Material non-public information risk in alternative data is managed in two places: at the vendor, in how each record is sourced, and at the fund, in written policies and procedures. This post sets out what Congress, the Securities and Exchange Commission (SEC), its staff and one settled order have said, each with its date and its standing, then how vendors mitigate the risk and what to ask them. It reports what those documents say and is no substitute for legal advice: whether a dataset holds MNPI is a judgement for your counsel and your chief compliance officer.
What the SEC has told investment advisers about alternative data and MNPI compliance
Three kinds of document make up the SEC record on alternative data and MNPI. Section 204A of the Investment Advisers Act requires written policies and procedures against misuse of material non-public information. A staff Risk Alert of 26 April 2022 described deficiencies at advisers. A settled Commission order of 14 September 2021 found that a data provider misled trading firms.
| Document | Date | Who speaks | What it says, in its own terms |
|---|---|---|---|
| Section 204A of the Investment Advisers Act | Added 19 November 1988 | Congress, in a statute | An adviser subject to 15 U.S.C. 80b-4 shall establish, maintain and enforce written policies and procedures reasonably designed, given the nature of its business, to prevent misuse, in violation of the securities laws it names, of material, nonpublic information by the adviser or its associated persons |
| Rule 10b5-1 and Rule 10b5-2 | Federal Register, 24 August 2000; Rule 10b5-1 as amended, Federal Register, 29 December 2022 | The Commission, in rules | A trade is on the basis of material nonpublic information if the person was aware of it when trading, subject to affirmative defences. A duty of trust or confidence exists, among other circumstances, whenever a person agrees to keep information in confidence. Insider trading law is otherwise defined by judicial opinions |
| 2020 Examination Priorities | Fiscal year 2020 | Staff of the Office of Compliance Inspections and Examinations | Examinations will focus on registered firms' use of alternative data sets and technologies to interact with and serve investors, firms and other service providers, and assess the effectiveness of related compliance and control functions |
| Order against App Annie Inc. and its co-founder | 14 September 2021 | The Commission, in a settled order whose findings the respondents neither admitted nor denied | Violations of Section 10(b) of the Exchange Act and Rule 10b-5, through material misrepresentations about how the provider's alternative data was derived |
| Risk Alert: Investment Adviser MNPI Compliance Issues | 26 April 2022 | Staff of the Division of Examinations | The staff observed advisers that used alternative data and did not appear to adopt or implement reasonably designed written policies and procedures for the potential risk of receiving and using MNPI through it |
The statute and the rules are law. Each staff document states that it represents the views of the staff, is not a rule, regulation or statement of the Commission and has no legal force or effect, and the Risk Alert adds that it is not legal advice.
Under Section 204A the Risk Alert gives three examples of what advisers did not appear to do:
- Adequately record their diligence processes for alternative data providers, or follow them consistently. The staff saw ad hoc and inconsistent diligence.
- Hold policies and procedures for assessing the terms, conditions or legal obligations related to the collection or provision of the data, including once red flags about its sources were known.
- Implement their procedures consistently. Diligence skipped some sources, onboarding came with no system for deciding when diligence had to be re-performed after the passage of time or a change in data collection practices, and some advisers could not demonstrate consistent implementation, such as by producing documentation.
Data provenance: what SEC insider trading compliance asks of alternative data vendors
In the SEC documents cited here we found no rule addressed to data vendors as such. Data provenance reaches a vendor through its clients, whose diligence the examination staff reviews, and through the antifraud provisions: the Commission's settled 2021 order against an alternative data provider turned on what it told trading firms about how its data was derived.
The order describes a provider that sold estimates of how mobile apps perform. By the order's account, companies using the provider's free analytics product gave it their app store credentials, on terms that their confidential figures would feed the estimates only in aggregated and anonymised form. The Commission found that from late 2014 to mid-2018 the provider used those figures, neither aggregated nor anonymised, to alter the estimates its statistical model produced, while telling trading firms the estimates came from a model on aggregated and anonymised data.
Three further findings bear on provenance. The app figures were confidential, nonpublic data belonging to each company and often material to a public company's financial performance and stock price. The provider told subscribers, in some cases in answer to diligence questionnaires, that it had internal controls against misuse of confidential data, and for most of the period it did not have effective ones. A policy on public company data agreed around late 2014 was first documented in April 2017.
The violations found were of Section 10(b) and Rule 10b-5, the antifraud provisions, and the order calls the subscribing trading firms unknowing. It imposed civil penalties of $10,000,000 on the provider and $300,000 on its co-founder. Both consented to the order without admitting or denying its findings. The SEC's announcement of the same day called it the agency's first enforcement action charging an alternative data provider with securities fraud.
How alternative data vendors mitigate material non-public information risk
A vendor mitigates material non-public information risk at the source, with controls a buyer can test. It collects what is public when observed, takes nothing from insiders or under confidentiality, keeps the terms under which each input was obtained, dates every record, describes its method truthfully in writing and gives notice when collection changes.
