January 26, 2023
Short Summary
Why do off-channel messaging violations keep happening despite years of enforcement? This article breaks down the SEC’s most recent enforcement actions, highlighting the systemic issues that regulators are still uncovering.
Since 2021, the U.S. Securities and Exchange Commission (SEC) has been cracking down on those in violation of SEC regulations. They’ve pursued an aggressive enforcement campaign targeting financial firms that fail to preserve and monitor business communications conducted through unauthorized messaging platforms like WhatsApp, Signal, and personal texts.
What began with headline-making WhatsApp fines against major Wall Street banks in 2021 and 2022 has grown into a sweeping, industry-wide investigation.
By early 2025, the SEC had charged over 100 firms and collected more than $2 billion in penalties for recordkeeping violations (that sum jumps to over 3.5 billion with fines from the CFTC, Ofgem, and FINRA). The infractions have spanned broker-dealers, investment advisers, and private equity firms alike, revealing a persistent compliance gap around how digital communications are governed and archived.
Below, we’ve put together a summary of the most noteworthy events from the beginning of the crackdown.
Key Takeaways
- Regulators have imposed more than $2 billion in SEC penalties since 2021 for failures to capture and retain business communications on apps like WhatsApp and Signal, as well as in personal text messages. Firms that ignore off-channel messaging risks face growing financial and reputational exposure.
- Off-channel communication is no longer just a technology issue – it’s a governance problem. Investigations repeatedly identified compliance gaps involving employees, executives, and even compliance teams, highlighting the need for organization-wide oversight and accountability.
- Banning messaging apps alone is not an effective compliance strategy. Surveys show that 73% of financial institutions lack confidence in their ability to enforce communication bans, making compliant capture, archiving, and monitoring solutions increasingly critical.
- Financial institutions should adopt proactive communications compliance programs that capture, supervise, and retain messages across approved channels to reduce regulatory risk, improve audit readiness, and strengthen internal investigations.
- The cost of non-compliance extends far beyond fines. Regulatory investigations often trigger operational disruptions, remediation expenses, reputational damage, and increased regulatory scrutiny, making preventive compliance controls far more cost-effective in the long term.
Santander US Capital Markets: $4 Million for WhatsApp Violations (January 14, 2025)
In early 2025, Santander US came under fire for its bankers’ use of WhatsApp to conduct official business, despite clear rules requiring the use of approved, monitored channels. They were hit with an SEC WhatsApp fine of $4 million, citing failures in oversight and monitoring. Santander cooperated with the investigation, securing a reduced penalty, and pledged sweeping internal audits and a revamp of its compliance training protocols.
SEC Charges 12 Firms $63 Million (January 13, 2025)
Ringing in the new year, the SEC charged 12 firms – including nine investment advisers and three broker-dealers – with $63 million for communication recordkeeping failures. The Commission emphasized that these violations stemmed from systemic lapses at all levels, including senior leadership, and obstructed regulatory oversight.
Among the most significant penalties were:
- Blackstone Alternative Credit Advisors LP which agreed to pay a $12 million penalty
- Kohlberg Kravis Roberts & Co. L.P. (KKR), which agreed to pay an $11 million penalty
- Charles Schwab & Co., Inc., which agreed to pay a $10 million penalty
Ameriprise, Edward Jones, Raymond James, and LPL Financial: $50 Million Each (August 14, 2024)
This headline-grabbing action saw a total of $393 million in fines levied across 26 firms, with Ameriprise, Edward Jones, Raymond James, and LPL Financial each receiving a $50 million penalty. LPL Financial stood out not for the size of the fine but for the scope of its internal communication failures. Messaging rule-breaking extended across departments, including compliance staff. This wasn’t just a technology lapse, it was a cultural one. LPL has since undertaken deep reforms, including new archiving tech and governance roles.
Piper Sandler: $14 Million for Record-Keeping Failures (August 6, 2024)
Just days before the August sweep, Piper Sandler quietly settled with the SEC for $14 million (and CFTC for $2 million) after investigations found that employees used unmonitored messaging apps for business. This case may have flown under the radar, but it was one of the earliest signals that another round of heavy enforcement was coming.
Sixteen Firms Fined $81 Million for Texting Violations (February 9, 2024)
Early in the year, the SEC sanctioned 16 firms for allowing employees to communicate via private text messages without proper retention or supervision. These firms, which paid between $1.25 million and $16.5 million each, were caught in a broader net cast by the SEC to ensure Wall Street was taking communication rules seriously after repeated warnings.
Interactive Brokers and Others: $79 Million for Persistent Off-Channel Messaging (September 29, 2023)
This 2023 case helped set the tone for what was to come in 2024. The SEC charged ten firms—including Interactive Brokers, William Blair, and Nuveen Securities—after discovering long-running use of private messaging tools for business conversations. The firms paid a combined $79 million and were ordered to overhaul their recordkeeping processes.
Pressure Reaches Private Equity (November 9, 2022)
With controls tightening over the course of the year, the pressure finally reached private equity in November when a new SEC texting probe was launched. Per regulatory filings disclosed by groups like Apollo, Carlyle, and KKR & Co, the SEC began questioning their use of electronic messaging for business.
