SEC’s $600M Fines in 2024: The Cost of Messaging Non-Compliance

The Securities and Exchange Commission (SEC) has made headlines with its crackdown on financial institutions. In 2024 it has imposed fines that collectively exceed $600 million for violations related to messaging compliance. These fines are a stark, and ongoing, reminder of how essential it is to manage and archive digital communications effectively. With the rapid adoption of messaging platforms such as WhatsApp and iMessage, recordkeeping compliance has become a complex and high-stakes issue.

This article explores the details behind the SEC’s 2024 fines, why the SEC is so invested in messaging compliance, and the steps financial institutions must take to avoid these costly mistakes.

Unpacking the Messaging Compliance Fines: 2024 SEC Actions

In 2024, the SEC continued its vigorous enforcement of recordkeeping violations related to off-channel communications, imposing substantial penalties on financial firms. The total fines for the year exceeded $600 million in civil penalties against more than 70 firms. This marks over $2 billion in penalties imposed by the SEC on more than 100 firms since the crackdown began in 2021, and when including fines from the CFTC and FINRA, the total exceeds $3.5 billion.

The scope of the violations also expanded in 2024, as the SEC targeted a wider range of entities, including standalone investment advisers and broker-dealers, and the first case against municipal advisors. These actions were significant because, historically, the SEC had focused on larger entities like broker-dealers. In 2024, the SEC brought actions against five standalone investment advisers who failed to preserve off-channel communications. This trend highlights the SEC’s expanding scope, as it now holds smaller firms to the same standards as larger ones, despite previous ambiguity over the scope of the Advisers Act. These advisers were subjected to penalties, with some paying significant fines, which reflect the SEC’s growing scrutiny over communication practices across the industry. Notably, the fines reached individual amounts of up to $50 million, signaling the SEC’s growing resolve to address communication recordkeeping failures across the financial sector.

Key violations and areas of concern included:

• Failure to Retain Records: One of the most common violations involves firms not retaining electronic communications conducted via personal messaging apps like WhatsApp, Signal, and Telegram. The SEC mandates that broker-dealers, investment advisers, and other registered entities preserve records of all business communications, regardless of the platform. These platforms, often used for personal or informal messaging, do not automatically store or archive communications, creating a significant compliance gap.
• Supervisory Failures: Another key violation centers around the lack of proper supervision regarding the use of off-channel communication Senior managers, employees, and contractors were found to be engaging in unmonitored communications through personal messaging apps. This supervisory failure is considered particularly serious since it reflects a lack of due diligence at the highest levels of management. Firms are expected to have robust systems in place to monitor and prevent such breaches, but many fell short.
• Non-Compliance with Existing Policies: Many firms had established policies aimed at limiting or regulating off-channel communications. However, these policies were frequently ineffective or inadequately enforced. These failures demonstrate a gap between regulatory expectations and firms’ internal practices. Firms that did not take timely corrective action or enforce their existing policies faced substantial fines. The SEC has emphasized that a firm’s internal policies must be backed by meaningful oversight, and failure to enforce these measures is considered a significant violation
• Inadequate Technology Implementation: Despite the availability of technologies designed to capture off-channel communications, some firms failed to implement these solutions adequately. Technologies such as communication surveillance tools are available to help firms ensure that all business-related messages, including those sent on personal devices, are captured and archived following SEC requirements. However, some firms either neglected to integrate these tools into their operations or did not use them effectively, leaving large gaps in their compliance efforts.
• Use of Ephemeral Messaging Apps: The rise of ephemeral messaging apps like WhatsApp, which allow users to send self-destructing messages, has posed a particular challenge for compliance. The SEC has highlighted the specific dangers posed by these apps, especially when used for business purposes. Messages sent through these platforms are often deleted after being viewed, making it difficult, if not impossible, to retrieve them for regulatory oversight. Firms using these apps for business purposes without appropriate retention mechanisms face severe penalties

The 2024 SEC enforcement actions provide a clear message: financial firms must take responsibility for ensuring that all business communications are captured and retained in compliance with SEC rules. Firms that fail to meet these requirements face substantial financial penalties.

Why Does the SEC Care So Much, and Why This Won’t Go Away

The SEC’s intensified scrutiny of messaging compliance is about far more than just enforcing technical regulations. Here’s a look at why the SEC is so focused on this issue and why it’s likely to persist:

• Protecting Market Integrity and Investor Trust: Financial markets rely on transparency to function effectively. When firms bypass official communication channels or fail to maintain records of those communications, it undermines the very foundation of trust that investors and market participants rely on.
• Preventing Undetected Misconduct: If financial institutions can conduct business off-the-record, there’s the potential for fraudulent activities—such as insider trading, market manipulation, or misrepresentation of financial information—to flourish undetected. This sort of communication can be difficult to track and audit, making it easier for bad actors to hide their actions and avoid scrutiny.
• Ensuring a Level Playing Field: A lack of message retention or the use of ungoverned channels can also distort the competitive landscape. If certain firms can hide communications that could give them an unfair advantage—say, in the case of undisclosed market-moving information—then they are operating in a way that disadvantages other market participants. The SEC aims to prevent any firm from gaining an unfair edge by ensuring that all communications are traceable and accountable.
• Long-Term Market Stability: If firms continue to circumvent record-keeping requirements, it can have serious long-term implications. The failure to maintain comprehensive and accurate records of business communications can create major gaps in a firm’s ability to respond to regulatory inquiries or market shocks. Ensuring the retention of messages and communications is vital for creating an environment where firms can be held accountable and where the system as a whole remains stable, especially when it comes to mitigating risks and handling market volatility.

