JPMorgan has admitted to widespread failures in keeping track of its employees’ communications via personal devices and accounts and agreed to pay $200 million in penalties to the Securities and Exchange Commission and the Commodity Futures Trading Commission.

From at least January 2018 through November 2020, employees at the company’s broker-dealer, JPMorgan Securities, often discussed “securities business matters” using their personal devices, via text messages, WhatsApp and personal email accounts, according to an SEC order published on Friday. The company failed to preserve any of these communications, as is required by securities laws, the SEC says.

Moreover, many of the staff engaging in such communications were “supervisors, including managing directors and other senior supervisors – the very people responsible for implementing and ensuring compliance with [JPMorgan Securities]’s policies and procedures,” according to the order.

The SEC also says that the company frequently failed to conduct searches of relevant records on its employees’ personal devices when the SEC requested or subpoenaed the company for documents “in numerous investigations” into the matter during the period in question. The firm admitted that it thereby “deprived the SEC staff of timely access to evidence and potential sources of information for extended periods of time and in some instances permanently,” according to the regulator.

The SEC censured JPMorgan and ordered it to cease and desist from further violations and to pay a $125 million penalty.

Unlike in many multimillion-dollar fines imposed by the SEC, JPMorgan admitted to the regulator’s findings, according to the order.

The SEC has also made it clear that it’s going after other firms in the industry for similar recordkeeping violations.

“As a result of the findings in this investigation, the SEC has commenced additional investigations of record preservation practices at financial firms,” the regulator said, adding that companies that believe their practices aren’t in compliance should get in touch.

In a parallel action, the CFTC, meanwhile, ordered the firm to cease and desist, take remedial steps and pay a $75 million civil monetary penalty, according to the regulator.

In the CFTC case — in which JPMorgan also admitted the findings — the use of personal text messages and WhatsApp, among other “unapproved channels,” went back to at least July 2015.

Do you have a news tip you’d like to share with FA-IQ? Email us at