Recordkeeping fails where the approved channel is slower than a text

The week

On September 27, 2022, a familiar moment became very expensive. A client texts a banker at nine in the evening with a quick question about a trade, and the banker, sitting at home, answers on the phone already in hand. It feels like good service. At large firms across Wall Street, versions of that moment had happened countless times.

That day the Securities and Exchange Commission (SEC), which regulates securities markets and the firms that operate in them, announced charges against fifteen broker-dealers and one affiliated investment adviser for widespread recordkeeping failures. A broker-dealer is a firm that buys and sells securities for clients or for itself; an investment adviser manages money or gives investment advice for a fee. Combined penalties came to more than 1.1 billion dollars.

The penalties came in tiers. Eight of the largest firms, with their affiliates, paid 125 million dollars each to the SEC: Barclays, Bank of America’s securities units, Citigroup, Credit Suisse, Deutsche Bank, Goldman Sachs, Morgan Stanley and UBS. Jefferies and Nomura paid 50 million dollars each, and Cantor Fitzgerald paid 10 million dollars. The SEC said the conduct ran from January 2018 through September 2021.

The Commodity Futures Trading Commission (CFTC), which oversees futures, swaps and similar derivatives markets, announced related actions against eleven of the same firms the same day. Its penalties totaled about 710 million dollars, and its announcement named personal text messages, WhatsApp and Signal among the unapproved methods. Across both agencies, the day’s penalties exceeded 1.8 billion dollars.

The firms admitted that employees, including senior staff, had discussed business on personal devices through text messages and apps such as WhatsApp. Regulators call this “off-channel communication”: business conversations happening outside the systems the firm has approved and can record. Those messages were not preserved as federal securities and commodities laws require. The SEC charged the broker-dealers with failing to keep required records and with failing reasonably to supervise. Each firm was ordered to cease and desist from further violations, and the broker-dealers were censured. Admissions of fact were themselves notable, since many SEC settlements let firms neither admit nor deny the findings.

The SEC also described how it found out. Its staff had collected evidence from the personal devices of a sample of employees, including senior and junior investment bankers and debt and equity traders. The agency said the missing records had likely deprived it of communications it needed in various investigations. That detail mattered as much as the money. Regulators were saying the gap had already impaired their oversight.

Why does that matter so much? Financial firms are required to keep records of business communications so that regulators can reconstruct what happened when something goes wrong: who said what to whom, when, about which deal. A text that vanishes from a personal phone leaves a hole in that record. Regulators treat a firm’s inability to produce its own communications as a serious failure in itself, whether or not anything improper was said.

The firms agreed to retain compliance consultants to review their policies and procedures for personal devices and for how they handled employees who broke the rules. The SEC’s enforcement director urged other broker-dealers and asset managers to self-report and fix their own gaps. The actions followed a December 2021 settlement with JPMorgan on similar facts, in which the firm paid 125 million dollars to the SEC and 75 million dollars to the CFTC. The industry had already been warned. What changed in September 2022 was the scale: this was no longer one firm’s problem but a pattern across much of Wall Street.

The SEC case did not stand alone. Twelve days earlier, on September 15, the Deputy Attorney General had issued a memo revising Justice Department corporate enforcement policy. Among other things, it told prosecutors to consider whether a company had effective policies on personal devices and third-party messaging apps when evaluating its compliance program. And on October 12, the SEC adopted amendments to its broker-dealer electronic recordkeeping rule, adding an audit-trail alternative to the long-standing requirement to store records in non-rewriteable form. Within a month, securities regulators and federal prosecutors had both put business messaging on personal phones at the center of their expectations.

Take the compliance officer at a large firm reading the September 2022 announcements. Her first thought might be that the firm already has a policy forbidding business texting on personal phones. It is in the handbook. Everyone signs it every year. Her second thought, if she is honest, is that she has no idea how many of the firm’s senior bankers follow it.

That gap between the written rule and daily behavior is what this case was really about. This article starts with why an old rule collided with a new habit, and why good people broke it. It then takes the three things that close the gap: approved channels as convenient as the phone in hand, supervision that starts at the top, and capture that is proven rather than assumed. It follows a message through the capture chain, counts what the fines left out, and ends with the signs a firm has closed the gap.

