According to the SEC's order, the violations by Robinhood related to the following conduct: Suspicious Activity Reporting: From January 2020 through March 2022, Robinhood failed to timely investigate suspicious transactions, resulting in systematic failures to timely file suspicious activity reports. Identity Theft Protection: From April 2019 to July 2022, Robinhood failed to implement adequate policies and procedures designed to protect their customers from the risk of identity theft. Unauthorized Access to Robinhood Systems: From June 2021 through November 2021, Robinhood failed to adequately address known risks posed by a cybersecurity vulnerability related to remote access to their systems. In November 2021, a third party obtained unauthorized access and downloaded information related to millions of individuals who had provided that information to Robinhood.