the firm can do. It does not answer how the firm benefits.

The order identified a second disclosure problem involving advisory firms that held indirect minority interests in Zoe and also participated in its referral network. Zoe disclosed the ownership conflict and said it mitigated that conflict by referring clients “solely” based on onboarding answers, without preferential treatment in referral volume.

But the actual process was not solely algorithmic. Once salespeople became involved, recommendations could reflect other factors and incentives. The SEC found the mitigation description misleading.

That is a different failure from omitting a conflict. The firm described a control that did not match the complete operating process.

Why the algorithm was not the control

It is tempting to document the referral algorithm, validate its inputs, confirm that a conflicted variable is excluded, and call the risk addressed. Zoe’s order shows why that approach is incomplete.

A recommendation system has multiple control points:

If a customer-facing result can be changed after model output, the override path is part of the recommendation system. It needs controls at least as strong as those applied to the algorithm.

This is also why the order should not be reduced to “AI enforcement.” The SEC did not make an AI claim, identify model bias, or allege defective code. It applied the established fiduciary standard in Section 206(2) of the Investment Advisers Act to a technology-enabled process. The Commission’s 2019 Interpretation Regarding Standard of Conduct for Investment Advisers explains that an adviser’s fiduciary duty includes a duty of loyalty and requires full and fair disclosure of conflicts so a client can provide informed consent.

Technology changed the workflow. It did not lower the disclosure standard.

The control failures practitioners should pull into their own reviews

1. The conflict inventory did not keep pace with the product launch

Zoe Wealth created a new revenue stream and a broader enterprise-value incentive. Yet the order says the referral brochure did not mention the platform or corresponding conflict from launch until October 28, 2024.

A product-approval control should require Compliance to answer four questions before launch:

1. Does the feature generate direct fees, indirect economic benefits, or valuation benefits?
2. Can employees influence which customers or counterparties use it?
3. Does any existing disclosure describe the incentive and its effect accurately?
4. What monitoring will detect whether recommendations shift after launch?

The approval evidence should include a compensation map, updated conflicts inventory, disclosure decision, and named monitoring owner. A product committee deck that says “Compliance reviewed” without those artifacts will not reconstruct the decision two years later.

2. Human recommendations lacked equivalent guardrails

The SEC order says salespeople were not given specific guidance or training about factors they could or could not consider when providing additional recommendations.

The corrective control is more than a refreshed training slide. Firms should constrain the workflow:

• Require structured reason codes for every adviser added outside the algorithm’s initial results.
• Prohibit platform economics, ownership, and salesperson compensation from being selection factors unless expressly permitted and disclosed.
• Preserve the original output next to the final shortlist.
• Route exceptions involving affiliated or platform-linked advisers for supervisory review.
• Sample calls and written communications against the logged reason.

A realistic starter test is to review all overrides involving conflicted advisers plus a risk-based sample of the remaining overrides each month. Calibrate sample size to actual referral volume and the prior three to six months of exception history; do not pick a percentage simply because it looks tidy in a policy.

3. Disclosure validation stopped at document text

A Form ADV review cannot be performed only by comparing this year’s brochure with last year’s brochure. Compliance needs to compare the words with the live process.

For each sentence that describes mitigation, ask for evidence:

• “Solely based on questionnaire responses” should tie to system controls preventing other inputs.
• “No preferential treatment” should tie to referral-distribution testing.
• “The algorithm determines matches” should tie to logs showing when humans add, remove, or reorder options.
• “Conflict is mitigated through review” should identify the reviewer, cadence, exception standard, and retained artifact.

The SEC’s compliance-program rule release emphasizes written policies and procedures reasonably designed to prevent violations, an annual review of adequacy and effectiveness, and a designated chief compliance officer. The operating word is effectiveness. A disclosure that accurately describes the intended process but not the real one is not an effective control.

4. Commercial pressure was visible but not converted into a compliance signal

The order cites internal communications focused on growing Zoe Wealth, increasing participating advisers, and increasing assets on the platform. Commercial ambition is not itself misconduct. But it becomes a compliance input when employees who influence recommendations are exposed to that ambition.

The CCO should receive a quarterly conflict dashboard containing:

• Referral share to platform users versus non-users
• Human-addition and override rates by salesperson
• Conversion rates by platform and ownership status
• Adviser removals, including whether platform refusal was a factor
• Complaints questioning match quality or sales pressure
• Disclosure changes and the business event that triggered each change

Review absolute movement and outliers rather than treating one universal threshold as a safe harbor. An unexplained jump in referrals to platform users immediately after a sales campaign deserves review even if it stays under an arbitrary red line.

A 30/60/90-day response plan for referral and marketplace firms

Days 1–30: establish the real process

Owner: CCO, with Product and Sales Operations

• Draw the end-to-end recommendation flow, including abandoned journeys, follow-up calls, manual additions, ranking changes, and adviser removal.
• Inventory direct fees, referral fees, platform fees, equity interests, and enterprise incentives attached to each participant.
• Pull the effective Form ADV brochure and every client-facing description of the matching process.
• Preserve current output and override logs before changing the workflow.
• Open separate issues for disclosure gaps, training gaps, missing logs, and untested conflicts rather than burying all remediation under one vague finding.

Evidence: approved process map, compensation map, disclosure crosswalk, data-retention confirmation, and issue records with owners and due dates.

Days 31–60: constrain and test the human layer

Owner: Sales Supervision and Compliance Testing

• Implement reason-coded additions and overrides with immutable user and timestamp records.
• Publish permitted and prohibited recommendation factors.
• Train sales staff using actual referral scenarios, then test comprehension.
• Compare initial algorithmic matches with final recommendations and hires.
• Segment outcomes by platform use, ownership interest, salesperson, and referral channel.

Evidence: workflow configuration, training completion and assessment results, first test script, exception population, and documented investigations.

Days 61–90: repair disclosure and governance

Owner: CCO, General Counsel, and Product Governance Committee

• Rewrite disclosures to name the economic benefit and explain where it can influence the process.
• Validate every claimed mitigation against system configuration and operating evidence.
• Add a mandatory conflict-impact assessment to product launches and compensation changes.
• Establish quarterly reporting and escalation criteria for recommendation disparities and unexplained overrides.
• Have Internal Audit or an independent reviewer validate closure rather than allowing the control owner to self-certify.

Evidence: approved disclosure, delivery record, governance minutes, dashboard, independent closure test, and retained remediation package.

For teams turning this review into tracked remediation, the Issues Management Tracker & Template provides a practical place to assign owners, due dates, root causes, action plans, and closure evidence.

Five checks for Monday morning

1. Pull a sample of final recommendations. Can you reproduce the original automated result and every human change?
2. Search sales materials for absolute control language. Words such as “solely,” “only,” “independent,” and “unbiased” require unusually strong evidence.
3. Reconcile the conflict inventory to the product catalog. Every fee-generating platform feature should have a documented conflict decision.
4. Compare conflicted and non-conflicted outcomes. Test platform users, affiliates, and ownership-linked participants separately.
5. Read Form ADV beside the live workflow. If the process owner says “that is not quite how it works,” open an issue now.

The Zoe order is narrower than many headline enforcement cases, but its control lesson travels well. A clean algorithm does not sanitize a conflicted operating process. The SEC looked at the system clients actually experienced: code, salespeople, incentives, disclosures, and all.

That is the perimeter compliance teams need to test.

For adjacent work, see the site’s practical breakdown of the SEC’s investment-adviser conflicts risk alert, the Commonwealth Financial Network revenue-sharing case, and the guide to Rule 206(4)-7 annual compliance reviews.