An old rule meets a new habit

The rules at issue were not new. Broker-dealers must preserve business communications under the Securities Exchange Act, including Rule 17a-4. Registered investment advisers have parallel duties under the Advisers Act, including Rule 204-2, and swap dealers and futures firms have CFTC requirements. Banks that are not broker-dealers face different rules, so organizations should confirm with counsel which regime applies to each business line.

The rules say, in essence: if your people talk business, you must keep a copy, store it safely, and be able to hand it over when asked. The principle long predates smartphones. It applied to letters and memos, then to email, and it applies to text messages in exactly the same way.

What each rule asks for

The details differ by regime, and the differences matter for firms with several registered entities.

• Broker-dealers. Rule 17a-4 requires them to keep originals of communications relating to their business as such for at least three years, the first two in an easily accessible place. FINRA’s supervision rule separately requires member firms to review correspondence and to have procedures for doing so.
• Investment advisers. Rule 204-2 requires registered advisers to keep written communications relating to recommendations or advice, orders, and certain other matters, generally for five years.
• Swap dealers and futures firms. CFTC rules require registrants to keep required records, and swap dealers must keep records of communications relating to swaps, including oral ones in some cases.
• Banks and credit unions. Deposit-taking and lending businesses that are not registered with the SEC or CFTC are not bound by these specific rules. They still face litigation preservation duties, examiner expectations on records, and in some cases securities or municipal activities that are covered.

A diversified bank holding company can have all four regimes under one roof. The same relationship manager may cover a client’s deposit account, which falls outside the SEC rule, and a securities trade, which falls inside it. Firms that wrote one messaging policy for the whole group usually chose the strictest standard, because a policy that depends on the employee deciding which regime applies to each text will fail.

What the rule turns on

The recordkeeping rules turn on content, not on device. A message relating to the firm’s business is a business record whether it was sent from a trading desk terminal, a firm phone or a personal phone in a taxi. That is why a personal phone gave no shelter. The device belonged to the employee, but the conversation belonged to the firm’s records.

Capture technology was not new either. “Capture” means automatically copying messages as they are sent and received and saving them into an archive, a secure, tamper-resistant store designed to meet recordkeeping rules. Archiving tools for email, chat and mobile messages had existed for years.

So neither the law nor the technology was the problem. What failed was behavior, at scale and at senior levels.

Why good people break the rule

A banker whose client texts at 9 p.m. will answer on the phone in hand unless the approved option is just as quick. That is not malice. It is how people behave when the convenient path and the compliant path diverge. Most employees who texted clients from personal phones were trying to be responsive. The client wanted a quick answer; the banker gave one.

The forces behind the habit

Several forces pushed in the same direction. From March 2020, remote work removed the trading floor and the desk phone from many people’s day. Clients, especially outside the United States, ran their business lives on WhatsApp and expected their bankers to do the same. Approved tools on firm laptops were slower to reach and clumsier on a phone. And for years the chance of being caught was low, because nobody was checking personal devices.

Status played a part as well. In some parts of finance, being reachable on a personal number signals closeness to the client. A senior banker who says “text me” is offering access. Asking that banker to route everything through a compliance app can feel, to both sides, like a downgrade in the relationship.

Each individual choice looked sensible. The client got a fast answer, the deal moved, and the record gap was invisible. The cost was spread across the firm and arrived years later, when regulators asked for messages that no longer existed.

The case that the rules are outdated

Some practitioners argued that the rules had not kept pace with how people communicate. Requiring firms to keep every business text, they said, treats casual coordination as if it were a formal letter. Others pointed out that the penalties were not tied to any finding of investor harm.

The argument has some force on proportionality, which is a matter for regulators. It does not change what a firm must do. The rules apply, they have applied to each new medium in turn, and a firm that cannot produce its communications cannot defend itself in a dispute either. Firms that waited for the rules to change were betting on a policy outcome. Firms that fixed the gap were managing a risk they could control.

