United States: SEC's Closing Message To B-Ds And IAs: A Mea Culpa Could Save You Millions In Recordkeeping Fines

On the last business day of its 2023 fiscal year, the U.S. Securities and Exchange Commission (SEC or Commission) announced settlements with 10 regulated entities — five broker-dealers (B-Ds), three dual-registered broker-dealers and registered investment advisors (RIAs), and two affiliated RIAs — for widespread and long-lasting failures to maintain and preserve their employees' off-channel communications. As explained in more detail below, off-channel communications generally include text messages, social media, and other messaging platforms, such as Slack or WhatsApp, that are used at least in part for work purposes and may not ordinarily be monitored and recorded by the B-Ds and RIAs. As part of the settlements, each firm admitted that their off-channel record-keeping practices violated federal securities laws; the firms, collectively, agreed to pay an aggregate penalty of US$79 million, and agreed to hire an independent compliance consultant to reform off-channel recordkeeping practices.

These recent settlements are the latest chapter in the Commission's enforcement of record-keeping requirements against B-Ds and RIAs pertaining to off-channel communications. Enforcement with respect to RIAs is particularly notable since the record-keeping obligations under the Investment Advisers Act are not as comprehensive as the record-keeping obligations that apply to B-Ds. The recent settlements also follow a series of high-profile enforcement actions against major banks and B-Ds in 2021 and 2022 and the Commission's October 2022 adoption of amendments to the electronic recordkeeping requirements for broker-dealers (and security-based swap dealers and major security-based swap participants), which "modernize" the requirements regarding the maintenance and preservation of electronic records to "make the requirements adaptable to new technologies" and "facilitate examinations." Notably, the recent settlements also make one point incredibly clear: firms that self-report violations and undertake remedial steps prior to self-reporting faced significantly lower monetary penalties than firms that did not. As Enforcement Director Gurbir Grewal stated, "[t]here are real benefits to self-reporting, remediating and cooperating."

It is worth noting that, in this context, the SEC defines off-channel communications as communications exchanged via text messages, social media, and messaging platforms such as iMessage, Telegram, Signal, WhatsApp, Slack, Zoom Team Chat, Rocket.Chat, etc. that either (1) "relate to the firm's business as" a broker-dealer (in the case of broker-dealers) or (2) are "recommendation[s] made or proposed to be made [or] advice given or proposed to be given" (in the case of RIAs). The SEC has adopted a very broad interpretation of these provisions such that a significant percentage of communications exchanged by B-Ds and RIAs via text messages, social media, and messaging platforms maybe subject to preservation and retention requirements.

The Impact of Self-Reporting Versus Failing to Self-Report

The eight broker-dealer entities each admitted that their failure to adequately maintain and preserve certain of their employees' off-channel communications violated Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-4(b)(4) thereunder. These firms also admitted this conduct violated their obligation to reasonably supervise employees' use of off-channel communications with a view toward preventing and detecting record-keeping violations.

The five RIAs each admitted that their failure to adequately maintain and preserve certain of their employees' off-channel communications violated Section 204 of the Investment Advisers Act of 1940 and Rule 204-2(a)(7) thereunder. In addition, each of the firms also admitted this conduct violated their obligation to reasonably supervise employees' use of off-channel communications with a view toward preventing and detecting recordkeeping violations.

The table below summarizes the penalties paid by the respective firms. Note that the two Perella Weinberg entities paid substantially less than the other B-Ds and RIAs. According to the SEC, this is because Perella Weinberg self-reported its violations to the Staff, resulting in "a real benefit" in the form of a significantly reduced penalty.

Key Take-Aways

The Commission has not been subtle on this front, and the take-aways are clear:

• First, the Commission is likely to continue its risk-based investigation into the use of off-channel and unpreserved communications at B-Ds and RIAs in FY 2024, and likely will continue its aggressive pursuit of any violations it uncovers.
• Second, knowing that off-channel and unpreserved communications are likely to continue to be an enforcement focus for the SEC, B-Ds and RIAs should undertake to assess whether employees are engaged in off-channel communications outside of the firm in violation of federal securities laws.
• Third, with regard to Slack, Teams, and Zoom chats, which might be "company approved" messaging platforms, firms need to ensure they satisfy regulatory record-keeping obligations.
• Fourth, while the full benefits of self-reporting are still up for debate, there is no question that regulated entities that self-report will be treated more leniently than those that do not self-report. To be sure, as alluded to above, there could well be instances where regulated entities may be wise to challenge a particularly broad or expansive application of the "off-channel" communication recordkeeping requirements.

Given the ease and prevalence of off-channel communications, firms that have not already done so should consider conducting a privileged internal investigation to determine whether any record-keeping violations have occurred. If the firm concludes it has failed to adequately prevent against, monitor, and preserve off-channel communications, it would be well-advised to identify and remediate the structural failures that permitted the violation, and at least consider whether self-reporting is in the company's interests. If making the decision to self-report, firms should continue to cooperatively engage with SEC Staff to work through any remedial plan or structural changes required as a result of the violation. As we saw in fiscal year 2023, anything short of a full mea culpa may result in steeper monetary fines.

We will continue to monitor and report on the key enforcement and regulatory developments at the SEC. In the meantime, please reach out to any author of this Advisory or your regular Arnold & Porter contact with any questions about the issues discussed herein or the state of play at the Commission.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.