Take one look at your phone and count how many different message apps you have.  WhatsApp, Facebook Messenger, Snapchat, Telegram, Signal, iMessage.  Those are just some of the most popular messaging applications available right now and chances are you have more than one of those on your phone right now.  If you are in the financial services industry, beware.  Last week it was reported that the U.S. Securities and Exchange Commission’s recent investigation of broker-dealers for violation of regulations relating to use of personal messaging devices, such as WhatsApp—which resulted in over $1.8 billion in fines to 16 financial institutions—has broadened to include investment funds and advisers.

According to individuals familiar with the inquiry, the SEC has issued document requests and preservation notices to a number of investment funds and advisers relating to their policies regarding employee use of personal devices and messaging platforms.

In an effort to comply with SEC and FINRA recordkeeping requirements, Wall Street banks frequently ban use of personal devices on trading floors and require traders to communicate with each other and with clients exclusively through email and bank-provided messaging programs, where messages can be monitored and preserved.  Though the SEC’s investigation of broker-dealers included violations from January 2018 through September 2021, the rise of remote work during the pandemic made enforcing personal device bans challenging.

Even as major banks are leading a push to bring workers back to the office full time, employees at many financial institutions are still working from home at least a few days a week.  Communication habits built while working from home may follow employees as they return to the office.

So too has the challenge of speaking to customers who may prefer to use apps like WhatsApp that for many are an easier and more immediate way to communicate.  When employees receive work-related messages on their personal phones, some companies now require them to take a picture of the message and forward it to compliance for preservation. 

The expansion of the SEC’s investigation comes on the heels of the SEC’s October 12, 2022  announcement of amendments to Rules 17a-4 and 18a-6 of the Securities Exchange Act relating to electronic recordkeeping and data production requirements for broker-dealers, security-based swap dealers, and major security-based swap participants.

The amendments allow firms greater flexibility in how they preserve electronic records but add a requirement that any data productions to securities regulators must be in a format that allows the regulators to search and sort information within the data production.

The amendments will become effective 60 days after publication in the Federal Register.  Broker-dealers will then have six months to bring their recordkeeping programs into compliance with the new rules.  Security-based swap dealers and major security-based swap participants will have 12 months.

The SEC’s focus on personal device usage underscores the importance of effective internal controls on the technology employees use to communicate about work.  It is becoming rare for government investigations and civil litigation not to involve requests for text messages and other messaging apps.  A well-thought-out—and well-enforced—policy regarding personal device usage is a crucial first step in preventing expensive headaches for organizations and potentially intrusive searches for individual employees, especially in an industry as heavily-regulated as the financial services industry.  But at the end of the day, there is no compliance measure that can stop an employee who wants to use a prohibited messaging device.