Three things moving together

A written policy cannot close that gap on its own. Closing it takes three things moving together:

1. Approved channels that are as convenient as the ones people use anyway.
2. Supervision that makes off-channel use costly, starting at the top.
3. Assurance that capture actually works across every approved channel and device.

The three depend on each other. Strength in one cannot make up for weakness in another.

Channels as convenient as the phone in hand

Employees use the channels their clients use. After 2020, with remote work widespread, those were often text messages and consumer messaging apps. A ban without an equally easy alternative is a ban employees work around, often with the best intentions toward the client.

Two broad approaches

Firms took two broad approaches.

• Bring the popular channels inside. Some issued managed devices, or managed apps on personal devices, with business texting and messaging captured automatically, including approved versions of popular apps routed through capture vendors. A “managed” device or app is one the firm controls centrally: it can configure it, check it is working, and connect it to the archive.
• Keep business on firm platforms. Others restricted business communication to firm platforms and told clients so, accepting some friction in exchange for simpler control.

Either works if it is designed around real workflows. Examples include how a trader reaches a client during market hours, how an adviser handles a family member who is also a client, and what happens when a client sends a voice note. These sound like small details. They are exactly where people slip back to old habits.

The capture options and their trade-offs

Capture for mobile messaging comes in a few technical forms, each with its own costs.

• Carrier-level capture. For phones on a firm’s mobile contract, the carrier or a partner copies text messages and call records to the archive. It is invisible to the user, which is good for adoption, but it covers only the firm’s numbers and only carrier messaging.
• Managed apps. A separate business messaging app, or a vendor-supplied version of a popular app, runs in a work profile on the phone and sends copies to the archive. It can cover personal devices, but it depends on the app staying current and enrolled.
• Firm-only platforms. Business messaging stays on the firm’s own collaboration tools, which are already archived. It is the simplest to prove, and the hardest to sell to clients who live on consumer apps.

Most large firms ended up with a mix. The design choice is less about technology than about which client behaviors the firm is willing to accommodate, and at what cost.

Different firms, different problems

The right answer depends heavily on the type of firm. A global investment bank has trading desks in several countries, clients on many messaging platforms, and the budget to issue managed phones. It also faces overlapping rules. In the European Union and the United Kingdom, the MiFID II framework already required firms to record telephone conversations and electronic communications relating to certain transactions. Voice capture was familiar there.

A small registered investment adviser with a dozen staff is a different case. It has no mobile engineering team and will buy capture as a service. Its main risk is an adviser texting long-standing clients from a personal phone out of habit, and its main tool is a simple approved app plus a clear policy.

A broker-dealer that works through independent representatives has the hardest version of the problem. Its representatives often run their own offices, buy their own phones and are independent contractors. Supervising their personal devices is legally and practically awkward, so these firms tend to rely on a required business app, contractual commitments and regular attestations, backed by surveillance of what is captured.

Voice calls and voice notes

Messaging is only part of the picture. Many client conversations happen by phone, and calls on a personal mobile leave no record at all. Firms subject to call recording rules in some jurisdictions already route trading calls through recorded lines. Elsewhere, firms had to decide whether business calls on mobiles must go through a recorded app, or whether a written follow-up summary on an approved channel was enough. Voice notes sent inside messaging apps raise the same question in a new form, and capture tools did not always handle them well at first.

Design details decide adoption

If the captured app takes longer to open, lacks group chats or drops attachments, staff will drift back. Every extra tap is a small invitation to use the personal phone instead.

Pilots with front-office teams, measured by how much of their client traffic moves onto the approved channel, show whether the design works before it is mandated. Suppose a regional wealth manager rolls out a captured messaging app to one advisory team for six weeks. It tracks how many client conversations happen on the new app compared with the team’s usual activity. If most traffic moves, the design is ready to extend. If little moves, the team is asked why, and the answers, such as “clients can’t send photos of documents,” become the next round of fixes.

Clients are part of the design

Many clients will keep texting whatever number they have. Telling them which channels the firm uses, and giving them a business number that works in their preferred app, moves much of the traffic without asking the employee to refuse a client. The employee rarely has to tell a valued client, “I can’t answer you here.”

