FINRA Fines H2C Securities $250K Over Unarchived Messages

Updated October 2026. First published August 2024. The first version gave the wrong period (January 2014 to September 2018). FINRA's order covers at least January 2013 to June 2021.

On March 29, 2024, FINRA accepted a Letter of Acceptance, Waiver, and Consent from H2C Securities Inc. (AWC No. 2021070970501). The firm agreed to a censure, a $250,000 fine, and an undertaking to certify its fixes, without admitting or denying the findings.

H2C is an Atlanta firm, a FINRA member since 1976, with 33 registered representatives and four branch offices. It provides investment banking and strategic advisory services to institutional investors. From at least January 2013 to June 2021, FINRA found, it failed to preserve and review more than 1.25 million business-related electronic communications. All of them went through four platforms that H2C itself had made available to its people, and none of the four was connected to its archive.

FINRA cited Section 17(a) of the Exchange Act, Exchange Act Rule 17a-4, FINRA Rules 3110, 4511, and 2010, and NASD Rule 3010, which FINRA Rule 3110 replaced on December 1, 2014.

What the Order Says Went Wrong

The 1.25 million items included internal and external emails, instant messages, mass marketing materials, and documents customers had to sign electronically. Most were mass marketing emails sent to large distribution lists.

The firm's written supervisory procedures didn't mention the four platforms. According to the order, they failed to identify three things:

That associated persons had access to the platforms.
When associated persons could use them for electronic communications.
How the firm would preserve and review what was sent through them.

H2C didn't review its system for preserving communications on those platforms until March 2021. That compliance review found the gap: there were no data feeds from the four platforms to the system the firm used to store electronic communications. On April 6, 2021, H2C filed a disclosure under FINRA Rule 4530, which is where FINRA's case began. The firm stopped using three of the platforms in April 2021 and connected the fourth to its archive in July 2021.

Most of the messages were gone. H2C retrieved and reviewed some, but it couldn't recover most of them. For many of the mass marketing emails it had kept at least one copy, but the order says it "did not preserve a copy of each message sent to each recipient."

The undertaking is specific. Within 60 days of the notice of acceptance, a member of senior management who is a registered principal had to certify in writing that the firm had fixed the issues and put in place a supervisory system, with written procedures, reasonably designed to comply with Rule 17a-4 and FINRA Rules 3110 and 4511. The certification had to include a narrative and supporting exhibits, and FINRA staff could ask for more evidence.

The Two Rules a Missing Feed Breaks

Rule 17a-4(b)(4) requires a broker-dealer to keep originals of all communications it receives and copies of all communications it sends relating to its business as such. It has to keep them at least three years, the first two in an easily accessible place. Under Rule 17a-4(f)(2)(i), the electronic system that holds them must either keep a time-stamped audit trail of every change and deletion or store the records in a non-rewriteable, non-erasable format. Our Rule 17a-4 page covers both options.

FINRA Rule 3110(b)(4) requires procedures for reviewing incoming and outgoing written correspondence, including electronic correspondence, and internal communications relating to the firm's investment banking or securities business.

A platform with no feed to the archive fails both rules at once. The archive can't preserve what it never receives, and reviewers working from the archive never see it. At H2C, that gap ran for more than eight years.

The SEC's off-channel cases were about business messages on what the agency called "unapproved communication methods". H2C's four platforms were tools the firm itself provided. Our post on off-channel communications after 2024 covers the SEC cases.

What to Check at Your Firm

H2C's facts make a good audit script. If you supervise electronic communications, these are the questions the order raises:

Do you have a current list of every system your people can use to send or receive a business message? Count the ones nobody thinks of as messaging. Two of H2C's categories were mass marketing and documents sent for customer e-signature.
For each system on the list, is there a live feed to the archive, and when did someone last test it? Send a test message through each one and pull it back out of the archive. H2C ran no such review of these platforms until March 2021.
Do your written supervisory procedures name each platform, say who may use it and for what, and say how its messages are captured and reviewed? Those are the three gaps the order lists.
For mass emails, does the archive hold each message as sent to each recipient? One saved copy of a mass email wasn't enough for FINRA here.
Does a new tool go live before compliance confirms capture? Make that sign-off a step in your vendor onboarding, with a date and a name on it.

Operations platforms belong on the list too. Letters of Free Funds and prime brokerage forms are business communications, and some firms send them through vendor systems. Freefunds Verified Direct (FVD), for example, keeps each letter request and response in write-once storage for eight years. Your firm's Rule 17a-4 obligation for those messages still stays with your firm, so the platform belongs in your procedures like any other.

Finding the gap yourself didn't end the case. H2C found it in March 2021, filed its Rule 4530 disclosure in April, shut off three platforms, and connected the fourth by July. It still agreed to a censure, a $250,000 fine, and a signed certification from senior management.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.