Key Takeaways
- HSBC Securities (USA) Inc. (HSBC) and Scotia Capital (USA) Inc. (Scotia Capital) paid a combined $37.5 million in fines to settle actions with the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) for violations arising from the firms’ failure to maintain and preserve employees’ business-related communications on personal devices.
- These enforcement actions follow years of increased regulator focus on employee use of personal devices as well as recent policy revisions by the Department of Justice (DOJ) concerning employees’ use of third-party messaging apps on personal devices.
- Employers should ensure that they maintain and consistently update policies and compliance procedures regarding record retention and the use of personal devices as regulators and prosecutors continue to focus on off-channel communications.
Background
The SEC and CFTC settlements with HSBC and Scotia Capital come after years of federal regulators’ and prosecutors’ steadily increasing scrutiny of off-channel communications. Anchoring these settlements are long-standing books and records requirements of the SEC and the CFTC regulating the maintenance and preservation of documents. Specifically, Section 17(a)(1) of the Securities Exchange Act of 1934 (the Exchange Act) authorizes the SEC to issue rules requiring broker-dealers to maintain and preserve records as necessary or appropriate in the public interest. The SEC adopted Rule 17a-4 pursuant to this authority, which, among other things, requires that broker-dealers preserve all communications received and all communications sent relating to the firm’s business.[1] Similarly, the Commodity Exchange Act (the CEA) requires registrants to “keep books and records of all activities related to its business as a swap dealer.”[2] Registrants are also required to “keep full, complete, and systemic records” of all swap activities, including “[r]ecords of each transaction.”[3]
[1] Exchange Act Rule 17a-4(b)(4), 17 C.F.R. § 240.17a-4(b)(4).
[2] CEA Section 4s(f)(1)(C), 7 U.S.C. 6s(f)(1)(C).
[3] Regulation 23.201(a).