Client communication works best when it comes from the firm as well as the individual. A short note to clients explaining that the firm records business messages, and listing the numbers and apps to use, removes the awkwardness from the employee. It also sets expectations: a client who knows business texts are recorded is less likely to treat a personal number as an off-the-record line.

Supervision that starts at the top

The SEC orders noted that supervisors and senior managers had themselves used off-channel communications. This is perhaps the most important detail in the whole episode. Where leaders do this, a policy against it carries little weight, and junior staff learn which rules are real.

Every organization has written rules and real rules. The real rules are the ones people see enforced, and above all the ones they see their bosses follow. A managing director who texts clients from a personal phone is teaching everyone below them that the policy is optional.

Making it a supervisory matter

Effective programs made off-channel use a supervisory matter with consequences:

• Periodic attestations by employees that they have not used unapproved channels, a signed statement that turns a vague expectation into a personal commitment.
• Surveillance of captured messages for signs of off-channel activity, such as references to texting or to conversations not found in the archive. If an approved message says “as I mentioned in my text,” and there is no such text in the archive, that is a clue.
• Disciplinary steps, including compensation consequences, applied to senior staff as visibly as to anyone.

Many firms that settled agreed to undertakings along these lines.

Why compensation matters

Warnings and training change little for senior staff whose pay depends on revenue. Compensation is the language they respond to. Programs that tied off-channel violations to bonus decisions, with the link written into compensation policy and applied consistently, changed behavior faster than those that relied on letters of reprimand.

The design needs care. A rule that punishes a single stray text as harshly as a pattern of deliberate evasion will be seen as unfair, and managers will stop applying it. A graded scale, from a recorded warning for a first lapse that is self-reported to pay consequences for repeated or concealed use, is easier to defend and to apply.

Surveillance that looks for absence

Most surveillance looks for bad things in captured messages. Off-channel detection has to look for what is missing. Lexicon rules flag phrases such as “text me,” “call my cell” or the names of unapproved apps. Pattern analysis compares an employee’s captured communications with their business activity. A trader whose captured messages fall to almost nothing while their trading volume holds steady is talking somewhere. So is an adviser whose clients’ transactions keep coming while the approved channel goes silent.

These signals are noisy and need human review. They are also the only way a firm can find off-channel use without inspecting personal phones, which makes them worth the tuning effort.

Evidence from the devices themselves

The SEC’s method, examining a sample of personal devices, showed that regulators would look where firms had not. Firms responded in different ways. Some required staff, as a condition of using personal devices for any work purpose, to make them available for review in an investigation. Others reviewed samples of devices themselves, with consent, to test whether attestations were true.

Both approaches collide with employee privacy, especially in Europe, where data protection law and works councils limit what an employer can inspect. Firms operating across jurisdictions usually needed different procedures by country, agreed with local counsel.

Disappearing messages

Ephemeral messaging, where messages delete themselves after a set time, raised the stakes. A deleted message cannot be recovered for a regulator or a court. The Justice Department’s September 2022 memo flagged ephemeral and encrypted messaging apps as an area of focus. Firms responded by banning disappearing-message settings for any business use, and in some cases by banning apps whose design made capture impossible.

Training that helps in the moment

Training mattered when it was specific. Staff needed to know which channels were approved and what to do when a client messaged a personal device. They also needed a way to move the conversation without seeming evasive. A short script for that moment, plus a simple way to forward or log the stray message, does more than an annual module on the rule.

A script might be as simple as: “Thanks, I’ve got this. I’ll reply from my work line so it’s on our records; that’s the best number for me going forward.” It is polite, takes seconds, and solves the immediate problem.

Joiners and leavers

Joiners and leavers are where habits enter and evidence leaves. New hires, especially senior lateral hires, arrive with client relationships on personal phones. Onboarding should move those conversations to approved channels in the first weeks. Departures need a check that business messages on managed devices were captured before the device is wiped or the employee walks out with it.

