“Under the Wire” E-Comms Settlements:
More Confusion Than Closure

On January 13, 2025, the U.S. Securities and Exchange Commission announced settled enforcement actions with five registered investment advisers for failing to maintain and preserve internal electronic communications. These nine settlements (two settlements covered groups of affiliated advisers) represent an inflection point in the SEC Enforcement Division’s long-running effort to police retention practices for text, WhatsApp and other platforms that operate away from firm-maintained systems – so-called “off channel communications” – across the funds industry.

Background

In October 2022, financial media outlets reported that the SEC Enforcement Division had opened investigations into how large fund managers were handling electronic communications retention; these probes followed a first wave of enforcement settlements with large banks and broker-dealers for similar compliance failures under a number of specific requirements promulgated under the Securities Exchange Act. However, by February, 2023, this adviser-focused sweep was described in the media as a “mushrooming probe into Wall Street’s use of unofficial messaging platforms like WhatsApp[.]” 

On January 31, 2023, a coalition of ten trade associations wrote a joint letter to all five SEC commissioners and to the Directors of the Enforcement, Examinations, and Investment Management Divisions characterizing this investment adviser-focused initiative as a problematic effort to expand the fairly narrow retention obligations of the Investment Advisers Act’s “Recordkeeping Rule” (Rule 204-2) into a requirement to capture substantially all of an adviser’s and its personnel’s electronic communications, stating:

we are deeply concerned that the SEC is prepared to engage in rulemaking by enforcement with respect to the recordkeeping rule under the Advisers Act. The Administrative Procedure Act was designed precisely to prevent unilateral rulemaking of this nature and to allow for public participation in the rulemaking process[.]

Since that time, notwithstanding a number of somewhat idiosyncratic electronic communications-related enforcement settlements with investment advisers, the broader electronic communications enforcement effort focused on large fund managers remained both unresolved and out of the public eye. However, the settlements announced on January 13 with five global private fund managers have pushed this issue back into the spotlight. 

Findings and Violations

As is customary, these settlement orders contained a recitation of the relevant regulations, and examples of conduct that the SEC has determined violated those regulations. Four of the five advisers were alleged to have violated clause (i), and two of those four to have violated clause (iii), of Rule 204-2(a)(7), which require the retention of:

Originals of all written communications received, and copies of all written communications sent by such investment adviser relating to:

(i) Any recommendation made or proposed to be made and any advice given or proposed to be given [and] …

(iii) The placing or execution of any order to purchase or sell any security[.]

The various settlement orders cite a common fact pattern, which centers on an electronic communication on an unapproved communication platform (such as text messages, WhatsApp messages and LinkedIn messages) that directly relates to a proposed trade or investment. The breaches in question involved personnel at different levels of authority, including supervisors and senior managers, but it is worth noting that in all but one of the cited interactions, the communications were wholly internal to the adviser. 

The fifth adviser was found to have violated clauses (ii) and (iv) of Rule 204-2(a)(7) -- which require the retention of records relating to “any receipt, disbursement or delivery of funds or securities” or the “performance or rate of return of any or all managed accounts, portfolios …, or securities recommendations” -- by exchanging messages with an insurance company regarding the disbursement of funds related to a transaction and engaging in internal communications about the performance of an investment vehicle managed by that adviser.

The orders do not raise or imply, even for the one matter that involved external personnel, concerns about any substantive violation of the federal securities laws, such as the misuse of material, nonpublic information, market manipulation, or front-running. Rather, the Enforcement staff filtered what was undoubtedly a massive amount of material to present a narrowly tailored set of situations that were as close to the technical requirements of the Recordkeeping Rule as possible.

Settlement Terms

In one sense, the terms of these settlements were strict in that each of the settling advisers admitted to the facts described in the orders, acknowledged that the conduct violated the federal securities laws, and conceded the Commission’s jurisdiction over it and the subject matter of these proceedings. Each settlement order, relatedly, states that each of the advisers “willfully violated Section 204 of the Advisers Act and Rule 204-2(a)(7) thereunder” and “failed reasonably to supervise its personnel[.]”

However, the sanctions under these orders contained notable differences to prior settlements in this area, including the various penalties assessed by the SEC upon the larger broker-dealers and banks over the past three years:

• Monetary penalties ranged from $8.5 to $11 million for each of the settling parties. While the orders do not shed any light on the basis for these calculations, when compared to the earlier waves of other settlements, it is reasonable to assume that these amounts represented a very small fraction of the amounts that the SEC would have sought in litigation.
• Remedial actions are required on the process, training, and technological sides, but may be undertaken and certified by an internal audit function. This is a significant difference from earlier orders that involved the imposition of an independent compliance monitor on the settling parties, which entails significant additional resource expenditures.
• Cease and desist orders with fairly conventional formulations.

Perhaps most importantly, none of the advisers will be deemed “bad actors” under Rule 506(d), which allows their sponsored funds to continue to engage in private placements under Rule 506(b) and (c) and enjoy the related NSMIA state law preemption. 

Impact and Implications

Normally, these kinds of group announcements are line-drawing exercises intended to clearly identify violative conduct and to warn of continued, vigorous enforcement against such conduct. However, this situation perhaps raises more questions than answers.

In assessing the impact of these settlements, fund managers should consider the following open points:

1. The Recordkeeping Rule has existed (in various iterations) for over half a century, and the SEC’s current position on its coverage differs from the historical understanding. It has never imposed a blanket retention requirement on (as was the case before the invention of email) every scrap of paper utilized in the day-to-day operation of an adviser’s business; furthermore, no court has found that the rule extends to all or substantially all “business related” communications involving an adviser’s personnel.
2. Relatedly, litigation with the remaining subjects of Enforcement’s initiative is still a possibility. The SEC has not fared well in high-stakes litigation over the past few years, and there are numerous managers still caught in the investigation that may want to bring the fight to the SEC in this post-Chevron, post-National Association of Fund Managers environment.
3. Finally, the SEC will have a new (acting) Chair in just a few days, and presumably a new permanent Chair in a matter of weeks. While it is difficult to predict positions, priorities, and outcomes, the next Director of Enforcement may have different thoughts on whether these actions are worth an investment of time and resources.

Notwithstanding this uncertainty, legal and compliance personnel should not allow these macro-level strategic considerations to distract them from their day-to-day compliance tasks. Most advisers currently prohibit communications outside of the adviser-provided business email, so it is still critical to attempt to ensure that these compliance policies are complied with. Surveillance, certifications, training, and technological alternatives are all important tools that a manager can deploy to show how it “says what it does and does what it says” in the near to medium term. To the extent that the goalposts move on this issue as a substantive manner in the coming months and years, policies and procedures can be reconsidered at that time.