Who can change the model?

What happened, in one paragraph

Two Sigma knew, for four years, that anyone could change its live trading models without review, and did not fix it until after someone did.

The SEC’s order, settled in January 2025, found that Two Sigma Investments and Two Sigma Advisers breached their fiduciary duty and failed to maintain the compliance policies the Advisers Act requires.¹ The specific failure is unusually concrete. The parameters that drive Two Sigma’s algorithmic models were stored in a database, called celFS, that dozens of employees could read from and write to, with no approval process and no monitoring. The firm’s own engineers flagged the risk in March 2019 and escalated it repeatedly, including a memo to a cofounder in 2022 and a near-miss that nearly halted trading. The firm did not adequately address it until October 2023. During that window, a single modeler made dozens of unauthorized changes to the parameters of fourteen live models, changing what they recommended, and the changes went undetected for roughly two years. The resulting distortion caused some client funds to overperform by more than $400 million and others to underperform by about $165 million, which Two Sigma later repaid. The SEC imposed a $90 million penalty, and separately found that Two Sigma’s departure agreements had chilled employees from reporting concerns to the SEC. Two Sigma settled without admitting or denying the findings.

The number: money moved between clients

The striking figure in this case is not the $90 million penalty. It is the split underneath it: unauthorized changes to the models caused some client funds and accounts to overperform by more than $400 million, and others to underperform by about $165 million.¹

Sit with what that means. The tampering did not simply lose money. It redistributed it. Because the same altered models drove decisions across many funds and separately managed accounts, the distortion helped some clients and hurt others, none of whom knew their returns were being shaped by changes no one had approved. A client whose account happened to benefit was, unknowingly, on the winning side of a control failure. A client whose account suffered was on the losing side, and had to be made whole afterward.

For a fiduciary, that is close to the worst version of a controls failure. The duty is to treat clients fairly and to act on decisions the firm actually made. An ungoverned model breaks both at once: the decisions were not the firm’s, and their effects fell unevenly across the people it was supposed to serve.

A firm that is its models

Two Sigma is not a firm that happens to use models. It is a firm that is its models. A large, quantitative-analytics-based hedge fund manager, it uses computer-based algorithmic models to make the investment decisions for dozens of private funds, separately managed accounts, and its own proprietary capital.¹ The models are not a tool that supports the investment process. They are the investment process.

That is what makes the control gap so serious. At a discretionary manager, a human portfolio manager sits between any system and a trade, and can sanity-check an odd instruction. At Two Sigma, the model’s output is the decision. There is no second human reading each recommendation and asking whether it looks right. The integrity of the model, and of the parameters that define it, is therefore not a technical detail. It is the whole basis on which client money is managed.

Which raises the obvious question, and the one the SEC effectively asked: if the model is the decision-maker, what governs changes to the decision-maker? For four years, at Two Sigma, the answer was very little.

The open door

The technical heart of the case is a database and who could write to it. Model parameters, the numbers that tune what each model does, were stored in celFS. During the relevant period, numerous Two Sigma personnel had unfettered read and write access to it, and could change those parameters without review or approval.¹ There was no gate between a person and a live trading model.

This is a control that almost every engineering organization treats as table stakes for production systems: you do not let an individual push an unreviewed change straight to production. Code review, approval, and an audit trail are standard precisely because the alternative is exactly what happened here. Two Sigma’s models were, in effect, production systems managing billions of dollars, and for years they were editable in a way most firms would not permit for a minor internal app.

Four years of warnings

What turns a vulnerability into a finding is knowledge. Two Sigma did not stumble into this gap unaware. Its own people identified it, documented it, and escalated it, for years.¹

The paper trail is damning precisely because it is so clear. In March 2019, employees circulated emails and a memorandum about the lack of read and write controls on celFS. In January 2022, a senior engineer sent a memo directly to a cofounder and other executives, warning that it was “dangerous” to allow unrestricted write access and that efforts were underway to limit it. In May 2022, an employee accidentally overwrote an entire volume of model parameters shortly before markets opened, which would have stopped several models from generating forecasts; the firm reversed it in time, and its own post-mortem named the same 2019 access gap as the cause.¹

A vulnerability no one saw coming is a misfortune. A vulnerability identified, escalated to the top, demonstrated by a live near-miss, and still left open for another year and a half is something a regulator reads as a choice. That gap between knowing and acting is the spine of the SEC’s case.

The modeler who walked through it

An open door is a risk. This one was used. Between November 2021 and August 2023, a modeler the SEC calls Modeler A made dozens of unauthorized changes to the decorrelation parameters of fourteen different models that Two Sigma used in live trading, including models he had built and models built by his direct reports.¹

These were not harmless tweaks. The changes caused the models to behave differently than they were designed to, so that Two Sigma made investment decisions it otherwise would not have made in the funds and accounts it advised. And they stayed invisible for roughly two years, because there was nothing watching the database for changes. The firm only discovered them in August 2023, when it finally began monitoring celFS to confirm that modelers were not making unauthorized changes, the very control it had lacked all along.

It is worth being precise about what the detective control did here. The monitoring did not prevent anything. It simply made the invisible visible. The moment Two Sigma started looking, it found the changes almost immediately. For two years, the only thing standing between an insider and fourteen live models was the hope that no one would do what the system plainly allowed.

The fix that wasn’t

Two Sigma did respond to the May 2022 near-miss, which makes what it did next instructive. In June 2022, it limited direct access to celFS to a small team of engineers and required a written ticket from a modeler for any parameter change.¹ On paper, that looks like a control. In practice, it had a hole the size of the original problem: the tickets did not have to be reviewed, tested, or approved.