Capture that is proven, not assumed

The third part is technical assurance. Capturing mobile messages and storing them in a compliant archive is a solved problem in principle. In practice, capture breaks when an app updates, a device falls out of management or a new channel is approved without being connected to the archive. Gaps can persist for months unnoticed.

This is the part executives most often take on trust. Someone bought a capture tool; therefore messages are captured. But a capture system is more like a smoke detector than a wall. It only protects you if it is working, and the only way to know is to test it.

Measuring coverage

Assurance means measuring coverage. Useful indicators include:

• The share of client-facing staff on approved mobile channels.
• Captured message volume by channel and desk compared with expected activity.
• The number of surveillance alerts suggesting off-channel use.
• The time to fix a capture failure.

A desk whose captured volume suddenly falls is either less busy or talking elsewhere. Reported monthly to the compliance committee, these numbers show whether behavior is changing.

Consider two desks at the same firm. Both have the same number of client-facing staff and similar business. One shows a steady stream of captured messages every week. The other shows a fraction of that, and a sharp fall after a recent app update. The second desk may simply be having a slow month. Or the update broke capture. Or the team has drifted back to personal phones. All three possibilities need someone to look, and only the numbers reveal that there is something to look at.

Testing the chain end to end

Volume trends catch large failures. Smaller ones need direct tests. A common technique is the test message: a scheduled, labeled message sent through each approved channel from a test device every day, then searched for in the archive. If it does not arrive, capture on that channel is broken, and the firm knows within a day.

Reconciliation goes further. Where a channel provides its own message counts, the firm can compare them with what reached the archive for the same period. A mismatch shows messages lost in transit. Device management reports add a third check, listing phones that have dropped out of enrollment or are running an outdated app version.

Change control and vendors

Many capture failures start with an ordinary change: an operating system update, a new app version, a new channel approved by a business line. Treating each of those as a change that requires a capture test before release closes the most common gap. Vendor contracts should require notice of changes that could affect capture, commit to restoring service within a defined time, and give the firm the logs it needs to prove completeness.

The SEC’s October 2022 amendments to its broker-dealer electronic recordkeeping rule bear on the storage end. Firms could now meet the requirement either with non-rewriteable, non-erasable storage or with a system that keeps a complete audit trail of changes. That gave firms more flexibility in archive design, but the burden of proving completeness stayed with them.

Privacy and personal devices

Privacy law complicates capture for staff in other countries and on devices used for both work and personal life. A firm cannot simply copy everything on an employee’s phone. Managed apps that separate business from personal data, and clear policies on what the firm will and will not access, help reconcile the two. Employees are far more willing to put a firm app on their own phone when they are confident the firm cannot read their family messages.

How message capture works in practice

A captured message travels in four steps, and each is a place where things can go wrong without anyone noticing.

Step one: the message is sent. An adviser types a reply to a client in an approved messaging app on a firm-managed phone, or in a managed business app on her own phone. The managed part matters: it means the firm has set the app up, can see that it is working, and has connected it to the capture service.

Step two: a copy is taken. As the message leaves the device, the capture tool makes a copy, along with details such as who sent it, who received it and when. For popular consumer apps, this usually happens through an approved, specially built version of the app supplied by a capture vendor, rather than the version anyone can download.

Step three: the copy is stored. The copy travels to the archive, where it is kept in a form that cannot be altered or deleted before the required retention period ends. This is what lets a firm say, years later, “here is exactly what was said.”

Step four: it is reviewed. Surveillance tools scan archived messages for risk signals, from potential misconduct to signs that a conversation has moved somewhere the archive cannot see. Compliance staff review the alerts.

Now consider the failure points. If the app updates and the capture connection breaks, step two stops. If a phone falls out of management, the firm may not know the device exists. If a new channel is approved but never connected, step three never happens for it. In each case, the adviser carries on working normally and nothing looks wrong, which is why measurement matters so much.

The later steps fail too. A retention setting configured too short in the archive deletes records early. A surveillance system that generates thousands of low-value alerts teaches reviewers to clear them without reading. And when a regulator asks for messages, the firm must be able to search and produce them promptly, with the attachments, in a usable form. Each of those is a control with an owner, and each should be tested.

