The SEC's $81M Off-Channel Settlements: What the February 2024 Orders Found

Updated October 2026. First published February 2024.

On February 9, 2024, the SEC settled with 16 firms that hadn't kept their employees' business text messages. The penalties came to $81.25 million. The firms admitted the facts in their orders, agreed to cease-and-desist orders and censures, and agreed to hire independent compliance consultants.

The 16 firms belong to eight groups:

The broker-dealers violated Section 17(a) of the Exchange Act and Rule 17a-4(b)(4), which requires a broker-dealer to keep originals of the communications it receives and copies of the ones it sends relating to its business, for at least three years. The advisers violated Section 204 of the Advisers Act and Rule 204-2(a)(7). All of them were charged with failing to reasonably supervise.

Every Firm Had a Policy

The orders read alike, and the similarity is the useful part. Take Oppenheimer's. Employees were told that personal email, chats, and text apps weren't allowed for business. Messages on approved channels were monitored and archived. Everyone, supervisors included, had to sign an annual attestation that they'd complied. The order finds that Oppenheimer "failed to implement a system of follow-up and review" to see whether supervisors and employees followed the policy. Huntington's order says the same of Huntington.

Without that follow-up, the attestation was the whole control, and it didn't hold. The SEC staff's investigation, which began as a risk-based initiative in September 2021, found that nearly all of the Oppenheimer broker-dealer personnel it sampled had sent at least some off-channel messages. One senior executive exchanged business texts with at least 60 colleagues, more than a dozen of whom he supervised. At Huntington, a director exchanged off-channel messages on at least 68 occasions between January 2019 and March 2023, including with junior employees under their supervision.

The people breaking the policy were often the people meant to enforce it. Both orders say supervisors routinely used personal devices for business. Both firms also answered SEC subpoenas or records requests in other investigations while the texts went unkept. The orders say that likely kept records from the SEC.

Why Huntington Paid $1.25 Million

Huntington's penalty was the smallest by a wide margin. Its compliance staff found business messages on an unapproved platform on personal devices, ran an internal investigation, and contacted SEC staff in September 2023. It had started fixing the problem years earlier, and in 2021 it gave employees an approved texting app for their phones. Gurbir Grewal, then the SEC's Director of Enforcement, said the penalty "reflects its voluntary self-report and cooperation."

The self-report started with Huntington's own compliance staff noticing the messages. A firm that never looks for off-channel use has nothing to report and gets no credit for reporting it.

The Consultant's Review Is a Checklist You Can Use

The undertakings in the Oppenheimer and Huntington orders are the same. Each firm had to retain a compliance consultant within 30 days, and the consultant had 90 days from the engagement letter to review, among other things:

1. The policies for preserving electronic communications, including those on personal devices.
2. Training, including a quarterly written certification from personnel that they're complying.
3. The surveillance program that checks compliance on an ongoing basis.
4. The technology the firm has started using, how likely employees are to use it, and how the firm tracks whether they do.
5. The measures that prevent unapproved channels, such as restrictions on trading floors.
6. Whether approved channels on personal devices feed the firm's regular surveillance.
7. How the firm handled past violations: who broke the policy and why, what penalties followed, and whether discipline was consistent across business lines and seniority.

The consultant then had 45 days to send a written report to the firm and the SEC staff. The firm had 90 days from the report to adopt its recommendations or propose an alternative for any it considered unduly burdensome.

You don't need a consent order to run this review on yourself. Start with items 4 and 7. If far fewer people use your approved texting app than are licensed for it, the attestations aren't telling you much. If junior staff have been disciplined for off-channel texting and no managing director has, that's the pattern item 7 asks the consultant to find.

What Happened Next

Firms that settled in January 2025 got terms that earlier settlers considered lighter. Sixteen firms that had settled between September 2023 and September 2024, including Oppenheimer and Key from this group, then asked the SEC to swap the roughly two-year consultant process for a one-time internal audit and to drop two years of reporting on employee discipline. On April 14, 2025, the Commission denied the motions, with Commissioner Peirce dissenting. For what changed in off-channel enforcement after 2024, see our post on off-channel enforcement since 2024.

If your firm wants an outside look at how it captures and supervises messages, Loffa's Compliance Consulting Services includes a review of communication capture across email, text and chat apps, voice, and collaboration platforms.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.