Regulators Turn to RIAs (October 4, 2022)
In October, regulators turned their focus to registered investment advisors (RIAs) and the way they managed their processes, with specific attention to outsourcing due diligence and maintaining oversight over compliance and recordkeeping responsibilities. These efforts are part of a broader push to protect consumers as more financial advisors explore outsourcing as a strategic focus.
The SEC’s $1.1 Billion Fine (September 27, 2022)
We knew this was coming for several months, but didn’t know how many institutions would be involved. In a big push against messaging compliance and recordkeeping failures, the SEC announced charges against 16 Wall Street firms, including Barclays, Bank of America, Merrill Lynch, Citigroup, Credit Suisse, Deutsche Bank, Goldman Sachs, Morgan Stanley, UBS, Jefferies, Nomura, and Cantor Fitzgerald. The combined fine totaled $1.1 billion and is considered a landmark ruling (as well as a warning) to investment advisers and broker-dealers.
SEC Phone Surrender (May 18, 2022)
The SEC announced an escalated texting probe that required numerous teams to surrender their phones, including heads of investment banking teams, traders, and more. Like the above example of a BaFin regulator in Germany acting, this SEC mandate was part of a larger push to examine and encourage messaging compliance at every organizational level. According to some reports, bankers were furious that their personal phones were being examined by regulators.
JP Morgan Fined $200 Million (December 17, 2021)
Although it technically occurred in late 2021, JP Morgan Securities set the tone for 2022 with a cool $200 million in fines levied by the U.S. Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission.
The JP Morgan SEC fine involved the unauthorized use of WhatsApp for business communications. SEC WhatsApp fines are just one example of how poor messaging compliance can affect businesses, and as the JP Morgan and WhatsApp debacle shows, no organization is immune.
LeapXpert: The Cure for Off-Channel Headaches
Several years into the SEC’s crackdown on off-channel communications, the message hasn’t changed – but it has gotten louder. Despite over $2 billion in fines, new enforcement actions continue to surface, targeting both the largest financial institutions and smaller firms that may have once flown under the radar. From private equity giants to regional broker-dealers, no corner of the financial sector is untouched.
The recurring theme in every case is clear: it’s not just about using the wrong app. It’s about the failure to govern communications in a way that meets regulatory expectations.
The LeapXpert Communications Platform is the solution to effective communication governance. By enabling businesses to capture, monitor, and govern employee conversations across messaging apps – including WhatsApp and iMessage – LeapXpert helps close the compliance gap without disrupting how teams communicate. With automated recordkeeping, policy enforcement tools, and seamless integration with existing archiving systems, LeapXpert ensures companies stay aligned with regulatory expectations before regulators come calling.
Book now for a demo.
FAQs
Why are companies receiving SEC WhatsApp fines?
Companies are being fined because employees, including senior people, have used WhatsApp and other unapproved messaging platforms to conduct business conversations without proper oversight or recordkeeping. SEC regulations require firms to preserve and supervise business-related communications. When firms fail to capture messages on platforms like WhatsApp, they violate federal securities laws regarding books and records, leading to enforcement actions.
How do SEC regulations impact WhatsApp compliance for businesses?
SEC regulations, particularly under Rule 17a-4 and related recordkeeping provisions, require registered firms to retain and supervise all business communications. If employees use WhatsApp to discuss business matters and those conversations aren’t archived and accessible for review, the company is out of compliance. This holds true regardless of whether the messages contain sensitive information – failure to capture them is enough to trigger a violation.
What steps can companies take to avoid SEC fines related to WhatsApp?
To reduce the risk of fines, companies should implement clear policies restricting or governing the use of messaging apps, deploy technology that enables compliant communication (including capture and archiving), and conduct regular training for employees. Firms should also perform internal audits to ensure that policies are being followed and adapt procedures as regulatory expectations evolve.
Are there any best practices for achieving WhatsApp compliance under SEC regulations?
Yes. Best practices include:
- Using a secure, approved platform that captures WhatsApp messages in real time
- Integrating communication tools with existing archiving and surveillance systems
- Establishing written supervisory procedures that clearly define how messaging is monitored
- Regularly testing and reviewing compliance frameworks
- Providing consistent training to employees on acceptable communication channels
What are the potential consequences of ignoring SEC regulations on messaging platforms?
Ignoring SEC rules on communication can lead to significant financial penalties, reputational damage, and increased regulatory scrutiny. In recent years, fines have exceeded $2 billion across dozens of firms. In some cases, senior staff have been dismissed, bonuses withheld, or firms suspended from certain activities. Repeated violations can also trigger more invasive audits and long-term compliance monitoring.
How can financial institutions ensure compliance with SEC regulations regarding electronic communications?
The most effective approach combines policy, technology, and culture. Firms must deploy tools to monitor and archive all business communications, whether via email, chat, or messaging apps like WhatsApp. At the same time, leadership must enforce clear rules, train staff on approved channels, and ensure that compliance teams have visibility into how employees communicate.
Previous
Next
Book a personalized
product demo
