Answer (2026): The SEC's off-channel communications sweep collected more than $2 billion from over 100 firms between December 2021 and January 2025, then ended. The current SEC leadership has redirected enforcement toward fraud, and FINRA now surfaces off-channel violations through routine cycle exams instead of headline sweeps. The recordkeeping rules themselves have not changed: firms must still retain business communications about advice, and a prohibition policy with no working record behind it does not satisfy them.
Context: Written for advisors, compliance officers, and firm principals deciding how to handle client texting and coordination in 2026. This page is educational, not legal advice; policy decisions belong with your compliance counsel.
Action: Compare your current approach against the three options at the end of this page, then see how X1's advisor platform keeps client coordination inside a signed, exportable record instead of scattered across channels you have to chase. For the broader picture of how X1 sits alongside your existing tools, the advisor client onboarding checklist and the advisor fee and fiduciary guide cover adjacent decisions.
Last reviewed: July 18, 2026.
This page is likely relevant if two or more of these are true:
- Client business regularly happens over text, personal email, or a messaging app.
- Your written policy prohibits channels your team still uses in practice.
- You could not produce a complete record of a given client's communications for an arbitrary date range today.
- The number that matters: the SEC's own FY2024 results release states the initiative brought "charges against more than 100 firms and over $2 billion in penalties" since December 2021.
- The January 2025 wave (12 firms, $63.1 million) was the last of the sweep. Under the current leadership the SEC has brought no comparable off-channel actions since.
- Watch the SEC-only figures. Headline totals like "$549 million" or "$1.8 billion" for a single wave combine SEC penalties with parallel CFTC penalties against the same banks. This page cites the SEC amounts.
- Advisers Act Rule 204-2, Exchange Act Rule 17a-4, and FINRA Rules 4511 and 3110 are unchanged. The enforcement posture moved; the obligations did not.
- Banning channels does not create records, and capturing a hundred channels is evidence the work leaks. The third option is coordinating inside a system that is a record by construction.
All amounts below are the SEC penalties stated in the cited press releases. Where the press was reported with a larger number, the difference is a parallel CFTC penalty against the same firms; the sources are linked at the end.
| When | Action (SEC release) | SEC penalty |
|---|
| December 17, 2021 | J.P. Morgan Securities admits widespread recordkeeping failures (2021-262) | $125 million |
| September 27, 2022 | 16 firms charged in the first broad wave (2022-174) | $1.1 billion combined |
| August 8, 2023 | 11 firms charged (2023-149) | $289 million combined |
| FY2024 | Multiple waves: 16 firms (2024-18), 26 firms (2024-98), 11 firms (2024-144), and others; over 70 firms for the year | over $600 million (FY2024) |
| January 13, 2025 | Final wave: 12 firms (nine investment advisers, three broker-dealers), including Blackstone Real Estate Advisors ($12M), KKR ($11M), Charles Schwab ($10M) (2025-6) | $63.1 million combined |
| 2025 | Velox Clearing and an executive sanctioned after 10,000+ business messages ran through WeChat off-channel and went unretained; the orders cited anti-money-laundering and suspicious-activity-reporting failures the off-channel conduct enabled | $1.3 million (FINRA, firm) + $500,000 (SEC) |
| January 2026 | Benjamin F. Edwards & Co. settles a FINRA action for failing to supervise and preserve business text messages; representatives sent and received at least 3,560 business texts through unapproved apps on personal devices between October 2019 and December 2023 | $750,000 (FINRA) |
Cumulative, in the SEC's own words: its FY2024 enforcement results state the off-channel initiative "has resulted in charges against more than 100 firms and over $2 billion in penalties" since December 2021. You will also see "$2.3 billion" (a later tally of about 95 actions since FY2022) and higher combined figures that add parallel CFTC penalties.
Two things happened that most compliance content has not caught up with.
First, the SEC walked away from the sweep. Its FY2025 enforcement results (released in fiscal 2025-2026) redirected resources toward fraud, market manipulation, and abuses of trust, and away from what the current leadership framed as approaches that prioritized volume and record-setting penalties over investor protection. Commissioners Peirce and Uyeda, dissenting from a late off-channel action, wrote that "it does not appear that firms have an achievable path to compliance." No comparable off-channel actions have followed.
Second, off-channel conduct keeps producing sanctions without the headline sweeps. In January 2026 FINRA fined Benjamin F. Edwards & Co. $750,000 for the plain version of the problem: representatives ran at least 3,560 business texts, including customer investment directives, through unapproved apps, and the firm could neither supervise nor preserve them. The 2025 Velox Clearing case made the same point through anti-money-laundering and suspicious-activity findings the off-channel WeChat traffic enabled. The exam cadence, not the sweep, is the risk now. A firm that treats the end of the sweep as the end of the obligation is confusing the enforcer with the rule.
The legal text is old; its practical meaning for systems is specific.
- Advisers Act Rule 204-2 requires investment advisers to keep written communications relating to advice, recommendations, and transactions, generally for five years. In software terms: business communications about client advice need to land somewhere retained and retrievable, whatever app they started in.
- Exchange Act Rule 17a-4 governs broker-dealer records. Since the 2023 amendments it accepts either write-once storage or an audit-trail alternative: a system that can reproduce a complete, unaltered record of changes. In software terms: append-only storage with a provable history qualifies; editable chat logs do not.
- FINRA Rules 4511 and 3110 require retention plus supervision: the firm has to be able to review its people's business communications. A channel the firm cannot see is a channel the firm cannot supervise.
The uncomfortable implication, stated plainly in most enforcement actions: a written policy banning texting, with no mechanism behind it, does not satisfy the recordkeeping obligation. The messages still happened. The records still do not exist.
