12 Credit-Rating Firms Fined $88 Million by SEC for Off-Channel Violations

The latest wave of fines from the Securities and Exchange Commission (SEC) sends a clear message: the issue of off-channel communications is not going away. In September, 12 credit-rating firms were hit with a collective $88 million in penalties for failing to properly monitor and record their communications. These fines aren’t the first, and they certainly won’t be the last. 

Despite regulators making it abundantly clear that businesses must have strict controls over their communications, many firms continue to fall short. Off-channel messaging—using unapproved apps or personal devices for work-related conversations—remains a persistent problem. The fines prove that regulators are serious about enforcing compliance, yet companies continue to struggle with managing these communication risks. 

So, why is this still happening? In this blog, we’ll explore the ongoing challenges of controlling off-channel communication, the growing regulatory pressure, and why businesses are finding it so difficult to fully comply. 

Regulators Are Taking Off-Channel Communication Seriously: A Growing List of Fines 

The SEC’s recent decision to fine 12 credit-rating firms a collective $88 million for off-channel communications violations is the latest—and one of the most significant—examples of regulators cracking down on communication compliance. The fines were issued after the SEC found that these firms had failed to properly capture, monitor, and retain communications conducted through unapproved messaging apps, personal devices, and email accounts. Despite existing regulations that mandate strict oversight of business communications, employees at these firms used platforms such as WhatsApp and personal emails to discuss sensitive business matters without the necessary recordkeeping in place. 

Among the 12 fined firms were major players in the credit-rating industry, including Moody’s, S&P Global, and Fitch Ratings. These firms were found to have violated federal securities laws, which require that all work-related communications be archived and made available for regulatory review. The SEC cited these firms for failing to implement adequate policies and technologies to manage off-channel communications, leading to these violations. 

This $88 million penalty is the latest in a series of actions taken by regulators in recent years, highlighting a growing trend of enforcement against firms that fail to comply with recordkeeping requirements. The most notable fines over recent years include: 

• FINRA and SEC Fine Major Banks: In 2023, several major banks collectively faced fines exceeding $1 billion from both FINRA and the SEC for using unapproved communication channels. These violations were primarily related to inadequate recordkeeping and regulatory oversight, highlighting significant compliance failures in the sector. 

• JPMorgan Chase was fined $200 million by the SEC for similar recordkeeping failures. 

• Goldman Sachs received a $150 million fine from FINRA due to off-channel communications violations. 

• Morgan Stanley faced a $200 million fine from the SEC for similar compliance issues. 

• BofA Securities Inc.: In December 2022, BofA Securities was fined $125 million by the SEC for failing to retain records of communications conducted on personal devices.  

• Wells Fargo Advisors: In April 2023, the SEC imposed a $125 million fine on Wells Fargo Advisors for not adequately retaining electronic communications. The firm was found to have inadequate policies regarding off-channel communications, which led to significant compliance breaches. 

This growing list of fines is part of a broader effort by regulatory bodies like the SEC, FINRA, and the CFTC to enforce communication compliance in the financial sector. These penalties are designed not just to punish, but to send a strong message that firms must actively manage and monitor all communication channels used for business purposes. 

Why Off-Channel Communication in the Financial Sector Is a Major Concern 

The financial sector operates within a heavily regulated environment where transparency, accountability, and proper recordkeeping are critical to ensuring market integrity and protecting investors. Off-channel communication undermines these principles, which is why regulators are so concerned. 

Here are the key risks associated with off-channel communication in the financial sector: 

• Fraud: Unapproved messaging apps and personal devices provide an opportunity for employees to engage in fraudulent activities, such as insider trading, without detection. Without a record of these communications, firms cannot detect suspicious behavior until it’s too late. 

• Misconduct: Off-channel communications make it easier for employees to bypass compliance policies, leading to potential misconduct such as market manipulation or conflicts of interest. Without proper oversight, these activities can go unnoticed, causing significant damage to both clients and the firm. 

• Lack of Accountability: When conversations are held on platforms that aren’t monitored, there’s no clear trail of responsibility. This makes it difficult to hold individuals accountable for their actions, especially in cases where regulatory violations or unethical behavior occur. 

• Inability to Meet Legal Obligations: SEC regulations mandate that all business-related communications be archived and stored for a minimum of three years. Off-channel communications that aren’t captured violate this requirement, exposing firms to both financial penalties and reputational risk. 

SEC Chair Gary Gensler has made it clear that these failures put both the firm and its investors at risk. In a 2022 statement, Gensler remarked: “Record-keeping requirements are core to the SEC’s enforcement and regulatory functions. Firms that fail to meet these obligations, particularly in an era of increased communication through new technologies, are putting themselves and their investors at risk.” 

Why Firms Are Struggling Despite Clear Regulatory Pressure 

Despite increasingly severe penalties and clear regulatory mandates, many firms are still failing to adequately address the issue of off-channel communication, despite having clear communications policies. While the risks are well known, there are several factors that make compliance challenging, including:  

• Multiple Communication Channels: Employees use a range of communication platforms—WhatsApp, Signal, Slack, personal email, and even social media. This fragmentation makes it difficult for companies to monitor and capture all communications. Many firms are still relying on legacy systems that are not built to integrate with modern apps, leaving significant gaps in coverage. 

