Information barriers fail at the wall crossing, not the firewall. See what the SEC expects, how crossings work, and what to train by role and desk.
Information barriers, also called ethical walls, are the policies and procedures financial firms use to stop material non-public information from moving between business units that must stay separated. Surveillance detects a breach after it happens. The controls that prevent one, including wall crossings and need-to-know discipline, are executed by employees in the moment.
Information barriers separate parts of a firm that hold material non-public information from parts that trade, advise, or publish research. The classic separations are investment banking from research, and advisory desks from proprietary trading, with the goal of preventing insider dealing, front running, and conflicts of interest.
The requirement is statutory rather than advisory. Section 15(g) of the Securities Exchange Act of 1934 requires registered broker-dealers to establish, maintain, and enforce written policies and procedures reasonably designed, taking into account the nature of their business, to prevent the misuse of material non-public information. Section 204A of the Investment Advisers Act of 1940 imposes a parallel duty on registered investment advisers.
Specific conduct rules sit on top of that general duty. FINRA Rules 2241 and 2242 govern conflicts around equity and debt research, Rule 5280 addresses trading ahead of research reports, and Rule 5270 on front running of block transactions carves out firms that have established information barriers to prevent internal disclosure. In the United Kingdom, the FCA addresses the same ground through SYSC 10.2.
How these obligations sit inside a wider control framework is covered in this guide to governance, risk, and compliance. The word “enforce” in Section 15(g) is the one that does the work. A written barrier that exists on paper and is routinely crossed without record does not satisfy a duty phrased that way, which is the gap most enforcement actions turn on.
The SEC’s Office of Compliance Inspections and Examinations published a staff summary report on examinations of information barriers after reviewing brokerage firms’ programmes for protecting against the misuse of MNPI. It remains the most specific published description of what examiners expect, and it identified four components of an effective programme.
| Component | What it means in practice |
|---|---|
| Removing decision-making authority from the business unit | The judgment about whether information may cross is made by a control group in compliance, not by the desk that wants the information |
| Formal procedures and documentation | Wall crossings, restricted lists, and watch lists are recorded contemporaneously rather than reconstructed later |
| Limiting the sharing of information | Need-to-know is applied at the level of individual people, not departments |
| Surveillance techniques | Communications and trading are monitored for patterns indicating leakage |
Three of those four are procedural controls carried out by people. Only the fourth is a monitoring technology, and it is the one that operates after information has already moved. Vendors selling detection tend to present the fourth component as the programme, which inverts the SEC’s own emphasis.
The report also cautioned firms about classifying individuals or groups as “above the wall” where physical barriers, documentation, or other controls are limited or absent, and noted that examiners found gaps in oversight coverage at most firms reviewed. Broader control context is set out in cybersecurity controls in banking.
Discover how Threatcop protects your workforce from modern cyber threats.
The wall crossing, or over-the-wall process, is the procedure by which someone on the public side is deliberately brought into possession of MNPI for a legitimate reason. It is the most human-dependent control in the entire framework, and it is missing from most discussions of information barriers.
The sequence is straightforward on paper. A banker identifies a need to consult someone outside the deal team. The request goes to the control group rather than being handled between colleagues. The control group decides whether to permit it, records who was crossed, when, and in respect of which issuer, adds the person to the relevant list, and restricts their activity accordingly. When the information becomes public or the deal dies, the person is brought back.
Every step of that depends on the banker recognizing, before the conversation happens, that they are about to cross a wall. No surveillance system can supply that recognition. By the time a monitoring tool observes the communication, the crossing has occurred, the person is contaminated, and the firm’s options have narrowed to remediation and disclosure.
That is the structural reason prevention in this domain is a training problem rather than a tooling problem. The moment of control arrives before any system has data to analyze, which is a pattern insider threat programmes encounter repeatedly.
The archetype of a barrier failure is a trader deliberately exploiting a tip. The common case is far more ordinary, and it is the one training can actually address.
An analyst replies to all on a thread that has quietly grown to include someone on the private side. A banker mentions a client name in a lift or an open-plan area. A shared drive permission survives a reorganization and nobody notices that a folder is now readable by a desk that should not see it. Someone forwards a deck to a personal account to work on it at home. A colleague asks a casual question at lunch and receives a helpful answer.
None of these involves intent to breach, and none of them is stopped by a policy document. What stops them is a person recognizing a situation as a wall-relevant moment and behaving differently because of it, which is a trained reflex rather than a rule lookup. The distinction between deliberate and inadvertent insider risk is developed in the difference between careless and deliberate insiders.
The full spectrum, from careless to deliberate, is mapped in insider threats: risks, identification and prevention. The practical consequence for programme design is that the population needing the deepest training is not the population most likely to act maliciously. It is the population most likely to be in the room when information moves without anyone deciding that it should.
Barriers were designed for an environment where communication was formal, physically separated, and logged. Hybrid work, messaging platforms, collaboration tools, and personal devices removed all three properties at once.
The scale of the resulting failure is documented in the off-channel communications enforcement campaign, in which regulators penalized firms for business conversations conducted on unapproved messaging apps and not preserved. What makes that campaign relevant to barriers specifically is not the penalty totals but the mechanism: conversations moved to channels where neither preservation nor surveillance applied, which means barrier monitoring was blind to them by construction.
Adding more channels to a surveillance estate is a partial answer at best, because each new platform arrives before the monitoring does, and the interval between adoption and coverage is exactly when the risk concentrates. Visibility limits of this kind are examined in insider threat detection.