The SEC’s actions highlight a growing realization that traditional compliance methods are no longer sufficient. As more communication happens through personal devices and mobile apps, it becomes harder for firms to monitor and manage communications in the same way they did with older technologies. The SEC is signaling that financial firms need to modernize their compliance processes to keep pace with technological change.

The Bottom Line: What Are the Do’s and Don’ts for Messaging in the Finance Industry?

The fines imposed in 2024 emphasize the growing importance of establishing clear communication policies that comply with regulatory expectations. To avoid costly penalties and reduce risks, financial firms must follow these essential guidelines for managing messaging systems:

Do’s:

• Do Bring More Communication Channels Under Governance: Ensure that all communication channels—whether traditional email, messaging apps, social media platforms, or collaboration tools like Slack—are part of your governance and compliance framework. As messaging tools evolve, financial firms should broaden their policies to include any platform where business-related communications may occur.
• Do Manage Personal Device Use Proactively: Establish clear policies regarding the use of personal devices for work-related communication. Implement Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) tools to monitor and control employee access to communication tools on personal devices. This ensures that messaging via personal phones or computers remains subject to the same monitoring, archiving, and compliance processes as company devices.
• Do Make Compliance Rules Explicit and Clear: Communicate the rules about messaging clearly and frequently to all employees. It should be made explicitly clear which communication channels are approved and which are prohibited. Ensure these rules are easy to understand and that all employees sign off on them, demonstrating their commitment to following company policies.
• Do Hold Employees Personally Accountable: Establish a culture of accountability by making it clear that individuals are responsible for their own compliance. Set up systems for tracking who communicates on which channels, and implement disciplinary actions for employees who consistently violate communication policies. This reinforces that non-compliance is not just a corporate issue, but a personal responsibility.
• Do Use Technology to Enhance Compliance: Leverage compliance monitoring and archiving software to track and store communications across all platforms. Invest in tools that can automatically capture, index, and store messages, ensuring that they are both retrievable for audits and compliant with industry regulations.
• Do Regularly Audit and Update Policies: Periodically audit your messaging systems to ensure compliance with evolving regulations. Messaging platforms and compliance requirements change over time, and it’s essential to update your policies and systems to reflect these changes. Conduct regular internal and external audits to identify gaps and correct them before regulators do.

Don’ts:

• Don’t Rely on Employees to “Do the Right Thing”: Do not assume that employees will adhere to messaging guidelines simply because they are aware of them. People often find workarounds, especially when it comes to messaging. Instead, ensure there are automated systems in place to monitor and capture communications, as relying solely on employee self-regulation can lead to gaps in compliance.
• Don’t Overlook Text or Direct Messages: Don’t forget that text messages and direct messages (whether via SMS, WhatsApp, or other platforms) are just as subject to regulations as emails. Ensure that all forms of communication are integrated into your archiving and monitoring systems, not just email. Some communication channels are more difficult to track, so it’s important to actively manage them.
• Don’t Use Ephemeral Messaging or Self-Destructing Features: Avoid relying on messaging platforms with ephemeral or disappearing message features. These platforms may seem convenient, but they undermine your ability to keep comprehensive records, which is required for regulatory compliance. Disappearing messages can leave gaps in your company’s communication records that can be costly when investigated.
• Don’t Overlook the Risks of Cross-Platform Communication: Avoid focusing only on one messaging platform. If your company uses multiple communication tools, including internal tools and external channels (such as mobile apps, third-party messaging apps, etc.), all platforms must be brought under the governance framework. Non-compliant communications can easily slip through the cracks if not properly tracked.

By following these dos and don’ts, financial firms can reduce the risk of non-compliance, avoid heavy fines, and create a messaging environment that fosters both regulatory compliance and operational efficiency. Consistently applying these best practices will help firms stay ahead of changing regulatory expectations and protect their reputation and bottom line.

Let LeapXpert Solve Your Messaging Compliance Headaches

With The LeapXpert Communications Platform, using any app – from WhatsApp, iMessage, and WeChat to Slack and Microsoft Teams –  securely and in full compliance – is easy.

The LeapXpert Communications Platform offers full integration of all these digital communication channels and maintains a complete record of all conversations between employees and customers to ensure that data privacy and governance standards are met. The user-friendly dashboard allows for easy auditing and reporting and displays the real-time status of all text messages, conversations, and data sent, as well as flagging when conditions and rules have been breached. Integrated with leading third-party archiving, surveillance, and analytics platforms, all text message records are securely stored and available alongside all the existing business data.

Book a demo today.