Off-Channel Communication Legal & Compliance Risks
-
May 31, 2023
-
Monitoring and preserving employee communications have become significantly more challenging for financial services firms and related businesses due to the use of off-channel communications (“O-C-C”). Although the remote work trend may be waning, the use of personal devices and platforms for business communications persists, making the risk of O-C-C a continuing concern for general counsel. This article offers some practical recommendations to help proactively address any potential regulatory inquiries in this area.
Increasing Scrutiny from Regulators Lead to More Violations and Off-Channel Communications Fines
In September 2022, the U.S. Securities and Exchange Commission (“SEC”) charged 16 financial services firms regarding their use of O-C-C, while the Commodity Futures Trading Commission (“CFTC”) charged 11 Wall Street firms. Collectively, the firms were fined more than $1.8 billion and had to improve their compliance policies and procedures. , The firms were required to retain an independent compliance consultant to conduct a comprehensive O-C-C review, assess the progress of the review under its internal audit function, and report its findings to the SEC.
On January 3, 2023, the SEC published final amendments to the recordkeeping rules applicable to broker-dealers, security-based swap dealers, and major security-based swap participants that modify requirements for maintaining and preserving electronic records, the use of third-party recordkeeping services to hold records, and the prompt production of records.
The O-C-C issue has also captured the attention of the Department of Justice (“DOJ”). The DOJ published the “Monaco Memorandum” that directed prosecutors, when evaluating corporate cooperation, to consider whether the corporation “has implemented effective policies and procedures governing the use of personal devices and third-party messaging platforms to ensure that business-related electronic data and communications are preserved.” This expands O-C-C preservation beyond broker-dealers, investment advisors and future traders to all corporations. General counsel should have a full understanding of their O-C-C policy and risk exposure.
Conducting an Internal O-C-C Review
A firm can start an internal review by focusing on the items raised in recent settlements, which include the following:
- Policies and procedures regarding preservation;
- Training materials, including employee attestations regarding compliance;
- Surveillance and Supervision program measures related to preservation of electronic communications;
- Tracking of employee usage of any solutions;
- Measures used to prevent unauthorized communication methods;
- Surveillance routines for approved electronic channels are incorporated in the firm’s overall communications surveillance program; and;
- Framework in place to address issues of non-compliance, including consequences that include compensation, promotion, and termination, regardless of seniority.
Fundamentally, the firm will need to decide whether to allow employees to use chat and text applications to discuss business matters on personal devices. If so, the firm will need to utilize a technology-related solution that archives and manages such communications in accordance with relevant preservation and review requirements. Given the world today, it is unrealistic to not allow some forms of O-C-C to become “on-channel”.
It is important for general counsel to find the right technology solution to manage O-C-C. Certain applications have privacy protection with end-to-end encryption while others do not, and some applications can be customized to delete messages as soon as they are read or after a specific time period. Working with their chief information security officer and/or a consulting firm, the general counsel can find the right solution for their specific need.
Looking to the Future
Regulators are expected to focus on O-C-C during exams and investigations and will likely continue to bring enforcement actions related to failure to maintain books and records. In fact, the SEC’s Division of Examinations sent inquiries to certain investment funds and investment advisers regarding O-C-C in October 2022. The following month, the SEC’s O C-C probe reached into the private equity space. There will always be new technologies and innovations related to communications. This requires companies to be vigilant in ensuring that they are properly reacting to these changes and effectively mitigating risk.
Footnotes:
1: “SEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures,” SEC.gov, (Sep. 27, 2022). https://www.sec.gov/news/press-release/2022-174.
2: “CFTC Orders 11 Financial Institutions to Pay Over $710 Million for Recordkeeping and Supervision Failures for Widespread Use of Unapproved Communication Methods,” CFTC.gov, (Sep. 27, 2022). https://www.cftc.gov/PressRoom/PressReleases/8599-22.
3: SEC, supra note 1.
4: CFTC, supra note 2.
5: SEC, supra note 1.
7: Memorandum from The Deputy Attorney General on Further Revisions to Corporate Criminal Enforcement Policies Following Discussions with Corporate Crime Advisory Group to Assistant Attorney General, et al., U.S. Department of Justice – Office of the Deputy Attorney General (Sep. 15, 2022), https://www.justice.gov/opa/speech/file/1535301/download.
8: SEC, supra note 1.
9: CFTC, supra note 2.
10: Chris Prentice, “SEC Scrutiny into Wall Street communications shifts to investment funds – sources,” Reuters (Oct. 11, 2022), https://www.reuters.com/business/sec-scrutiny-into-wall-street-communications-widens-investment-funds-sources-2022-10-11/.
11: Manya Saini, “Major private equity firms become latest targets in SEC's communication probe”, Reuters (Nov. 9, 2022), https://www.reuters.com/legal/major-private-equity-firms-become-latest-targets-secs-communication-probe-2022-11-09/.
Related Insights
Published
May 31, 2023
Key Contacts