Japan’s financial regulator penalized Mitsubishi UFJ Financial Group’s flagship banking unit and two joint ventures for violating client confidentiality rules, potentially dealing a further blow to their business.

The Financial Services Agency ordered MUFG Bank, Morgan Stanley MUFG Securities and Mitsubishi UFJ Morgan Stanley Securities to improve their operations. The FSA also asked for reports by July 24 on the cause of the breach and planned measures to prevent a recurrence.

The scandal has shaken confidence in the country’s largest banking group, causing some clients to take bond underwriting business elsewhere. Japan forbids commercial and investment banking arms of the same financial group from sharing client data without their consent, in part to keep lenders from abusing their bargaining positions.

The FSA’s investigative arm, the Securities and Exchange Surveillance Commission, said earlier this month that MUFG Bank, Morgan Stanley MUFG Securities and Mitsubishi UFJ Morgan Stanley Securities had inappropriately exchanged client information at least 26 times to win business. The market watchdog also found other improper conduct, including cases in which MUFG Bank tried to win underwriting business for the brokerage unit.

The banking industry has long lobbied officials to ease restrictions, arguing it would better serve clients’ interests if lenders and their group brokerages can offer products and services together.

Officials found firewall violations a few years ago at rival Sumitomo Mitsui Financial Group’s brokerage subsidiary.