On 27 September 2022 the SEC and CFTC announced settlements with 15 broker-dealers and one investment adviser totalling over $1.1bn, with individual SEC penalties ranging from $10M to $125M, for failing to preserve business communications conducted on personal messaging apps. What was the architectural failure, and what does it teach about capture obligations generally?

The situation they were in

Regulated firms must preserve business communications and produce them on request. Every one of these firms had an approved, archived channel and a policy requiring its use. The communications happened on WhatsApp, iMessage and Signal instead, on personal devices, including by senior staff.

The practical trigger was ordinary: the approved channel was less convenient. It was slower to reach a counterparty, unavailable on the device in someone's hand, or simply not where the conversation was already happening.

What the architecture got wrong

It placed the capture obligation on the person rather than on the channel. A policy is a request for compliance repeated indefinitely against a convenience gradient, and convenience wins in aggregate however well-intentioned the staff.

Three further design errors follow from it:

• No detection. Nothing in the estate could show that business conversation had moved elsewhere. Firms learned about the gap through enforcement, not through monitoring, which means the control had no feedback of any kind.
• Production impossibility. When records are requested, "we do not have them" is itself the violation. Capture failures are discovered at exactly the moment they are most expensive.
• Seniority inversion. The people most likely to have market-moving conversations are the least likely to accept friction, so the gap is largest where the risk is highest.

Why the penalties were the size they were

Not because a specific transaction was harmed. The records regime exists so that supervision is possible at all, and losing the records removes the regulator's ability to examine anything. That is why the sanction attaches to the failure to preserve rather than to any underlying misconduct, and why firms self-reporting and remediating were treated differently from those that did not.

What it teaches about capture generally

The rule that transfers to any capture obligation, financial or not: the compliant channel must be the most convenient one, or capture fails regardless of policy. Concretely:

• Make the approved channel genuinely better — on the devices people actually use, with the features they need, reaching the people they need to reach, including externally. This is product work and it is the intervention that works.
• Instrument the gap. Correlate deal activity with communication volume per person. A trader with material activity and almost no captured messages is the signal, and it is available without reading anyone's personal device.
• Attest and sample, because attestation alone is worth little, and sampling gives the attestation meaning.
• Provide a compliant path for the awkward case — a counterparty who will only use one app — rather than pretending it does not arise, since an unacknowledged exception becomes the norm.

Where copying it would be a mistake

Do not import this machinery where the obligation does not exist. Archiving all employee communication in an unregulated business creates a large, sensitive, discoverable corpus with its own privacy obligations and its own breach consequences, and it is a liability rather than a control. The scope of capture should match the scope of the obligation, which is a narrow set of roles and subject matter in most firms and everything in very few.

And do not read the case as an argument for banning applications. The bans were in place. The lesson is about the gradient, not the rule: a prohibition that makes the compliant path harder produces evasion rather than compliance, and the successful remediations were the ones that changed the tooling.

Common weak answers

• "Ban the apps and enforce it with mobile device management." Personal devices are outside the estate. The bans existed; the conversations moved anyway.
• "Add a policy attestation." Attestation without sampling measures willingness to sign a form. It was present in these firms too.
• "Archive everything." In an unregulated context this creates a sensitive, discoverable corpus with its own breach exposure, and in a regulated one it still misses the channels you do not control.