Twenty-one percent in three weeks. Advertised as 2,700% a year.

A $1.05 million penalty for a number that could not be true

On 21 August 2023, the Securities and Exchange Commission settled proceedings against Titan Global Capital Management USA LLC, a FinTech investment adviser that delivered personalized advice to retail investors through a mobile app and managed roughly $548 million, imposing total sanctions of $1,050,052 in penalty, disgorgement, and a Fair Fund for affected clients. The order was one of the first enforcement actions under the SEC's amended Marketing Rule, Advisers Act Rule 206(4)-1, and it found violations of that rule, of the compliance-procedures rule 206(4)-7, and of the antifraud provision Section 206(2). The headline conduct was a single advertised figure: an annualized return for the Titan Crypto strategy as high as 2,700%.¹

The 2,700% is worth understanding exactly, because its construction is the whole lesson. Titan Crypto launched on 10 August 2021. Over its first three weeks, through the end of August, a hypothetical account, one that reflected no actual client trading, returned about 21%. Titan took that three-week, 21% figure and annualized it by assuming the strategy would continue to return 21% every three weeks for an entire year, which compounds to roughly 2,700%. The firm then advertised that number to a mass audience of retail investors on its website and app, without disclosing that it was hypothetical rather than real, that it was extrapolated from only three weeks, that it rested on the assumption of 21% repeating seventeen times over, whether it was net of fees, or what the risks and limitations of relying on it were. A number that could not have been a genuine expectation of anyone's returns was presented as a performance result to exactly the audience least equipped to see through it.

But the 2,700% was only the most vivid of a set of failures that together describe a firm scaling a modern advice platform faster than it built the compliance underneath it. Titan had voluntarily opted into the new Marketing Rule early and then failed to adopt any policies or procedures to comply with it. Its wrap-fee brochure contradicted itself about who held clients' crypto assets, on page 8 against page 45, and named no actual custodian. Its client agreements contained a hedge clause that implied clients had waived legal rights they could not waive. It told clients it had personal-trading controls for crypto that it had never built. And for three years its employees applied clients' electronic signatures to transfer authorizations themselves, more than 3,000 times, without the clients knowing their signatures were being used. This study walks each failure and lifts it into the discipline it violated: why the way a performance number is computed can be a lie even when the inputs are real; why a figure's propriety depends on who is reading it; why electing a standard obligates you to its machinery; why an internally contradictory disclosure is misleading by construction; why a fiduciary cannot contract out of its duty; and why authorization must be verified rather than assumed.

The Marketing Rule meets a retail app

To see why Titan's 2,700% was not merely aggressive but a rule violation, you have to understand what the SEC's Marketing Rule requires and the audience Titan was speaking to. In December 2020, the Commission adopted significant amendments to Advisers Act Rule 206(4)-1, the rule that governs how registered investment advisers may advertise. The amended rule, which advisers were required to follow by November 2022, set specific conditions on the use of performance figures, and especially on hypothetical performance, the category into which Titan's 2,700% fell because it reflected no actual client account's results. Among its requirements, the rule permits hypothetical performance in an advertisement only if the adviser has adopted policies and procedures reasonably designed to ensure the hypothetical performance is relevant to the likely financial situation and investment objectives of the intended audience, and provides the information underlying the hypothetical performance.¹

Read those conditions against Titan's situation and the mismatch is immediate. The rule ties the permissibility of a hypothetical figure to the intended audience and whether the figure is relevant to that audience's financial situation and objectives. The entire regulatory design assumes that hypothetical performance is dangerous in proportion to the sophistication of who sees it, and that an adviser must tailor, and gate, its use accordingly. Titan's audience was the opposite of tailored. Titan was a FinTech adviser whose client base was primarily retail investors, reached through a mobile app and a public website, which is to say a mass, undifferentiated, largely unsophisticated audience, exactly the audience for whom a hypothetical 2,700% is most likely to be taken as a real and achievable return. The rule's audience-relevance condition exists to prevent precisely what Titan did: broadcast a hypothetical figure, stripped of the context that would let a reader understand it, to a crowd with no ability to supply that context themselves.

The context also matters because Titan was a certain kind of firm, a technology platform scaling retail advice through an app, and that model carries a specific compliance hazard that recurs throughout this case. The app form factor compresses complex financial representations into headline numbers and simple screens, and it reaches enormous numbers of unsophisticated users at once, which means an error in what the app displays is an error shown instantly to a mass audience with high reliance and low ability to question it. A 2,700% figure on a brokerage statement read by an institution is one thing; the same figure on a consumer app, next to a one-tap invest button, read by retail investors, is another. The Marketing Rule's conditions, audience relevance, underlying information, risk disclosure, are the regulatory answer to exactly that hazard, and Titan, a retail app, was the firm those conditions most squarely governed and the firm that most completely ignored them.

