Message Received: SEC Zeros In On Off-Channel Communication

Introduction

On 7 February 2023, the U.S. Securities and Exchange Commission (SEC) Division of Examinations (the Division) released its 2023 examination priorities. As expected, the Division’s priorities highlight areas that were the subject of 2022 rulemaking or Division of Enforcement initiatives, including recordkeeping and supervisory programs related to business-related electronic communication.¹ As the 2023 SEC examination period begins, alongside continuing SEC sweep examinations into electronic communication and record keeping,² firms should be on alert for compliance with communication policies and be prepared to demonstrate an effective and robust recordkeeping program. 

The Division’s examination of recordkeeping for electronic communication follows a series of well-publicized enforcement actions by both the SEC and Commodity Futures Trading Commission (CFTC) against major financial institutions for failing to implement and maintain proper controls for business-related communication. Starting with a December 2021 settlement for US$200 million, and carrying through to late September 2022 settlements with 15 major financial institutions, the SEC and CFTC have sent a clear message that regulated entities must comply with recordkeeping requirements.³ SEC Chair Gary Gensler stated last fall that the SEC was only just getting started in its enforcement efforts and that companies should expect substantial penalties to come from record retention enforcement actions.⁴ 

This alert recaps the recent government actions relating to electronic recordkeeping, identifies the types of off-channel communication regulators are targeting, and offers tips on how firms can best stay out of the SEC and CFTC’s crosshairs for failing to monitor and retain off-channel communication.

Applicable Agency Rules

Broker-dealers are subject to record retention requirements enumerated in Exchange Act Rule 17a-4 (Rule 17a-4)⁵ and investment advisers are subject to record retention requirements set forth in Advisers Act Rule 204-2 (Rule 204-2).⁶ Additionally, Sections 4g and 4s of the Commodity Exchange Act, and the regulations implemented thereto, require that swap dealers and other CFTC registrants retain comprehensive records of their business-related communication.⁷ 

These requirements apply to all business-related communications that fall into one or more of the categories of records that are required to be maintained under the applicable rule. For the past two decades, business communication has largely taken place over email or company-maintained messaging services, where longstanding technology has been capable of capturing and retaining such records. Notably, preservation of business email became standard practice following actions brought by the SEC in the early 2000s as email communication became the norm.⁸ As communication practices have evolved with technology, aided in part by the rise of messaging platforms during pandemic-era remote work, the SEC has been clear that the same recordkeeping requirements apply to off-channel communication, including ephemeral messaging platforms such as WhatsApp and social media messaging services, as well as personal email and text-messaging. 

Regulated entities must also be aware of the requirement to supervise their employees to prevent or detect violations of applicable laws and regulations.⁹ As the recent enforcement actions indicate, failures to implement procedures and preserve communications will also likely result in additional violations for failure to properly supervise employees.¹⁰ 

Sending the Message: Recent Enforcement Actions and Inquiries

The first signal that the SEC and CFTC were serious about enforcing record retention requirements for off-channel communication came in December 2021. The SEC and CFTC resolved charges against a major Wall Street firm, resulting in a combined penalty of US$200 million for “widespread and longstanding failures by the firm and its employees to maintain and preserve” business-related communication occurring over text message, WhatsApp, and personal email accounts.¹¹ After the settled charges were announced, Gensler noted the importance of recordkeeping requirements, particularly in light of ever-evolving technology.¹²   

Then, on 27 September 2022, the SEC and CFTC announced a group of settled enforcement actions, involving charges against 15 high-profile broker dealers and one investment advisor and a total of US$1.1 billion in penalties.¹³ The charges centered on the firms’ respective failures to implement and maintain proper controls for business-related communications, including monitoring and retaining business-related communication conducted over “off-channel” mediums. 

The September 2022 charges closely mirrored those alleged in the previous December 2021 settlement. In the September 2022 orders, the regulators focused on the following facts:

1. The widespread and pervasive use of unrecorded business-related communication conducted through “off-channel” mediums, including text messages, personal email, WhatsApp, and Signal.
2. The existence of record retention policies and procedures that were not followed, enforced, or reviewed.
3. Management and supervisors tasked with enforcing policies and procedures related to record retention and off-channel communication violated such policies and procedures themselves. 

