Robinhood (and other similar companies) is not a bank (not sure what it is registered as?). By not being a bank it doesn't have to implement all kind of securi

Robinhood (and other similar companies) is not a bank (not sure what it is registered as?). By not being a bank it doesn't have to implement all kind of security and operational measures (e.g. access limitations by its own employees, active data-transfer analysis, communication "firewalls" between departments, liability based on the degree of the IT-security which is implemented, etc...) that banks HAve to implement/adhere to => that's really A LOT of in/direct effort (therefore $) for both the initial implementation and the ongoing operations => I imagine that platforms like Robinhood (and similar) shrank ALL costs to the minimum, therefore the kind of problems reported in the article are in my opinion not unexpected. The most simple (to understand) IT-security guidelines worldwide (but still quite complicated to interpret, at least for me) are maybe the ones of the Monetary Authority of Singapore ("MAS"): https://www.mas.gov.sg/regulation/cyber-security https://www.mas.gov.sg/regulation/cyber-security They're high-level (as they should be - details are for lawyers & tribunals), but in the end they all scream to you a lot of <embedded> stuff about security. For example if you're (un/willingly) running an old version of Apache that has security bugs (and those bugs were fixed by some patch that you did not apply "timely") then you don't comply to the MAS guidelines therefore you'll be preemptively thrown out of their market, voilà. The adherence to these rules and the results of their controls must be confirmed yearly by a top-mgmt executive => if external audit discovers that that was false, and/or if later events discover that that was false then that/those executive/s will burn and/or you'll be thrown out of their market (all this is the result of the last ~20 years of regulations, which I personally think is generally more good than bad, but which is definitely painful for me to deliver hehe). I don't think that this level of <liability/control/regulation> is in place for Robinhood & Co. - not saying that such companies are bad, they're probably interesting from a certain point of view, but customers should be made more aware of the embedded risks.