U.S. regulatory enforcements against non-compliant electronic communications

U.S. regulators have repeatedly taken enforcement action where financial firms failed to capture, retain, or appropriately supervise business communications conducted through electronic channels.

The enforcement examples covered in this resource span 2021 to April 2024 and show regulators extending established recordkeeping expectations beyond email to communications taking place through SMS, WhatsApp, Signal, iMessage, and social media.

Key enforcement actions covered in the report

• December 2021: A global investment bank received a combined
• $200 million penalty from the SEC and CFTC for failures to capture written communications, including messages conducted through email, text, and WhatsApp.
• September 2022: The CFTC charged 11 firms more than $710 million for recordkeeping failures involving WhatsApp, text messages, and Signal.
• September 2022: FINRA fined a firm $1.5 million, with additional penalties for two employees, in connection with unauthorized text communications and required changes to supervisory policies and training.
• September 2022: The SEC charged 16 firms a combined $1.1 billion for widespread recordkeeping failures involving electronic communications.
• August 2023: The SEC charged 11 firms $289 million over failures to preserve communications conducted through channels including WhatsApp, iMessage, and Signal.
• February 2024: A further 16 firms were charged more than $81 million by the SEC for recordkeeping failures involving unauthorized text communications.

Which communications channels have attracted regulatory scrutiny?

The enforcement history demonstrates that recordkeeping obligations are not limited to traditional corporate email.

• SMS and text messaging
• WhatsApp
• Signal
• iMessage
• Email
• Instant messaging platforms
• Social media and websites

As employee and client communications move across a wider range of channels and devices, firms need to consider whether business-related communications can be captured and retained regardless of where they take place.

Which U.S. rules apply to electronic communications?

The report highlights several regulatory developments affecting electronic communications compliance.

SEC Rule 17a-4 establishes electronic recordkeeping requirements for applicable broker-dealers, while updates to the
Department of Justice Evaluation of Corporate Compliance Programs (ECCP) have increased attention on the use of personal devices and communications platforms.

The SEC’s Marketing Rule has also created additional expectations around how investment advisers use advertising and social media, including the presentation of hypothetical performance.

Social media creates a different communications compliance risk

Electronic communications enforcement is not limited to failures to retain employee messages.

The resource also highlights SEC Marketing Rule cases involving registered investment advisers. In September 2023, nine RIAs received penalties totalling $850,000 relating to the use of hypothetical performance in public advertising, followed by five additional RIAs receiving $200,000 in penalties in April 2024 for similar conduct.

This illustrates how communications compliance can extend from the preservation of internal and client communications to the way firms communicate publicly through websites and social channels.

What can financial firms learn from these enforcement actions?

The cases covered in the report point to several recurring considerations for communications compliance programs:

• Business communications can create recordkeeping obligations regardless of channel.
• Policies alone may not prevent employees from using unauthorized communications platforms.
• Mobile and instant messaging channels need to be considered alongside traditional email.
• Supervisory policies and employee training remain part of the regulatory response to communications failures.
• Firms need visibility over changing communications behavior as new platforms are adopted.

The enforcement timeline shows why communications capture and recordkeeping need to evolve alongside the channels employees and clients actually use.

Explore the U.S. enforcement timeline

View the full infographic for the enforcement timeline and examples of SEC, FINRA, and CFTC actionsinvolving non-compliant electronic communications between 2021 and 2024.