What's Up With WhatsApp? Regulators Recently Fine Firms $1.8 Billion in Aggregate for "Off-Channel" Communications

Recent alleged recordkeeping failures resulted in aggregate fines in excess of $1.8 billion levied against 11 Wall Street financial institutions and many of their affiliated entities by the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) (together, "the Commissions") in enforcement actions and simultaneous settlements announced by the agencies on September 27, 2022. An earlier action in December 2021 resulted in over $200 million in fines by the SEC and CFTC for the same alleged conduct.

These large settlements came shortly after the Commissions completed investigations at each of the registered defendant firms and affiliated entities regarding the alleged widespread use of personal devices and unapproved communication channels to discuss subjects that are allegedly subject to the Commissions' recordkeeping requirements.

The investigations allegedly uncovered extensive "off-channel"¹ communications by the firms' personnel, which were gathered from personal devices. The Commissions claimed that many of the registrants' employees regularly communicated about business matters via messaging applications such as WhatsApp on their personal devices instead of using work-approved forms of communication such as work-sanctioned emails and firm-issued devices in violation of the firms' approved communications policies and procedures. The firms allegedly did not retain and supervise the "substantial majority" of these communications in violation of federal securities and commodities laws. The Commissions charged that, in some cases, supervisors and senior executives responsible for ensuring compliance with the firms' communications policies themselves violated the firms' communication policies and, in some cases, pro-actively promoted violations by employees.

There was significant overlap among the 11 Wall Street firms and their affiliates that were charged by each Commission, with most of those firms paying a total of $200 million in fines to the Commissions. Among the 11 firms and their affiliates, the SEC charged 15 registered broker-dealers and one affiliated investment adviser, while the CFTC charged 25 registered or provisionally registered swap dealers and registered futures commission merchants. SEC fines ranged from $10 million to $125 million. CFTC fines ranged from $6 million to $100 million.

The size of the penalties indicates that recordkeeping enforcement is a priority at both Commissions. In fact, CFTC Commissioner Christy Goldsmith Romero stated, "The CFTC is sending a zero-tolerance message that [it] will not allow Wall Street to undermine [its] law enforcement by obfuscating or deleting communications surrounding trading."

Although advisers and funds are not subject to the same more extensive record-keeping requirements that apply to broker-dealers, and the record-keeping rules for advisers and funds are often ambiguous and outdated, it is noteworthy, as noted below, that advisers and funds are a focus of recent SEC examination initiatives.

The SEC's Division of Examinations has recently sent inquiries to certain funds and advisers related to their record-keeping practices. The inquiries apparently requested that firms produce documents relating to, among other topics: firm communication, retention and device policies and procedures; supervisors; annual reviews; monitoring and compliance testing; attestation of compliance; training efforts; reminders or materials sent to employees; documents sufficient to identify any violations; and organizational charts identifying those employees primarily responsible for investment decisions, communicating with investors, and executing transactions and those employees for whom firms prepared Form ADV brochure supplements and their direct reports. In addition to inspecting firms' books and records, the SEC might also review whether firms' supervisory and compliance procedures are adequate and whether there is individual regulatory exposure for those who failed to supervise.

Moreover, in its press release related to the sweep, SEC Division of Enforcement Director Gurbir S. Grewal publicly called for firms to self-report and self-remediate their use of off-channel communications. In particular, Director Grewal stated that "[B]roker dealers and asset managers who are subject to similar requirements under the federal securities laws would be well-served to self-report and self-remediate any deficiencies."

Lessons Learned and Path Forward

As new technology continues to change the way that registered firms communicate with their clients and investors, firms' policies, procedures and control frameworks for the retention and monitoring of electronic communications in compliance with the Commissions' recordkeeping rules also must keep pace. Indeed, the need to enhance policies, procedures and control frameworks became more evident during the COVID-19 pandemic when the use of personal devices and alternative forms of electronic communications increased due to remote working.

As the Commissions continue their electronic recordkeeping enforcement, it is highly advisable that registered firms:

1. evaluate their current recordkeeping policies, procedures and controls to determine whether they are in compliance with the Commissions' recordkeeping rules and guidance and consider whether updates should be made;
2. determine whether there are prior off-channel communications or supervisory violations that should be self-reported and remediated; and
3. consider the effect of potential recordkeeping violations on annual chief compliance officer reports and, in the case of SEC registered broker-dealers, Financial Industry Regulatory Authority (FINRA) Rule compliance 3130 certifications.

The full text of the SEC press release is available here, and the full text of the CFTC press release is available here.

Sydney Sapir, a Financial Markets and Funds associate and candidate for admission to the New York State Bar, contributed to this advisory.