How 21% became 2,700%

The arithmetic that produced 2,700% is worth walking slowly, because every step is individually unremarkable and the result is nonetheless a fabrication, which is what makes it such a clean illustration of how a performance number lies. Titan Crypto launched on 10 August 2021. In the roughly three weeks that followed, to the end of August, the strategy, measured in a hypothetical account that reflected no actual trading, returned about 21%. That 21% over three weeks was the only real input. Everything else was extrapolation: to get an annualized figure, Titan assumed that the 21% three-week return would recur, three-week period after three-week period, for a full year, which, compounded across the roughly seventeen such periods in a year, yields an annualized return on the order of 2,700%.¹

The crucial feature of this construction is that the dishonesty does not live in any single calculation; it lives in the assumption that the calculation silently embeds. Annualizing a return is a standard and legitimate operation when the underlying period is representative and the extrapolation is reasonable. It becomes a fabrication when the underlying period is too short to be representative and the assumption required to annualize it, here, that a 21% three-week return would repeat seventeen times in a row, is one no reasonable person would make and that Titan itself surely did not believe. The firm did not disclose its own view of the likelihood that the strategy would actually generate 21% every three weeks for a year, because the honest answer, that this was wildly improbable, would have destroyed the number. So the 2,700% was presented as a performance result, implying it described something real about the strategy's returns, when it was in fact the output of an assumption, embedded in the annualization, that the firm could not and did not defend. The percent sign made it look like a measurement; it was a projection resting on a premise no one would state out loud.

And the figure was shown stripped of everything that would have let a reader reconstruct what it really was. The advertisement did not disclose that the return was based on a purely hypothetical account rather than actual performance, that it was extrapolated from only three weeks, that the three-week figure was 21%, that the 2,700% assumed that 21% would continue for a year, or Titan's views on whether that assumption would hold. It also did not adequately disclose whether the figure was net of fees and expenses, and it relied on generic embedded hyperlinks that, the SEC found, did not adequately alert the mass retail audience that vital information was available through them. A reader of the Titan app saw 2,700% annualized and had no way, from what was shown, to know that the number was a three-week result multiplied by an indefensible assumption. The construction was hidden, and only the conclusion was displayed.

The computation can be the lie, even when the inputs are true

Titan's 2,700% crystallizes a discipline that firms and their marketers consistently miss because it hides inside apparently neutral math: a performance figure can be materially misleading even when every underlying number is accurate, because the method of computation, the annualization, the extrapolation, the selection of period, the choice of what to include, embeds assumptions that can be false, and a figure presented without its method is a conclusion detached from the premises that would reveal it is not what it appears to be. Titan's 21% was real; the 2,700% was a lie, and the lie lived entirely in the computation that connected them.¹

The reason this is so easy to get wrong is that math carries an aura of objectivity that disclaimers do not. A firm that writes a false sentence knows it is making a claim that must be true. A firm that performs a calculation can feel it is merely reporting a fact, because the output is a number and numbers feel like measurements rather than assertions. But a computed performance figure is an assertion, and a dense one: it asserts that the method used to produce it was appropriate, that the assumptions embedded in the method were reasonable, and that the resulting number means what a reader will take it to mean. Annualizing three weeks asserts that three weeks is representative of a year, which is false. Compounding 21% across seventeen periods asserts that the 21% will recur, which is indefensible. Presenting the result as "annualized performance" asserts that it describes the strategy's returns, when it describes an assumption about them. Each of these assertions is embedded in the arithmetic and invisible in the output, which is exactly why a figure must always be accompanied by the method and assumptions that produced it, so the reader can evaluate the assertions rather than only see the conclusion. A number without its method is a claim that has hidden its own premises.

Disclose the method, and test the assumptions the math embeds

The discipline is that any computed figure a firm publishes, above all a performance figure, must be accompanied by the method and the material assumptions used to produce it, prominently enough that the intended audience can actually evaluate them, and those assumptions must themselves be tested for reasonableness before the figure is published. Concretely, a firm should never present an annualized, extrapolated, projected, or model-derived number without disclosing the period it is based on, the key assumptions the computation requires, whether it is net of fees, and the firm's own view of the assumptions' reliability, and it must treat an assumption the firm would not defend in plain language, such as 21% every three weeks for a year, as a reason not to publish the figure at all rather than a detail to omit. The test is whether a firm could state, in words, the assumptions its number embeds and stand behind them; if saying the assumption out loud, we assume this strategy returns 21% every three weeks indefinitely, would be absurd, then the number resting on it is misleading no matter how the arithmetic checks out. Titan's inputs were accurate and its output was a fabrication, because the method in between embedded an assumption that could not survive being stated, and the discipline is to state the method, test the assumption, and never let a conclusion travel without the premises that would expose it.

