SEC Announces Possible Last Wave of Off-Channel Communications Enforcement Actions

On January 13, 2025, the SEC announced charges against nine investment advisers and three broker-dealers for failures to maintain and preserve electronic communications, the latest wave in a series of charges against financial institutions for violating recordkeeping obligations under the securities laws.¹ With the change in the administration, this may be the last wave of actions coming out of the SEC's enforcement sweep relating to off-channel communications.

Background

The SEC announced that the settlements with 12 financial firms included admissions of the facts set forth in the SEC's orders, violations of the recordkeeping provisions, and agreements to pay combined civil penalties of $63 million. The bases for the penalties were the firms' failure to properly maintain and preserve electronic communications, such as texts and emails, on personal devices used by their employees. According to the SEC, this failure impeded the SEC's ability to conduct investigations and enforce compliance with securities regulations.

The announcement was the latest activity in a string of actions focused on "off-channel communications" violations, detailed in our previous alerts.² In recent years, the SEC has brought several waves of enforcement actions against registrants for failing to apply the record retention requirements outlined in the Securities Exchange Act of 1934 ("Exchange Act") Rule 17a-4(b)(4) and Investment Advisers Act of 1940 ("Advisers Act") Rule 204-2(a)(7) to employee personal devices or other modern communications applications, including iMessage, WhatsApp, and Signal. As discussed further below, the announcement may mark the final iteration of standalone enforcement actions based solely on off-channel communications violations, in favor of including recordkeeping violations in enforcement actions that also address other violations of the securities laws.

In the latest enforcement actions, the SEC stressed that recordkeeping failures spanned personnel at multiple levels of authority, including individuals in supervisory roles, such as senior management, partners, or managing directors who exchanged off-channel communications with multiple colleagues, including junior employees under their supervision. The enforcement actions emphasize that these respondents also failed to reasonably supervise employees with a view to preventing or detecting violation of the recordkeeping requirements and any record retention policies or procedures were not followed or enforced. The SEC further highlights that by failing to maintain and preserve these records, the firms likely deprived the SEC staff of relevant evidence in SEC investigations.

Off-Channel Communications Actions Going Forward

While this announcement represents the latest in a lengthy string of off-channel communications enforcement actions, with the change in the administration, it may be the final set of standalone charges coming out of the recordkeeping sweep. In September, two Republican-appointed Commissioners dissented from an off-channel communications enforcement action expressing concern that firms do not have an achievable path to compliance.³ Their dissent noted that even firms which take reasonable steps to address off-channel communications issues may still find themselves not in compliance with recordkeeping requirements. They further advocated that the SEC should work with the industry and interested members of the public to develop a pragmatic and privacy-respecting approach that enables adequate record retention, and explicitly stated that the SEC cannot enforce its way to perfection with respect to recordkeeping requirements under the securities laws. This dissent and expected changes at the SEC resulting from the incoming administration signal that the Commission may address recordkeeping violations through new regulations or guidance, but not through further enforcement actions.

We may see off-channel communications violations included when a registered entity is also charged with other securities violations by the SEC. For example, on the same day that the latest wave of off-channel communications actions were announced, the SEC announced settled charges against a broker-dealer for a variety of securities law violations.⁴ These violations included failure to timely investigate suspicious activity reports, failure to implement adequate policies to protect against identity theft, failure to address cybersecurity vulnerabilities, failure to retain brokerage data, and failure to maintain customer communications. In addition, the settlement included violation of the recordkeeping requirements for failure to retain off-channel communications. We view the SEC's announcement of multiple charges, including off-channel communications violations, as a sign that going forward, the SEC will likely include off-channel communications as part of broader enforcement actions concerning other violations of the securities laws, not as standalone violations.

Benefits of Self-Reporting

As in other waves of enforcement actions, the SEC again highlighted the fact that one of the twelve firms self-reported its violations to the SEC and, as a result, faced significantly lower civil penalties than it would have otherwise. In previous waves of enforcement actions, the SEC stressed the importance of self-reporting.⁵ In each instance where a registrant self-reported, however, they have still been required to pay significant penalties and admit to the same liability as other respondents, namely violations of recordkeeping provisions of the Exchange Act and/or Advisers Act, and failing to reasonably supervise employees as required under the same statutes. They were also required to engage "compliance consultants" to conduct comprehensive reviews of firm policies concerning electronic communications. As a result, it is important for registrants to consult with outside counsel upon the discovery of any recordkeeping issue to consider next steps, options, and potential benefits of self-disclosure.

_{1 See Press Release, U.S. Sec. & Exch. Comm'n, Twelve Firms to Pay More Than $63 Million Combined to Settle SEC's Charges for Recordkeeping Failures (Jan. 13, 2025) available here.
2 See previous client alerts on this topic here and here.
3 Statement, Comm'r Hester M. Peirce and Comm'r Mark T. Uyeda, A Catalyst: Statement on Qatalyst Partners, LP (Sept. 24, 2024) available here.
4 Press Release, U.S. Sec. & Exch. Comm'n, Two Robinhood Broker-Dealers to Pay $45 Million in Combined Penalties for Violating More Than 10 Separate Securities Law Provisions (Jan. 13, 2025) available here.
5 Press Release, U.S. Sec. & Exch. Comm'n, SEC Charges 11 Wall Street Firms with Widespread Recordkeeping Failures, (Aug. 8, 2023) available here.}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2025 White & Case LLP}