FISD is an industry forum within the Software & Information Industry Association, and its documents are voluntary industry guidance. Its Alternative Data Council puts the vendor's part in its note on MNPI: it is important that vendors know the regulations their financial clients work under and check the origin of what they sell.
- Public when observed. A vendor that reads what a company has already published can show the address and time of each observation.
- Nothing held in confidence. Rule 10b5-2 counts an agreement to keep information in confidence among the sources of a duty of trust or confidence. An input received under a non-disclosure agreement, through a client's credentials or on terms limiting its use is disclosed first.
- A method run as described. The 2021 order found estimates described as model output being altered with the confidential figures themselves.
- Controls in writing, with dates. The order found a policy first documented more than two years after it was agreed.
- Notice of change. The staff observed advisers with no system for re-performing diligence when collection practices changed. A vendor that announces such changes supplies the trigger.
Fokals data is collected from first-party company sources and public records, and processed in-house: what companies publish on their own websites and careers pages, what they announce and what they file. Section 5 of the sourcing statement covers material non-public information: all inputs are public at the time they are observed, and none is received from insiders, from companies under confidentiality or from any other non-public source. Each record carries the time it was observed, and the compliance page gathers the documents.
MNPI due diligence on an alternative data vendor: a compliance checklist
MNPI due diligence on an alternative data vendor is a written, repeatable procedure: the same questions to every vendor, documents in answer, a test on sample data, and a record of the result. The checklist below pairs each question with the SEC staff observation or industry questionnaire it answers and the evidence to request.
The questionnaire is the due diligence questionnaire of FISD's Alternative Data Council, whose page says adoption of its documents is entirely voluntary. The form opens with what investment managers generally do not want to receive, including MNPI, information under a confidentiality obligation and information obtained through misappropriation, deception or a breach of duty.
| Ask the vendor | Source of the question | Evidence and test |
|---|---|---|
| 1. Where does each input come from, and who provides it? | FISD form | A written sourcing statement, and a trace of sampled records to the original |
| 2. Does the data contain or derive from MNPI or other confidential information? | FISD form. Rule 10b5-2 | A written yes or no, with any upstream terms |
| 3. Do your other activities expose you to MNPI? | FISD form | Other business lines, and whether the vendor or its staff invest on the data |
| 4. What diligence do you perform on the origin of your data? | FISD form. FISD note on MNPI | The written policy, with its date |
| 5. Is the method as described the method as run? | 2021 order | The methodology, and who may alter an output after it is produced |
| 6. What terms and legal obligations attach to collection? | Risk Alert, second example | For web data, the answers to the form's scraping appendix |
| 7. Is the data delivered to all customers at the same time? | FISD form | The delivery schedule and the licence |
| 8. What has changed since the last review? | Risk Alert, third example | Versioned documents, a changelog, a review date in your file |
| 9. Can the fund show its own work? | Risk Alert, first and third examples | The completed checklist, the sample trace and the sign-off, on file |
The vendor answers questions 1 to 8 on the facts. Your counsel decides whether a class of data could be material to an issuer. Your chief compliance officer owns the written procedure and question 9. Our guide to alternative data due diligence questionnaires walks the FISD form, and ten questions for a company data vendor covers the questions beyond compliance.
Does web scraping put material nonpublic information in an investment adviser's alternative data?
The SEC staff's Risk Alert of April 2022 does not mention web scraping. It says alternative data does not necessarily contain MNPI, and it describes advisers that appeared to have no procedure for assessing the terms, conditions or legal obligations of collection. For web data, an adviser therefore asks how each page was reached and what it shows.
How a page was reached goes to whether its content was public. The 2021 order lists public records and the internet among the sources of alternative data, and its findings concerned figures taken with a company's own credentials on terms that limited their use. What the page shows goes to materiality, the subject of the next section.
The FISD form's appendix on scraping asks whether the vendor:
- analyses the terms and conditions of the websites it scrapes;
- scrapes directories or files that robots.txt disallows;
- collects from websites that require an affirmative action, such as ticking a box, a password or a CAPTCHA;
- uses proxies, CAPTCHA solutions, third-party scraping providers or anonymised IP addresses;
- can be identified and contacted by the websites it scrapes.
Section 2 of the Fokals sourcing statement sets out its collection conduct, including how a read that a site's network protection refuses is handled. Among its points: every request is identified, site owners' published permissions are obeyed before every request, and only public pages are read, with no sign-in, no forms and nothing behind a login or paywall.
Mosaic theory and alternative data: what the SEC wrote on insider trading and material nonpublic information
The mosaic theory describes an analyst assembling pieces of information, none of them material alone, into a conclusion that is material. The Commission wrote in its Regulation FD release of August 2000 that the regulation does not prohibit an issuer from disclosing a non-material piece to an analyst, even if, unknown to the issuer, it helps complete such a mosaic.
The passage, which speaks of a mosaic and not of a mosaic theory, sits in the Commission's release adopting Regulation FD, titled Selective Disclosure and Insider Trading. The regulation addresses selective disclosure by issuers to listed recipients, among them investment advisers. The Commission added that analysts can provide a valuable service in sifting information that would not be significant to the ordinary investor to reach material conclusions, and that it did not intend, by Regulation FD, to discourage this.
