Off-channel communications: what the SEC cases mean for small firms

“Off-channel” is the SEC's word for business messages sent on a channel the firm does not capture: a personal phone's texts, WhatsApp, a personal email account. The charge in these cases was never the texting itself. It was that the messages were records the firm had to keep, and the firm did not keep them. The first group release, in September 2022, put it plainly: “the firms' employees routinely communicated about business matters using text messaging applications on their personal devices.”

The releases read for this guide add a second charge to the record one. In the January 2025 release, “the firms were also each charged with failing to reasonably supervise their personnel with a view to preventing and detecting those violations.” Each firm was ordered to cease and desist and was censured, and in the early groups the firms “agreed to retain compliance consultants” to review their policies on “the retention of electronic communications found on personal devices”.

Most of the named firms are large banks, brokerages and fund managers. The rules they broke are the same ones a three-person adviser works under, and at least one order, read closely below, concerns a single adviser based in Newburgh, New York. The SEC's own running count, published in April 2026, came with a change of stance that any reader of these numbers needs beside them.

Release 2026-34 is the SEC's report on its fiscal year 2025 enforcement results. It groups the off-channel actions with two other sets of cases brought under the prior Commission and says they show “a misinterpretation of the federal securities laws, a misallocation of Commission resources, and a bias for volume of cases brought versus matters of investor protection.” The Chairman's statement in the same release names where the effort goes now: “the types of misconduct that inflict the greatest harm—particularly fraud, market manipulation, and abuses of trust”.

That is a real change in tone, and a small firm should not pretend otherwise. It is also a statement about enforcement, not a rule change. The release does not amend Rule 204-2 or Rule 17a-4, and both still name the communications a firm keeps in the eCFR text current in October 2026. FINRA's Rule 3110 still requires a registered principal to review correspondence and internal communications. And both rules still oblige a firm to hand its records over: a broker-dealer “must furnish promptly to a representative of the Commission legible, true, complete, and current copies of those records”, and an adviser must “provide promptly” a “legible, true, and complete copy of the record in the medium and format in which it is stored”. A message the firm never captured cannot be produced, whatever the enforcement climate.

The same release also notes that in fiscal year 2025 some firms “self-reported violations, co-operated meaningfully with the Division’s investigations, and/or remediated”, and received reduced penalties or no recommended action. What the Commission will do with a recordkeeping gap it finds today, the release does not say. Read the full text on sec.gov, and take your own firm's position to your compliance counsel. Where the record duty comes from in detail is in our guide to Rule 204-2.

Two rules sit under every off-channel order: Rule 204-2 for an SEC-registered adviser and Rule 17a-4 for a broker-dealer. Neither names an app. Both name a record, and a record is kept whatever device it was typed on. The broker-dealer rule is the wider of the two.

The adviser rule reaches written communications on four subjects: any recommendation or advice, any receipt, disbursement or delivery of funds or securities, the placing or execution of any order, and performance. That is narrower than “all communications … relating to its business as such”, but in an advisory firm almost every message to a client touches one of the four. A text confirming a rebalance is about an order; a reply to “how are we doing this year?” touches performance.

Two cautions. Rule 17a-4(b) gives a length and an accessible window but does not say what event the three years run from, so do not let a vendor's default setting decide it for you; ask your counsel and write the answer into the policy. And an adviser is not required to buy WORM storage: the audit-trail-or-WORM test is a broker-dealer condition in 17a-4(f), explained in SEC Rule 17a-4 and WORM storage. A firm registered both ways should read Rule 204-2(h)(1), which treats a record kept under 17a-4 that is “substantially the same” as the adviser record as kept in compliance, and settle with counsel how the two periods apply. Our retention calculator runs the dates for either side.

For a broker-dealer, keeping the message is half the duty. FINRA Rule 3110(b)(4) requires review of “incoming and outgoing written (including electronic) correspondence and internal communications”, and the evidence must name the reviewer, the item, the date and any action taken. How that works in a small member firm is set out in our guide to FINRA Rule 3110.

The group releases are mostly about large firms. The order that reads most like a small firm's file is one of the twelve in the September 2024 release: Focused Wealth Management, an adviser based in Newburgh, New York and registered with the SEC since November 2010. Its facts are the ones a five-person office meets, and the order is short enough to read in full on sec.gov.

Three lessons come out of it. First, a carve-out by topic does not hold. A policy that lets people text clients about anything except business assumes each person stops at the line, every time, and nothing records it when they do not. Second, a ban is not a control. The firm prohibited personal email, but with no way to see it, the prohibition was never implemented. The order's Rule 206(4)-7 finding rests on exactly that: policies not reasonably designed for staff texts, and a ban the firm did not implement. Third, the firm's eventual fix is ordinary: name the approved channels, give people a firm phone or a captured app, and require that anything sent elsewhere is copied into the firm's system. The compliance-program side of that is covered in Rule 206(4)-7.

Read the releases together and the same six facts come back. None of them needs a large firm to happen.

The auto-delete point deserves its own line in any small firm's policy: check the message-retention setting on every app the firm allows, on every phone that carries business. In that case three senior people with deletion switched on were enough. The release that described it is 2024-44.

Card 02

Neither rule hands you a policy template. For an adviser, Rule 206(4)-7 requires written policies “reasonably designed to prevent violation” of the Act and its rules, which includes the record rule; for a broker-dealer, Rule 3110 requires written procedures it must “establish, maintain, and enforce”. What the orders show is the shape a messaging policy needs. The nine clauses below are our reading of the rule text and the orders, with the source of each named on the right.

Our off-channel communications policy builder drafts these clauses from your own answers (firm type, approved channels, devices and archive) and cites the rule beside each one. Review the draft with your compliance counsel before you adopt it.

The archive behind the policy

A policy that approves a channel the firm cannot capture repeats the order above. So the archive decides the approved list, not the other way round. Ask any vendor four things in writing: which channels it captures as sent and received, including texts on a personal phone; how retention is set and who can change it; how a message and its review record are exported when an examiner asks; and, for a broker-dealer, whether its storage keeps a time-stamped audit trail or non-rewriteable, non-erasable copies under 17a-4(f), and what it signs for the undertakings that rule requires. Our archiving requirements matcher lists what each channel needs.

Start with texting: it runs through the releases from 2022 on. Apps a rep can text clients from while every message is kept and supervised are compared in FINRA-compliant texting; carrier, app and device capture for the texts people already send is in text message archiving software; and capture for WhatsApp and iMessage is in WhatsApp and iMessage archiving. Email capture is covered in email archiving software.

Most firms that look will find something: a client who only texts, a rep who answered on WhatsApp from holiday. What to do next is a legal decision as much as a compliance one, and this page is not legal advice. The order of work is still clear.

1. 01Close the gap firstMove the conversation to an approved channel and switch off any auto-delete setting on the phones involved.
2. 02Keep what existsDo not let anyone delete the messages. Collect them as your counsel directs.
3. 03Map itWhich people, which channels, which dates, and whether the messages touch the subjects the record rule names.
4. 04Take it to counsel before deciding anything about reportingThe releases credited self-reporting: three firms in 2024-98 paid “significantly lower civil penalties”, and Qatalyst Partners in 2024-144 “will not pay a penalty”. Whether that applies to you is counsel’s call.
5. 05Fix the policy and keep the record of the fixA broker-dealer amends its procedures “promptly” under FINRA 3110(b)(7); an adviser keeps the records of its annual review under 204-2(a)(17)(ii).

This guide explains the rules and the SEC's published releases; it is not legal advice, and nothing on it promises compliance. Check your own policy with your compliance counsel.