A number is only as honest as its audience

The Marketing Rule did not simply require Titan to disclose more about its 2,700%; it tied the very permissibility of a hypothetical figure to who would see it, and that linkage is the second deep lesson of the case. The rule permits hypothetical performance only where the adviser has procedures reasonably designed to ensure the figure is relevant to the likely financial situation and investment objectives of the intended audience. The regulatory judgment embedded in that condition is that the same number can be acceptable for one audience and misleading for another, and that an adviser must therefore control who receives a hypothetical figure, not merely what disclaimers accompany it. Titan broadcast its hypothetical figure to the broadest, least sophisticated audience possible, retail users of a consumer app, which is the audience for which the rule is most protective and for which a bare 2,700% is most dangerous.¹

This audience-relativity of truth is unintuitive and important. We tend to think of a statement as true or false in itself, independent of who hears it, but a performance figure's honesty is a function of what the reader will understand it to mean, and different readers understand the same number differently. A sophisticated institutional investor who sees "2,700% annualized, hypothetical, extrapolated from three weeks" can mentally discount it to nothing, recognizing the construction for what it is. A retail investor scrolling a consumer app sees "2,700%" and may reasonably, if wrongly, take it as an indication of what the strategy can do. The figure has not changed; its capacity to mislead has, because the reader's ability to contextualize it has. The Marketing Rule's audience condition encodes exactly this: it makes the adviser responsible for whether the figure is appropriate for the specific audience receiving it, which means a figure defensible in a tailored communication to qualified investors can be a violation when pushed to a mass retail app. Titan treated its 2,700% as if its honesty were a fixed property of the number; the rule treats honesty as a property of the number in front of its audience, and by that standard the figure was misleading because of who Titan showed it to.

The generic hyperlinks compound the audience failure and illustrate its mechanism. Titan did include some underlying information, but behind generic embedded links that, the SEC found, did not adequately alert the mass retail audience that vital information was available. For a sophisticated reader, a link labeled with a generic reference might be a sufficient signal to go look; for a retail app user, a non-prominent hyperlink is effectively invisible, and the material context sits unread behind it while the headline number does its work. This is the audience principle operating at the level of design: whether a disclosure is adequate depends on whether the actual audience will actually see and use it, and a disclosure that a sophisticated reader would follow but a retail reader will scroll past has not been made to the audience that received the claim. Titan's context was technically present and practically absent, which for a mass retail audience is the same as absent.

Who reads it is part of whether it is true

The audience condition generalizes into a discipline that reaches every communication a firm makes to the public: the honesty of a claim is not a fixed property of its words or its numbers but a function of what the intended audience will understand it to mean, and a firm must therefore match both the claim and the prominence of its context to the sophistication of the actual audience, gating or tailoring communications that a mass audience cannot be expected to contextualize. Titan published a figure whose honesty depended on the reader supplying context the reader did not have, and the rule holds the firm responsible for that gap.¹

The reason firms violate this is that the same marketing content is cheap to broadcast to everyone and expensive to tailor by audience, so the default is to publish one version to the widest reach, and the widest reach is the least sophisticated audience. A performance figure, a capability claim, a risk statement, drafted with an implicit sophisticated reader in mind, is then pushed to a mass retail channel where the implicit reader does not exist, and the content that was borderline-defensible for the imagined audience becomes misleading for the real one. The discipline requires inverting that default: deciding first who the actual audience is, assuming the least sophisticated reader the channel will reach, and then determining what claims are appropriate and how prominent their context must be for that reader. For a mass retail app, this is demanding, because it means a hypothetical performance figure may simply not be publishable in that channel at all, regardless of disclaimers, if the figure cannot be made genuinely understandable to a retail reader, which is close to what the Marketing Rule concluded. The firm cannot discharge its obligation by burying context in a hyperlink and relying on the reader to be sophisticated enough to find it, because the obligation is defined by what the real audience will do, and the real audience will not.

Design the claim for the least sophisticated reader the channel reaches

The discipline is to determine the actual audience of every public communication, assume the least sophisticated reader that channel will reach, and match both the content of the claim and the prominence of its necessary context to that reader, gating figures and claims that cannot be made genuinely understandable to the mass audience rather than publishing them with context the audience will not use. For a firm reaching retail investors through an app, this means performance figures must be comprehensible, and their assumptions and risks visible, on the screen where the figure appears, not behind a generic link, and it means some figures appropriate for a tailored sophisticated communication must not appear in the mass channel at all. The test is whether a representative member of the actual audience, a retail app user, not an imagined analyst, would correctly understand the claim from what is actually placed in front of them, and a firm whose claims are only defensible on the assumption of a sophisticated reader who will chase down linked context has mismatched its content to its audience. Titan's 2,700% might, with full context, have been marginally defensible in a tailored communication to qualified investors; broadcast to a retail app with its context behind a generic link, it was a violation, because who read it was part of whether it was true.