So the gate was a door that always opened. Between February and August 2023, Modeler A simply submitted tickets for the changes he wanted, knowing, as the SEC put it, that they would not be substantively reviewed or questioned.¹ The process had added a step without adding any scrutiny. It created a record of changes while doing nothing to validate them.

This is the most portable lesson in the case for anyone designing governance, in markets or in AI. It is easy to build a process that looks like oversight: a form, a ticket, a sign-off field. It is the review that is hard, and the review is the entire point. A change-management process in which no one has the authority, the information, or the mandate to reject a change is a conveyor belt with a clipboard next to it.

Winners and losers

Return to the money, because the shape of the harm is unusual and worth seeing plainly.¹

Note what repayment can and cannot do. Two Sigma voluntarily returned about $165 million to the funds and accounts that were hurt, which addresses the loss. It does nothing about the mirror image: the clients whose returns were inflated by changes no one approved received a benefit they were never entitled to, at the structural expense of the fairness the firm owed everyone. You can refund a loss. You cannot easily unwind a redistribution. That asymmetry is why a fiduciary cannot treat model integrity as a back-office concern. When the model is the decision-maker, an ungoverned change is not an operational glitch. It is the firm silently favouring some clients over others.

The second door

Alongside the model-governance findings sits a separate one that is easy to overlook and important not to. From April 2019 to February 2024, Two Sigma required departing employees, in order to receive certain post-separation payments, to represent that they had not filed any complaints against the firm.¹ The SEC found this violated its whistleblower protection rule, Rule 21F-17, because it impeded employees from reporting possible securities-law violations to the Commission.

Read the two findings together and a pattern appears. The first door was the one into the models, left open. The second was the one out to the regulator, pushed closed. A firm that makes it awkward for departing insiders to talk to the SEC, while running a model environment its own engineers are warning about, has reduced the odds that an outside party ever hears what the inside already knows.

The SEC has pursued a steady line of these 21F-17 cases precisely because the chilling effect is structural, not hypothetical. Separation agreements, confidentiality terms, and employment contracts that condition benefits on silence toward regulators undercut the early-warning system the whole disclosure regime depends on. Two Sigma revised the language in February 2024 to carve out communications with the SEC, but the years it was in force are part of the order.

A model is production code

Strip this case to its principle and it is the one every organization deploying models and AI needs to internalize now: a model is production code, and it deserves the controls of production code. The sophistication of the model is irrelevant if anyone can change it without review and no one is watching.

The governance of models still skews heavily toward whether the model is good: is it accurate, is it validated, does it perform. That matters. But Two Sigma’s models may well have been excellent. The failure was not in the models. It was in everything around them: who could touch them, whether a change was reviewed, and whether the firm could even detect that a change had been made. Those are not data-science questions. They are the same access, change-management, and monitoring controls that protect any critical system.

As firms wire AI models into decisions that used to run through people, the attack surface moves with them. The risk is no longer only a human making a bad call. It is a parameter, a prompt, a weight, a config quietly changed, by an insider, a mistake, or eventually an automated process, with no gate and no log. The discipline Two Sigma lacked is the discipline every AI deployment needs: govern who can change the model, make every change reviewable and reviewed, and watch the thing continuously, so that the first person to notice a change is never a regulator.

What good model governance looks like

The controls that would have prevented this are not exotic, and the recommendations attached to the case name them directly.² They are the ordinary disciplines of production change management, applied to the thing that actually makes the decisions.

• Segregation of duties on model access. Role-based access so that the people who develop models cannot unilaterally change live parameters. Developers propose; a separate, authorized role reviews and approves.
• A real change-approval process. Every change to a live model proposed, independently reviewed, tested where appropriate, and approved by a second person before it reaches production, with a ticket that must be acted on, not merely filed.
• Automated monitoring of model changes. Continuous detection and alerting on any change to model parameters, reconciled against approved changes, so an unauthorized edit surfaces in hours, not after two years.
• Access reviews and attestations. Periodic recertification of who can touch the model environment, with prompt removal on role change, so entitlements do not quietly accumulate.
• A protocol for known vulnerabilities. A process that takes an identified, escalated control gap and drives it to closure on a clock, so a 2019 finding cannot still be open in 2023.
• Whistleblower channels kept open. Separation and confidentiality agreements that expressly preserve the right to report to regulators, and internal channels that make raising a model-risk concern safe and routine.

The pattern

The specifics are new; the shape is familiar. Regulators have a long record with the models that drive investment decisions, and it is rarely about the math. It is about governance: models built with errors, model code that broke and produced trades no one intended, and known weaknesses that were concealed or left to run.

Read alongside these, Two Sigma is the purest version of the theme. There was no disguise, no concealment of risk from clients, no complex instrument. There was simply a model that drove decisions, a door into it that anyone could open, a warning that went unheeded for four years, and no one watching. The lesson generalizes exactly because the facts are so plain: the governance of the thing that makes the decision matters at least as much as the quality of the decision.

The question to answer first

It would be comfortable to read this as a story about one firm and one modeler. It is more useful to read it as a preview. Two Sigma was early to running its business on models, so it was early to this particular failure. Most organizations are now heading the same way, wiring models and AI into decisions that used to pass through human hands, and inheriting the same question whether they have asked it or not.

The SEC did not fault Two Sigma for using models, or for the models being wrong. It faulted the firm for not being able to trust its own models, because it had not governed the one thing that makes a model trustworthy: control over who can change it, and visibility when they do. That is not a quant problem or an AI problem. It is a controls problem, as old as production systems, arriving now at the center of the business. The firms that answer the question before the regulator asks it will be the ones that treated their models, from the start, like what they are: the most important code they run.