The era of blockbuster SEC off-channel enforcement actions may be fading.
The compliance risk is not.
That is the message from Kevin J. Harnisch, partner and co-head of regulation, investigations, securities and compliance at Norton Rose Fulbright and a former SEC Enforcement Division branch chief.
Harnisch’s advice to broker-dealers and registered investment advisors is blunt: Do not mistake a quieter SEC for a lighter compliance burden.
The key is where regulators are looking, he said.
Under SEC Chair Paul Atkins, the SEC appears to be taking a more risk-based, investor-protection-focused approach to electronic communications, he said. Harnisch, for example, expects off-channel communications to increasingly surface as part of routine examinations rather than as broad regulatory sweeps.
That means the question is no longer simply whether a firm has a WhatsApp, text or WeChat problem. It is whether the firm’s business model creates communications risks that regulators expect it to understand, monitor and control.
Consider a broker-dealer with clients or counterparties overseas. WhatsApp or WeChat may be routine there. A younger U.S. client base may prefer texting to email. A registered representative may receive an innocent inbound message on a personal device and respond simply because the client expects an answer.
Then the conversation grows.
Harnisch said those situations are often practical failures rather than deliberate attempts to evade regulation. That distinction matters, he said, as does what happens next.
A firm that discovers substantive off-channel communications has a compliance decision to make, Harnisch said. It must investigate. It must remediate. It may need better training, surveillance or technology.
Doing nothing can create the bigger problem.
A regulator that sees repeated violations—particularly after the firm knew about them—may stop viewing the issue as an isolated bad actor and start questioning the effectiveness of the firm’s compliance program and its tone at the top, he said.
This is where Finra enters the picture.
While the SEC’s appetite for sweeping off-channel cases may have cooled, Finra continues to scrutinize communications and recordkeeping. Harnisch sees a potential divergence between the regulators: The SEC may be more inclined to connect off-channel communications to investor harm, market harm, concealment or other misconduct. Finra, meanwhile, can bring cases focused more directly on communications failures.
For firms, that distinction has a practical consequence.
Off-channel compliance is no longer a standalone project. It is part of the examination process and examiners are looking at the entire architecture, he said.
Policies and procedures matter. Training matters. Surveillance matters. Fact-gathering matters. So does the firm’s ability to demonstrate that substantive communications are being captured in approved systems.
Harnisch recommends periodic risk assessments, preferably at least annually. Better yet, he said, firms should bring in fresh eyes. An outside perspective can reveal gaps that become invisible when a compliance program runs on autopilot.
That same principle applies to the next regulatory frontier: generative AI.
AI is moving quickly through wealth management. Firms want the efficiency and competitive advantage. Regulators are trying to keep pace.
That creates opportunity. It also creates peril, Harnisch said.
What prompts are being entered? What interactions need to be preserved? How are AI-generated communications being supervised? What happens when an AI agent operates with greater autonomy? How do cybersecurity and data-protection obligations fit into the picture?
These are not theoretical questions for the distant future. They are becoming examination questions, he noted.
And they sit alongside Regulation Best Interest, cybersecurity and data protection as areas squarely within the SEC’s investor-protection mission.
The lesson for financial advisors and compliance leaders is simple: The enforcement spotlight may have moved. The obligation did not.
The smartest firms will not measure their communications program by the number of headlines regulators generate. They will measure it by whether they can walk into an examination and demonstrate that they understand their risks, have controls designed around those risks, monitor those controls and act when something breaks.