Since December 2021, US financial regulators have extracted more than $2 billion in penalties from firms that let employees discuss business over WhatsApp, iMessage, and text without capturing the records. The enforcement wave slowed in headline terms after 2025, but the underlying rule hasn't moved, and FINRA's own 2026 oversight report makes clear examiners are still watching closely. Here's what the rule actually requires and what's changed operationally.
The rule itself isn't new
The obligation traces back to SEC Rule 17a-4 and its counterpart under the Investment Advisers Act, Rule 204-2(a)(7), alongside FINRA Rule 4511. Rule 17a-3 specifies what records broker-dealers must create, including records of business-related communications. Rule 17a-4 specifies how those records must be retained, generally requiring preservation in a non-rewritable, non-erasable format for a set retention period, commonly summarized as WORM storage, write once, read many.
None of this was written with WhatsApp or Telegram in mind. It was written for a world of paper correspondence and later extended to electronic communication broadly. The rule doesn't name a channel. It defines an obligation: if the communication is business-related, it has to be captured, retained, and supervisable, regardless of what app it happened on.
How this became a multi-billion dollar enforcement story
In December 2021, the SEC and CFTC charged JPMorgan Securities with recordkeeping failures after finding that employees, including supervisors responsible for compliance, had routinely discussed business over personal texts, personal email, and WhatsApp. The firm paid $200 million combined. That case set off a sweep: in September 2022, 16 Wall Street firms were fined a combined $1.1 billion for the same underlying failure. In August 2024, 26 more firms were fined a combined $392.75 million, with the largest individual penalties, $50 million each, landing on Ameriprise, Edward Jones, LPL Financial, and Raymond James. A further wave in January 2025 added $63 million across 12 more firms.
The pattern in nearly every case is the same: employees used a consumer messaging app for real business conversations, the firm had no system capturing those messages, and when regulators asked for records during an exam or investigation, the firm simply couldn't produce them. The violation isn't really about what was said. It's about the inability to produce the record at all.
What actually changed after 2025
Following a change in SEC leadership, the pace of headline SEC enforcement actions slowed considerably in the first half of 2025, and some firms read that as the pressure easing off. That read misses where enforcement moved rather than stopped. FINRA has continued pursuing off-channel failures through its ordinary cycle examinations, and increasingly holds individuals, not just firms, accountable. In June 2025, Velox Clearing was fined a combined $1.8 million by FINRA and the SEC after a routine exam turned up over 10,000 unretained WeChat messages that compliance staff had internally flagged but never acted on. Individual brokers have also faced suspensions and, in at least one case reported in early 2026, an outright industry bar tied to off-channel use.
FINRA's 2026 Annual Regulatory Oversight Report flags recordkeeping lapses more than 50 times and explicitly calls out electronic communications capture failures, off-channel use, and inadequate supervision procedures as active examination findings. For a mid-market firm that assumed the SEC's big enforcement wave was the whole story, that report is the clearest possible signal that the obligation, and the scrutiny, are still very much active.
Where Telegram fits into this picture
Every enforcement action referenced above involved WhatsApp, iMessage, SMS, or WeChat, not Telegram specifically. But the rule doesn't carve out an exception for any particular app. If a US broker-dealer, investment adviser, or their supervised employees are discussing client business, trades, recommendations, or anything else that counts as a business communication inside a Telegram group, that communication falls under the same 17a-4 and FINRA 4511 obligations as if it happened over WhatsApp. Regulators have shown they're willing to look at whichever channel employees are actually using, not just the ones on an approved list, including channels used by outsourced teams, a gap we cover in why your BPO vendor's Telegram habits are your compliance exposure too.
What a defensible setup actually looks like
Across the enforcement actions and the compliance guidance written in response to them, a few practical requirements show up consistently:
- Capture, not just policy. A written policy banning off-channel communication doesn't satisfy the rule if employees use the channel anyway and nothing captures it. Regulators have penalized firms with clear written policies just as heavily as firms without one.
- Retention in an unalterable format. Records need to be preserved in a way that can't be edited after the fact, for the retention period the rule requires, generally measured in years, not months.
- Supervisory review. It's not enough to store the messages; firms are expected to have a working surveillance process reviewing captured communications for compliance issues.
- Ability to produce records on request. When an exam or investigation asks for a specific period of communication, the firm needs to be able to retrieve it promptly and completely.
This is precisely the gap that MessengerKit's Media Vault is built to close for Telegram-based teams: messages and media archive continuously to storage you control, Watchtower flags flagged-keyword conversations for review in real time, and every governed group keeps a persistent, retrievable history instead of one that lives and dies with whoever's phone it's on.
A quick, honest caveat
This is a general overview, not legal advice, and it isn't a complete statement of your obligations under SEC or FINRA rules. Whether a specific Telegram conversation counts as a business communication subject to 17a-4, what retention period applies, and how your supervisory procedures need to be structured all depend on your registration status and the specifics of your business. Talk to securities compliance counsel before treating any messaging setup, ours included, as sufficient on its own. For how this compares to messaging compliance obligations in other markets, see our region-by-region look at Telegram archiving requirements, and for the fuller enforcement trend behind these numbers, see our piece on the off-channel fine total.
Frequently asked questions
Does Rule 17a-4 apply to Telegram specifically?
The rule doesn't name any specific app. It applies to business-related communications regardless of channel, so a Telegram conversation covering client business is treated the same as one over WhatsApp or email for recordkeeping purposes.
Is a written policy against off-channel communication enough on its own?
No. Multiple enforcement actions have fined firms that had clear written policies but no actual capture mechanism, because employees used the unapproved channel anyway and nothing archived it.
Has enforcement actually slowed down in 2026?
Headline SEC actions slowed after a 2025 leadership change, but FINRA's cycle exams and individual accountability actions have continued, and FINRA's 2026 oversight report treats this as an active priority area.