Recordkeeping fails where the approved channel is slower than a text
The SEC and CFTC fined large Wall Street firms over employees’ business texts on personal phones. The rules were old and capture tools existed. The failures came from convenience, and fixing them meant channels, supervision and capture assurance moving together.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On September 27, 2022, the Securities and Exchange Commission announced charges against fifteen broker-dealers and one affiliated investment adviser for widespread recordkeeping failures, with combined penalties of more than 1.1 billion dollars. The Commodity Futures Trading Commission announced related actions against many of the same firms the same day, with additional penalties. The firms admitted that employees, including senior staff, had discussed business on personal devices through text messages and apps such as WhatsApp. Those messages were not preserved as federal securities and commodities laws require. The firms agreed to retain compliance consultants to review their policies and procedures. The actions followed a December 2021 settlement with one large firm on similar facts.
The rules at issue were not new. Broker-dealers must preserve business communications under the Securities Exchange Act, including Rule 17a-4. Registered investment advisers have parallel duties under the Advisers Act, including Rule 204-2, and swap dealers and futures firms have CFTC requirements. Banks that are not broker-dealers face different rules, so organizations should check with counsel on which regime applies to each business line. Capture technology was not new either. Archiving tools for email, chat and mobile messages had existed for years.
What failed was behavior, at scale and at senior levels. A banker whose client texts at 9 p.m. will answer on the phone in hand unless the approved option is just as quick. A written policy cannot close that gap on its own. Closing it takes three things moving together. The first is approved channels that are as convenient as the ones people use anyway. The second is supervision that makes off-channel use costly, starting at the top. The third is assurance that capture actually works across every approved channel and device.
Channels as convenient as the phone in hand
Employees use the channels their clients use. After 2020, with remote work widespread, those were often text messages and consumer messaging apps. A ban without an equally easy alternative is a ban employees work around, often with the best intentions toward the client.
Firms took two broad approaches. Some issued managed devices, or managed apps on personal devices, with business texting and messaging captured automatically, including approved versions of popular apps routed through capture vendors. Others restricted business communication to firm platforms and told clients so, accepting some friction in exchange for simpler control. Either works if it is designed around real workflows. Examples include how a trader reaches a client during market hours, how an adviser handles a family member who is also a client, what happens when a client sends a voice note.
Design details decide adoption. If the captured app takes longer to open, lacks group chats or drops attachments, staff will drift back. Pilots with front-office teams, measured by how much of their client traffic moves onto the approved channel, show whether the design works before it is mandated.
Clients are part of the design. Many will keep texting whatever number they have. Telling them which channels the firm uses, and giving them a business number that works in their preferred app, moves much of the traffic without asking the employee to refuse a client.
Supervision that starts at the top
The SEC orders noted that supervisors and senior managers had themselves used off-channel communications. Where leaders do this, a policy against it carries little weight, and junior staff learn which rules are real.
Effective programs made off-channel use a supervisory matter with consequences. Periodic attestations by employees that they have not used unapproved channels. Surveillance of captured messages for signs of off-channel activity, such as references to texting or to conversations not found in the archive. Disciplinary steps, including compensation consequences, applied to senior staff as visibly as to anyone. Many firms that settled agreed to undertakings along these lines.
Training mattered when it was specific. Staff needed to know which channels were approved and what to do when a client messaged a personal device. They also needed a way to move the conversation without seeming evasive. A short script for that moment, plus a simple way to forward or log the stray message, does more than an annual module on the rule.
Joiners and leavers are where habits enter and evidence leaves. New hires, especially senior lateral hires, arrive with client relationships on personal phones. Onboarding should move those conversations to approved channels in the first weeks. Departures need a check that business messages on managed devices were captured before the device is wiped or the employee walks out with it.
Capture that is proven, not assumed
The third part is technical assurance. Capturing mobile messages and storing them in a compliant archive is a solved problem in principle. In practice, capture breaks when an app updates, a device falls out of management or a new channel is approved without being connected to the archive. Gaps can persist for months unnoticed.
Assurance means measuring coverage. Useful indicators include the share of client-facing staff on approved mobile channels, and captured message volume by channel and desk compared with expected activity. They also include the number of surveillance alerts suggesting off-channel use and the time to fix a capture failure. A desk whose captured volume suddenly falls is either quieter or talking elsewhere. Reported monthly to the compliance committee, these numbers show whether behavior is changing.
Privacy law complicates capture for staff in other countries and on devices used for both work and personal life. Managed apps that separate business from personal data, and clear policies on what the firm will and will not access, help reconcile the two. Each of the three parts fails alone. Approved channels without supervision are ignored. Supervision without good channels drives use underground. Capture without both records only what people choose to put in it.
With hindsight
The September 2022 actions were the start of a long run. Through 2023 and 2024, the SEC and CFTC brought further off-channel cases against dozens of firms, including many investment advisers, with cumulative penalties reported in the billions of dollars. Firms invested heavily in mobile capture, managed devices and supervision. Some SEC commissioners criticized the approach, arguing that penalties were not tied to harm. After the change of administration in 2025, enforcement priorities shifted and the pace of new off-channel cases slowed. The recordkeeping rules themselves did not change. Later questions, such as how to reconcile recommendations to use encrypted messaging with capture obligations, tested the same three parts. By 2026, the firms with the fewest problems are those whose approved channels are genuinely convenient and whose leaders use them.