The SEC’s focus on text messaging and ephemeral messaging platforms is not disappearing anytime soon. Just last week, SEC Enforcement Director Gurbir Grewal announced that the SEC intends to continue to prioritize and bring cases related to text messaging and ephemeral messaging platforms. The news came in a “fireside chat” during the Global Investigations Review’s Annual Investigations Meeting.[1] His statement, however, should not come as a surprise to readers of these Alerts.[2]
Ephemeral messaging platforms, such as Signal, allow users to send encrypted messages or messages that self-destruct after a certain amount of time. The use of these platforms by employees of broker-dealers and investment advisers may violate the SEC’s books and records requirements. Indeed, cracking down on recordkeeping violations stemming from the use of personal devices, ephemeral messaging platforms, and other unmonitored channels has been a priority for the SEC since at least 2021 when one broker-dealer agreed to pay $125 million in penalties relating to such failures.[3] According to Grewal, the SEC has brought some 30 enforcement actions and imposed $1.5 billion in fines related to failures to preserve communications taking place on non-official channels.[4] The SEC, it appears, is concerned that its message is still not getting through. At the Global Investigations Review chat, Grewal emphasized that the SEC “continue[s] to see noncompliance.”
Recent SEC Enforcement Actions
Director Grewal’s remarks come on the heels of the SEC’s August 2023 enforcement actions against ten broker-dealers and one firm dually registered as a broker-dealer and investment adviser for failing to maintain and preserve electronic records. All firms settled the charges brought against them, agreeing to pay an aggregate amount of $289 million in penalties and to undertakings that require them to implement improvements to their relevant policies and procedures.[5] More actions are widely expected.
The August SEC orders are substantially similar to the orders entered in a prior sweep announced in September 2022. In the August 2023 orders, the SEC alleged (and the firms admitted) that senior executives and other firm employees communicated internally and externally about the firms’ business as broker-dealers via unapproved and unpreserved text message and ephemeral messaging platforms. According to the SEC, the firms failed to preserve these communications in violation of applicable recordkeeping rules, including Exchange Act rules that broadly require broker-dealers to preserve “all communications received and copies of all communications sent … relating to its business as such ….”[6]
Each SEC order cited examples of the communications that the firms failed to preserve. The SEC highlighted internal communications, especially those involving managing directors or similarly high-level employees, that related to customer business, including specific orders and transactions. And the SEC also emphasized off-channel communications with customers and other market participants. Throughout its orders, the SEC noted the use of messaging platforms that destroy or delete messages. The SEC imposed fines ranging from $9 million to $125 million.
As in the September 2022 cases, the Commission required that each firm retain an independent compliance consultant to conduct a 90-day review of the firm’s policies and procedures, training, and surveillance program relevant to compliance with recordkeeping requirements. The compliance consultants were also tasked with assessing the efficacy of (i) any technical solutions that the broker-dealers’ employed to address recordkeeping requirements, (ii) the broker-dealers’ approach for restricting the use of personal communication devices by certain employees while at work, and (iii) the broker dealers’ frameworks for disciplining employees that violated recordkeeping-related policies and procedures.[7]
Grewal’s public statements during the “fireside chat” about these actions indicate a consistent approach from the SEC as to the importance of communications preservation and the likelihood of further recordkeeping-related cases. Grewal described the SEC as attempting to drive home the “foundational message” that “[c]ompliance with the books and records requirements of the federal securities laws is essential to investor protection and well-functioning markets.” From the SEC’s perspective, according to Grewal, many broker-dealers and investment advisers have yet to improve their policies and procedures. Grewal called on these firms to “self-report, cooperate and remediate.”[8]
CFTC and DOJ Focus
Parallel to the SEC, the CFTC continues to focus on financial institutions’ compliance with recordkeeping requirements imposed by the Commodity Exchange Act and the regulations thereunder. Registered swap dealers or futures commission merchants are subject to extensive and detailed recordkeeping requirements related to their business activities. These recordkeeping rules require firms to maintain records of all oral and written communications related to the provision or receipt of bids, offers, or quotes that lead to a swaps or futures transaction.[9] Moreover, the CFTC has indicated it views these records as critical to the duty of firms to diligently supervise and monitor the activities of their employees. Since 2021, the CFTC settled charges, with admissions of liability, against many financial institutions registered with the CFTC as a swap dealer or futures commission merchant for their employees’ widespread use of unauthorized methods of communication, including personal text and ephemeral messages on personal devices, to discuss business-related matters. Each CFTC settlement charged the registrant with failing to: (i) maintain, preserve, and (in some cases) produce records which were required to be kept under CFTC recordkeeping requirements, and (ii) diligently supervise matters related to their businesses as swap dealers.
