In a related criminal prosecution, Marsh was sentenced to three years probation and ordered to pay a $600,000 fine for the data breach after pleading guilty last year.
Morgan Stanley agreed to a censure and a $1 million civil penalty without admitting or denying the SEC’s findings.