Opting in without building the machinery

One detail of the case has an almost painful irony: Titan was not late to the Marketing Rule, it was early, and its early election is part of what produced the violation. The amended Marketing Rule was adopted in December 2020 with a compliance deadline of November 2022, but advisers were permitted to adopt it sooner, and Titan voluntarily elected to comply with the amended rule as of June 2021, well ahead of the deadline. Having opted in, however, Titan did not adopt and implement the written policies and procedures, or adapt its practices, to address the new requirements. It took on the obligations of the rule and built none of the machinery the rule required, and then advertised hypothetical performance, the 2,700%, under a rule it was now bound by and had not operationalized.¹

The irony is instructive rather than merely unfortunate, because it exposes a confusion between adopting a standard and implementing it that firms make constantly. Electing to comply with a rule is a decision; complying with it is an operational program, and the two are separated by exactly the work Titan did not do: writing the policies and procedures, building the controls, training the people, changing the practices so that the firm's conduct actually conforms to the rule's requirements. By opting in early, Titan assumed the rule's obligations ahead of schedule, which is laudable in intention, but it did so without assuming the rule's machinery, which converted an early good intention into early exposure. The firm was now measured against the amended rule's conditions, the audience-relevance procedures, the underlying-information requirements, from June 2021, and it had none of them, so every hypothetical-performance advertisement it ran in that window was a violation of a rule it had chosen to be bound by and had not implemented. Opting in without building is worse than not opting in, because it accepts the liability of the standard without acquiring the protection of its controls.

Elect a standard only with the program to meet it

The discipline is that electing to comply with a standard, voluntarily, early, or to signal sophistication, obligates the firm to build and implement the full operational machinery the standard requires before it begins operating under it, because the election is what binds the firm to the standard's conditions, and a firm bound to conditions it has not operationalized is in continuous violation. This means an early-adoption decision must be paired with an implementation program, the written procedures, the controls, the training, the practice changes, completed before the election takes effect, not deferred to the eventual mandatory deadline. The test is whether, at the moment a firm holds itself out as complying with a standard, it has the procedures and controls that make the compliance real, and a firm that has announced adherence to a rule while building none of its requirements has created a gap between its representation and its operation that is itself a violation of the compliance-procedures rules. Titan's early election to follow the Marketing Rule should have come with Marketing Rule procedures; without them, the election merely pulled forward the date from which its unbuilt compliance became an enforceable failure, and the 2,700% ran in exactly that gap between the obligation accepted and the machinery never built.

Electing a standard obligates its procedures

The failure to pair the election with implementation points to a broader discipline that governs every rule an adviser is subject to, whether elected or mandatory: a substantive requirement and the compliance procedures that operationalize it are two distinct obligations, and the compliance-procedures rule, 206(4)-7, is violated whenever a firm lacks the written policies and procedures reasonably designed to ensure the substantive rule is followed, independent of whether a substantive violation also occurs. Titan violated both the Marketing Rule's substance, by running misleading ads, and 206(4)-7, by never building procedures to ensure its ads complied, and the second violation is the structural one.¹

The reason 206(4)-7 exists as a separate obligation is that the securities regulatory scheme does not trust substantive compliance to happen by good intentions; it requires that firms build the machinery, the written procedures reasonably designed to prevent violations, that makes compliance systematic rather than accidental. A firm can, in principle, happen to comply with a substantive rule without any procedures, by luck, by the diligence of individuals, by the absence of occasion to violate it, but the compliance-procedures rule treats that absence of machinery as a violation in itself, because a firm without procedures is one violation away from a substantive breach at all times and has no systematic defense against it. Titan's story is the proof: it had no Marketing Rule procedures, which meant nothing in its operation was designed to catch a 2,700% figure before it published, so the substantive violation was not an aberration against a working system, it was the expected output of a firm that had built no system. The procedures rule is the regulator's insistence that compliance be engineered, and Titan's recurrence of failures, marketing, custody disclosure, personal-trading controls, signature verification, all traces to the same root the procedures rule targets: the firm had not built the machinery that would make any of these compliant by design.

Build the procedures that make each requirement systematic

The discipline is that for every substantive requirement a firm is subject to, it must build and implement written policies and procedures reasonably designed to ensure the requirement is met, treating the procedures as a first-class obligation whose absence is a violation regardless of whether a substantive breach has yet occurred. This means a firm's compliance program must map its substantive obligations to specific operational controls, for the Marketing Rule, a review process that tests performance figures against the rule's conditions before publication; for custody, a process ensuring disclosures match the actual arrangement; for personal trading, the preapproval machinery the firm represents it has, so that compliance is produced by the system rather than hoped for from individuals. The test is whether, for each rule the firm is subject to, it can point to the procedures reasonably designed to ensure compliance and show they are implemented, and a firm that is relying on good intentions, or on the absence of occasion to violate, has a 206(4)-7 problem waiting to become a substantive one. Titan had the obligation and not the machinery across every area the order touched, which is why a single firm generated violations spanning marketing, custody, fiduciary duty, and client authorization at once: the common cause was not many separate lapses but one missing thing, the procedures that operationalize obligations into systematic compliance.

