What are the SEC recordkeeping fines for off-channel business communications on personal phones?

The short answer

U.S. financial regulators — chiefly the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) — have imposed very large civil penalties on regulated firms for failing to preserve “off-channel” business communications. These are work-related messages sent through personal phones and consumer apps (such as personal text messaging and encrypted chat tools) that were never captured or retained on approved firm systems.

In a series of enforcement sweeps beginning in 2021, the SEC and CFTC reached settlements with many broker-dealers, investment advisers, and banks. Combined penalties across the industry have run into the billions of dollars, with individual firms commonly settling for tens of millions of dollars each. Because amounts vary widely by firm, conduct, and cooperation, treat any single figure as case-specific rather than a fixed schedule.

What rule is actually being broken

The fines are not about the personal phone itself. They stem from books-and-records and supervision obligations that require regulated firms to capture and preserve business communications regardless of the channel used. When employees discuss firm business on unmonitored personal devices, the firm cannot meet its retention, supervision, and production duties, which is the violation regulators charge.

Key drivers behind the penalties typically include:

• Recordkeeping failures — required business communications were not preserved.
• Supervision gaps — firms could not reasonably monitor employee communications.
• Production problems — missing records hampered regulatory investigations.

What this means for records and IG programs

The lesson is broadly applicable beyond finance. Any organization governed by retention rules should ensure that content, not channel, defines a record. Off-channel messaging creates undisclosed recordkeeping risk.

Practical safeguards include:

• A clear policy stating which channels are approved for business use.
• Capture and retention of messaging that qualifies as a record.
• Training and periodic attestations.
• Monitoring and enforcement, including consequences for circumventing approved tools.

For related guidance on governing texts, chats, and email as records, see the email and messaging topic hub.

Bottom line

There is no fixed “fine schedule” for personal-phone use. Penalties flow from the underlying duty to preserve and supervise business communications — and have been substantial because those records were lost.