The durable answer is that employees need to understand which conversations are wall-relevant regardless of the channel carrying them, because the rule attaches to the information rather than to the application.
Generic compliance training does not equip anyone to handle a wall-crossing moment. The content has to match what each population will actually encounter.
| Population | What they need to recognize | The behaviour being built |
|---|---|---|
| Investment banking | When a consultation requires a formal crossing rather than an informal question | Route the request to the control group before the conversation |
| Research | When an inbound request is seeking information they should not supply | Decline and report rather than deflect informally |
| Trading and sales | When a piece of information they hold changes what they may trade | Escalate immediately, before acting |
| Control room and compliance | Edge cases, documentation standards, and list hygiene | Consistent decisions and contemporaneous records |
| Support functions | That administrative access can carry MNPI exposure | Apply need-to-know to files and calendars, not only conversations |
| Senior management | That “above the wall” status carries documentation duties | Accept the controls that classification requires |
The last two rows are the ones most often skipped. Support staff frequently hold broader systems access than the front office, and senior executives are the population most likely to be classified above the wall and least likely to complete role-specific training on what that entails.
Threatcop’s TLMS delivers this layer as role-based and category-based content across compliance frameworks, with coverage reported by role rather than as a single firm-wide completion figure, so a control room and a trading desk receive different material and the firm can show which population got which. Design considerations are covered in matching training content to job function.
A barrier breach that is reported within the hour is a remediation exercise. The same breach discovered six months later by surveillance is an enforcement matter, because the firm cannot show it acted.
That difference is created entirely by whether someone chose to speak up, and in financial services the incentives against speaking up are unusually strong. Reporting an accidental crossing means telling compliance you may have contaminated yourself, with consequences for what you can work on and what you can trade. In a blame-oriented culture, the rational individual choice is silence, and the firm then holds a clean compliance record that reflects nothing.
Firms that get early reports have usually done three specific things: made self-reporting of accidental crossings explicitly non-punitive in writing, demonstrated it by handling a real case that way visibly, and made the reporting path fast enough to use in the moment rather than at the end of the day. Mechanics are set out in why employees stay silent about mistakes, and the cost argument in why weak human controls raise compliance costs.
Alert volume measures the monitoring system. These measure the programme.
Wall crossings recorded per period, where a suspiciously low number usually means informal crossings, not disciplined separation
Median time from crossing to control group record, which distinguishes a live process from retrospective paperwork
Self-reported accidental crossings, read as a health indicator rather than a failure count
Restricted and watch list accuracy, sampled against actual deal activity
Role coverage of training against the populations the barrier map identifies
Time from a new communication channel appearing to a policy decision about it
The first two are diagnostic in a way alert counts are not. A firm with an active pipeline and almost no recorded crossings is not exercising better discipline than its peers; it is failing to record something that is certainly happening. Metric selection of this kind is discussed in the goal of an insider threat programme.
Pull the count of formally recorded wall crossings for the last two quarters and compare it against the number of live transactions in the same period. If the first number is small relative to the second, the crossings are happening informally, and the firm’s documentation will not support the word “enforce” in Section 15(g) if an examiner asks.
Then train the populations that map identifies, on the moments they will actually face rather than on the policy in general. Deliver the role-specific version to banking, research, trading, and the support functions that quietly hold the broadest access, and report coverage by role so the programme can be evidenced rather than described.
Information barriers, historically called Chinese walls and now more often ethical walls, are the policies, procedures, and physical or technical separations that prevent material non-public information from moving between parts of a financial firm that must remain independent. Typical separations divide investment banking from research and advisory functions from proprietary trading, preventing insider dealing, front running, and conflicts of interest.
Section 15(g) of the Securities Exchange Act of 1934 requires broker-dealers to establish, maintain, and enforce written policies and procedures reasonably designed to prevent the misuse of MNPI. Section 204A of the Investment Advisers Act of 1940 applies the same duty to registered investment advisers. FINRA Rules 2241, 2242, 5270, and 5280 address specific conduct, and the FCA covers the area through SYSC 10.2.
A wall crossing, or over-the-wall process, is the controlled procedure for giving someone on the public side access to MNPI for a legitimate business purpose. A control group within compliance approves the crossing, records who was crossed and in respect of which issuer, adds the person to the relevant restricted or watch list, and brings them back when the information becomes public or the transaction ends.
No. The SEC’s examination work identifies four components of an effective programme, of which only surveillance is a monitoring technology; the others concern where decision authority sits, documentation, and need-to-know discipline. Surveillance also operates after information has moved, whereas the decisive moment in a wall crossing occurs before any system has data to analyze.
A restricted list is typically visible within the firm and prohibits activity in named securities, such as proprietary trading or research publication. A watch list is confidential to the control group and is used to monitor activity in securities where the firm holds MNPI without signalling that it does. Maintaining the confidentiality distinction is itself part of the barrier.
Yogyata Sethi is a finance professional at Kratikal with experience in financial analysis, business operations, and corporate finance. She has contributed to key business initiatives, including strategic growth and the company’s public listing journey. Currently pursuing an MBA in Finance, Yogyata is passionate about financial planning, business strategy, and data-driven decision-making. She focuses on creating insights that support sustainable growth and long-term business value.
NIST requires 15 characters, not 25. See what SP 800-63B-4 actually says, why Grover's algorithm changes less than claimed,...
Verifying an AI-generated image means checking provenance rather than appearance. Detection classifiers degrade as generators improve, so the reliable...
Shadow AI governance is the practice of finding, assessing, and managing the AI tools employees use without approval. Most...
