Insider trading charges against a former legal department worker at an American International Group Inc. subsidiary shows how careful in-house law departments must be in guarding their confidential information.

The U.S. Securities and Exchange Commission on Thursday said it reached a consent agreement with Jon Aronson, a former senior administrative assistant in the subsidiary's legal department.  Aronson could not be reached for comment Thursday.

The commission alleged that Aronson learned details about AIG's 2018 merger with Validus Holdings and shared them with his father, Elliet Aronson. Both men, who live in Massachusetts, bought Validus stock.

The son had second thoughts and sold his shares before the merger closed, and advised his father to also sell, according to the complaint filed in U.S. District Court in Manhattan. But the father kept his shares, earning a profit of $20,310.

Both men signed consent agreements that permanently enjoin them from violating insider trading laws in the future. Each man agreed to pay $20,310 in penalties. In addition, the father agreed to pay another $20,310 in disgorgement of his profits.

The two men were represented by Robert Heim of Tarter Krinsky & Drogin in New York. Heim told Corporate Counsel on Thursday that both men "settled the allegations without admitting or denying wrongdoing, and are hoping to put the matter behind them."

The commission also has been busy delving into compliance department conduct. In a separate and unrelated complaint, it has charged two chief compliance officers for breaching their fiduciary duty and defrauding their clients at Criterion Wealth Management Insurance Services Inc.

The complaint, filed last week in U.S. District Court for the Central District of California, accuses Criterion and its two co-owners and investment advisers at the time, Robert Gravette and Mark MacArthur, of failing to disclose that they were receiving side commissions when they invested clients' money in private real estate investment funds. Gravette also served as Criterion's chief compliance officer.

The firm and the defendants reside in Santa Clarita, California. Calls and emails to both men and the firm were not returned Thursday.

The complaint, filed in U.S. District Court for the Central District of California, said they profited over $1 million. It added that for two of the funds, this undisclosed compensation arrangement resulted in reduced investment returns for the defendants' clients.

MacArthur also served as chief investment officer until mid-2016 when he became an independent contractor. He is now president and chief compliance officer of M2 Financial LLC, which he formed in mid-2016.

The commission said the two men "owed their clients—who entrusted them with the discretionary management of [their clients'] money—a fiduciary duty to act with loyalty, fairness, and good faith." It called the side commissions "a glaring conflict of their [clients'] financial interest."

Given the two men's backgrounds, the commission found, "Gravette and MacArthur's failure to disclose their obvious conflicts of interest was willful, knowing, intentional, or reckless."

The complaint seeks permanent injunctions against future violations, disgorgement and prejudgment interest, and civil penalties from all three defendants.

The complaint said that during a 2014 review by an outside compliance consultant, the firm did not disclose the side commissions that represented a substantial portion of Criterion's income.

The consultant said the firm had not been complying with a requirement for annual compliance reviews nor had it tailored its policies to fit the needs of their business. The consultant also pointed out that Criterion was still using a 2008 compliance manual that had not been updated, and that key topics were missing from its written policies and procedures.

When commission staff examined Criterion in 2016, the firm "had not implemented many of the compliance consultant's recommendations." The complaint said the company still had not updated its policies and procedures, and it was still using the 2008 compliance manual.