SEC and CFTC Crackdown on Use of Personal Messaging Platforms Raises Compliance Concerns – and Opportunities
By Alston & Bird partners David J. Baum and Martin H. Dozier
Executive Summary
Using personal devices and messaging platforms may be convenient (and ubiquitous), but it may run afoul of federal records retention rules. Our Investment Management, Trading & Markets and White Collar, Government & Internal Investigations Teams examine the latest federal enforcement and self-disclosure activity and what companies can do to comply before facing an investigation.
- Agencies’ willingness to bring enforcement actions based solely on underlying violations of records retention rules signals a more aggressive enforcement posture
- Failures identified in the current enforcement initiative could heighten enforcement risk from other agencies
- Firms should revisit current practices to find opportunities to identify and close compliance gaps
Recent disclosures by several of the world’s largest financial institutions indicate that the Securities and Exchanges Commission’s (SEC) and Commodity Futures Trading Commission’s (CFTC) scrutiny of the use of unapproved messaging platforms for business communications continues across the industry. This follows these agencies’ recent enforcement actions against a broker-dealer subsidiary of a major U.S. financial institution, accompanied by the “invitation” to other industry participants to self-disclose their own use of personal devices for business purposes, without mention of any potential safe harbor or cooperation credit.
The SEC’s and CFTC’s willingness to bring enforcement actions based solely on underlying violations of records retention rules signals a more aggressive near-term enforcement posture in this space. Given the prevalence of personal (and ephemeral) messaging platforms and the rigors of statutory and regulatory requirements such as those found in the Exchange Act and the SEC’s Compliance Rule, this more aggressive posture further underscores the critical importance for the broker-dealer and investment adviser community of ensuring the adequacy and effectiveness of recordkeeping policies and procedures and otherwise continuing to take measures to strengthen compliance programs.
Records retention practices related to the intersection of business communications and personal messaging applications will soon feature in SEC examinations, more formal enforcement investigations, and even in whistleblower claims. Leveraging the lessons of recent enforcement activity and agency guidance regarding compliance with recordkeeping requirements will enable firms to adjust their compliance programs to mitigate this heightened enforcement risk.
