A Catalyst: Statement On Qatalyst Partners LP, SEC Commissioner Hester M. Peirce, SEC Commissioner Mark T. Uyeda, Sept. 24, 2024

Over the last several years, off-channel communications cases have become more prevalent on the Commission’s enforcement docket. We have struggled with these cases. While we supported many of them initially, it was not without deep reservations. Recently, we have objected to the penalties and undertakings in most of these cases. Today’s case against Qatalyst Partners LP[1] illustrates and confirms the reason for our reservations: it does not appear that firms have an achievable path to compliance. Accordingly, we voted no on Qatalyst Partners LP, and urge our colleagues to reconsider our current approach to the off-channel communications issue.

Recordkeeping by regulated entities is important. The Commission needs to be able to enforce its rules. To do that, it needs access to records about firms’ activities. Firms that are serious about complying with our rules also need access to records about their business activities. If business is being conducted using communications means that are outside of the reach of firm compliance personnel and Commission staff, both will be hampered in their ability to foster compliance with the rules. The off-channel communications cases arise from a legitimate concern that the compliance efforts both of firm compliance personnel and of Commission staff are impeded by improper recordkeeping practices. As the Commission’s Order in the first of these cases stated:

The federal securities laws impose recordkeeping requirements on broker-dealers to ensure that they responsibly discharge their crucial role in our markets. The Commission has long said that compliance with these requirements is essential to investor protection and the Commission’s efforts to further its mandate of protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation.[2]

That first case involved a “widespread failure to implement” recordkeeping policies that “was not hidden within the firm,” “was firm-wide, and involved employees at all levels of authority,” and “impacted the Commission’s ability to carry out its regulatory functions and investigate potential violations of the federal securities laws across these investigations.”

Many other cases have followed. The use of off-channel communications—text messages, smartphone chat applications like WhatsApp, and personal email outside firm-approved systems—is prevalent across the securities industry. We have an industry-wide problem that we will not solve through enforcement.

Today’s action against Qatalyst illustrates why we cannot enforce our way to compliance. Under the standard applied in this case, even well-intentioned firms could find themselves in the Commission’s enforcement queue time and again. Qatalyst has been working to address the off-channel issue for at least sixteen years. The Commission’s Order outlines some of the firm’s efforts:

As early as 2008, Qatalyst personnel were advised that the use of unapproved electronic communications methods, including on their personal devices, was not permitted, and they should not use personal email, chats or text messaging applications for business purposes, or forward work-related communications to unapproved applications on their personal devices. Qatalyst reinforced its policies at least annually with regular, mandatory training and reinforcement from compliance and senior management. Qatalyst personnel were specifically advised not to list personal phone numbers in email signatures.

Then, “beginning in March 2017, Qatalyst provided its personnel with a compliant text-messaging process that could retain business communications” and “instructed its personnel to use only this process to communicate about Qatalyst’s broker-dealer business by text message.” “Beginning in 2020, Qatalyst required all personnel to have a firm-issued device on which to conduct Qatalyst business, and encouraged personnel to use firm-issued devices when communicating with both business and personal contacts.” Further updates to capture Slack and LinkedIn messages came in 2020 and 2022. Qatalyst trained its employees, monitored communications sent through firm-approved communication methods, and disciplined employees who violated the firm’s policies. Even with all that, Qatalyst violated the recordkeeping requirements: “Qatalyst collected data from a sampling of broker-dealer personnel and found that . . . several broker-dealer personnel, including at senior levels, had engaged in off-channel communications that concerned the broker-dealer’s business as such.” At the end of the day, despite Qatalyst’s compliance efforts, the Commission’s order states that:

Qatalyst . . . failed to implement a system reasonably expected to determine whether all personnel, including supervisors, were following Qatalyst’s policies and procedures. While permitting personnel to use approved communications methods, including on personal phones, for business communications, Qatalyst failed to implement sufficient monitoring to ensure that its recordkeeping and communications policies and procedures were always being followed.” (Emphasis added.)

