FINRA Is Still Barring Brokers Over Text Messages. Here's What the Off-Channel Enforcement Split Means for Your Records Program.

TL;DR

• The SEC ended systematic off-channel enforcement in 2025 after 95 cases and $2.3 billion in penalties, citing no identifiable investor harm — but FINRA did not follow
• FINRA fined BTIG $600,000 after finding 50+ employees used unauthorized messaging platforms for substantive client business between 2020 and 2024
• FINRA is now barring individuals from the industry entirely for off-channel violations — a consequence the SEC’s institutional sweep rarely imposed
• A former Wells Fargo Advisors broker was fined and suspended for off-channel messaging and then deleting the evidence — destruction of records is an independent aggravating factor
• FINRA’s 2026 Annual Regulatory Oversight Report flags recordkeeping lapses more than 50 times — the prohibition-without-detection policy gap remains the most common failure mode

The SEC spent three years building one of the most consequential enforcement waves in broker-dealer history. Ninety-five off-channel communications cases. $2.3 billion in penalties. JPMorgan, Goldman Sachs, Morgan Stanley, Bank of America — virtually every major firm wrote a check. The message was unmistakable: use WhatsApp for business, pay the price.

Then the current administration characterized those 95 cases as generating “no direct investor harm and no investor benefit or protection.” New off-channel referrals from the Division of Examinations stopped. The wave was over.

FINRA didn’t follow.

That divergence is now a material compliance issue for every registered broker-dealer. The SEC isn’t going after off-channel communications. FINRA is — and it’s now doing something the SEC’s institutional sweep rarely did: targeting individuals, not just firms.

Why the SEC Pulled Back

The shift is documented. As covered in our mid-year SEC enforcement analysis, the current Division of Enforcement leadership has been explicit about its rationale: the prior off-channel program prioritized volume and record-setting penalties over true investor protection. Three years and $2.3 billion in penalties, the agency concluded, didn’t move the needle on actual investor harm.

Chair Paul Atkins has redirected enforcement resources toward fraud, market manipulation, and abuses of trust — cases with demonstrable victims and demonstrable harm. Off-channel recordkeeping violations, in the current framework, are technical failures that don’t meet that threshold.

For large institutions, this is a meaningful change. It is not the end of off-channel enforcement risk.

Why FINRA Operates Independently

FINRA is a self-regulatory organization that operates under its own examination and enforcement authority, independent from the political dynamics that shape SEC enforcement priorities. When the SEC changes direction, FINRA doesn’t automatically follow — and it hasn’t.

FINRA Rule 4511 requires members to preserve books and records in accordance with Exchange Act Rule 17a-4. FINRA Rule 4512 covers customer account record requirements. These rules have been in place for decades, and the obligation to capture and preserve business-related electronic communications hasn’t changed.

What has changed is where those communications happen. When broker-dealer employees use iMessage, WhatsApp, Signal, or personal email for substantive business discussions — with clients, with colleagues, about transactions — those conversations are business records that Rule 4511 requires to be preserved. FINRA examiners know this. They’re still looking for it.

What FINRA Is Actually Doing in 2026

BTIG — $600,000

FINRA fined BTIG $600,000 for widespread failures in supervising and preserving business-related communications. BTIG is a San Francisco-based institutional broker-dealer serving approximately 500 registered representatives in investment banking, institutional sales and trading, and research.

The findings were extensive: more than 50 current and former BTIG employees used unauthorized messaging platforms between January 2020 and July 2024. The unauthorized communications weren’t incidental — they included substantive discussions with clients about the firm’s investment banking business, communications that belong in the firm’s recordkeeping system.

FINRA cited violations of FINRA Rules 4511 and 4512 and Exchange Act Rule 17a-4. The $600,000 penalty is smaller than what the SEC collected from major institutions during its sweep — but the pattern is identical: supervisory procedures that prohibit off-channel use without detection mechanisms, oversight that identified the prohibition but not the non-compliance.

Individual Bars and Suspensions

Here is where the 2026 picture diverges from the SEC sweep in a way that registered representatives need to understand: FINRA is now going after individuals, not just institutions.

In 2026, FINRA barred at least one individual from associating with any member firm for off-channel communications violations. Not a fine. Not a suspension. A bar — meaning they can no longer work in the industry in any capacity that requires FINRA registration.