A ninety-day plan

Suppose a mid-sized brokerage reads the 2022 announcements and decides to act. A sensible first quarter might look like this. In the first month, it surveys front-office teams on which channels clients actually use, and asks counsel to confirm which recordkeeping rules apply to each business line. In the second month, it pilots a captured messaging option with two client-facing teams, and its executive committee members move their own client contact onto approved channels first. In the third month, it starts a simple monthly report of captured message volume by desk, writes the short client-message script, and adds channel migration to onboarding for new hires. Not one of these steps is exotic. Together they address all three parts at once.

The quarter after that is about making it stick. It adds daily test messages on every channel and change control for app updates. It also brings a graded discipline policy linked to pay, and the first round of device attestations with spot checks.

What the fines left out

The penalties drew the headlines, but the costs ran wider:

• Legal exposure. If a firm cannot produce its communications, it cannot easily defend itself in a dispute or investigation. Missing records rarely help the side that lost them.
• Remediation cost. Retaining outside compliance consultants, rebuilding channels and rolling out new devices and apps all cost money and management attention.
• Culture. When senior people are seen to ignore a rule, the damage extends beyond that rule.
• Clients. Clients want responsiveness. A program that simply forbids texting, without a good alternative, risks frustrating the people the firm most wants to keep.

The undertakings

The settlements came with work attached. A compliance consultant had to review the firm’s policies, training, surveillance and approach to discipline, and recommend changes. The firm then had to adopt the recommendations and certify its compliance. That work ran for many months, consumed senior compliance time, and put the firm’s internal processes in front of an outside reviewer whose report the regulator would see.

Consequences beyond the order

For broker-dealers that are members of FINRA, the securities industry’s self-regulatory organization, the settlements had a further effect. FINRA later explained that the SEC settlements from 2021 through 2024 made each member firm involved statutorily disqualified under the Exchange Act. Each had to apply to FINRA to continue as a member and accept a heightened supervision plan. A recordkeeping case thus triggered membership consequences that firms had to manage for years.

Litigation adds a separate exposure that applies to every kind of organization, regulated or not. When a lawsuit is reasonably anticipated, a party must preserve relevant information, and courts can sanction parties that lose it. A bank, a credit union or a fintech that is outside the SEC rules still faces that duty for business messages on personal phones.

The same pattern outside securities firms

The off-channel problem is not confined to Wall Street. Public agencies face it under records laws. Federal employees who use a non-official messaging account for official business must, under federal records law, copy or forward the record to an official account within twenty days. State public records laws reach officials’ texts in many states. Health systems face it when clinicians text patient information from personal phones, which raises HIPAA questions as well as records ones. The fix has the same three parts in every sector: a convenient approved channel, supervision that applies to senior people, and evidence that capture works.

Each part fails alone

Each of the three parts fails alone. Approved channels without supervision are ignored. Supervision without good channels drives use underground. Capture without both records only what people choose to put in it.

Signs a firm has closed the gap

A firm in good shape tends to show these signs:

• Approved messaging channels that front-office staff actually prefer, tested in pilots before being mandated.
• Senior leaders visibly using approved channels, and visibly held to account when they do not.
• Specific, practical guidance for the moment a client messages a personal device.
• A monthly dashboard of capture coverage reviewed by a compliance committee.
• Clear onboarding and departure steps for moving and preserving client conversations.
• Clear advice from counsel on which recordkeeping rules apply to which business lines.

The usual failures:

• Relying on the annual attestation alone. Signing a form once a year does not change what happens at 9 p.m.
• Banning without replacing. Forbidding popular apps without offering an equally easy option pushes behavior out of sight.
• Exempting stars. Letting top earners off sends the loudest possible message about which rules matter.
• Assuming capture works. Tools break without warning. Only measurement shows the gaps.

The evidence file

When an examiner or a consultant tests the program, the conversation goes better with evidence ready. A useful file starts with the list of approved channels, with the date each was connected to the archive and last tested. It adds the coverage dashboard for the past year and records of capture failures with detection and repair times. It closes with attestation results, spot-check findings and a log of disciplinary outcomes by seniority. The last item is the one that shows whether the rule applies at the top.

