On August 8, 2023, the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) resolved their off-channel communications investigations into several financial institutions.

The SEC announced $289 million in charges against ten firms in their capacity as broker-dealers and investment advisers for “widespread and longstanding failures by the firms and their employees to maintain and preserve electronic communications.” According to the SEC, the firms acknowledged that their conduct violated recordkeeping provisions of the federal securities laws. The SEC’s investigation found that the firms’ employees at multiple levels of authority often conducted business on their personal devices through messaging platforms such as iMessage, WhatsApp, and Signal. The firms then failed to maintain or preserve most of these communications. In addition to financial penalties, the firms agreed to retain independent compliance consultants to review their policies and procedures.

Similarly, the CFTC settled charges against swap dealer and futures commission merchant affiliates of four financial institutions for “failing to maintain, preserve, or produce records that were required to be kept under CFTC recordkeeping requirements” and “failing to diligently supervise matters related to their businesses as CFTC registrants.” The orders found that the firms failed to stop employees from communicating about business using unapproved methods. As a result, the firms did not preserve “hundreds if not thousands of business-related communications.” In total, the firms were fined $260 million.

The latest resolutions by the SEC and CFTC are the result of sweeping investigations into recordkeeping compliance across the financial sector. In September 2022, the SEC and CFTC similarly issued a combined $1.8 billion in fines to more than a dozen firms for such violations. The DOJ has similarly warned companies to preserve business records. In March 2023, the DOJ announced changes to its Evaluation of Corporate Compliance Programs (ECCP), which is used to assist prosecutors with assessing the effectiveness of corporations’ compliance programs following a criminal investigation. The ECCP instructs prosecutors evaluating a compliance program to consider whether a company properly retains all business-related communications to ensure that such communications can be produced to the government when requested.

It is clear that regulators and enforcers will continue to focus on this area. Consequently, companies will be well served to evaluate their own compliance programs and ensure conformance with supervision and recordkeeping requirements.

Authors: Daniel Ahn, Evan Barr, Mark Bini, Kaela Dahan, Joanna Howe, and Karunya Venugopal