Lawyer Breaks Down SEC's Sweep of Advisors' Texts

As the Securities and Exchange Commission continues its sweep of advisors’ off-channel communications, including text messages, more firms can expect to “receive targeted inquiries regarding record retention” from the agency, according to Hayley Trahan-Liptak, partner in K&L Gates’ Boston office.

Off-channel communications are an SEC exam priority for 2023. The Financial Industry Regulatory Authority‘s biggest fine category last year was books and records, in which offenses included failure to supervise the use and preservation of business-related emails and texts.

Industry trade groups have told SEC Chairman Gary Gensler that the sweep exceeds the agency’s authority because, according to news reports, the SEC has asked each of the investment advisors “involved in the sweep to have the personal phones of several employees imaged and reviewed, and that the SEC seeks evidence of any off-channel business communication, regardless of its nature.”

We caught up with Trahan-Liptak after she spoke on a recent webcast, “‘Off-Channel’ Communications: Managing Risks as SEC & DOJ Scrutinize Personal-Device Use and Recordkeeping,” about the SEC’s sweep — and whether it’s legal — as well as what advisors and broker-dealers can do to prepare for heightened pressure from regulators.

THINKADVISOR: Is the SEC within its legal authority to monitor these off-channel communications — which includes advisors’ texts?

TRAHAN-LIPTAK: It is important to note that the SEC is not technically monitoring off-channel communication — it’s instead requiring that firms retain business communications.

The SEC’s authority to enforce business communication retention is derived from Section 17(a)(1) of the [Securities Exchange Act of 1934] and Section 204 of the [Investment Advisers Act of 1940].

These provisions permit the SEC to issue rules requiring, respectively, broker-dealers and investment advisors to make and keep for prescribed periods, and furnish copies of, certain records necessary to protect investors. Rule 17a-4 and Rule 204-2 were adopted pursuant to this authority. Given this authority, it follows that the SEC expects firms to develop policies and procedures that comport with the rules.

However, we do believe regulators are aware of — and will respect to a certain extent — competing employee interests and applicable employment laws.

While the SEC has not directly commented on these issues, the Department of Justice touched upon them in its March 3, 2023, guidance in which it identified what prosecutors should consider when evaluating a corporation’s policies and mechanisms for retaining off-channel business-related communication.

Specifically, the DOJ noted that record retention policies “should be tailored to the corporation’s risk profile and specific business needs” to ensure that, “to the greatest extent possible, business-related” communication is preserved. The DOJ further advised prosecutors to consider:

The relevant code of conduct, privacy, security, and employment laws or policies that govern the organization’s ability to ensure security or monitor/access business-related communications; and
Whether the organization’s policies permit the company to review business communications on “bring your own device policy” and/or messaging applications.

Still, regulators will certainly expect (and make sure) that business-related communication is retained. Firms will therefore need to ensure that off-channel business-related communication is retained “to the greatest extent possible” in light of applicable employment law and related policies.

On the webcast, you mentioned that the SEC has not specifically defined “business-related” regarding off-channel communications. Can you give more details on what “business-related” means, exactly? Do you see the SEC issuing more guidance on this, or will it take a proposed rulemaking?

It is important to look first at the relevant recordkeeping rules that support the SEC’s recent focus on off-channel communication.

Rule 17a-4 applies to communications relating to [a broker-dealer’s] “business as such.”

Rule 204-2 is a bit more specific, requiring preservation of an investment advisor’s communications relating to “advice given or proposed,” “receipt, disbursement, or delivery of funds or securities,” the “placing or execution of any order to purchase or sell” or “predecessor performance.”

The SEC has interpreted these rules broadly — most recently calling out communication related to a firm’s investment or business strategy, discussions of client meetings, and communications about market color, analysis, activity trends or events.

Without offering a definition, the SEC has deemed these communications “related to the business” of broker-dealers and registered investment advisors.

This broad definition increases the SEC’s flexibility in future enforcement actions, allowing the SEC to analyze communication on a case-by-case basis to determine whether it falls within the applicable rules. This flexibility suggests it is unlikely the SEC will issue formal guidance on the definition of “business related” and will continue to rely on the broad interpretation of the existing rules.