The release relies on the case-law definitions of material and nonpublic and restates them. The test of materiality is a substantial likelihood that a reasonable shareholder would consider the information important in making an investment decision, for which it cites the Supreme Court in TSC Industries v. Northway. Information stays nonpublic until it has been disseminated in a manner making it available to investors generally.
The passage concerns an issuer's disclosures under one regulation, and it speaks of pieces that are not material. Neither the Risk Alert nor the 2021 order uses the word mosaic, and the order treated the app figures themselves as confidential, nonpublic and often material. A mosaic argument therefore needs three answers for each input: was it public, if not on what terms was it obtained, and could it be material alone? Whether the argument holds for a dataset is for counsel, with the vendor's written answers in hand.
A worked example: tracing a vendor sample to its sources
This example is illustrative: Acme Robotics and every figure below are invented.
Assumptions:
- A fund's written procedure requires a trace before a new dataset is loaded: 10% of the sampled records in each source class, and at least 10 per class.
- A traced record passes when the page or filing it names opens with no sign-in, payment or agreement, and its observation time is not earlier than the date the source itself carries.
- One failure in any class stops onboarding and goes to counsel.
- The vendor's sample on Acme Robotics holds 240 dated records: 150 job postings, 60 website and technology changes, 30 announcements and filings.
| Source class | Records in sample | 10% of the class | Traced, minimum 10 | Passed |
|---|---|---|---|---|
| Job postings | 150 | 15 | 15 | 15 |
| Website and technology changes | 60 | 6 | 10 | 10 |
| Announcements and filings | 30 | 3 | 10 | 10 |
| Total | 240 | 24 | 35 | 35 |
The analyst traces 35 of the 240 records, 14.6% of the sample, because the minimum lifts the two smaller classes above 10%. All 35 pass, so the dataset moves to the next step and the file gains a dated record of the 35 addresses, the reviewer and the result: documentation of the kind the Risk Alert describes some advisers as unable to produce.
The trace is evidence on one of the two questions: whether the inputs were public. Whether hiring or technology changes at Acme Robotics could be material is the other, and it goes to counsel with the trace attached.
On Fokals data the census that fixes the sample sizes is one query on Company Signals, which carries the source class of every signal and the time it was observed. Job Postings and Company News carry the address of the public posting and of the original announcement or filing, and the data dictionary defines each field.
select source,
count(*) as signals,
min(observed_at) as earliest,
max(observed_at) as latest
from company_signals
where company_id = :company_id
group by source
order by signals desc;Frequently asked questions
Does alternative data contain material non-public information?
Not necessarily. A footnote in the SEC examination staff's Risk Alert of 26 April 2022 says alternative data does not necessarily contain MNPI. Whether a given dataset does depends on how each input was obtained and on what it shows about an issuer, and that judgement belongs to your counsel and your chief compliance officer. Ask the vendor for a written description of every source before the data is loaded.
What did the SEC find in its order against App Annie?
In a settled order of 14 September 2021 the Commission found that App Annie and its co-founder violated Section 10(b) of the Exchange Act and Rule 10b-5 by misrepresenting to trading firms how its estimates of app performance were derived. The order imposed civil penalties of $10,000,000 on the company and $300,000 on the co-founder. The respondents consented to the order without admitting or denying its findings.
Is an SEC Risk Alert legally binding?
The Risk Alert of 26 April 2022 answers this itself. It states that it represents the views of the staff of the Division of Examinations, that it is not a rule, regulation or statement of the Commission, that it has no legal force or effect and creates no new or additional obligations, and that it is not legal advice. The obligations it discusses come from Section 204A of the Investment Advisers Act, which is a statute, and from Rule 204A-1 under it.
Which investment advisers does Section 204A cover?
The statute applies to every investment adviser subject to 15 U.S.C. 80b-4, and the SEC staff's Risk Alert of April 2022 summarises it as covering all investment advisers, registered and unregistered. It requires written policies and procedures reasonably designed to prevent the misuse of material, nonpublic information. Whether and how it applies to your firm is a question for counsel.
How often should due diligence on a data vendor be repeated?
The SEC documents cited in this post set no interval. The staff's Risk Alert of April 2022 describes advisers that had an onboarding process for alternative data providers and no system for determining when diligence needed to be re-performed based on the passage of time or changes in data collection practices. A written procedure can therefore name both triggers: a review date, and any change the vendor announces in how it collects.
How does Fokals source its data?
Fokals data is collected from first-party company sources and public records, and processed in-house: what companies publish on their own websites and careers pages, what they announce and what they file. The sourcing statement sets out that all inputs are public at the time they are observed. It is company-level data throughout, and each record carries the time it was observed.
The queries and code on this page are examples to adapt. Test them in your own environment before you rely on them.
What this page says about the products it names was checked against their public documentation on 7 October 2026. Product and company names are trademarks of their owners. Fokals is not affiliated with them or endorsed by them.