The SEC fines 11 Wall Street firms $289M total for poor recordkeeping by using apps including Signal, WhatsApp, and iMessage; CFTC fines four banks $260M total
Context & Ripple Effects
This action extends an enforcement arc that began with JPMorgan’s penalties over unapproved employee messaging and then widened into a broader examination of financial-firm communications controls.
The prior round of SEC and CFTC penalties against 16 firms showed that the issue was not confined to one institution; this follow-on action reinforces that unauthorized-channel recordkeeping failures remain an active regulatory target.
First-order effects
- The 11 firms face $289 million in SEC penalties, while four banks face $260 million from the CFTC, raising the immediate cost of failing to preserve business communications.
- The actions put renewed pressure on regulated firms to enforce approved-channel and record-retention policies across Signal, WhatsApp, iMessage, and similar tools.
Second-order effects
- Other banks and brokerages are likely to review employee communications controls, since the enforcement pattern has moved from an initial bank case to repeated multi-firm actions.
- Compliance teams and communications-archiving providers gain urgency as firms need policies that cover the channels employees actually use, rather than relying on formal rules alone.
Third-order effects
- If the pattern continues, communications retention will become a more embedded operational requirement for regulated financial firms, with personal and encrypted messaging creating a persistent control boundary.
- Repeated SEC-CFTC coordination suggests recordkeeping enforcement can remain a sector-wide deterrent rather than a one-off response to individual institutions.
The trend: Financial regulators are steadily turning the use of off-channel workplace messaging into a recurring, industry-wide compliance and enforcement issue.