Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Let’s say, once upon a time, you worked from home during the pandemic.

core/paragraph

If so, did you use a variety of communication methods (perhaps switching among different platforms, never sure which camera or microphone would be active)?

core/list-item

And did you communicate with your colleagues or clients outside of email when you were just trying to respond to inquiries, using professional, social, and media-sharing platforms (so-called off-channel communications)?

And were you a broker-dealer or registered investment adviser?

core/list

If not, you can likely stop holding your breath, at least for now…but regardless, please read more below.

During calendar year 2024, a number of U.S. federal regulatory bodies in the financial sector, including the U.S. Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC), continued demonstrating interest into how organizations regulated by the SEC and CFTC maintain books and records according to federal securities law requirements – many according to one of the best acronyms in information governance, the non-rewritable, non-erasable format (also known as “write once, read many,” or WORM).

Specifically, in August 2024 (continuing a spate of enforcement stretching several years) the <a href="https://www.sec.gov/newsroom/press-releases/2024-98" target="_blank" rel="noreferrer noopener">SEC and CFTC announced</a> $390 million in fines, where the SEC stated that each of its investigations “uncovered pervasive and longstanding use of unapproved communication methods, known as off-channel communications, at these firms.” That is, firms admitted that “their personnel sent and received off-channel communications that were records required to be maintained under the securities laws. The failure to maintain and preserve required records deprives the SEC of these communications in its investigations. The failures involved personnel at multiple levels of authority, including supervisors and senior managers.”

Not to be outdone, in September 2024 the CFTC stepped away from a focus on enforcing off-channel communication retention issues and returned to a traditional form of communication also difficult to manage – charging a brokerage firm with failing to make or retain 3,000 audio recordings during transactions with clients. The targeted firm cooperated with the probe and settled, agreeing to pay a $650,000 penalty and reiterating its commitment to improving its compliance and risk management practices.

Possibly recognizing the challenge associated with just-in-time communication that lends itself to off-channel methods, there has been a change in approach for financial institutions confronting this plethora of communication choice. During the pandemic, the Financial Industry Regulatory Authority (FINRA), the primary U.S. brokerage industry regulator, had suspended rules on workplace inspections to make it easier for banks to allow their employees to work from home. But in December 2024, FINRA changed that approach, indicating a regulatory enforcement preference that emphasized pre-pandemic requirements for monitoring workplaces, meaning that some home offices would have to be registered with regulators and remotely inspected at least every three years under a new pilot program.

Perhaps a return-to-office mandate will help redirect employee communications to tried-and-true communication platforms that are more likely to be within the control of employers; however, if the past five years have indicated a constant, it is that communication will try to spread to fit the needs of the people doing business, regardless of the technologies, policies, procedures and preferences of the organizations ultimately responsible. And that the regulators, from all corners of government, will soon follow.

With that in mind, it is imperative for all organizations, not just those in the financial services industry, to consider and accommodate this shift in how business is conducted. Whether this takes the shape of revising an existing acceptable use policy, creating a new bring-your-own-device policy and/or engaging with employees through training and direction, it is critical for organizations to keep pace with such technological change, especially as underlying laws and enforcement authorities begin to catch up.

DSIR Deeper Dive: Information Governance – Communication Retention Challenges and a Return-to-Office Reaction