By Jennifer Dickinson, Senior Managing Director, U.S.
Both the U.S. Securities and Exchange Commission (SEC) and U.S. Commodity Futures Trading Commission (CFTC) are cracking down on firms’ use of “off-channel communications”, i.e. electronic communications via apps, personal devices, texts, etc. that aren’t being retained by the firm. Following the latest round of enforcement actions on August 8, 2023, I take a look at the key details of these violations and what firms can learn from them.
On August 8, the SEC announced the settlement of enforcement cases against 11 firms for recordkeeping failures associated with electronic communications retention. The firms included 10 broker-dealers and one dually-registered broker-dealer/investment adviser. The penalties totaled $289 million.
Eight of the firms are also registered swap dealers or futures commission merchants and settled similar actions brought by the CFTC. Penalties in the CFTC cases totaled $260 million.
In addition to monetary penalties, the regulators imposed undertakings such as hiring independent consultants to assess the firms’ policies and procedures around electronic communications and retention.
What had gone wrong?
In the latest actions, all 11 firms admitted that from at least December 2019, employees used messaging apps (iMessage, WhatsApp and Signal) on their personal devices to communicate business-related matters that were subject to SEC or CFTC recordkeeping rules.
Rule violation occurred because the firms did not retain these communications.
The regulators found these instances to be widespread and involved employees across multiple levels of authority, including supervisors and senior executives.
Zero tolerance for non-compliance
Both regulators have increased their scrutiny of firms’ use of “off-channel communications”, with the SEC having brought 30 enforcement actions and ordered over $1.5 billion in penalties so far, while the CFTC has imposed an additional $1.091 billion in civil monetary penalties on 18 financial institutions since December 2021.
This latest set of actions further demonstrates both regulators’ “zero-tolerance” approach, with Gurbir S. Grewal, Director of the SEC’s Division of Enforcement, stating:
“So here are three takeaways for those firms who haven’t yet done so: self-report, cooperate and remediate. If you adopt that playbook, you’ll have a better outcome than if you wait for us to come calling.”
Similarly, the CFTC’s Director of Enforcement Ian McGinley emphasized that “[t]he Commission’s message could not be more clear—recordkeeping and supervision requirements are fundamental, and registrants that fail to comply with these core regulatory obligations do so at their own peril.”
Keep the regulators from knocking on your door
Advisers struggling with this issue can consider implementing a number of strategies to better support their electronic communications retention. Such strategies include:
- Remind employees of the firm’s policy to use only approved and archived modes of communication for business purposes
- When conducting electronic communications reviews, look for references to texting and specific messaging apps
- Conduct training with employees as needed
- Obtain certifications from employees in which they attest to their understanding of and compliance with the firm’s electronic communications and record retention policies
- If your firm issues mobile phones to employees, prohibit installation of unauthorized messaging apps on the work device
- Look into technology solutions that would allow your archiving provider to capture texts and other messaging apps
