An investigation into the use of off-channel and unpreserved communications by the SEC has led to another 16 firms being fined for recordkeeping failures. The $81m in penalties adds to the $2.6bn already levied for failures to maintain and preserve electronic communications, serving as a stark reminder that regulators’ focus on recordkeeping isn’t going away.  

Pervasive recordkeeping violations were identified

The SEC’s investigations uncovered pervasive and longstanding use of unapproved or ‘off-channel’ communication at each firm, which included five broker-dealers, seven dually registered broker-dealers and investment advisers, and four affiliated investment advisers.

The failures were widespread, involving employees of all seniority levels including supervisors and senior managers. Employees sent and received off-channel communications with colleagues, customers, and other participants in the securities industry, relating to recommendations and advice given or proposed. The issues were also longstanding, dating back to at least January 2019. 

Not maintaining or preserving off-channel communications also had a direct impact on the regulator’s ability to carry out its investigations. The SEC has frequently reiterated that preserved records are the primary means by which it monitors compliance with applicable securities laws.

Widespread non-compliance with firms’ own policies

The investigation also found widespread and longstanding failures in firms’ adhering to their own policies and procedures, including those that specifically prohibited unmonitored communications.  Employees had been advised that the use of unapproved electronic communications methods was not permitted, and they should not use personal email, chats or text messaging applications for business purposes, or forward work-related communications to unapproved applications on their personal devices.  However, systems of follow-up and review hadn’t been implemented to check that supervisors were following policies or undertaking sufficient monitoring to ensure recordkeeping and communications policies were being followed. 

The steps taken to remedy non-compliance 

Each firm has undertaken significant action to improve their compliance policies and procedures, including a review of recordkeeping and a program of remediation. Significant remedial action was also mandated by the regulator, bringing additional financial and operational costs including: 

• The appointment of an independent compliance consultant to review policies and procedures relating to the retention of electronic communications and to submit a report on findings to the regulator plus a follow-up assessment one year later. 
  
  
• A review of training, with staff certifying on a quarterly basis that they are complying with preservation requirements. 
  
  
• An assessment of the technological solutions that firms are using to meet record retention requirements, including an assessment of the likelihood that staff will use the technological solutions going forward and a review of the measures employed to track usage of new technological solutions by personnel. 

Being proactive pays off

As with all enforcement actions there are lessons to be learned and the regulator gives a deliberately clear message to other firms, in-line with its previous advice. The one firm that self-reported and remediated has financially and reputationally benefited from a lower penalty, as well as being positively highlighted by the regulator. 

After identifying off-channel communications, the firm conducted an internal investigation and self-reported the facts to the SEC. It also initiated a program of remediation, which included strengthening policies and procedures by making investments in new technologies to improve surveillance and retention efforts; increasing training and sending firm-wide reminders on the importance of complying with recordkeeping obligations, and making an on-channel texting platform available.

The key takeaways for financial services firms:

• Being proactive pays off: Firms are much better off finding regulatory breaches for themselves, self-reporting and remediating as quickly as possible. Whilst a firm may still be fined, the penalties imposed are likely to be substantially smaller and there is far less likelihood of individual liability.
  
  
• Revisit communications compliance: The regulatory scrutiny and focus on all aspects of communications compliance continues unabated and firms need to consider how to facilitate, and to be able to evidence, compliant communications. Theta Lake’s annual survey report found that the vast majority of financial services firms are revisiting their approach to communications compliance, with only 6% are confident in their approach. 
  
  
• Regulatory patience has run out: The background to this latest set of fines serves to reinforce the zero tolerance approach regulators are taking with regards to communications capture. Firms were found to have consistently and pervasively failed to fulfill their regulatory obligations with regard to electronic communications records capture and preservation. Equally important is the failure (with the one exception) to learn the lessons of previous enforcement and proactively consider whether they too were in breach of recordkeeping requirements. 
  
  
• Facilitate compliant communications: It is clear that the challenge of unmonitored communication channels is far from over. Firms must consider how they can open up approved platform features to both enable productivity and ensure employees are not driven to alternative off-channel platforms. 
  
  
• It’s not just a WhatsApp issue: The consequences of unmonitored communications continue to plague firms, but it’s not just unapproved channels. Regulators will be scrutinizing all communication types. Being able to capture, and provide records from, all channels, from voice to in-meeting chat, as well as the context like emojis, GIFs, reactions, deletions etc, must be a priority for firms.
  
  

In the current regulatory climate, if firms choose to do nothing and unmonitored or unsupervised communications are found by a regulatory body then significantly larger sanctions are likely. Indeed given the recent regulatory rhetoric it is entirely possible that future sanctions will include senior individual liability and accountability.