Wall Street to pay $1.8bn in fines over traders’ use of banned messaging apps

The firms include brokerage units of Bank of America Corp., Barclays PLC, Citigroup Inc., Credit Suisse Group AG, Deutsche Bank AG, Goldman Sachs Group Inc., Morgan Stanley, UBS Group AG and Nomura Holdings Inc. Brokerage firms Jefferies LLC and Cantor Fitzgerald & Co. also settled the claims with the Securities and Exchange Commission and the Commodity Futures Trading Commission.

The fines, which many of the banks had already disclosed to shareholders, underscore the market regulators’ stern approach to civil enforcement. Fines of $200 million, which many of the banks will pay under the agreements, have typically been seen only in fraud cases or investigations that alleged harm to investors.

But the SEC, in particular, has during the Biden administration pushed for fines that are higher than precedents, saying it wants to levy fines that punish wrongdoing and effectively deter future potential harm. The SEC’s focus on record-keeping is likely to be extended next to money managers, who also have a duty to maintain written communications related to investment advice.

Last month, the SEC alleged that hedge-fund manager Deccan Value Investors LP and its chief investment officer failed to maintain messages sent over Apple iMessage and WhatsApp. In some cases, the chief investment officer directed an officer of the company to delete their text messages, the SEC said. The claims were included in a broader enforcement action, which Deccan settled without admitting or denying wrongdoing.

The Wall Street Journal reported last month that the settlements announced Tuesday were likely to top $1 billion and would be announced before the end of September.

Eight of the largest entities, including Goldman Sachs and Morgan Stanley, agreed to pay $125 million to the SEC and at least $75 million to the CFTC. Jefferies will pay a total of $80 million to the two market regulators, and Nomura agreed to pay $100 million. Cantor agreed to pay $16 million.

The SEC said it found “pervasive off-channel communications." In some cases, supervisors at the banks were aware of and even encouraged employees to use unauthorized messaging apps instead of communicating over company email or other approved platforms.

“Today’s actions—both in terms of the firms involved and the size of the penalties ordered—underscore the importance of recordkeeping requirements: they’re sacrosanct. If there are allegations of wrongdoing or misconduct, we must be able to examine a firm’s books and records to determine what happened," said SEC Enforcement Director Gurbir Grewal.

Bank of America, which faced the highest fine from the CFTC, had a “widespread and long-standing use of unapproved methods to engage in business-related communications," according to the CFTC’s settlement order. One trader wrote in a 2020 message to a colleague: “We use WhatsApp all the time, but we delete convos regularly," according to the CFTC.

One head of a trading desk at Bank of America told subordinates to delete messages from their personal devices and to communicate through the encrypted messaging app Signal, the CFTC said. The head of that trading desk resigned this year, although the bank was aware of his conduct in 2021, the CFTC said.

At Nomura, one trader deleted messages on his personal device in 2019 after being told the CFTC wanted them for an investigation, the agency said. The trader made false statements to the CFTC about his compliance with the records request, the regulator said.

Broker-dealers have to follow strict record-keeping rules intended to ensure regulators can access documents for oversight purposes. The firms settling with the SEC and CFTC admitted their employees’ conduct violated those regulations.

JPMorgan Chase & Co.’s brokerage arm was the first to settle with the two market regulators over its failure to maintain required electronic records. JPMorgan paid $200 million last year and admitted some employees used WhatsApp and other messaging tools to do business, which also broke the bank’s own policies.

Regulators discovered that some JPMorgan communications, which should have been turned over for separate enforcement investigations, weren’t collected because they were sent on employees’ personal devices or apps that the bank didn’t supervise.