It all started when...

Once upon a time, banking was created as a means of safeguarding and managing monetary assets. From ancient civilization to modern day, the need to store, issue, lend, and supervise finances have been essential to a well-functioning society.

Yet, while banks have always been foundational, financial regulation has constantly been evolving.

Today, finance is one of the most regulated industries. Due to the sensitivity of data, potential for financial risk, investor protection, and need to maintain a healthy market, regulators are consistently monitoring institutions and establishing guidelines to match the speed of advancing technologies.

In this particular account, financial regulators began to focus on a present-day challenge that continues to advance – communications and recordkeeping in the age of multiplying messaging channels.

It all started in December 2021 when unanticipatedly, the Securities and Exchange Commission (SEC) and Commodities Future Trading Commission (CFTC) catalyzed a chain of action across the regulatory realm by issuing fines for illicit communications and recordkeeping failures.

These initial enforcements were against JP Morgan Securities for failing to capture written communications occurring on personal devices through email, text, and WhatsApp. Alongside employees, supervisors contributed to this noncompliance. The SEC and CFTC charged the firm a combined $200 million dollars and required that it improve its compliance policies.

Since then, regulatory entities globally seem to continue zeroing in on these unfolding industry issues.

What did the regulators have to say?
SEC Chair Gary Gensler stated that since the 1930s, recordkeeping has been a critical part of market integrity. It is a component of regulators' ability to monitor the industry, and with advancing technology...

it’s even more important that registrants ensure that their communications are appropriately recorded...in order to avoid market oversight.

Gary Gensler, SEC Chair

After the initial fines, the CFTC followed up with a sweeping series of enforcements from September 2022 to current day, many of which were jointly filed alongside the SEC. These fines include:

Coincidingly, the SEC hit another 16 firms with a staggering number of fines in September 2022 that totaled over $1.1 billion dollars. Again, these charges arose from failure to record text communications and included employees across all levels of authority, raising the question of proper culture and conduct.

What else to look out for?
In their speeches, regulators have cautioned firms to account for the following topics: tone from the top, cooperation and self-reporting, strong internal policies, education and training, and established cyber resilience procedures – all of which protect against the threat of noncompliance.

Meanwhile, the Financial Industry Regulatory Authority (FINRA), a regulatory authority overseen by the SEC, announced fines for unauthorized communications against a firm and two of its senior managers in September 2022 for $1.5 million and $15,000 per individual.

FINRA struck again in January 2023 and charged an organization $200,000 dollars for a failed blocker that inadequately prevented use of certain communications channels. Unlike many others, this organization took remedial action and cooperated with regulators. For that reason, it received a lighter fine amount.

Not the first case...
Though these enforcements mark a record consecutive chain of charges spurring action and catching attention in the industry, they are not the first instances of recordkeeping failures. FINRA has issued a range of penalties for inadequate record retention, such as in 2016 when the regulator fined 12 firms $14.4 million for “failing to protect records from alteration.” Additionally, the CFTC has issued charges related to communications recordkeeping failures as early as 2015. While not the center of regulatory attention, the significance of recorded communications has long been on the radar.

Ensuring the integrity of [electronic] records is critical to the investor protection function because they are a primary means by which regulators examine for misconduct in the securities industry.

Brad Bennett, FINRA's Executive Vice President and Chief of Enforcement

Coinciding with the rapid-fire fines spanning from late 2022 to early 2023, another U.S. regulator joined in. The Department of Justice (DOJ) alluded to new rules around personal communication devices, communications platforms, and ephemeral messaging, which it later acted on when amending its Evaluations of Corporate Compliance Program (ECCP) in March 2023.

Eventually, U.K. regulators became more involved in combatting noncompliance. In April 2023, the Prudential Regulations Authority (PRA) censured a now inactive bank for regulatory failings, which included improper retention for WhatsApp messaging. Though the severity of the breach originally warranted a £8.5 ($10.5) million fine, the bank’s limited financial resources caused the regulator to instead issue a censure.

Then, in May 2023, the Competitions and Market Authority (CMA) released provisional findings that a firm allowed its employees to use Bloomberg chat to engage in anti-competitive behavior.

A quick look at the numbers
Average fine amount	$45-46 million
Average time between each enforcement	1-2 months

Surprisingly, even the Office of Gas and Electricity Markets (Ofgem), a non-financial regulator, made moves to charge Morgan Stanley & Co. International £5.4 ($6.8) million for failing to record and retain electronic trading communications on WhatsApp in August 2023. Though U.S. regulators had been vigilant in their pursuit of communications compliance to this point, this case was the first fine issued in the U.K.

Over this same period, the SEC once again made an appearance in the communications compliance campaign and carried out enforcements against various firms for improperly captured communications.

Amidst this succession of scrutiny, firms started taking matters into their own hands by penalizing or even terminating communications compliance violators. This includes Morgan Stanley in January 2023 and Goldman Sachs in September 2023.

An analysis of data capture in response to regulatory movement:
Global Relay Data Insights: Compliant Communications report, which analyzes capture solutions for compliant communication, discovered a correlating trend in conjunction with the timeline of these noncompliant charges. From 2021 to 2023, when regulatory action against WhatsApp was at an all-time high, capture implementation for WhatsApp increased over 400%.

Similarly, capture implementation for Microsoft Teams Connectors increased 229% in the year of the COVID-19 pandemic, likely due to its similarity to WhatsApp and heightened use among remote workers.

What's the next move?
Interestingly, Global Relay’s Data Insights report also found that LinkedIn communications capture steadily grew from 2019 to 2023. With regulators like the SEC stressing the importance of firms' adherence to the Marketing Rule, specifically outlining proper social media use, could this hint at what channels are to come into focus as we continue into 2024?

By the time 2024 had started, the number of fines charged of each firm had added up to a staggering figure - over $2.8 billion.

All in all, this cautionary tale serves to ensure financial firms remain vigilant and prepared. Though the saga of regulatory scrutiny seems to only be beginning, firms can heed warning from previous examples and future predictions to outrun the risks of noncompliance.