Japan's Financial Services Agency (FSA) has issued business improvement orders to three units of Mitsubishi UFJ Financial Group (MUFG), the country's largest banking conglomerate, for violating client confidentiality rules.

Japan Regulator Penalizes MUFG Units for Client Data Breaches

The FSA directed MUFG Bank Ltd., Morgan Stanley MUFG Securities Co., and Mitsubishi UFJ Morgan Stanley Securities Co. to enhance their operations following an investigation that revealed repeated instances of unauthorized sharing of non-public client information among the group's entities.

According to the regulator, the firms exchanged sensitive client data at least 26 times without consent, some of which contained material information that could impact investment decisions. In one instance, a board member of Mitsubishi UFJ Morgan Stanley Securities received confidential client information from an executive officer of MUFG Bank, which was subsequently used for soliciting financial instrument sales.

“The above three firms repeatedly shared non-public client information, knowing that their clients asked not to share their information with other firms within the group, and some of the information contained material information that would impact investment decisions,” the FSA commented. “These findings led to the conclusion that the three firms had deficiencies in internal control environment for the management of information.”

The FSA also found that MUFG Bank had engaged in prohibited securities-related activities, including negotiating underwriting shares on behalf of Mitsubishi UFJ Morgan Stanley Securities. In some cases, the bank allegedly conducted tie-in negotiations, linking loan agreements to increased underwriting allocations for the securities arm.

These actions violate Japan's Financial Instruments and Exchange Act, which prohibits the sharing of non-public information between banking and securities units without client approval. The law aims to prevent banks from leveraging their lending relationships to gain unfair advantages in investment banking activities.

The regulatory action has already impacted MUFG's business, with some clients reportedly shifting their bond underwriting business to competitors. An FSA official, while noting that MUFG did not abuse its superior bargaining position, emphasized that sharing client information without permission was a "big problem."

The FSA has mandated all three entities to submit detailed business improvement plans by July 24, 2024, focusing on strengthening compliance frameworks, particularly in bank-securities collaborative business and client information management. The regulator also requested regular progress reports on the implementation of these plans.