The U.S. Securities and Exchange Commission (SEC) and other financial regulators are targeting regulated entities over their employees’ use of personal messaging apps and other off-channel electronic communication platforms, raising concerns for employers over monitoring of employee communications and highlighting regulators’ incentives for self-reporting of potential violations.

Quick Hits

• Federal financial regulators are targeting employers for employees’ use of personal text messages or off-channel communications to discuss business, alleging it may violate recordkeeping rules.
• The actions raise concerns for financial employers given the increased use of personal electronic communications platforms and of the popularity of bring-your-own-device policies.
• The actions further highlight federal regulators’ push to incentivize employers to self-report potential legal violations by providing leniency in penalties. 

On April 3, 2024, the SEC announced that registered investment adviser Senvest Management LLC will pay a $6.5 million penalty to settle charges for recordkeeping violations after the Commission alleged employees discussed company business via personal text and other non-employer messaging, or off-channel, platforms. The SEC alleged that the use of off-channel communications makes it more difficult for regulators to obtain records and fulfill their oversight duties.

The settlement comes less than two months after the SEC in February 2024 announced settlements with eight entities, totaling a combined $81 million in penalties, for alleged failures to maintain and preserve electronic communications.

Additionally, the Commodity Futures Trading Commission (CFTC) on March 19, 2024, announced a settlement with another regulated entity, Oppenheimer & Co., Inc., over similar charges. Specifically, the CFTC alleged the company failed to stop employees from using unapproved communication methods, including personal text messages, and also alleged that Oppenheimer failed to preserve communications as required by CFTC regulations.

Given the widespread prevalence of employees’ use of smartphones equipped with various text and communications apps or platforms and the increasing popularity of bring-your-own-device (BYOD) policies, there are growing compliance concerns that employees will use non-employer-controlled channels to discuss business. The SEC and other regulators have indicated that use of off-channel communications platforms may implicate regulated entities’ recordkeeping requirements.

Off-Channel Communications

In the Senvest case, the SEC charged the company with violations of several parts of Section 204 of the Advisers Act and its rules. Specifically, the SEC alleged violations of Rule 204-2, which specifies the length of time certain records produced by investment advisers must be maintained and requires them to be promptly produced to the SEC. The SEC also alleged violations of Rule 204-2(a)(7), which requires investment advisers “to make and keep true, accurate and current” certain “books and records relating to its investment advisory business,” including written communications about “[a]ny recommendation made or proposed to be made and any advice given or proposed to be given.”

The SEC imposed the $6.5 million penalty even though Senvest maintained policies to preserve records, required advisers to use approved electronic communication platforms designed to retain communications, and prohibited employees from using personal email and other personal text messaging.

The SEC alleged that, despite the policies, between January 2019 and December 2021, “Senvest employees sent and received thousands of business-related messages using off-channel communications,” and some employees even had auto-delete policies on their phones. The SEC stated that “[d]espite this unapproved use of off-channel communication, Senvest did not access employees’ personal devices to determine whether they were complying with the firm’s communication policies.”

The Commission also noted that Senvest later “provided employees with firm-issued cell phones to reduce opportunities for off-channel communications” and that those firm-issued cell phones automatically upload communications to the company’s archiving system.

Self-Reporting

The SEC’s recordkeeping enforcement actions also highlight federal regulators’ push to encourage companies to self-report misconduct with incentives and the possibility of reduced penalties.

In its February 2024 announcement of eight settlements, the SEC stated that Huntington Investment Company (HIC) was required to pay only a $1.25 million penalty to settle charges alleging Advisers Act and Exchange Act violations over employees using off-channel communications because it identified and self-reported the alleged violations. That penalty was significantly less than the $8 million to more than $16 million penalties imposed on other companies that did not self-report.

An SEC official later stated that the Commission takes into consideration whether a company has self-disclosed recordkeeping violations when it comes to setting penalties, while defending the SEC’s varying penalty amounts.

The U.S. Department of Justice (DOJ) is similarly updating its Corporate Voluntary Self-Disclosure (VSD) policy to incentivize companies to investigate and self-report allegations of misconduct, including allowing companies to potentially avoid criminal liability. The DOJ is also expanding incentives for individual whistleblowers, including recently announcing a new test program that will pay whistleblowers who provide information on serious financial crimes and foreign and domestic corruption.

Next Steps

Regulated employers may want to consider reviewing their recordkeeping and device and electronic communications policies with regard to their various retention and production compliance obligations. Employers may also want to consider balancing the benefits of employee BYOD policies against compliance concerns related to such policies.

Further, while these enforcement priorities are of particular concern for employers in highly regulated industries such as the financial services sector, recordkeeping and electronic communications platforms is also an evolving compliance issue. More employers beyond those regulated by the SEC may be required to adhere to similar recordkeeping requirements regarding business communications in the future.

Ogletree Deakins will continue to monitor developments and will provide updates on the Ethics / Whistleblower and Workplace Investigations and Organizational Assessments blogs.