In December 2021, JP Morgan
agreed to pay $200 million in fines for failing to monitor employee communications on unauthorized channels, primarily WhatsApp, SMS, and iMessage. Initially seen as a high-profile, isolated incident meant to set an example, it turned out to be the opening
salvo in a sweeping, industry-wide enforcement campaign.
By 2023, that $200 million spark ignited a $1.8 billion wildfire. The SEC and CFTC came
down hard on 16 major financial firms for similar violations, all tied to the same issue; the use of off-channel communications that violated federal recordkeeping laws.
Many firms felt blindsided. The penalties were severe, retroactive, and unprecedented. Rather than signaling a new start point for compliance expectations, the regulators looked backward. The messsage was clear: regulatory priorities may shift, but accountability
persists, and consequences can surface long after the fact.
The SEC’s Messaging Sweep Wasn’t Just About WhatsApp
While encrypted messaging apps stole the headlines, this investigation was about the unchecked normalization of informal communication in regulated environments, and the widespread failure to treat those exchanges as subject to compliance oversight. The
rules didn’t change, but the enforcement of them did.
For years, firms treated recordkeeping as a matter of emails and memos, dismissing chat apps and personal devices as outside the scope of ‘real’ business communication. The SEC took a different view. This was not an indictment of technology, but of behavior.
What many viewed as harmless workarounds were, in reality, a systemic breakdown, and a billion-dollar compliance blind spot hiding in plain sight.
The False Comfort of Deregulation
Between 2017 and 2020, the broader regulatory environment softened. There was a
palpable shift toward deregulation, from rollback proposals to relaxed oversight in finance and climate policies. Many firms interpreted this as a green light to ease up on compliance infrastructure. The SEC’s off-channel probe, which extended back to
this period, shows that was a costly miscalculation.
Periods of deregulation create a false sense of safety. Firms assume that if rules aren’t being actively enforced, they don’t need to be followed as rigorously. But history tells a different story – from the mortgage
crisis to the
Wells Fargo account scandal, relaxed oversight doesn’t remove accountability. It simply delays it. When regulators return, they don’t rewind expectations, they fast-forward consequences.
Backdated Fines are the Regulator’s Time Machine
Perhaps the most striking feature of the SEC’s messaging crackdown was how far back it reached. Many fines issued in 2023 targeted conduct dating back to 2018, years before the JPMorgan precedent had been set.
Backdated enforcement is not only legal, it’s strategic. It sends a powerful signal that regulators don’t need to catch you in the act. They can review logs, communications, and historical behavior to enforce longstanding rules, and they will.
Even under a new administration, the stance didn’t soften. In April 2025, 16 financial firms appealed to reduce their fines, hoping for a reprieve under a more lenient SEC. With Paul Atkins now Chair, they expected a rollback of Biden-era penalties. Instead, the
agency upheld them, emphasizing that mobile compliance isn’t a political issue, but a permanent regulatory priority.
What Smart Firms Are Doing Right Now
Forward-thinking firms didn’t wait for the $1.8 billion headline. For them, one warning was enough – they saw the 2021 JPMorgan fine and got to work. Here’s what they’re doing now:
- End-to-end capture: Deploying audit-ready systems that record all relevant communication, from emails to mobile messaging to emerging platforms like TikTok.
-
Future-proofing technology: Using quieter enforcement periods to upgrade systems, replace outdated tools, and invest in scalable, compliant communication solutions.
These firms know compliance isn’t just about risk avoidance, it’s about building sustainable business practices. Gambling on regulatory silence is a strategy that never pays.
Were the Fines Fair?
Many critics question the fairness of the penalties. Why did some firms pay more than double what others did for the same offense? Why weren’t all held to the same standard?
Valid questions, but ultimately, they miss the point.
Regulators aren’t running a fairness contest. They’re sending a message. Accountability is non-negotiable, and cooperation counts. Just as guilty pleas lead to reduced sentences in a court of law, the SEC has rewarded firms that held their hands up and acknowledged
their shortcomings.
Firms that engaged early, self-disclosed, or took meaningful steps to fix compliance gaps saw better outcomes. That’s not favoritism, it’s the playbook. It reflects the SEC’s broader strategy, to embed a culture of proactive compliance. This approach favors
the carrot over the stick, replacing fear with clarity and reinforcing the principles behind the rules.
The Deregulation Fallacy
A strong compliance strategy isn’t just about surviving current scrutiny, it’s about building long-term resilience and avoiding the high cost of short-sighted decisions. From JPMorgan’s initial retroactive penalty to the $1.8 billion fallout, all the way
through to the new SEC regime’s refusal to equalize off-channel fines, the pattern is clear: accountability doesn’t pause when enforcement does.
Informal communication, once dismissed as harmless, became a billion-dollar blind spot. But after several years of high-profile penalties, there are no excuses. And deregulation? It may relax the tone, but that’s when regulations are at their most dangerous.
It doesn’t erase the rules or the consequences of ignoring them. With retroactive penalties now standard, a change in leadership or a shift in regulatory priorities could trigger catastrophic consequences down the line.
