The SEC's off-channel communications sweep, running from December 2021 through 2024, settled with more than two dozen firms for over $2 billion combined, per the agency's orders and releases — all for the same violation family: business communications on personal texting and chat apps that never reached the firm's books-and-records systems, in breach of Exchange Act Rule 17a-4's retention requirements. The enforcement intensity has cycled with administrations; the rule it enforced is the same sentence it was in 1997, and every supervised institution still owns the gap between how its people actually talk and what its archive can produce.
3G Times publishes information, not legal advice; supervision and records questions are firm-specific and belong with counsel.
What does the rule actually require?
Rule 17a-4 requires broker-dealers to preserve specified categories of communications — order tickets, memoranda of business, correspondence relating to the business — in a non-rewriteable, non-erasable format, retrievable for the retention period, with an index the staff can navigate. The rule predates smartphones and never named a channel: a text about a trade is a record because of its subject, not its app. The sweep's fact pattern was uniform: policies prohibited personal-channel business talk, employees did it anyway, and when examinations requested communications the firms certified completeness on archives the business had partly routed around. The violation was not the policy's absence — policies existed everywhere — but the supervision and retention failure the routing exposed.
Why did the settlements cluster the way they did?
Because the discovery mechanism scaled: one examination's production gap became a questionnaire to the industry, and firms' answers sorted them into settlement tiers — self-reporters with remediation on the favorable end, and firms whose first production contradicted their certifications on the other. The penalties tracked cooperation and recurrence, and the orders consistently required retention-program undertakings: channel capture deployed, discipline enforced, certifications rebuilt on honest foundations. The CFTC ran its parallel sweep for futures registrants with the same arithmetic. Read together, the orders describe a market that had quietly accepted a two-phone fiction — compliance channel for auditable traffic, personal phones for the real conversation — and a regulator that priced the fiction.
| Program element | Sweep-era expectation | Where it still fails |
|---|---|---|
| Channel inventory | Named, approved channels with capture | Shadow apps on personal devices |
| Capture coverage | Approved channels archived to 17a-4 format | Gaps for senior staff and contractors |
| Policy honesty | Written prohibitions match practice | Policies nobody enforces on revenue staff |
| Supervision | Reviews that sample off-channel risk | Reviews of the archive only |
| Attestations | Certifications on verified completeness | Certifying beyond what the archive proves |
What does a program that holds look like?
It starts where the failures started: approved channels people will actually use, with capture that does not degrade the experience enough to drive evasion — the retention architecture that loses to convenience loses. Senior staff carry the heaviest weight, because their texts are the records examiners request first; the programs that survived scrutiny applied the same capture to the executives the policy nominally bound. Supervision reviews sample the seams — channels newly installed, messages deleted, contacts crossing client lines — rather than re-reading the compliant archive. Attestations are rebuilt on verification: completeness claims traceable to the capture systems' coverage, not to employee promises. And discipline, applied at least once to a consequential case, converts the policy from paper to fact; the settlements repeatedly cited firms whose written discipline had never touched a producer.
How has the landscape moved since the sweep?
Two directions at once. Enforcement appetite is cyclical — the Commission's priorities have shifted across administrations — but the production requests have not stopped, because examinations ask for communications as a matter of course, and the gap between the archive and reality is discovered in the asking. Meanwhile the channel stack multiplied: collaboration platforms, meeting chat, and now AI-mediated drafting and messaging each create a new records surface (the same drift the ambient-note-taker governance addresses). Firms that treated the sweep's undertakings as a one-time remediation are re-meeting the gap on new channels; firms that institutionalized the channel inventory — a standing list, capture verified per channel, reviewed quarterly — absorbed each new surface as it arrived.
What does this mean in practice?
- Institutionalize the channel inventory. Every messaging surface employees can use for business, with capture status — the document that answers "where else might they talk" before an examiner asks it.
- Capture the top of the house identically. Executive carve-outs were the sweep's most expensive pattern; symmetry is cheaper than the settlement.
- Make attestation mean verification. Certify completeness from system coverage, and say in the certification what was verified and how.
- Extend the pattern forward. Meeting assistants and AI messaging inherit the same duty; onboarding a channel now includes onboarding its record.
The sweep's billion-dollar lesson was procedural: records law does not grade intentions, it grades retrievability. The firms that internalized that — capture real enough to be used, supervision honest enough to look where the gaps are — spend their regulatory capital elsewhere, which is where it earns more.
The examiner's opening ask anchors the whole cycle, so its mechanics deserve rehearsal: the request defines scope by custodian, channel, and period, and the completeness reconciliation — inventory against coverage — is the response's first exhibit. Programs that keep the reconciliation current answer in days; programs that build it under deadline discover that their channel inventory was a snapshot of a world that has since installed three new messaging apps.
How do AI-drafted messages change the picture?
They extend it: a message generated by a tool and sent through an approved channel is a record like any other, but the drafting layer adds artifacts — prompts, source documents, version history — that completeness analyses and privilege reviews may need. Programs that inventory the drafting surface alongside the channel surface keep the certification ahead of the tooling rather than behind it.
Frequently asked questions
The training design matters as much as the policy text: the sweep's fact patterns were rarely conspiracies — they were habits, formed when a client texted a number and the reply felt like relationship management. Programs that train on the redirect — the two taps that move the conversation to a captured channel — convert compliance from an abstraction into a reflex, and the redirect habit is the single control most correlated with clean productions.
Are personal devices banned?
The rule bans unretained business records, not hardware. Firms land anywhere from approved apps on personal devices with capture, through corporate-owned devices, to strict prohibition — all compliant if the record actually lands in the archive and supervision matches reality.
Does this apply to investment advisers as well as broker-dealers?
The sweep's core was Rule 17a-4 for broker-dealers, and the Commission applied the advisers' books-and-records rule (204-2) to registered advisers in parallel actions. The duties rhyme; both regimes grade retrievability.
The vendor dimension deserves its own line: capture platforms consolidate, and the archive's custody can move with a contract. Retention duties outlive vendor relationships, so the escrow, export, and format-migration clauses in capture agreements are records-compliance terms, not procurement boilerplate — the archive that cannot outlive its vendor cannot satisfy a six-year clock.
What should an examiner request trigger?
A completeness check before the certification: reconcile the requested population against the channel inventory, verify capture coverage for the period, and document the reconciliation — the two-page artifact that separates a production from an admission.
For more context, read The E-SIGN Act and Digital Account Opening: What Constitutes Valid Consumer Consent.
For more context, read ecoa adverse action notices ai.
For more context, read regulation e error resolution.