The brochure that contradicted itself

The custody failure in the case has a feature that makes it especially instructive: the firm did not simply disclose something false, it disclosed two incompatible things in the same document, and the contradiction is itself the violation. Titan's wrap-fee brochure, distributed to clients and prospective clients, stated on page 8 that the Affiliate would buy and sell supported crypto assets and store crypto assets acquired by clients, held in a separate account in the name of the client at the Affiliate. Then, on page 45 of the same brochure, in direct contradiction to page 8 and to the firm's website, it stated that the Affiliate did not custody crypto assets but instead relied on unaffiliated third parties to provide custody. Within one document, the firm told clients both that the Affiliate held their crypto and that it did not.¹

A self-contradicting disclosure is a distinct and under-appreciated kind of failure, and it is worse than a simple misstatement in a specific way. When a disclosure is simply wrong, the client at least has a definite, if false, belief to act on, and the error can be identified and corrected. When a disclosure contradicts itself, the client has no reliable belief at all: whichever statement they read, the other one unsays it, and the document has failed at its basic function of conveying a fact the reader can depend on. The contradiction also signals something deeper about the firm's control over its own representations, because a document that says opposite things on page 8 and page 45 is a document no one read as a whole against itself, assembled from pieces that were never reconciled. The client cannot know which statement is operative, the firm has demonstrated it does not control the consistency of its own disclosures, and in Titan's case both statements were in any event false, because neither the Clearing Firm nor the Affiliate ever actually held the clients' crypto assets, and the brochure named no actual custodian. The contradiction was not a case of one true statement and one false; it was two incompatible claims, neither accurate, in the one document clients were given to understand where their assets were.

An internally inconsistent disclosure is misleading by construction

Titan's self-contradicting brochure crystallizes a discipline that applies to every disclosure document a firm produces: internal consistency is a requirement of adequate disclosure, not a stylistic nicety, because a document that states incompatible things cannot convey a reliable fact to the reader, and the contradiction is therefore misleading by construction regardless of whether either statement, taken alone, might have been defensible. A client reading Titan's brochure could not know who held their crypto, because the brochure answered the question two ways, and a disclosure that cannot be relied upon has failed as a disclosure.¹

The reason internal contradiction is so common and so corrosive is that disclosure documents are assembled, over time, by multiple people, from templates and prior versions and sectional updates, and no one reads the whole against itself to confirm it says one consistent thing. A page-8 description written at one time and a page-45 description written or copied at another can each seem fine in isolation and flatly contradict each other, and because disclosure review tends to proceed section by section, the contradiction survives, invisible to any reviewer who never reads page 8 and page 45 together. The harm is that the reader, who does rely on the document as a single source of truth, is left unable to extract a reliable fact from it, which defeats the entire purpose of disclosure, to inform the client, and exposes the firm, because a document that says a thing and its opposite is misleading no matter how the regulator resolves which half was true. For disclosures about where client assets are held, the stakes of this are at their highest, because the client's ability to assess the safety of their assets, and risks like custodian bankruptcy, depends entirely on knowing, reliably, who holds them, which a self-contradicting brochure makes impossible.

Reconcile every disclosure against itself, and against the operation

The discipline is that a firm must review each disclosure document for internal consistency as a whole, reconciling every statement against every other statement on the same subject, and must reconcile all of them against the actual operational reality, so that the document conveys one consistent, accurate fact the reader can rely on. This requires a review that reads the document integrally rather than section by section, specifically checking that descriptions of the same arrangement, custody, fees, services, controls, agree wherever they appear, and a process that ties those descriptions back to how the arrangement actually works, so that the brochure matches the operation and not merely itself. The test is whether every material fact in a disclosure is stated consistently throughout the document and across the firm's other materials, and matches reality, and a firm whose brochure answers the same question differently on different pages, as Titan's did on custody, has failed at the threshold of disclosure, before any question of whether a given statement was true. Titan's brochure contradicted itself and both halves were false and no actual custodian was named, which is three failures in one, but the foundational one is that the document could not be relied upon to say even one thing about where clients' assets were, and a disclosure that cannot be relied upon is not a weak disclosure, it is a misleading one by its own construction.

Who actually holds the assets

The custody contradiction matters so much because of what it was a contradiction about: the single most material fact in the relationship between a client and an adviser, which is who holds the client's money and assets and how safely. Titan's disclosures created the false impression that clients' crypto assets were held by the Clearing Firm and its Affiliate, when in reality neither ever held them, and Titan's disclosures did not identify the actual custodians at all. As the SEC put it, clients were provided misleading information about who held their assets, how those entities did or did not secure them, and whether the assets might be subject to financial risk such as custodian bankruptcy. The question the brochure fumbled was not a technicality; it was the question of where the client's property actually was.¹

Custody disclosure sits at the center of investor protection for a reason that the crypto context made vivid. A client who places assets with or through an adviser is exposed to the risk that the entity actually holding those assets fails, is hacked, commingles, or goes bankrupt, and the client's ability to understand and manage that risk depends entirely on knowing who the custodian is and how the assets are secured. The identity of the custodian determines the client's exposure: a regulated, segregated, insured custodian presents one risk profile, an unnamed third party presents another, and a client who does not know which they have cannot assess their own exposure. This was not abstract in the crypto market of this period, where custodian failures and bankruptcies were a live and material risk, and where the difference between assets held in a client's name at a known custodian and assets held by an undisclosed third party could be the difference between recovering them and not. Titan's clients, told two contradictory things and never told the truth, had no way to know their actual exposure, which is the precise harm custody disclosure exists to prevent.

