Why depository institutions, with or without affiliated securities firms, can and should manage employee use of personal devices for work-related communications

This paper shows how the failure to monitor for and prevent off-channel communications poses risk to traditional depository institutions that are not subject to the jurisdiction of securities-law regulators and shows how those institutions can mitigate that risk. US securities regulators have cracked down on broker-dealer, investment-adviser and futures commission merchant employees' use of unapproved personal devices and applications for business communications, imposing over US$2.8bn in penalties between December 2021 and April 2024. However, because there have not, at the time of writing this paper, been similar enforcement actions against traditional depository institutions that do not have securities affiliates, many traditional banks without securities affiliates have continued with business as usual. Nonetheless, the OCC has recognised that electronic communications can constitute records that must be retained pursuant to specific rules and that banks' failure to maintain adequate record retention systems in general can create significant reputation, transaction, credit and compliance risks. This paper aims to illuminate those risks and offers suggestions about how to address them.