The above penalties indicate a considerable uptick in recent record retention violations. Regulators are focused on ensuring that firms are retaining and monitoring business communications, including any business-related texts and chat applications on personal devices.

As the pandemic and other factors accelerated the use of electronic communications in the workforce, it’s critical that companies make an effort to keep up with advancing technology and the new messaging, audio, and video applications.

Record retention fines go beyond emails now. They're also being handed out for collaboration applications, including chat systems, audio, ephemeral messages, videoconferencing platforms with features like polls, virtual whiteboards, file transfers and tools like animated gifs and reactions. The regulatory message is clear when it comes to electronic communications – firms must ensure their recordkeeping and supervision processes and controls are keeping pace.

FINRA has issued guidance on several topics related to electronic communications. FINRA’s advertising regulation FAQ advised that even a virtual whiteboard presented in an online meeting will in some cases need to be retained and archived as a "communication." Whether a communication should be retained does not depend on the device or platform used but rather on the content and context.

“Firms need to be actively thinking about and addressing the many compliance issues raised by the increased use of personal devices, new communications channels, and other technological developments like ephemeral apps,” says Gurbir S. Grewal, Director of the Division of Enforcement at the SEC.

Many companies have banned the use of messaging applications such as texting, messaging, social media or collaboration applications for business-related communications. In particular, ephemeral messaging applications (e.g., Telegram, WhatsApp, Snapchat) that automatically delete messages after a certain period has passed can prevent businesses from properly preserving the communication and lead to regulatory compliance problems.

The above enforcement cases are examples of prohibition policies failing to work. Even if the firms prohibit the use of messaging applications, firms cannot ignore their employees' use of prohibited platforms.

Companies are required to monitor for compliance to mitigate the risk of recordkeeping violations. Firms must develop and maintain policies and procedures reasonably designed to prevent and detect violations of employees working for them.

There is no way of predicting which conversations will be relevant, and firms must be prepared for regulatory inquiries. That calls for implementing versatile supervision and surveillance tools that automatically capture and archive electronic communications data, while allowing compliance officers to search for crucial conversations in their proper context.