The SEC’s Recent Off-Channel Communications Settlements Create More Uncertainty

Since December 2021, the US Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) have been conducting a sweep of Wall Street’s “off-channel” communications—such as text messages, iMessages, WhatsApp messages—sent and received by employees of registered entities using their personal devices. Despite more than 80 SEC-settled orders in the off-channel space (and nearly as many with the CFTC), the path to compliance for broker-dealers, investment advisers, and other financial institutions is still far from clear and numerous questions remain.

BACKGROUND

The SEC’s sweep first focused on the largest broker-dealers, then quickly expanded in scope. Over the last four years, more than 100 entities have settled off-channel recordkeeping charges, including broker-dealers, dually registered broker-dealer/investment advisers, standalone investment advisers, credit ratings agencies, and municipal advisors.

These firms have been charged with, among other things, violations of the recordkeeping rules promulgated under the Securities Exchange Act of 1934 and the Investment Advisers Act of 1940. [1] Until recently, the settlements have included civil penalties ranging from five to nine figures (with nearly all in the many millions). The vast majority of settling respondents have also been required to retain independent compliance consultants (ICC) for multiyear engagements, a further significant expense. Additionally, in nearly all the settlements to date, the respondents were required to admit to the alleged conduct—typically a rarity in SEC settlements.

SEC Commissioners Hester Peirce and Mark Uyeda have previously objected to the penalties and undertakings in the SEC’s off-channel cases, and, in a recent statement following two SEC settlements where firms self-reported off-channel communications, the Commissioners “urge[d] [their] colleagues to reconsider [the] current approach to the off-channel communications issue.” [2]

Commissioners Peirce and Uyeda noted that proper recordkeeping by financial institutions of off-channel communications is critical to the SEC’s ability to investigate and enforce its rules. However, they acknowledged that the recordkeeping rules “are a product of simpler times,” and emphasized the need to modernize those rules, as firm personnel communicate very differently now than they did when the rules were first adopted in 1997. [3]

While acknowledging the importance of recordkeeping, Commissioners Peirce and Uyeda stressed that under the current standards and antiquated recordkeeping rules “even well-intentioned firms could find themselves in the Commission’s enforcement queue time and again.” Among other things, they highlighted the “lack of clarity” regarding the types of communications covered by the rules.

Their statement echoed a sentiment of frustration widely felt across the financial sector: “Effective deterrence requires persons to understand what conduct is prohibited.” [4] As the Commissioners noted, the more recent settled orders suggest that firms are required to ensure that their “recordkeeping and communications policies and procedures [are] always being followed,” [5] a standard seemingly requiring perfection rather than reasonableness.

The two self-reported off-channel matters that preceded Commissioner Peirce and Uyeda’s statement were the following:

IN THE MATTER OF ATOM INVESTORS LP

On September 23, 2024, the SEC announced its first settled off-channel communications action that resulted in no civil penalty or imposition of an ICC, as well as the first (and only) no-admit, no-deny settlement in these matters. The SEC charged Atom Investors LP with violations of, among other things, Advisers Act Rule 204-2. [6]

According to the SEC’s order, the matter originated in 2021, when the adviser was responding to an SEC subpoena for documents in connection with the SEC’s investigation into a third party. The order states that the adviser self-reported to the SEC staff that it had failed to maintain certain electronic communications responsive to the SEC staff’s requests. These included off-channel communications by personnel (including “senior management”) relating to “recommendations and advice from other entities and the execution of orders to purchase or sell securities,” which brought the communications within the ambit of Rule 204-2.

The SEC’s order acknowledges Atom Investors’ self-report as well as its cooperation with the SEC’s investigation of a third party (which appears unrelated to the adviser’s remedial efforts with respect to off-channel communications), but provides no other facts distinguishing the matter from others where the respondents self-reported. The order noticeably lacks any explanation for the absence of a civil penalty, ICC mandate, or admissions.

IN THE MATTER OF QATALYST PARTNERS LP

The next day, on September 24, 2024, the SEC charged Qatalyst Partners LP with violations of Exchange Act Rule 17a-4. [7] Like Atom Investors, Qatalyst self-reported its recordkeeping violations to the SEC and was not required to pay a civil penalty or retain an ICC. Unlike Atom Investors, however, Qatalyst was required to admit to the SEC’s allegations.

The facts underlying the settlement highlight the extent to which it is an outlier in a host of ways. According to the SEC’s order, the firm had undertaken efforts for more than 15 years to prevent the use of off-channel communications and comply with recordkeeping rules, including advising its personnel in 2008 that the use of unapproved electronic communications methods was impermissible.

The SEC found that the firm established a compliant text-messaging process that could retain business communications in 2017 and instructed its personnel to use only that process to communicate about the firm’s broker-dealer business by text message. In 2020, the firm required all personnel to have a firm-issued device on which to conduct firm business and encouraged personnel to use firm-issued and monitored devices when communicating with both business and personal contacts.

Additionally, the SEC’s order states that the firm implemented additional processes in 2022 when it trained its employees, monitored communications sent through firm-approved communication methods, and had a historical record of disciplining employees who violated the firm’s policies. Despite all these efforts, the SEC found the firm did not “implement sufficient monitoring to ensure that its recordkeeping and communications policies and procedures were always being followed,” [8] and thus were in noncompliance with recordkeeping rules. The order is silent as to what more Qatalyst could have, or should have, done.

TAKEAWAYS

Following the announcement of the Qatalyst settlement, Commissioners Peirce and Uyeda implored the Commission to “develop a pragmatic and privacy-respecting approach” to off-channel communications. [9] Until that happens, the SEC’s orders unfortunately leave open many questions about what standards need to be met, what full compliance requires, and what type of penalties and undertakings will flow from a self-report.

Nevertheless, the SEC’s focus on off-channel communications will continue and firms are well served by regularly reviewing and, as necessary, updating their supervisory and compliance programs, policies, and procedures with respect to off-channel communications. We lay out below some general takeaways and considerations, in no particular order:

• Although the orders provide little in the way of guidance on what elements of compliance programs would pass muster with the SEC, firms should promptly review their compliance programs with respect to off-channel communications and determine whether and what updates and/or changes are necessary. We recommend that firms focus on the areas that are identified in the SEC settled orders: supervisory and compliance policies and procedures, training, surveillance, technology, and discipline for noncompliance.
• The SEC has provided little insight concerning its calculation of penalties for off-channel communications recordkeeping violations. While the penalties generally (and roughly) increase by the size of the particular respondent entity, it does not appear there is any set of metrics or formula on which the penalties are based. This is true even for the few firms that self-reported violations. Although Division of Enforcement Deputy Director Sanjay Wadhwa has outlined general factors the SEC considers when determining penalties in these matters, [10] it is still difficult to predict with any certainty what civil penalty the Commission may impose and what “credit” will be given, if any, for self-reporting, cooperation, and/or remediation.
• Several of the settlements reference the fact that the off-channel communications issues were identified in connection with unrelated investigations, sometimes of third parties. Even if not specifically called for in the SEC’s requests, the SEC’s subpoenas and requests often define “communications” broadly to encompass off-channel communications. Registrants responding to SEC requests should carefully consider whether communications on their personnels’ personal devices are within the scope of the subpoena or request and, if so, take steps to obtain and preserve those communications.
• Despite the SEC routinely touting the benefits to firms that self-report recordkeeping-related violations, the settled orders provide little practical (or consistent) guidance into when a self-report will result in a reduced or no civil penalty, no ICC imposition, or the opportunity to settle the matter on a no-admit/no-deny basis. What is clear, however, is that a self-report will almost certainly lead to an investigation and a publicly filed settled order.