.svg)
J.P. Morgan has agreed to pay a steep $125m fine to the U.S. Securities and Exchange Commission (SEC) for failing to keep records of WhatsApp messages that included securities business communications.
The fine is a "warning shot across the bow" to the financial industry, according to Bob Browne, CEO of Cedar Creek Consulting.
The SEC found that, between January 2018 and November 2020, J.P. Morgan employees communicated both internally and externally about securities business matters on their personal devices, using text messages, WhatsApp and personal email accounts.
During this period, the bank was contacted by the SEC seeking documents and voluntary submissions in numerous investigations.
In responding to these subpoenas and requests, J.P. Morgan did not search for information contained on the personal devices of its employees and had no knowledge whatsoever of when and which text messages were deleted.
According to the SEC, the bank “deprived the SEC staff of timely access to evidence and potential sources of information for extended periods of time and in some instances permanently” and “meaningfully impacted the SEC’s ability to investigate potential violations of the federal securities laws.”
J.P. Morgan was aware that employees firm-wide communicated this way. Even managing directors and other senior supervisors, those who should have been responsible for implementing and ensuring compliance, used personal channels to discuss sensitive information.
As technology evolves and usage increases on various platforms, financial institutions will need to become "more draconian" as to whether and to which extent they allow their employees and other parties to use different platforms to communicate, Browne told VIXIO. Otherwise, they will need to intrude on the privacy of employees and others on their use of alternative communication options.
At the moment, the SEC case means that publicly traded companies must understand it is their liability to monitor and be able to report on communications across all channels. But in the future, the same will be required from private companies as well, Browne noted.
In addition to the $125m penalty, J.P. Morgan agreed to hire a compliance consultant to, among other things, conduct a comprehensive review of its policies and procedures relating to the retention of electronic communications found on personal devices and the bank’s framework for addressing non-compliance by its employees with those policies and procedures.
“As technology changes, it’s even more important that registrants ensure that their communications are appropriately recorded and are not conducted outside of official channels in order to avoid market oversight,” said SEC chair Gary Gensler.
“Books-and-records obligations help the SEC conduct its important examinations and enforcement work. They build trust in our system. Ultimately, everybody should play by the same rules, and today’s charges signal that we will continue to hold market participants accountable for violating our time-tested recordkeeping requirements,” Gensler added.
In light of the findings in this investigation, the SEC announced that it had started additional investigations into recordkeeping practices at financial firms.
