The SEC & CFTC have made good on warnings to crack down on alleged recordkeeping violations. But will Wall Street firms change their ways?
The Securities and Exchange Commission’s (SEC) December 2021 announcement that J.P. Morgan Securities LLC had been fined $125 million for allegedly violating the agency’s recordkeeping rules amounted to a shot heard up and down Wall Street.
The market regulator made clear that it took breaches of recordkeeping regulations seriously, and that the J.P. Morgan penalty was likely to be the start of something bigger. (Find the press release here: https://bit.ly/3tuBOO3).
J.P. Morgan officials decline to comment for this story.
“Today’s charges signal that we will continue to hold market participants accountable for violating our time-tested recordkeeping requirements,” according to SEC Chair Gary Gensler in a prepared statement at the time.
J.P. Morgan Securities and two affiliated companies were also fined $75 million by the Commodity Futures Trading Commission (CFTC), and that agency’s acting chairman, Rostin Behnam said then: “The Division of Enforcement will aggressively investigate potential recordkeeping and related supervision violations, and the commission will impose appropriate penalties for violations of these critical regulatory requirements.” (See the CFTC order here: https://bit.ly/3TyNrhz ).
Regulators Take On WhatsApp
Regulators have made good on those warnings.
The past two years witnessed a succession of punishments on a host of brokerage firms, investment advisers, and credit rating agencies, with so-called “off-channel” communications at the heart of most of the enforcement actions.
The suspect communication methods include common apps like WhatsApp, iMessage, and Signal that let brokers or investment advisers communicate with coworkers and clients without leaving an audit trail or a record.
The enforcement actions levied upon off-channel communications have been part of a broader trend that the SEC said turned 2022 and 2023 into its two years with the largest total of penalties on record.
(Find the 2022 Enforcement Division annual report here: https://bit.ly/3v8wLTU The 2023 Enforcement Division annual report can be found here: https://bit.ly/3v6gHC5 )
From the regulators’ point of view, the use of off-channel communications breaches recordkeeping rules that have been in place since the SEC was formed during the New Deal and the CFTC’s establishment in 1974. But the punishment of off-channel communications during the past two years marks a departure for the SEC, at least from its recent history, in the view of some lawyers.
“These are the easiest cases in the world for them,” says David Kornblau, a partner in New York for the law firm Dentons. “It was a bit of a gotcha, frankly, for all of these firms.”
Do Recordkeeping Differently
“Until the recent onslaught of cases, few people on Wall Street would have thought keeping track of their communications via methods like WhatsApp was necessary, says Andrew Charles Barker, a professor at Berkeley Law School.
Andrew C. Barker
Still, the language of the SEC’s recordkeeping rules in laws like the Securities Exchange Act of 1934 are broadly written and open to interpretation, although the laws were written at a time when regulators wanted to scrutinize formal communications from typewriters, not smartphones that wouldn’t be available for another 70 years.
“It’s fundamentally very different from what was happening when the securities laws were written,” Barker said.
But with regulators prepared to use every weapon at their disposal, Wall Street has to change its practices or find itself in regulators’ crosshairs yet again.
“The SEC is taking a stance, and the SEC is making it known that they take it seriously, and that therefore the firms should, too,” said Sijia Cai, a partner in the New York office of the law firm Davis Polk & Wardwell LLP.
“The important thing is to do something,” Kornblau said.
“Most of our clients are not waiting to take action to fix things,” said Nicholas Losurdo, a partner in Boston with the law firm Goodwin. “They’re actually taking very proactive steps to remediate any deficiencies they may have even if they haven’t been identified by a regulator.”
Goodwin has helped numerous clients revise supervisory procedures, compliance controls, training programs, and the annual attestations employees have to sign about their adherence to the firm’s communications and recordkeeping policies.
The type of response adopted also varies from firm to firm.
Some firms are banning the use of newer communications and mandating that employees stick to their company email account, while others are accommodating a world of changed attitudes and behaviors and implementing checks and controls around a broader set of communications methods, Losurdo says.
The message is made clear to employees with repetition of the required practices.
“There are those reminders where you make people sit down and watch a presentation, or you gather them in a room, and you do a lunch presentation. That sort of thing,” Cai says. “Basically, hammer it into people’s heads.”
New SEC & Compliance Burdens Ahead
The compliance challenges are made even more pressing with the SEC’s recent updates to some of its recordkeeping rules. While limited in scope, the rule changes add to the burdens of the firms that are covered by them.
In August 2023, the SEC added requirements for private funds like private equity firms and hedge funds to, among other things, release quarterly statements to investors that disclose data about the fund’s performance and costs.
The rule doesn’t directly affect third-party providers of fund data, but some are working intently with clients to ensure that they’re ready for the effective date.
“From our perspective, it’s more about getting ahead of these rules and making sure we have the infrastructure in place, the technology in place,” says Ishita Shah, chief commercial officer for Gen II Fund Services, a fund administrator focused on private equity firms.
Ishita Shah
In October 2022, the SEC finalized a rule that it said would, among other things, ensure that original records are preserved. The rule updates a regulation for the preservation of broker-dealer electronic records that the agency adopted in 1997. The updated rule calls upon brokerage firms to implement audit trails to track records that have been altered and ensure that the original record can be reproduced following the alteration.
The recent rule changes notwithstanding; securities lawyers are set to begin 2024 by continuing to work with clients about their compliance programs for the rules already on the books as well as the new ones. Lawyers and clients don’t have much choice: There’s little indication that the enforcement actions are going to slow down any time soon.
Many securities lawyers are prepping clients by looking to the enforcement cases that have been brought and the orders the SEC has issued against the firms that have been fined for indications about how compliance programs should be brought up to date.
“Lawyers, like me, who focus on SEC enforcement matters, spend a lot of time analyzing the SEC’s orders in these settled actions,” says Jonathan Hecht, who is also a partner at Goodwin, based in Washington.
“We look to those orders because they’re some of the only guidance out there and they inform how we should be advising our clients on these issues,” Hecht says.
Need a Reprint?