The discipline this implies is that the identity and arrangement of whoever actually holds client assets is the most material disclosure a firm makes and must be stated accurately, specifically, and consistently everywhere it appears, naming the real custodian and describing the real protections, because the client's assessment of the safety of their own property depends on it entirely. A firm must be able to say, plainly and consistently, who holds each category of client asset, under what legal arrangement, and with what protections, and it must ensure that statement is accurate to the operation and identical across the website, the brochure, and every other client communication. Titan could not say any of this reliably, because its disclosures contradicted themselves, misidentified the holders, and named no actual custodian, which meant that on the one question that most determines a client's risk, where are my assets, the firm's disclosures were worse than silent; they were affirmatively misleading about the location and safety of the clients' own property.

The clause that disclaimed what cannot be waived

Running through Titan's client agreements since at least June 2019 was a provision of a kind that looks like boilerplate and functions as a trap: a hedge clause, a liability-disclaimer, that created the false impression that clients had waived legal rights they could not actually waive. The agreements included indemnification and liability-limiting language under which clients would hold Titan harmless from broad categories of losses and under which Titan and its indemnified persons would not be liable for various indirect, special, incidental, punitive, or consequential damages. Read in its entirety, the SEC found, this language was inconsistent with an adviser's fiduciary duty and with the Commission's guidance, because it may mislead retail clients into not exercising legal rights, including non-waivable causes of action under state or federal law, that they in fact retained. The clause therefore violated Section 206(2) of the Advisers Act.¹

The mechanism of harm in a hedge clause is subtle, which is why the SEC's long-standing position, restated in its June 2019 interpretation of the adviser standard of conduct, is that such clauses in retail agreements are generally problematic. The clause need not actually succeed in waiving the client's rights to be a violation; it is enough that it creates the false impression that the rights have been waived, because a retail client who reads a broad liability disclaimer and believes, wrongly, that they have given up their claims against the adviser will not pursue those claims, and the practical effect is the same as an enforceable waiver even though the waiver is legally ineffective. The clause works, in other words, by discouraging the exercise of rights that remain legally intact, exploiting the gap between what an unsophisticated client believes the contract did and what the law actually permits. An investment adviser is a fiduciary, and the antifraud provisions do not permit it to lead its clients, through contractual language they are unlikely to parse, into surrendering protections the law deliberately made non-waivable. The clause looked like standard risk-limiting boilerplate; in a fiduciary's retail agreement, it was a misrepresentation about the client's own legal rights.

A fiduciary cannot contract out of its duty

The hedge clause crystallizes a discipline specific to fiduciaries and routinely missed by firms importing commercial contract norms into advisory relationships: an investment adviser is a fiduciary, and it cannot use contractual language to disclaim, limit, or create the impression of waiving the duties and liabilities its fiduciary status imposes, because the relationship is not an arm's-length commercial one in which parties freely allocate risk, and language that would be ordinary in a commercial contract is a violation in a fiduciary's retail agreement. Titan imported a standard liability disclaimer into an advisory agreement, and in that setting it became a breach of the antifraud provisions.¹

The reason this trips firms up is that liability-limiting and indemnification clauses are genuinely standard across commercial contracts, where sophisticated parties are free to allocate risk between themselves, and a firm's legal templates are built for that world. Dropped into an investment adviser's agreement with a retail client, the same language collides with the fiduciary duty, which is precisely a duty that the adviser act in the client's interest and that cannot be bargained away to the client's detriment, especially with an unsophisticated client who cannot meaningfully negotiate the terms. The fiduciary relationship inverts the commercial default: rather than two equals allocating risk, it is a relationship of trust in which one party is legally obligated to protect the other, and provisions that limit the protector's accountability, or that lead the protected party to believe they have fewer rights than they do, run directly against the duty. A hedge clause in that setting is not risk allocation; it is a fiduciary using its drafting control over the relationship to diminish, in appearance or effect, the protections it owes. The discipline requires recognizing that fiduciary agreements are governed by different rules than commercial ones, and that standard contractual risk-limiting language must be stripped out or carefully qualified, because what is routine between arm's-length parties is a breach when a fiduciary writes it into a retail client's contract.

Draft fiduciary agreements to the duty, not the commercial template

The discipline is to draft every client-facing agreement from the premise of the fiduciary duty rather than from a commercial contract template, scrutinizing and removing any language, especially liability disclaimers, indemnities, and waivers, that limits the firm's accountability to clients or that could lead a retail client to believe they have surrendered rights the law makes non-waivable. This means a firm's advisory agreements should be reviewed specifically against the fiduciary standard and the regulator's guidance on hedge clauses, with the test being not whether the language is standard in commercial contracts but whether it is consistent with a fiduciary's duty and whether a retail client might read it as waiving protections they retain. The broader test is whether every term in a client agreement can be reconciled with the obligation to act in the client's interest, and a firm reusing commercial boilerplate in fiduciary agreements, as Titan did with its hedge clause since 2019, has imported norms from a relationship that does not apply. A fiduciary's contract is not a tool for limiting the fiduciary's accountability; it is part of the relationship in which the fiduciary is accountable, and language that treats it otherwise is, as Titan learned, a violation of the antifraud provisions regardless of how conventional it looks.

