‘Heed This Message’: Organizations That Fail to Contemplate Off-Channel Communications ‘Do So at Their Own Peril’

Financial Regulators Continue Focus on Off-Channel Communications

On Aug. 8, the Securities and Exchange Commission (SEC) announced it had imposed $289 million in fines on 10 broker-dealers for violating recordkeeping provisions of federal securities laws. Similarly, the Commodity Futures Trading Commission (CFTC) announced on the same day that it had imposed $260 million in fines on four CFTC-registered firms for violating CFTC recordkeeping rules. Both the SEC and the CFTC charges were based on the failure to preserve electronic communications, including employees’ “off-channel” communications through personal messaging apps as opposed to company-sanctioned platforms.

The agencies’ investigations revealed that employees of these firms, including supervisors and senior-level executives, communicated regularly and extensively using unapproved communication methods, such as personal text, iMessage and Signal. Even if company policies forbade such off-channel communications, the firms were nevertheless culpable for “failing to reasonably supervise with a view to preventing and detecting those violations.” In addition to agreeing to pay the fines, the firms committed to improving their compliance mechanisms to prevent such violations in the future.

Gurbir Grewal, director of the SEC’s Division of Enforcement, emphasized the agency’s continued focus on recordkeeping rules, noting that “to drive this foundational message home” it had brought 30 enforcement actions, rendering $1.5 billion in fines. Ian McGinley, the CFTC’s director of enforcement, likewise highlighted his agency’s actions against 18 firms, rendering more than $1 billion in fines for similar violations. Grewal encouraged firms to “heed[] this message” – and advised those who have committed similar recordkeeping violations to “self-report, cooperate and remediate,” as doing so would result in “a better outcome than if you wait for us to come calling.” McGinley warned in the same vein, “[CFTC] registrants that fail to comply with these core regulatory obligations do so at their own peril.”

A Recent Growing Concern

These announcements follow similar news from December 2021, when the SEC and the CFTC imposed a combined $200 million in fines on JPMorgan Chase for the loss of off-channel messages that were sent via apps on employees’ personal devices. The Department of Justice (DOJ) showed that it too is paying close attention to the issue of off-channel communications – meaning this should be a concern to every organization, not just financial institutions subject to SEC or CFTC oversight. Deputy Attorney General Lisa Monaco issued a memorandum in September 2022 advising prosecutors that in evaluating a company’s compliance program, they should “consider whether the corporation has implemented effective policies and procedures governing the use of personal devices and third-party messaging platforms to ensure that business-related electronic data and communications are preserved.” These considerations should play a role in corporations seeking “cooperation credit in connection with an investigation.”  In March, the DOJ Criminal Division revised its “Evaluation of Corporate Compliance Programs” (ECCP) guidelines, which prosecutors use to make corporate charging decisions, to incorporate those principles from the September 2022 Monaco Memo.

Prepare to Address the Issue

As attention to this issue increases, it is critical for each organization to develop a deep understanding of employee practices, its own data management and the legal framework under which it operates. Only then can it establish effective policies and procedures that, among other things:

These sweeps by the SEC and the CFTC, when viewed in light of recent DOJ guidance concerning the primacy of text messages and chats in the criminal enforcement area, are a harbinger of things to come in the litigation arena as well. Perceptions of a right to privacy concerning off-channel business communications mirror similar misplaced beliefs concerning email from decades past. While BakerHostetler emphasizes a practical approach in each unique eDiscovery exercise, we do believe that the email-only era of electronic communications is over, and it behooves organizations to understand where their relevant business data resides, particularly when under a regulatory retention requirement or other duty to preserve.

BakerHostetler’s attorneys have extensive experience helping clients with these issues through their work on our practice teams for White Collar, Investigations, and Securities Enforcement and Litigation; E-Discovery Advocacy and Management; and Information Management. Please feel free to contact any of our experienced professionals if you have questions about this alert.