TAG Associates SEC Fine: Stopping Fraud Was Not Enough to Avoid a Reg S-ID Charge

A $175,000 Penalty With No Identified Client Loss

The SEC fined TAG Associates LLC $175,000 on October 23, 2026 for failing to update its identity theft prevention program and for failing to submit some client accounts to an outside auditor, as Law360 reported. According to the SEC's administrative proceeding summary (File No. 3-22777), TAG, a New York-based investment adviser to high-net-worth individuals and private funds, agreed to a cease-and-desist order, a censure, and the civil penalty without admitting or denying the findings.

But here is the part the headline is missing. According to Debevoise's analysis of the order, the SEC did not identify any successful identity theft, fraudulent transfer, or client loss. The order instead describes unsuccessful fraud attempts, including one where existing verification procedures stopped an unauthorized wire.

What the order does identify is a written program that went unreviewed between June 2014 and December 2023 while TAG detected red flags.

What the SEC Actually Found

The Commission's order (Advisers Act Release No. 7028) finds violations of two separate regimes, and the Reg S-ID finding is characterized as willful.

Regulation S-ID

• No internal review. TAG did not undertake any internal review of its written program for roughly nine and a half years.
• No updates for detected red flags. The program was not periodically updated to address red flags TAG itself had identified.
• No senior oversight. The order finds TAG did not involve the board, an appropriate committee, or a designated senior-level employee in administering the program.

The Custody Rule

The Custody Rule finding covered 116 clients or client accounts with more than $129 million in regulatory assets under management. From approximately December 2015 through July 2024, TAG failed to identify 112 of those accounts to its independent public accountant, so they were not subject to surprise examination. The order also finds TAG failed to maintain certain securities with a qualified custodian, relying on the privately offered securities exception even though the limited liability company clients were not audited and did not distribute financials to beneficial owners, as the exception requires.

Reading the Signal: Blocked Fraud Did Not Excuse a Stale Program

The distinction that matters here is between a control that works and a program that is maintained. TAG's existing verification procedures stopped at least one unauthorized wire, per Debevoise. Its written program did not evolve.

According to Debevoise, the SEC faulted TAG for not reviewing and updating its program despite numerous attempted identity theft incidents.

Debevoise notes it is unclear whether the SEC would have brought the Reg S-ID charges as a standalone case, since the settlement also resolved the Custody Rule violations. The SEC charged TAG's Reg S-ID program failures alongside the custody violations even though, per Debevoise, the order identifies no successful theft, and the charges rested on TAG's failure to review, update, and oversee its written program despite its awareness of attempted fraud.

What Your Leadership Team Should Decide This Quarter

These items are owned by the CEO and CCO, not delegated to IT.

Reg S-ID program

• Date-stamp your last review. If your written program has no documented internal review, that is the TAG fact pattern.
• Map incidents to updates. Pull every attempted fraud from the last 24 months and confirm each one triggered a documented assessment of whether the program needed to change.
• Name an owner in writing. Designate the board, a committee, or a specific senior-level employee to administer the program, and minute their review.

Custody

• Reconcile the surprise examination list. Compare every account where you have custody, including LLCs and entities where employees serve as managers or officers, against the list given to your independent public accountant.
• Verify the privately offered securities exception. Confirm any reliance on the privately offered securities exception is backed by audited financials actually distributed to beneficial owners.
• Test entity roles. The order finds that TAG employees served as managers, co-managers or officers of four LLC clients, giving them authority to obtain client assets; confirm whether any employee role at a client vehicle creates custody you have not inventoried.

Have SEC exam counsel review your Reg S-ID program and custody inventory against the TAG order before your next examination, not after.