Ban the channels. Prohibit texting and personal email for client business. Industry survey data shows channel bans rising sharply, and it is also the approach regulators have repeatedly found insufficient on its own, because the work moves to wherever the client is and the ban produces no record of what leaked.
Capture the channels. Archive texts, messaging apps, and email through a capture vendor, then surveil the archive. This is the incumbent model, and for channels that genuinely must stay open it is the required control. Its limit is structural: an archive is a copy of a conversation that already happened outside governance, collected after the fact, and every additional captured channel adds another place client business is happening that the firm has to chase.
Give the work a governed home. Move the coordination itself, the advisor, the client, and the client's CPA or attorney working a real question, into a system where the conversation is the record: messages that cannot be silently edited or deleted, exports that are signed and independently verifiable, and a date-ranged production path a compliance officer can run on request. Then capture only what still happens outside it. This shrinks the off-channel surface instead of photographing it. It also changes what a client handoff looks like: instead of a reconstructed email trail, the advisor packet and meeting prep draw from a record that already exists.
X1 takes the third approach for advisor-client coordination: threads are append-only at the database level, exports are hash-chained and signed so an examiner can verify completeness offline, and a firm's advisors can produce their coordination record for any date range. X1 does not replace a firm's archive for email and text that still occur elsewhere, and it does not make policy decisions for you. It removes the reason most of that traffic exists.
Score any system, current or proposed, against these. A "no" on any of the first four is the gap an examiner tends to reach for.
- Records cannot be altered or deleted after the fact. Corrections are added as new entries, not written over the old ones.
- The firm can produce a complete record for an arbitrary date range in minutes, without stitching together a reconstructed trail.
- Completeness can be proven, not just asserted. A signature, a hash, or an equivalent an examiner can check independently.
- Supervisors can review the business communications in the channel, not only the person who sent them.
- The record survives the vendor relationship ending, and the firm keeps its own copy in a portable format.
- Using it shrinks the number of channels where client business happens, rather than adding one more surface to capture.
- For the firm or compliance officer: pull your current written supervision procedure and check whether it names a working record for every channel your advisors actually use, or only prohibits the ones you wish they did not.
- For the advisor: list where client business actually happened this month (text, personal email, a scheduling app, a portal) and mark which of those the firm could produce on request.
- For evaluating any governed channel: run one real coordination thread end to end in the system you are considering, export it, and verify the export. If you cannot produce a complete, unalterable record for a date range in minutes, the exam version of that request will not go better.
Is the off-channel enforcement era over?
The sweep is over; the obligation is not. FINRA continues to bring off-channel cases through routine exams, and the SEC's own report criticized the sweep's targeting, not the recordkeeping rules.
Do the rules apply to small RIAs or only large broker-dealers?
Rule 204-2 applies to registered investment advisers regardless of size. The sweep concentrated on large firms; the exam-driven cases since 2025 have included small firms and individuals.
Does a no-texting policy protect the firm?
Not by itself. Enforcement actions repeatedly involved firms with written prohibitions their people ignored. A policy with no record behind it documents the intention, not the communications.
What should we ask any communications vendor?
Whether records can be altered after the fact, how completeness is proven to an examiner, what the firm can produce for an arbitrary date range and how fast, and what happens to the records if the vendor relationship ends.
What counts as an off-channel communication?
Any business communication sent or received on a channel the firm does not capture, supervise, and retain: personal texts, personal email, and messaging apps like WhatsApp, WeChat, Signal, or Slack when they carry firm business. The channel being personal is not the issue; the business content on an uncaptured channel is.
How long do firms have to retain business communications?
Registered investment advisers generally keep written communications about advice for five years under Advisers Act Rule 204-2, the first two in an easily accessible place. Broker-dealers retain under Exchange Act Rule 17a-4, commonly three years for many records and longer for some, with the earliest readily accessible. The content, not the app, determines what must be kept.
Do the rules cover personal texts or only business messages?
The content determines coverage. A message about a client's account, a recommendation, or a transaction is a business record wherever it was sent, and a personal device is not a safe harbor when firm business happens on it.
This page is maintained as enforcement actions land. If a figure here looks out of date, the "Last reviewed" date above tells you when it was checked.
Every dollar figure and firm count above is drawn from the primary release cited here.
- SEC Press Release 2021-262: JPMorgan admits recordkeeping failures, $125M (December 17, 2021)
- SEC Press Release 2022-174: 16 firms, widespread recordkeeping failures, $1.1B (September 27, 2022)
- SEC Press Release 2023-149: 11 firms, $289M (August 8, 2023)
- SEC Press Release 2024-18: 16 firms, more than $81M
- SEC Press Release 2024-98: 26 firms, more than $390M
- SEC Press Release 2024-144: 11 firms, more than $88M
- SEC Press Release 2024-186: FY2024 enforcement results, "more than 100 firms and over $2 billion" since December 2021
- SEC Press Release 2025-6: 12 firms, $63.1M (January 13, 2025)
- SEC Press Release 2026-34: FY2025 enforcement results
- Harvard Law Forum: SEC Enforcement FY2025 Results Signal Shift in Priorities
- ThinkAdvisor: FINRA Sanctions Clearing Firm Exec for Sending Thousands of WeChat Messages (Velox Clearing, 2025)
- ThinkAdvisor: FINRA Fines BD $750K Over Texting (Benjamin F. Edwards, January 2026)
- FINRA Regulatory Notice 17-18: guidance on digital communications and recordkeeping
- FINRA 2026 Annual Regulatory Oversight Report: Books and Records
