SEC Sanctions Broker-Dealer Whose Recordkeeping Vendor Deleted Required Records Due to Incorrect Retention Settings
[35357]
June 26, 2023
TO: Chief Compliance Officer CommitteeOperations Committee
Technology Committee
Transfer Agent Advisory Committee RE: SEC Sanctions Broker-Dealer Whose Recordkeeping Vendor Deleted Required Records Due to Incorrect Retention Settings
Last week, the SEC announced that it has settled an enforcement proceeding against a broker-dealer that failed to maintain approximately 47 million electronic communications created from January through April 2018 that were in about 8700 electronic mailboxes.[1] The failure to retain these required records resulted from the default retentions settings at the Respondent's recordkeeping vendor being incorrectly set. The facts of this action are briefly summarized below. To resolve it, the Respondent was censured, ordered to cease and desist from further violations, and fined $4 million.[2] In imposing these penalties, while the Respondent neither admitted nor denied the violations, the SEC found that it had willfully violated the recordkeeping requirements of the Securities Exchange Act of 1934 (the "1934 Act").
The Respondent's Violations
According to the Order, in 2016, the Respondent undertook a project to clean out its system by deleting communications and documents that were no longer required to be retained under the recordkeeping requirements of the 1934 Act. Apparently, there were glitches with this project and the firm discovered that the documents to be deleted were not, in fact, being deleted. In troubleshooting this issue, the Respondent's employees deleted electronic communications from the first quarter of 2018, "erroneously believing, based on written representations from the [Respondent's] archiving vendor, that all the documents were coded in a way to prevent permanent deletion of records still within the thirty-six month regulatory retention period required" by the 1934 Act.[3] In fact, however, the vendor did not apply the applicable default retention settings and those communications—which included required records—were permanently deleted. The Order notes that "the vendor periodically represented to [the Respondent], and separately to FINRA, that its media storage complied [with the requirements of the 1934 Act] including that a default retention period of thirty-six months was applied to all electronic communications—and thus that documents within this thirty-six month window could not be permanently deleted."[4]
It was not until October 2019 that the Respondent discovered that the required electronic communications had been deleted because the vendor had improperly coded the default retention period for the records. It was at this time that the Respondent also discovered that the records were unrecoverable. In response to this deletion, the Respondent implemented its own thirty-six month retention coding and updated its procedures to both prohibit deletion of required electronic communications and obtain approval from a senior level information officer prior to deleting any records.
The firm reported the deletion of the records in January 2020.[5]
Tamara K. Salmon
Associate General Counsel
Notes
[1] See In the Matter of J.P. Morgan Securities, LLC, Administrative Proceeding File No. 3-21502 (June 22, 2023) (the "Order"), which is available at https://www.sec.gov/litigation/admin/2023/34-97787.pdf.
[2] Interestingly, the Respondent was not required to agree to any undertakings to settle this matter.
[3] Order at ¶ 2. The Order also notes that, in at least twelve civil securities-relate regulatory investigations, the Respondent had received subpoenas and document requests for communications that could not be retrieved due to this deletion.
[4] Order at ¶ 5.
[5] The action the SEC filed against the Respondent in December 2021 for its failure to maintain "off-channel" electronic communications involved activities occurring from January 2018 through November 2020. See https://www.sec.gov/litigation/admin/2021/34-93807.pdf.