The SEC must release parts of more than 50 spreadsheets showing just how it arrived at billions of dollars of penalties over firms’ failures to track business messages sent using WhatsApp and other “off channel” messaging services.
Processing Content
So ordered Judge Steven Merryday of the U.S. District in Tampa, Florida, late last week in a lawsuit initially brought in 2024 by the American Securities Association. The ASA, a lobbying and advocacy group for the brokerage industry, filed its suit after being met with rejection in various attempts to obtain information directly from the Securities and Exchange Commission on how it had calculated fines imposed on firms in a series of settlements over so-called off-channel communications.
The ASA argued in its suit that it had a right under the federal Freedom of Information Act to learn just how the SEC had gone about setting the penalty amounts. The SEC responded by arguing that information was shielded from public release by protections applying to deliberations about new rules and work done by government attorneys.
In a strongly worded footnote in his order, Merryday wrote that the SEC’s position “appears to countenance duplicity, gamesmanship, neglect, insouciance, or worse from an agency of the United States and denies a party forced to undergo the agency’s administrative process the benefit of orderly, disciplined, accountable, and forthcoming participation by the United States.”
READ MORE: With enforcement actions plummeting, is the SEC losing its regulatory zeal?
Merryday ordered that SEC must release records related to the $2 billion in penalties it imposed on firms for off-channel violations, including “the final penalty amounts, the entities penalized, and the attendant data considered..” The only information it can keep private is deliberations on settlement agreements never made final. The order says the SEC has roughly 52 spreadsheets that will have to be released, likely with some redactions.
The SEC declined to comment on the order. ASA President and CEO Chris Iacovella, in a blog post applauding Merryday’s order, said he was glad the judge recognized “the SEC playing fast and loose with information that should have been made available to the public.”
“The government used its vast power to disproportionately impose billions of dollars in fines on registered entities for administrative violations and then refused to disclose how those fines were calculated,” Iacovella wrote.
The SEC’s penalty tally for firms it has reached settlement deals with over alleged violations of its off-channel communications rules easily exceeds $2 billion. (The Commodity Futures Trading Commission has separately imposed more than $1 billion in fines on its own.) In general, regulators have accused firms, including most of the big names on Wall Street, of not doing enough to keep employees from discussing business-related matters using encrypted messages and other means that can’t be easily tracked and preserved.
The SEC and other regulators have argued that a lack of such records can impede their ability to investigate instances of alleged fraud and other crimes. For some of the key milestones in the SEC’s crackdown, scroll down.
READ MORE: Lawsuit seeks logic behind SEC fines in WhatsApp cases
JPMorgan kicks things off with a $200M fine
The SEC sent a message to the financial services industry in late 2021 when it hit JPMorgan with a $125 million penalty, accompanied by a $75 million CFTC penalty, over alleged off-channel violations.
Regulators found that employees including “managing directors and other senior supervisors” had shrugged off surveillance duties by using messaging services such as WhatsApp or personal email to discuss business matters with colleagues and clients. JPMorgan was quick to take corrective measures, in part by insisting on the use of company-approved devices and communications channels.
It was far from the last firm, though, to fall under regulators’ hammer.
READ MORE: JPMorgan bosses addicted to WhatsApp fuel $200 million in fines
Goldman Sachs, Morgan Stanley, Bank of America, others get their turn
The SEC and CFTC moved the following year on to other Wall Street mainstays, reaching $1.8 billion in settlements with Goldman Sachs, Morgan Stanley, Bank of America, UBS and other firms. Subsequent sweeps hit Wells Fargo and BNP Paribas, which were part of a group ordered to pay $289 million in 2023, and Northwestern Mutual, Oppenheimer and Cambridge Investment Research, which were among 16 firms ordered to pay $81 million in early 2024.
Later off-channel cases led to nearly $393 million in penalties for 26 firms including Ameriprise, Edward Jones, LPL Financial, Raymond James, BNY Pershing and RBC Capital Markets; and $63.1 million for Charles Schwab, Blackstone, KKR and other firms in early 2025.
That last group of settlements hasn’t been followed up by any others. After President Donald Trump took office in January 2025, regulators have stepped away from bringing “penalty only” enforcement cases that involve no particular victim. Firms and groups like the ASA, meanwhile, have been calling into question some of the SEC’s previous settlements.
The ASA filed its lawsuit in June 2024. Several months after that, Republican commissioners on the SEC expressed concerns amid another round of off-channel settlements that even firms that had made earnest attempts at abiding by the rules were being hit with penalties.
With the arrival of a new regulatory order under Trump, some of the firms that reached settlements with the SEC before this year also submitted a petition asking for modifications to their deals. The SEC rejected that appeal, in part noting that all the firms that reached settlements had done so voluntarily.
“The Respondents negotiated and made a choice to accept the terms of their orders, accepting the risk that comparable cases later could reach different outcomes,” the SEC wrote.
