SEC Enforcement Turns Focus to Broker-Dealer Employee Communications on Personal Devices

The Securities and Exchange Commission has opened a broad inquiry into how Wall Street banks are keeping track of employees’ digital communications, according to an October 11, 2021 Reuters report. SEC enforcement staff reportedly contacted several banks recently to inquire whether they had been adequately documenting their employees’ work-related communications, with a specific focus on messages exchanged using personal devices. This new SEC action is particularly timely given the rise of employee telework arrangements amid the COVID-19 pandemic.

The SEC’s inquiry follows a speech by the new SEC Enforcement Director, Gurbir Grewal, during which he emphasized that firms need to implement proactive compliance programs to monitor off-channel broker-dealer communications. While acknowledging that “[r]ecordkeeping violations may not grab the headlines,” Director Grewal signaled more aggressive SEC enforcement of recordkeeping obligations, at least insofar as they relate to the preservation of “off-channel communications,” as such records are “essential to market integrity and enforcement.”

Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-4, one of the two “Books and Records Rules” promulgated under the federal statute, require broker-dealers to create and preserve certain records for specified periods of time to enable regulators’ effective examination and enforcement. In particular, Rule 17a-4(b)(4) requires broker-dealers to preserve originals of all communications received and copies of all communications sent relating to their business as broker-dealers, including internal communications. The Financial Industry Regulatory Authority (FINRA) also has issued guidance regarding the supervision of electronic communications, as well as social media activity.

The Commission’s focus on communications using personal devices is not entirely new. In August 2020, the SEC Office of Compliance Inspections and Examinations issued a Risk Alert identifying a number of pandemic-related issues and encouraged firms to modify their compliance practices to address “[c]ommunications or transactions occurring outside of the Firms’ systems due to personnel working from remote locations and using personal devices.”

In late September 2020, the SEC also announced settled charges against the broker-dealer JonesTrading Institutional Services LLC for failing to preserve business-related text messages sent and received on the personal devices of its representatives. As alleged in the administrative order, JonesTrading employees, including members of the company’s senior management, communicated with each other, customers and third parties about the size of orders and timing of trades, product offerings, updates on markets and securities prices, and the timing of SEC filings, among other topics, without preserving copies of these messages. The SEC contended that JonesTrading had relied solely on annual employee attestations and trainings to monitor adherence to the company’s record retention and business communications policies that required representatives to transmit electronic communications exclusively through firm-sponsored systems; the SEC further alleged that JonesTrading took no additional action despite senior management and compliance personnel knowing that employees were deviating from JonesTrading’s policies. The settlement consisted of a cease-and-desist order, a censure and a $100,000 civil penalty.

Director Grewal highlighted the JonesTrading Order in his recent speech and asserted that companies should proactively consider “how their specific business models and products interact with both emerging risks and Enforcement priorities, and tailor their compliance practices and policies accordingly,” with specific attention given to “the many compliance issues raised by the increased use of personal devices, new communications channels, and other technological developments like ephemeral apps.” Director Grewal further encouraged firms to make significant and tangible efforts to cooperate with SEC investigations, including voluntarily self-reporting potential violations and identifying conduct or actors that contributed to wrongdoing. He also cautioned that larger monetary penalties may be in store for companies that violate these laws, following the SEC’s close assessment of “whether prior penalties have been sufficient to generally deter the misconduct at issue.”

For questions about broker-dealers’ obligations under the Securities Exchange Act or the Books and Records Rules, please reach out to the authors or any of their colleagues in Arnold & Porter’s Securities Enforcement & Litigation practice group.

*Kelley Changfong-Hagen contributed to this blog post. Ms. Changfong-Hagen is a graduate of Columbia University School of Law and is employed at Arnold & Porter’s New York office. Ms. Changfong-Hagen is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2021 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.