The control it described but had not built

In its wrap-fee brochure, Titan told clients it had a specific control to manage a specific conflict of interest, and the control did not exist. The brochure stated that Titan had adopted personal securities and crypto-asset trading procedures to help manage conflicts of interest, and that Titan employees and associated persons were required to obtain Chief Compliance Officer preapproval to trade in securities and crypto assets. The securities part may have existed; the crypto part did not. Despite the written representation, Titan failed to adopt and implement such procedures for crypto assets, so the control it described to clients, CCO preapproval of employee crypto trading, to manage the conflict created by a strategy, Titan Crypto, in which employees might personally trade the same assets, was not actually in place.¹

This is the phantom-control failure, and it is a distinct species of misrepresentation worth isolating because it is so tempting and so common. A firm writing its disclosures describes the controls it has, or intends to have, or believes it has, and the description can run ahead of the reality: the procedure is drafted but not implemented, exists for one asset class but not another, is a policy on paper that no operational process enforces. The client reading the brochure is told the control exists and relies on that, assessing the conflict of interest as managed, when it is not. The specific danger of describing a control that does not exist, as opposed to simply lacking the control silently, is that the description affirmatively reassures the client that a risk is handled, inducing a reliance that the absent control cannot support. Titan's clients, told that employee crypto trading was subject to CCO preapproval, had reason to believe the conflict between the firm's crypto strategy and its employees' personal crypto trading was being managed, and it was not, because the control they were told about was a phantom. The gap between the represented control and the real one is the misrepresentation, and it is why the SEC treated the inaccurate description of the crypto-trading procedures as a 206(4)-7 and disclosure violation in its own right.

Describe only the controls you have actually built and operate

The discipline is that a firm must describe, to clients and in its disclosures, only the controls it has actually adopted and implemented and that are operating, never the ones it intends to build, has for some cases but not the one described, or maintains on paper without operational enforcement, because a described control induces client reliance and a described control that does not exist is a misrepresentation about how the firm manages its risks and conflicts. This means a firm's disclosures about its controls must be reconciled against the controls it genuinely operates, with each represented procedure, personal-trading preapproval, conflict management, asset safeguarding, verified to actually exist and function across the full scope the disclosure claims, including every asset class and situation named. The test is whether, for every control the firm tells clients it has, it can demonstrate the control is implemented and operating as described, and a firm that has disclosed a conflict-management procedure it never built for a product it actively offers, exactly Titan's crypto preapproval gap, has made a phantom claim that reassures clients about a risk it is not managing. Describe the controls you operate, build the controls you describe, and never let the disclosure of a control run ahead of its existence, because the client relies on the description and the regulator will measure the description against the reality.

Three thousand signatures it supplied itself

The last of Titan's failures is the one that most directly touched client funds, and it ran, undetected by the firm's own controls, for three years. From 2019 until the practice was discovered in about August 2022, Titan employees, after a client requested an asset transfer or other account action through the mobile app, applied an electronic signature to the Letters of Authorization sent to third-party custodians to effect the request, rather than obtaining the signature from the client personally. More than 3,000 LOAs were electronically signed by Titan without the clients' knowledge that their signatures were being applied. Through this practice, Titan had access to, and in certain cases the ability to transfer, client funds without first obtaining client signatures, and it had adopted no reasonable safeguards to verify that clients had actually signed the authorizations.¹

It is important to be precise about what was and was not found, because the nature of the violation turns on it. The transfers made under these LOAs are believed to have been authorized by the clients beforehand, through their requests in the app, and the independent PCAOB-registered auditor Titan retained did not identify any unauthorized asset transfers or other actions for which signatures were applied. In other words, there is no finding that client money was moved where the client did not want it moved. The violation is not that harm occurred; it is that the control was absent. Titan had placed itself in the position of being able to transfer client funds on the strength of signatures it applied itself, without any verified authorization process standing between a request and the movement of assets, and the fact that no misuse was found does not cure the gap, because the gap is the exposure. A firm that can move client funds on authorizations it signs for the client has, regardless of whether it ever abuses the capability, failed to maintain the control that ensures client assets move only on the client's verified instruction, and the SEC faulted exactly that failure to adopt reasonably designed procedures for verifying transfers.