More recently, as part of the August 2023 sweep, the CFTC brought four cases against swap dealers and futures commission merchants. The CFTC noted in these cases that the firms had used unapproved methods, including text and ephemeral messaging services, to engage in communications related to the trading of CFTC-regulated products. Like the SEC, the CFTC emphasized that supervisors and senior-level employees were among the violators.[10] According to the CFTC’s Director of Enforcement Ian McGinley, the CFTC has imposed $1 billion in penalties for recordkeeping violations as part of its prioritization of recordkeeping compliance. [11]
For its part, the DOJ has also signaled its own focus on ephemeral messaging and document preservation. In March 2023, then-Assistant Attorney General Kenneth Polite announced additions to the DOJ’s memorandum regarding its evaluation of corporate compliance programs such that the memorandum now addresses the use of personal devices and ephemeral messaging platforms for business communications.[12] The memorandum explains that the DOJ will consider whether a company maintains policies and procedures related to “personal devices, communications, platforms, and messaging applications, including ephemeral messaging applications,” that are “tailored to the corporation’s risk profile” and ensures that records are “accessible and amenable to preservation by the company.”[13]
Looking Forward
Grewal emphasized in his recent speech that one reason for the SEC’s focus on ephemeral messaging and recordkeeping compliance is a concern that a failure to preserve key documents will impede investigation into other substantive violations. This concern likely animates the CFTC and DOJ’s interest as well and, for the DOJ’s part, indicates that its emphasis on ephemeral messaging and the use of personal devices to conduct business will extend well beyond financial-market fraud and regulated broker-dealers. The SEC and CFTC Enforcement Staffs will likely continue to identify and charge regulated firms with recordkeeping-specific violations as part of their ongoing sweep. But firms should also expect that the efficacy of their records-retention program will factor into the SEC’s enforcement approach to any kind of purported misconduct, including the SEC’s evaluation of the efficacy of compliance programs and the extent to which a company has cooperated with an investigation.
Willkie attorneys have extensive experience with SEC, CFTC, and DOJ enforcement actions, including first-hand experience working at each agency. We are available to advise firms regarding their policies, procedures, controls, trainings, and technological applications related to recordkeeping requirements and monitoring off-channel communications.
For more on this topic, please do not hesitate to reach out or consider taking our recent CLE: “Ephemeral Messaging, Tangible Costs: The DOJ, SEC, and CFTC Crackdown on Off-Channel Communications.”[14]
Click here to download this article.
[1] Anna Bianca Roach, “SEC to prioritise ephemeral messaging and ESG misstatements, enforcement director says,” Global Investigations Review (September 22, 2023), available here.
[2] William J. Stellmach, et al., The SEC and Messaging Apps, Harvard Law School Forum on Corporate Governance (June 15, 2022), available here.
[3] In the Matter of J.P. Morgan Securities LLC, Exchange Act Release No.3-20681 (December 17, 2021).
[4] Gurbir Grewal, Director, SEC Division of Enforcement, Statements in Relation to SEC Recordkeeping Enforcement Actions (August 08, 2023), available here.
[5] Id.
[6] Exchange Act Rule 17a-4(b)(4).
[7] The orders instituting proceedings against each firm are appended to the SEC’s August 8 press release.
[8] Id.
[9] See CFTC Rules 1.31, 23.201(a), 23.202(a)(1), (b)(1).
[10] CFTC Orders Four Financial Institutions to Pay total of $260 Million for Recordkeeping and Supervision Failures for Widespread Use of Unapproved Communication Methods, CFTC press release (August 8, 2023), available here.
[11] CFTC Orders Four Financial Institutions to Pay total of $260 Million for Recordkeeping and Supervision Failures for Widespread Use of Unapproved Communication Methods, CFTC press release (August 08, 2023), available here.
[12] Department of Justice, “Assistant Attorney General Kenneth A. Polite, Jr. Delivers Keynote at the ABA’s 38th Annual National Institute on White Collar Crime,” (March 3, 2023), available here.
[13] Department of Justice Criminal Division, Memorandum, Evaluation of Corporate Compliance Programs (updated March 2023) at p. 17, available here.
