SEC Recordkeeping and Off-Channel Communications: The Archive Architecture Behind the Fines

The SEC has taken billions of dollars off Wall Street for off-channel communications, and almost every write-up frames it as a conduct problem. It is not. It is a capture-and-retention engineering problem that the compliance function was never resourced to solve.

The enforcement record is now long enough to read as a specification. Firms did not get fined because a trader said something improper on WhatsApp. They got fined because business communications happened on channels the firm could not capture, and therefore could not produce when a regulator asked. The message content was, in most orders, beside the point. The failure was that the record did not exist. That is an architecture question, and it is the one this post is about.

What the enforcement record actually shows

The wave opened in December 2021, when JPMorgan Securities agreed to a 125 million dollar SEC penalty and admitted that its employees had for years communicated about the business on personal devices and messaging apps that the firm did not preserve. In September 2022 the SEC charged sixteen firms — fifteen broker-dealers and one investment adviser — with widespread recordkeeping failures and collected more than 1.1 billion dollars, with eight of those firms paying 125 million dollars each. The conduct the orders described ran from roughly January 2018 to September 2021 and centred on text-messaging applications on personal phones used for firm business.

The sweep did not stop there. It has since reached more than a hundred firms and, across the SEC and the CFTC together, well over three billion dollars in penalties. By early 2025 the pattern had shifted: firms that proactively investigated and self-reported were drawing materially lower numbers — one adviser settled for 600,000 dollars with explicit cooperation credit — while the substance of the charge stayed identical. The common thread through every order is the same sentence, rephrased: the firm failed to maintain and preserve required records of business communications.

The rules are about capture, not policy

The obligations are old and boring, which is exactly why they were under-engineered. Broker-dealers sit under Section 17(a) of the Securities Exchange Act and Rule 17a-4, which require that records of communications relating to the business be preserved, historically in a non-rewriteable, non-erasable format. Investment advisers sit under Section 204 of the Advisers Act and Rule 204-2. Neither rule cares which app a message was sent on. Both require that if a communication concerns the business, the firm can retain it and produce it.

Read as an engineer rather than a lawyer, that decomposes into three capabilities. You must capture business communications wherever they occur. You must retain them immutably for the prescribed period. And you must be able to produce a complete, tamper-evident set on demand. A written policy that prohibits WhatsApp satisfies none of these. The firms that were fined mostly had the policy. What they did not have was the capture.

Where the coverage gaps actually were

Every enforced firm had an email archive. Email was a solved problem twenty years ago. The gaps were in the surfaces email archiving never reached, and they map cleanly onto the modern communications estate.

• Personal mobile. The signature failure. iMessage, WhatsApp, Signal and SMS on a device the firm does not manage are invisible to any server-side archive. If capture depends on the employee choosing a monitored channel, capture is optional, and optional capture is no capture.
• Collaboration platforms. Microsoft Teams, Slack and their kin generate exactly the ephemeral, conversational, business-relevant content the rules cover — direct messages, private channels, edits and deletions — and firms routinely archived the email tenant while leaving the chat tenant partially or wholly uncaptured.
• Consumer messaging as a business channel. Clients and counterparties reach people where they already are. A relationship conducted over a personal channel because the client prefers it is still a business record, and the firm still owns the obligation to keep it.

The uncomfortable point the orders make repeatedly is that this was not junior staff cutting corners. Supervisors and senior people were on the unmonitored channels too, which is why the supervisory-failure charge landed alongside the recordkeeping one.

What a defensible archive architecture looks like

A capture-and-retention architecture that survives an examination has a small number of load-bearing properties, and none of them are the archive vendor’s logo.

Capture at source, not by cooperation. The channel itself must feed the archive — Teams and Slack through their compliance-export or journaling APIs, mobile through a managed-device or captured-messaging service that intercepts business messaging before it leaves the estate. Any design that relies on a human forwarding a message is a design that will fail on the day it matters.

Immutability you can prove. Write-once storage, hash chains or write-once-read-many object locking, so that the retained record is demonstrably the original. This is a data-lineage discipline: every item needs provenance and an integrity seal, because the examiner’s question is not only “do you have it” but “can you show it was not altered”. Access to the retention layer itself must be tightly scoped and logged — the same least-privilege discipline you apply to credentials applies to whoever can touch the archive.

Surveillance over the captured set. Capture without review is a warehouse nobody visits. Lexicon and behavioural surveillance running across the archive is what turns retained data into a control, and — more practically — what surfaces the coverage gap. A sudden drop in a channel’s volume is often the first signal that business has migrated somewhere unmonitored. Treat capture completeness as a metric you watch continuously, the same way you would instrument any operational signal, not as a box ticked at procurement.

What an examiner actually asks for

The test is concrete and it is evidential. Show us the inventory of communication channels your staff use for business. Show us which of those channels feed the archive and which do not. For a named person over a named period, produce the complete set of their business communications, including collaboration-tool messages and mobile. Demonstrate that what you produced cannot have been edited after capture. Show us the surveillance that runs over it and what it flagged.

A firm that can answer those five is defensible. A firm with a good policy and a good email archive, and no answer for mobile or collaboration tools, is precisely the firm that appears in the orders. The distance between the two is not legal. It is the architecture that decides whether the record exists before anyone asks for it.

The penalties are large, but they are not the real exposure. The real exposure is that once a firm cannot produce the record, it has lost control of the narrative of its own conduct — and it paid to build the systems that were supposed to prevent exactly that.