Authorization must be verified, never assumed

The 3,000 self-applied signatures crystallize a discipline that governs any process touching client assets or consequential client actions: authorization must be independently verified at the point of action, never assumed from an earlier or upstream step, and a firm that can act on a client's assets without a verified authorization has a control gap whose severity does not depend on whether harm has yet resulted. Titan assumed the app request authorized the transfer and let employees supply the signature; the discipline required verifying the authorization at the point the assets moved.¹

The reason this matters even when, as here, the transfers were probably authorized, is that a control's job is to guarantee a property, not to be usually right about it. The property that must be guaranteed for client-asset movements is that every movement rests on the client's verified authorization, and a process that assumes authorization from an app request and then has the firm apply the client's signature does not guarantee that property, it merely tends to produce it when everyone behaves. The gap, the firm's ability to move funds on signatures it supplies, is a standing exposure: it means that the only thing preventing an unauthorized transfer is the good behavior of the firm's employees, not a control that would stop a bad one. That is precisely the situation controls exist to eliminate, because the point of requiring verified client authorization is to make an unauthorized transfer impossible, not merely unlikely, and a firm that relies on the absence of bad actors rather than the presence of a control has not met its obligation. The clean audit finding, no unauthorized transfers, is evidence that the employees behaved, not that the control existed, and the violation is the missing control, which would have mattered enormously in the case where an employee did not behave, a case the firm had left itself defenseless against for three years.

Verify authorization at the point of action, independently

The discipline is to build, for every process that moves client assets or takes consequential client actions, an independent verification of the client's authorization at the point of action, so that the action cannot occur without confirmed client instruction, and never to let an upstream request stand in for a verified authorization that the firm then supplies on the client's behalf. Concretely, where a client requests an action through an app, the authorization that effects it must be verifiably the client's, captured and confirmed through a process the firm cannot complete on the client's behalf, so that the firm never holds the ability to move assets on a signature it applied itself. The test is whether the firm is structurally incapable of moving client assets without the client's verified authorization, and a firm that can complete the authorization itself, as Titan could by applying the signatures, has the exposure regardless of whether it has ever exploited it. Titan's practice was probably harmless in every individual instance and was nonetheless a serious violation, because the standard for a control over client assets is not whether it was abused but whether abuse was possible, and for three years, across more than 3,000 authorizations, Titan had built a process in which it was. Authorization assumed is authorization absent; the control is the verification, and the verification is the thing Titan never built.

The broader lesson: the platform scaled faster than the controls

The enduring lesson of the Titan case is what connects its scattered failures, marketing, custody, fiduciary clauses, phantom controls, signature verification, into a single story: a technology platform scaled a retail advice business faster than it built the compliance machinery underneath it, and every failure is a place where the growth outran the controls. Titan reached a mass retail audience through an app, offered a novel crypto product, opted into a new marketing standard, and moved client assets at scale, and at each of those frontiers it had the product and the reach before it had the procedures, the verification, the disclosures, and the fiduciary discipline that the activity required.¹

The disciplines this study has drawn out are the controls the platform skipped. Show the method and test the assumptions behind every computed figure, because Titan's real 21% became a fabricated 2,700% entirely in the undisclosed annualization. Match the claim and its context to the least sophisticated reader the channel reaches, because a hypothetical figure broadcast to a retail app is misleading no matter what sits behind a generic link. Build the full machinery of any standard you elect, because opting into the Marketing Rule without its procedures only pulled forward the date the violations began. Reconcile every disclosure against itself and against the operation, because a brochure that answers the custody question two ways has told the client nothing. State who holds client assets accurately and consistently, because it is the most material fact in the relationship. Draft fiduciary agreements to the duty rather than the commercial template, because a standard hedge clause is a breach in an adviser's retail contract. Describe only the controls you actually operate, because a disclosed control that does not exist is a reassurance about a risk you are not managing. And verify authorization at the point of action, because a firm that can move client funds on signatures it supplies has the exposure whether or not it ever abuses it. Each is a control the platform needed and had not built, and together they are the compliance infrastructure that a retail advice business must have in place before, not after, it scales.

The forward view: advice at app scale, and the next novel product

The reason the case is a template rather than an isolated episode is that the model it represents, technology platforms delivering investment advice and products to mass retail audiences, fast, through apps, around novel assets, is the direction the industry is moving, and the structural temptation Titan exemplifies, to ship the product and the marketing ahead of the compliance, intensifies with the speed and reach that technology provides. The next Titan will reach more retail investors faster, around the next novel product, crypto yesterday, tokenized assets, AI-driven strategies, and whatever comes next, and the same frontiers will present the same gaps: performance figures that flatter novel products, disclosures that cannot keep pace with new arrangements, controls described before they are built, and client-asset processes scaled before they are secured. The firms that avoid Titan's outcome will be the ones that treat compliance machinery as part of the product, built before launch and scaled with the platform, rather than as a layer added after the growth, because an app's reach turns a compliance gap into a mass-market harm instantly, and a regulator will find it. The Marketing Rule enforcement that began with cases like Titan's is the regulator signaling that the standards apply fully to the new channels, and that reaching retail investors through an app does not lower the bar, it raises it, because the audience is less able to protect itself. The lesson is not about crypto or about one firm's growing pains; it is that a platform's controls must scale with its reach, and that the moment the product outruns the compliance, the gap is no longer a risk, it is a violation waiting for an examiner.

What this case is really about