NEW YORK (AP) -- The young Citigroup analyst was researching Facebook before it went public. He dropped an email to two of his buddies at a popular technology blog, leaking them information about Citigroup's research that was supposed to be private.
When one friend asked if it was OK to publish the information, the analyst responded with an answer that showed he knew he was breaking the rules: "My boss," he wrote back, "would eat me alive."
Friday, Massachusetts' top securities regulator dragged the incident into the spotlight, slapping Citigroup with a consent order and charging the bank $2 million for failing to oversee its employee.
"This penalty," said Massachusetts Secretary of the Commonwealth William Galvin, "should serve as a warning to the industry as a whole."
Citi fired the young research analyst about a month ago, after Galvin's office had started its investigation. The case was unusual compared to some other recent lawsuits and fines against major banks, because Citigroup acknowledged that the events in question did take place.
Citi was part of the team of banks that helped underwrite the deal that made Facebook a public company on May 18. Regulations forbade those banks from sharing any written research about Facebook until 40 days after the company went public. That's supposed to ensure that investors don't have access to insider information that would give them an unfair advantage, just because the investment bank where they are a client has done business with Facebook.
This is the first penalty that Galvin's office has issued over the Facebook public offering, but there could be more. A spokesman for Galvin, Brian McNiff, said the office had also served subpoenas to Goldman Sachs, JPMorgan Chase and Morgan Stanley over similar issues related to leaking information about Facebook. A subpoena is a request for information and doesn't necessarily mean that wrongdoing was committed.
Representatives for Goldman Sachs, JPMorgan and Morgan Stanley declined to comment. The subpoena served to Morgan Stanley was first reported in May, but the subpoenas to Goldman and JPMorgan had not previously been confirmed.
Working on Facebook's public offering was supposed to be a coup for the banks that were chosen, but it's brought a long line of headaches, including lawsuits and regulatory inquiries.
But on May 2, the research analyst sent an email to two employees at the technology website TechCrunch.com, with what was supposed to be confidential information about Citigroup's research on Facebook.
"I am ramping up coverage on FB and thought you guys might like to see how the street is thinking about it (and our estimates)," the analyst wrote to the two TechCrunch writers. "...This, of course is confidential."
One of the TechCrunch writers wrote back: "There's no way I can publish this doc from an anonymous source, right?"
A minute later, the research analyst replied: "My boss would eat me alive."
The analyst and the TechCrunch writers were friends, according to Galvin's office. They all lived in the Bay Area and kept in touch via social media. The analyst and one of the TechCrunch writers had gone to Stanford together and graduated several years ago, according to Galvin's office. The consent order did not name any of them.
Citigroup fired the junior analyst in late September, after Galvin's office started looking into the matter.
The bank told Galvin's office that the junior analyst acted alone. It agreed to review its policies for overseeing analysts' communications, and to strengthen compliance training for the analysts.
"We are pleased to have this matter resolved," bank spokeswoman Sophia Stewart said. "We take our internal policies and procedures very seriously and have taken the appropriate actions."
Separately, Galvin's consent order also brought the downfall of the research analyst's boss, a well-known and influential senior tech analyst named Mark Mahaney.
The consent order didn't name him, but gave enough information to make him easily identifiable.
Mahaney isn't accused of being involved in the research analyst's misconduct. But Galvin's investigation found emails about another damaging incident that happened around the same time.
On April 30, Mahaney answered an email from a reporter for a French business magazine, Capital, about his financial predictions for YouTube. That was problematic because the opinions hadn't previously been published and weren't public information.
Later, when a Citigroup employee told Mahaney he'd need to get approval to talk to the Capital reporter, Mahaney said that he wouldn't respond to the reporter's questions.
Later, after the communications employee learned that Mahaney had already talked to the reporter, Mahaney wrote: "This could get me in trouble. Shoot."
Citigroup confirmed that Mahaney is no longer at the bank. A source familiar with the matter, who wasn't allowed to speak on the record about personnel matters, said Mahaney had been fired because he misled the bank about his communications with the French magazine.
On Friday afternoon, Citigroup sent a note to clients who had subscribed to Mahaney's research. "Mark Mahaney has left Citi," it said, without elaborating. As a result, Citi will discontinue its coverage of Expedia, WebMD and 12 other companies.