• Employee Resistance: Employees often resist restrictions on their personal device usage. They may find using company-approved channels cumbersome or prefer the convenience of their own messaging apps. This resistance can lead to employees knowingly bypassing compliance rules, using off-channel platforms for business communications even when they know it’s not permitted. 

• Technological Barriers: Many companies lack the systems required to capture and store off-channel communications effectively, especially across a wide range of platforms. Implementing new technologies is costly and time-consuming, and firms may struggle with complex integrations. 

These challenges are not insurmountable, but they do require significant investment in both technology and training.  

Addressing Off-Channel Communication: Bans Don’t Work, But Governance Does 

While many firms see the issue of off-channel communication as a daunting challenge, the truth is, the solution may be simpler than they realize. One of the most common misconceptions companies have is that they need to completely ban the use of apps like WhatsApp or Signal for business communication. However as many organizations have found, bans rarely stop employees from using these platforms. In fact, they often push communications further underground, making them even harder to monitor. 

Rather than trying to block the use of these channels, firms should instead focus on expanding their compliance oversight. By embracing a governance-first approach, businesses can allow employees to use their preferred messaging apps while still maintaining full control over recordkeeping, monitoring, and security. 

Fortunately, modern technology makes it easy for firms to capture and manage communications across a wide range of platforms. Here’s how available technologies can help: 

• Multi-Platform Capture Solutions: New tools allow companies to capture and archive communications from almost any platform, including WhatsApp, Signal, personal email, and social media. These tools integrate seamlessly with existing systems and automatically store messages in a compliant manner, eliminating the need for employees to manually transfer conversations into approved channels. 

• Automated Archiving and Recordkeeping: Today’s technologies can capture and store off-channel communications in real time. They archive messages securely and allow companies to easily retrieve and review conversations during audits or investigations. With automated archiving, there’s no risk of important conversations slipping through the cracks. 

• Compliance Monitoring Across Devices: Solutions exist that monitor communications across multiple devices, including smartphones, laptops, and tablets. This allows firms to capture both work and personal devices used for business purposes, ensuring no communication goes unrecorded, no matter where it occurs. 

• Encryption and Security: Off-channel communication often raises concerns about data security, especially when personal devices are involved. However, technologies that offer end-to-end encryption and secure storage ensure that sensitive business communications remain protected, even when they take place on non-corporate platforms. 

• AI-Powered Auditing: Advanced tools now include AI capabilities that can automatically flag risky or non-compliant communications. These systems scan for keywords, phrases, or patterns of behavior that suggest a violation of regulatory policies, allowing firms to proactively address issues before they escalate. 

Off-Channel Communication Management: Simpler Than You Think 

While the task may seem overwhelming at first, following these strategic steps can make the process of managing off-channel communications more manageable and, ultimately, ensure full compliance. 

• Conduct a Comprehensive Communication Audit: Before implementing new tools or policies, companies need to understand how communication is currently happening across the organization. This involves conducting a thorough audit of the platforms employees use, both officially and unofficially, for work-related discussions. A detailed audit gives the company a clear view of its current vulnerabilities and informs decisions about which tools and policies to adopt. 

• Set Clear, Inclusive Policies: After the audit, companies should draft or revise their communication policies to reflect the realities of modern communication. Rather than focusing on banning specific apps or devices, the policy should emphasize the need for capturing and archiving all business-related communications, regardless of the platform.  

• Implement Communication Capture Tools: Once the policies are in place, the next step is to deploy communication capture tools that integrate with the platforms employees are using. These tools should cover a broad range of communication channels. The goal is to ensure that no business-related communication takes place without being properly captured and stored following regulatory requirements. 

• Train Employees and Drive Cultural Change: One of the biggest challenges in managing off-channel communication is employee resistance. To overcome this, companies must prioritize training and communication to help employees understand why these measures are necessary. Cultural change is equally important—employees should feel that compliance isn’t about limiting their ability to work effectively, but about creating transparency and trust within the organization. 

• Monitor, Audit, and Adjust: Even with the right tools and policies in place, continuous monitoring is essential. Firms should establish regular auditing processes to ensure that all communications are being captured as required and that employees are following the established guidelines. Using AI-powered monitoring tools can further streamline this process, flagging any potential compliance risks automatically. 

Let LeapXpert Solve Your Off-Channel Headaches   

Don’t let “off-channel” communication become a compliance headache. Partner with LeapXpert to turn off-channel communications into authorized channels, creating a seamless, efficient, and compliant communication ecosystem for your organization.    

With The LeapXpert Communications Platform, using any app – from WhatsApp, iMessage, and WeChat to Slack and Microsoft Teams –  securely and in full compliance – is easy.  

The LeapXpert Communications Platform offers full integration of all these digital communication channels and maintains a complete record of all conversations between employees and customers to ensure that data privacy and governance standards are met. The user-friendly dashboard allows for easy auditing and reporting and displays the real-time status of all text messages, conversations, and data sent, as well as flagging when conditions and rules have been breached. Integrated with leading third-party archiving, surveillance, and analytics platforms, all text message records are securely stored and available alongside all the existing business data.    

Book a demo today.