This statement sounds to us like one that equates reasonableness with perfection. If we assess reasonableness based on whether policies and procedures always are being followed, firms will never escape our enforcement net. People are not perfect and so compliance will not be perfect—even at a firm that tries as hard as Qatalyst. Firing up our enforcement machinery every couple years to haul the industry in for headline-making penalties will not make people perfect, so firms will continue to discover violations of firm policies. We cannot enforce to perfection, but there is a way to achieve better compliance.

This case should serve as a catalyst for the Commission. We need to work with the industry and other interested members of the public to develop a pragmatic and privacy-respecting approach that enables firms and the Commission to have the records they need for compliance, examination, and enforcement at a reasonable cost in both financial and privacy terms. As we have this conversation, we ought to bear several points in mind:

• The existing recordkeeping rules are a product of simpler times. The ways in which people communicate have multiplied, and the percentage of communications that are written has risen so firms have more avenues to monitor. Paper documents have given way to e-mail, which has given way to text messages, which have given way to app-based chats. This technological progression poses unique challenges and opportunities in terms of recordkeeping.
  • How can we modernize the recordkeeping rules to deal with the recordkeeping challenges of the new technology and accompanying shifts in the communication habits of people?  How do we identify and take advantage of aspects of these changes that facilitate recordkeeping?
• Oral conversations that would not have been captured by recordkeeping rules in the past are now written conversations that are captured. One needs only observe a couple teenagers sitting in a room together who are texting one another rather than talking to each other to realize that texts have taken the place of what would have been oral communications in the past. This shift of communication from verbal to written intensified during the pandemic when colleagues that used to sit next to one another retreated to their own homes.
  • Should we revisit the recordkeeping rules so that they do not capture the modern-day equivalent of oral chatter?
• Client service imperatives drive how firms communicate with their clients. A client of an investment adviser who is also her neighbor wants to be able to send her a WhatsApp message when she needs advice on her investment portfolio, just as she does when she wants advice on her garden. Firms have made a lot of progress on developing tools that allow their employees to capture the business-related messages for recordkeeping purposes.
  • How can we help firms as they think about seamless ways to accommodate client communication preferences and still meet recordkeeping obligations?
  • Issuing firm phones is an expensive option. What are best practices for firms that do not have the budget to issue phones or whose employees prefer not to have a work phone?
• Firms and their employees have questions about what types of communications are covered by the rules. Certain messages are clearly covered by the rules, but others are not so clear. The lack of clarity stems in part—but not entirely—from the different scope of the recordkeeping rules for various types of firms.[3]
  • What can the Commission do to provide clarity on the requirements under the existing rules?
  • Is the scope of the current rules appropriate?
  • Once we settle on the scope, how can firms effectively train their employees about what needs to be preserved for recordkeeping purposes?
• Ensuring that employees abide by firm policies implicates privacy concerns. A firm can write excellent policies and procedures that prohibit the use of off-channel communications but ensuring that everybody complies with them is difficult. We see this in enforcement cases like Qatalyst, where the firm had a great set of policies and procedures, but some employees did not comply. Any firm surveillance system has to achieve record retention without subjecting employees’ personal means of communication to constant surveillance. Doing so is offensive to employees’ privacy and may have legal implications in some jurisdictions. Firms have developed ways, such as monitoring on-channel communications for indications that other communications are happening off-channel and only then looking at employees’ personal phones and emails. Firms also have disciplined employees found to be in violation of the policies, which sends a message that such conduct is not tolerated.
  • What are best practices for training employees and ensuring compliance with off-channel communications policies and procedures?
  • What are best practices for monitoring compliance with off-channel communication prohibitions?
  • How do the securities recordkeeping rules interact with other laws, such as employment or privacy laws?
• Input from compliance personnel is essential. To develop workable, effective policies, we need to hear from the people who write, implement, and oversee these policies. This issue would be a perfect one to put in front of a Chief Compliance Officer Advisory committee. Compliance personnel understand the importance of maintaining good records, the difficulty of doing so, and have real-world experience in weighing the sometimes-conflicting interests of firms, clients, and employees.
  • What would an effective Chief Compliance Officer Advisory Committee look like?

The issues laid out above are only a few of the many that deserve discussion outside of the enforcement context. We look forward to working with our colleagues at the Commission and interested members of the public on a more productive path forward.