"AACA (Craigs) was negligent at best, approaching recklessness, as a reasonable person would have expected AACA (Craigs) to have effective filters," the tribunal said.
More than a year after the event Craigs still hasn't developed a filter to prevent the type of trading and is relying on other controls to avoid similar breaches.
At issue were a series of transactions by a Craigs customer with direct market access. Algorithm-based orders were submitted between May and October last year that didn't result in a change in ownership. The customer had direct access since June 2016.
Among the aggravating factors was that the breach related to the fundamental obligations of ensuring a fair and orderly market.
"The nature of algorithmic trading and high-frequency trading is such that it gives rise to potentially heightened risks that must be managed through the use of effective filters and other technological controls," the tribunal said.
The brokerage didn't appear to identify the breaches and wouldn't have been in a position to report more serious issues, the report said. The tribunal noted that two of the trades took place after Craigs was alerted to the issue by NZX.
Craigs' engagement with the supervisor was also found wanting, with the brokerage's responses containing inconsistencies, and needing clarification. At times, information from Craigs' client wasn't assessed by the broker. While the investigation took longer than desirable, the tribunal said the delay hadn't been deliberate or intended to frustrate NZX.
The tribunal said the mitigating factors were that there was no commercial advantage or benefit to Craigs or the client and that there wasn't a market impact.
The trades without a change in ownership didn't move the share price of A2 Milk Co - often a volatile stock - and Craigs' client has taken steps to reduce the chance of the issue occurring again.
Craigs was fined $45,000 and censured in 2012 over two breaches by a direct market access client whose orders disrupted the market.
At the time, Craigs admitted it didn't have any filters in place to capture the erroneous trades, and in the second instance was caught by a glitch.