In addition to civil money penalties, each of the firms subject to the September 2022 orders were required to, among other things, retain an independent consultant to review and report on policies, procedures, training, and other implemented measures related to the preservation of electronic communication and the use of unauthorized communication channels.¹⁴ 

While the SEC has not announced additional charges or settlements since last fall, reports indicate investigations of electronic communication retention practices are in full swing. In November 2022, three large private equity firms disclosed in quarterly filings they were responding to SEC inquiries into their business-related messaging. At the start of February, two hedge funds disclosed that the SEC had asked to review the mobile phones of certain employees for off-channel business communication.¹⁵ A French bank also recently announced the SEC asked for information related to “compliance with recordkeeping requirements in connection with business-related communications on messaging platforms that were not approved by the firm[.]”¹⁶

Scope of the Applicable Requirements

The recent enforcement actions reiterate the SEC and CFTC’s long-standing positions that not all employee personal text or email, WhatsApp, Signal, or other off-channel communications must be preserved. Instead, regulators are focused on ensuring the preservation of all records that are required to be maintained under applicable law, which capture certain off-channel business-related communications between colleagues, clients, broker-dealer customers, and other persons connected to securities, commodities, or swaps-related businesses.¹⁷ 
 
While the SEC and CFTC have refrained from specifically defining “business-related,” the SEC has interpreted the term as including communication related to investment strategies and discussions of client meetings. The agency has also taken issue with communication related to the “market, analysis, activity trends or events.”¹⁸ In the Deutsche Bank order, the SEC specifically noted that a senior investment banker “sent and received a substantial number of off-channel text messages” about, among other things, “market color, analysis, activity trends or events in the technology industry[,]” and identified such communication as that which should have been preserved.¹⁹  

Firms should be mindful that the content of the communication, not the medium used, is determinative of whether retention requirements apply. In an adopting release of Rule 17a-4, the SEC noted that “the content of the electronic communication is determinative” when deciding whether it relates to a broker-dealer’s business and should be retained.²⁰ This guidance remains particularly relevant as communication technology shifts to new platforms, where both business and personal communication regularly occur.

What Is Next and How to Prepare:

It is clear the SEC is just getting started. Following actions targeting major financial firms, communication and record retention practices at smaller entities are likely to be next in line. In a speech delivered on 2 November 2022, Gensler projected the use of “sweeps, initiatives, and undertakings” to actively enforce federal record retention requirements, putting firms of all sizes on notice of the SEC’s enforcement focus.²¹ Penalties from such initiatives are also likely to be substantial. In announcing the SEC’s Fiscal Year 2022 Enforcement Results on 15 November  2022, the SEC noted it had “recalibrated penalties” for certain violations, and pointed to the cumulative US$1.235 billion in penalties from recordkeeping violations as an example of ensuring such penalties are “not just a cost of doing business.”²²

Moving forward, in light of the regulators’ renewed focus and evolving uses of technology, regulated entities should consider whether existing practices and procedures address the issues emphasized by the SEC and CFTC in the recent enforcement proceedings. Practices and procedures regulated entities may wish to consider include: 

1. Institute and/or evaluate current and prior policies pertaining to electronic records preservation and the use of communication channels. Among other things, such policies should address permitted (and prohibited) communication channels, types of communications permitted on approved channels, record retention requirements, and supervision. Policies should be clear that any business-related communications through employees’ personal devices, if permitted, are subject to firm policies. Policies should be periodically analyzed to confirm they are being followed, enforced, and are effective. Firms should also consider requiring their employees to certify compliance with such policies quarterly.
2. Conduct routine employee trainings, including initial and annual training, regarding the firm’s policies and procedures regarding electronic communications and proper use of electronic communications, including electronic communication preservation and the use of personal text and email, WhatsApp, Signal, and other off-channel mediums to discuss business-related matters. Firms should consider making these trainings mandatory for all employees.
3. Institute technological measures that preserve and flag off-channel communication, or prohibit the download or use of certain applications where message retention is not possible. Such measures may include surveillance of tracked communications, such as firm email accounts, for indications that employees may be taking business-related communications into an unmonitored medium.
4. Issue company-owned phones or company-managed phones through which employees can message others about business-related matters. Such communication should be preserved. Additionally, companies should require that only business-related communication is occurring over company-owned or managed phones.
5. Firm policies should include a clear statement that violation of the policy can result in serious disciplinary actions, including fines and termination of employment. Moreover, firms should be ready to take strong disciplinary action when violations of the policies are discovered. In fact, one firm subject to the SEC’s September 2022 settlements announced it had fined certain employees up to US$1 million for off-channel business communication.²³ Disciplining employees that violate policies can effectively deter future violations and demonstrate to regulators that the firm is serious about following record retention laws and regulations. Firms should also consider self-reporting recordkeeping violations, which the SEC encouraged in one recent action.²⁴