Ownership

The three parts have natural owners. The business heads own channel adoption, because only they can make it a priority for their teams. Compliance owns supervision and surveillance. Technology owns capture and its testing. A single senior executive, often the chief compliance officer with a technology counterpart, should own the whole and report it to the board or its risk committee. Without that, each owner can show progress on its own part while the gap between them stays open.

Whether approved channels, senior use and capture hold up

1. Which messaging channels are approved for client contact, and are they genuinely as quick and easy as the ones clients prefer?
2. Do our most senior people use the approved channels, and how would we know if they did not?
3. What happens, step by step, when a client texts an employee’s personal phone?
4. Do we compare captured message volume by desk with expected activity, and who looks at the results?
5. When did a capture failure last occur, how long did it take to notice, and how long to fix?

With hindsight

The September 2022 actions were the start of a long run. Through 2023 and 2024, the SEC and CFTC brought further off-channel cases against dozens of firms, including many investment advisers, private fund managers and smaller broker-dealers. In August 2024 alone, twenty-six firms agreed to pay more than 390 million dollars to settle SEC charges, and eleven more paid over 88 million dollars the following month. In its fiscal 2024 enforcement results, the SEC said the initiative had by then charged more than 100 firms and produced more than 2 billion dollars in penalties since December 2021.

The terms shifted at the end. In January 2025, in the final weeks of the previous administration, the SEC settled another round of cases with smaller penalties, including a sharply reduced penalty for a firm that had self-reported. Those later settlements also avoided the FINRA membership consequences that earlier settlements had triggered.

That difference prompted a dispute. More than a dozen firms that had settled earlier asked the SEC to modify their orders to match the later terms. In April 2025 the Commission denied a group of those requests, with Commissioner Hester Peirce dissenting, and it denied further requests in June 2025. FINRA said in May 2025 that it would revise the heightened supervision plans for affected member firms to focus on completing their SEC undertakings. It also sought comment that year on modernizing rules that affect how people work, including remote and hybrid arrangements.

The SEC’s posture changed under its new chairman. In May 2026, speaking at FINRA’s annual conference, Chairman Paul Atkins criticized the earlier off-channel sweep. He noted that none of the cases had involved investor harm and said the agency would put quality of cases ahead of quantity. That is a change in enforcement priority, not in the law. The recordkeeping rules themselves did not change. Undertakings in existing orders stayed in force after the Commission declined to modify them, and litigation preservation duties apply whatever the enforcement climate. For most firms, the practical effect of the new posture was smaller than the headlines suggested.

Other expectations moved the other way. In March 2023, the Justice Department updated its guidance on evaluating corporate compliance programs, telling prosecutors to examine how companies govern personal devices, communication platforms and ephemeral messaging apps. That guidance reaches companies in every sector, including those outside securities regulation. Firms invested heavily in mobile capture, managed devices and supervision over the same period, and the market for compliant mobile messaging grew accordingly. The SEC’s amended electronic recordkeeping rule took effect for broker-dealers in 2023, giving firms the audit-trail option for their archives.

That last point matters most. Enforcement priorities rise and fall with administrations, but the underlying obligation to keep business records has stayed put for decades, through letters, email and now mobile messaging. The next popular app, whatever it turns out to be, will raise the same questions: can our people use it with clients, are we capturing it, and do our leaders follow the rules they set? A firm that answered those questions only to satisfy a particular enforcement wave will find itself answering them again.

There is also a broader management message here, well beyond financial services. Any rule that asks people to choose a slower path over a faster one will be tested daily, and usually by well-meaning staff trying to serve customers. Rules hold when the compliant path is made as easy as the shortcut, when leaders are seen to follow them, and when someone checks that the controls are actually working.

The firms that fared best treated the 2022 actions as a design problem rather than a policy problem. By 2026, the firms with the fewest problems are those whose approved channels are genuinely convenient and whose leaders use them.