A former Wells Fargo Advisors broker was separately fined and suspended for a related but more serious pattern: not only using off-channel communications for business, but deleting the messages afterward. The deletion of evidence is treated as an aggravating factor in FINRA proceedings. Off-channel use is a Rule 4511 violation. Destroying the evidence of off-channel use creates a far more serious evidentiary problem — one that moves outcomes from institutional fines toward individual bars.

The SEC’s institutional sweep left individual registered representatives largely untouched. Firms paid the fines; reps kept their licenses. FINRA is writing a different story.

What FINRA’s 2026 Oversight Report Actually Says

FINRA’s 2026 Annual Regulatory Oversight Report makes the picture explicit: recordkeeping lapses appear more than 50 times in the nearly 90-page document. That frequency reflects how often examiners found recordkeeping deficiencies across member firms during the prior examination cycle.

The report specifically identifies three failure modes:

• Electronic communications capture failures: Firms whose surveillance systems don’t capture the actual platforms their employees use — archiving Microsoft Teams while employees conduct business on WhatsApp.
• Off-channel use: Employees using platforms that aren’t on the firm’s approved list, often with the knowledge of supervisors who didn’t report or remediate it.
• Inadequate supervision procedures: Written Supervisory Procedures that identify prohibited platforms without specifying how the firm detects violations or what happens when they’re discovered.

FINRA’s direction to firms is specific and operational: simulate regulatory examinations, actively monitor for unapproved channel use — not just collect annual attestations — and regularly refresh communications surveillance keywords to keep pace with new platform adoption.

The Supervision Gap That Creates the Liability

The consistent pattern across off-channel enforcement cases isn’t that firms don’t have policies. Most firms have policies that say “don’t use personal devices or unapproved platforms for business communications.” The gap is that the policy exists without a mechanism to enforce it.

A Written Supervisory Procedure that says “registered representatives shall not use personal devices for business communications” satisfies nothing if the firm has no way to determine whether the policy is being followed. FINRA examines not just whether the policy exists, but whether the firm can demonstrate it’s actively supervising compliance with that policy.

That’s the obligation under FINRA Rule 3110: not to have procedures, but to supervise compliance with procedures. An unmonitored policy is an unenforceable policy — and an unenforceable policy doesn’t protect the firm when an examiner asks what happened, or a rep who assumed the firm would absorb the consequences.

The Personal Stakes for Registered Representatives

The institutional focus of the prior SEC sweep created a misleading sense of personal insulation for individual registered representatives. The headlines were about firms paying $100 million-plus penalties. Individual reps kept their licenses and their careers.

FINRA’s enforcement posture in 2026 is different. The individual bar is documented. The former Wells Fargo Advisors broker’s suspension is documented. These outcomes attach to specific people — not to firms that pay penalties and move on.

According to analysts tracking off-channel outcomes across regulators, FINRA’s shift toward individual accountability reflects a recognition that firm-level fines don’t change behavior when individual representatives don’t face personal consequences. The bar changes that calculus.

Personal devices create personal liability when FINRA is doing the examining.

So What? Three Actions for Compliance Programs

The Q2 2026 enforcement data showed that firms were consistently penalized not for missing frameworks, but for having frameworks that didn’t follow through. Off-channel supervision is that pattern precisely: prohibition policies without detection mechanisms.

1. Test whether your electronic communications supervision actually detects off-channel use — don’t rely on attestations. Have a registered representative send a business-related message on a platform that’s supposed to be prohibited. Does anything in your surveillance infrastructure catch it? If the answer is no, your WSP says “prohibited” but your supervision doesn’t enforce that prohibition. The BTIG case involves 50+ employees over four years — that’s not a rogue individual, that’s a supervision gap.

2. Review your Written Supervisory Procedures for specificity on off-channel detection and remediation. A WSP that says “off-channel communications are prohibited” without specifying how the firm detects violations or what happens when they’re found fails the supervision obligation. The FINRA 2026 report expects WSPs to include the detection method, the escalation path, and the remediation step.

3. Brief individual registered representatives on the personal consequences, not just the firm consequences. If your compliance training frames off-channel risk as “the firm gets fined,” it’s missing the 2026 reality: FINRA is barring individuals. Destroying evidence of the violation makes outcomes worse. Reps who understand that personal devices can produce personal bars — up to and including permanent bars from the industry — make different decisions about where they conduct business conversations.

The SEC stepping back doesn’t mean off-channel enforcement risk went away. It means the risk migrated to a regulator that isn’t subject to the same policy constraints — one that examines independently, sanctions independently, and is now calibrating those sanctions to land directly on the registered representatives whose texts it finds.