Truist's Civil Penalty Topped the Rep's: The Cancel-Rebill Supervision Lesson

Truist Advisory Paid $200,000 for One Representative's Cancel-Rebill Scheme

On September 22, 2026, the SEC fined Truist Advisory Services, Inc. $200,000 over a cancel-rebill scheme run by one of its representatives, Gary Steven Costello. Costello was an investment adviser representative who had the firm cancel losing trades in his personal margin account and rebill them to client accounts. The settled order, Advisers Act Release No. 7016, finds that the firm willfully violated Advisers Act Sections 206(2) and 206(4) and Rule 206(4)-7, the compliance program rule.

But here is the part the headlines are missing. The firm's $200,000 civil penalty was larger than Costello's own $195,000 civil penalty, according to the SEC's July 16, 2025 order against Costello. Costello was also ordered to pay $1,291,491 in disgorgement and $184,681 in prejudgment interest, so his total monetary sanctions far exceeded the firm's. The civil penalties alone still tell the story: the SEC set the firm's penalty above the individual's. And the first outside party to ask about his account was not Truist's compliance team. It was the custodian, which inquired about his margin calls and trade corrections on July 25, 2023, almost five months after the scheme began.

The test for your firm is concrete. Pull every cancel-rebill that moved a position from an employee account to a client account, and confirm that your own surveillance, not the custodian, would have flagged it first.

Two SEC Orders, Two Sets of Numbers

Compliance Building's write-up tells the story bluntly. A representative traded for his clients and for himself, lost money in his own account, and pushed those losses onto his clients. The facts sit in two separate SEC orders, and the figures in them should not be blended.

The Costello order (July 16, 2025)

The SEC settled proceedings against Costello on July 16, 2025, in Securities Act Release No. 33-11380, Exchange Act Release No. 34-103474 and Advisers Act Release No. IA-6897 (File No. 3-22494), according to the settled order. The order covers both his broker-dealer and advisory activity.

• Scope: According to the order, from March to August 2023, he transferred 30 securities purchases with almost $1.3 million in unrealized losses into clients' and customers' accounts.
• Violations: The SEC found willful violations of Securities Act Section 17(a), Exchange Act Section 10(b) and Rule 10b-5, and Advisers Act Sections 206(1) and 206(2).
• Sanctions: The order imposes a permanent industry bar, a penny-stock bar, a cease-and-desist order, disgorgement of $1,291,491, prejudgment interest of $184,681, and a $195,000 civil penalty.

The Truist Advisory order (September 22, 2026)

The firm's order covers only the advisory side. It involves ten cancel-rebilled trades moved to four advisory clients, with $503,659 in unrealized losses and numerous margin calls. The SEC brought it roughly 14 months after it resolved the individual case. Closing the case against the representative did not close the firm's exposure.

The Distinction That Matters: A Rogue Representative Versus a Blind Program

Many executives assume that one bad actor is a personnel problem and not a firm problem. That assumption is wrong in a specific way. The Truist order does not punish the firm for hiring someone dishonest. Paragraph 14 of the Truist order expressly finds that the firm failed reasonably to supervise under Advisers Act Section 203(e)(6), alongside the Section 206(2), Section 206(4) and Rule 206(4)-7 violations described above. The finding is about supervision, not the hire.

The warning signs were in the account

According to the Truist order, Costello joined Truist Advisory in November 2022 and traded on margin in his personal account. That trading included day-trading and stocks priced under $5, and it produced frequent large margin calls. None of this was hidden. It was the profile of an employee under financial pressure, sitting next to client accounts he controlled.

The timeline tells the story

The SEC's timeline in the Truist order runs as follows:

1. March 3, 2023: The cancel-rebills begin.
2. July 25, 2023: The custodian asks about his margin calls and trade corrections (paragraph 8).
3. August 1, 2023: A specific inquiry follows (paragraph 4), and the last cancel-rebill takes place.
4. August 3, 2023: An investigation begins (paragraph 11).
5. August 4, 2023: Costello is restricted (paragraph 11).
6. August 14, 2023: Truist terminates him (paragraph 11).

Every step after July 25 followed the custodian's question, and the termination came 20 days after it. That gap is the entire case against the firm. A compliance program that moves quickly once someone else raises the alarm is not the same as a program that raises the alarm itself.

What Your Firm Should Test This Quarter

The Truist order is a test your own program can take before the SEC gives it. Four controls deserve attention this quarter.

1. Trade corrections that move positions from employee accounts to client accounts

Pull every cancel, rebill, and trade reallocation from the last twelve months. Flag any correction where the original account belongs to an employee and the receiving account belongs to a client. Each one needs a documented reason, a supervisor approval dated before the rebill, and a check on whether the position was sitting at a loss when it moved. In the Truist matter, ten such trades moved $503,659 in unrealized losses into four advisory clients' accounts.

2. Margin activity in employee personal accounts

Review the personal accounts of every representative with trading authority over client accounts. Frequent large margin calls, day-trading, and positions in stocks under $5 are the profile the Truist order describes. Set a threshold that routes those accounts to compliance, and document what compliance did with each alert.

3. Custodian inquiries and alerts

Map every channel through which a custodian can raise a question about an employee or client account, and confirm each one reaches compliance promptly. Then ask the harder question: would your own surveillance have found the problem before the custodian did? At Truist, the custodian got there first.

4. The annual Rule 206(4)-7 review

Rule 206(4)-7 requires an annual review of whether your policies work. Test the trade-correction and personal-trading procedures against real account data, not against the written manual. A procedure that exists on paper and never produces an exception is not a working control.