Kevin Harnisch: SEC off-channel focus moving from sweeps to exams; Finra still scrutinizes

Off-channel communications cases will increasingly surface in routine SEC examinations rather than broad regulatory sweeps, Kevin Harnisch of Norton Rose Fulbright told Financial Advisor Magazine. Harnisch is a partner and co-head of regulation, investigations, securities and compliance at the firm and a former SEC Enforcement Division branch chief. His advice to broker-dealers and registered investment advisers: do not mistake a quieter SEC under Chair Paul Atkins for a lighter compliance burden.

The question is no longer simply whether a firm has a WhatsApp, text or WeChat problem, he said, but whether its business model creates communications risks that regulators expect it to understand, monitor and control. He described three settings where that risk concentrates: a broker-dealer with clients or counterparties overseas, where WhatsApp or WeChat may be routine; a younger U.S. client base that prefers texting to email; and a registered representative who answers an inbound message on a personal device because the client expects an answer.

A firm that discovers substantive off-channel communications must investigate and remediate, Harnisch said, possibly with better training, surveillance or technology. He characterized the situations above as practical failures rather than deliberate attempts to evade regulation. Doing nothing creates the bigger problem: a regulator that sees repeated violations, particularly after the firm knew about them, may stop viewing the issue as an isolated bad actor and start questioning the effectiveness of the compliance program and its tone at the top.

Finra continues to scrutinize communications and recordkeeping, and Harnisch sees a potential divergence between the regulators. The SEC may be more inclined to connect off-channel communications to investor harm, market harm, concealment or other misconduct, while Finra can bring cases focused more directly on communications failures.

For a practice, the consequence is that communications risk gets assessed against the client base itself. Harnisch's framing suggests the compliance record needs to reflect which kind of book a firm runs, since an overseas clientele that lives on WhatsApp starts from a different place than a texting-heavy younger one. The remediation question follows from that: better training, surveillance or technology, chosen to fit the risk the business actually creates.