In re BNY Mellon Securities
BNY Mellon Securities Corporation and Pershing LLC failed to preserve business-related communications on personal devices from January 2020 to August 2024, violating federal securities recordkeeping rules and supervision requirements, and agreed to a $40 million civil penalty and compliance reforms.
BNY Mellon Securities Corporation and Pershing LLC violated Section 17(a) of the Securities Exchange Act and Rule 17a-4(b)(4) by failing to preserve off-channel business communications on personal devices. The firms' personnel, including senior levels, used unapproved communication methods like WhatsApp and text messages from January 2020 to August 2024. As a result, they were censured, ordered to cease and desist, and must jointly pay a $40 million civil penalty.
BNY Mellon Securities Corporation and Pershing LLC, registered with the SEC as a broker-dealer and investment adviser, failed to maintain and preserve business-related communications on personal devices using unapproved methods like WhatsApp and text messages from January 2020 to August 2024. This widespread failure involved personnel at various levels, including senior supervisors, violating the firms' own policies and leading to a breach of their duty to reasonably supervise under Section 15(b)(4)(E) of the Exchange Act. The firms' recordkeeping failures likely impacted the SEC's ability to carry out its regulatory functions and investigate violations of federal securities laws. As part of a settled SEC order, both firms were censured and ordered to cease and desist from further violations. They must jointly pay a $40 million civil penalty within 14 days. The firms are required to retain an independent compliance consultant to review and assess their recordkeeping practices, policies, and procedures, and implement recommended changes. They must also conduct internal audits, maintain records for six years, and submit compliance certifications to the SEC's New York Regional Office within 60 days of completing undertakings.
Extracted insights
- $40.00M $40,000,000 $10M–$100M
- company Bnymsc
- company Pershing LLC
- agency Securities and Exchange Commission
- Commission deems appropriate public administrative and cease-and-desist proceedings be instituted
- Respondents submitted Offers of Settlement
- Respondents admit the facts set forth in Section III
- BNYMSC and Pershing Personnel sent and received off-channel communications
- Respondents did not maintain or preserve the substantial majority of these written communications
UNITED STATES OF AMERICA
before the
SECURITIES AND EXCHANGE COMMISSION
SECURITIES EXCHANGE ACT OF 1934
Release No. 100712 / August 14, 2024
INVESTMENT ADVISERS ACT OF 1940
Release No. 6661 / August 14, 2024
ADMINISTRATIVE PROCEEDING
File No. 3-22009
In the Matter of
BNY Mellon Securities
Corporation and
Pershing LLC,
Respondents.
ORDER INSTITUTING
ADMINISTRATIVE AND CEASE-
AND-DESIST PROCEEDINGS,
PURSUANT TO SECTIONS 15(b) AND
21C OF THE SECURITIES
EXCHANGE ACT OF 1934 AND
SECTION 203(e) OF THE
INVESTMENT ADVISERS ACT OF
1940, MAKING FINDINGS, AND
IMPOSING REMEDIAL SANCTIONS
AND A CEASE-AND-DESIST ORDER
I.
The Securities and Exchange Commission (“Commission”) deems it appropriate and in
the public interest that public administrative and cease-and-desist proceedings be, and hereby
are, instituted pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934
(“Exchange Act”) against BNY Mellon Securities Corporation (“BNYMSC”) and Pershing LLC
(“Pershing,” with BNYMSC, “Respondents”) and pursuant to Section 203(e) of the Investment
Advisers Act of 1940 (“Advisers Act”) as to BNYMSC.
II.
In anticipation of the institution of these proceedings, Respondents have submitted Offers
of Settlement (“Offers”) that the Commission has determined to accept. Respondents admit the
facts set forth in Section III below, acknowledge that their conduct violated the federal securities
laws, admit the Commission’s jurisdiction over them and the subject matter of these proceedings,
and consent to the entry of this Order Instituting Administrative and Cease-and-Desist
Proceedings, Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934 and
Sections 203(e) of the Investment Advisers Act of 1940, Making Findings, and Imposing
Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below.
2
III.
On the basis of this Order and Respondents’ Offers, the Commission finds
1
that:
Summary
1. The federal securities laws impose recordkeeping requirements on broker-dealers
to ensure that they responsibly discharge their crucial role in our markets. The Commission has
long said that compliance with these requirements is essential to investor protection and the
Commission’s efforts to further its mandate of protecting investors, maintaining fair, orderly, and
efficient markets, and facilitating capital formation.
2. These proceedings arise out of the widespread and longstanding failure of
Respondents’ personnel, including at senior levels, to adhere to certain of these essential
requirements and Respondents’ own policies. Using their personal devices, these personnel
communicated both internally and externally by text messages, and/or other unapproved written
communications platforms, such as WhatsApp (“off-channel communications”).
3. From at least January 2020 through the date of this Order, BNYMSC and
Pershing personnel sent and received off-channel communications that related to the business of
the broker-dealers. Respondents did not maintain or preserve the substantial majority of these
written communications. Respondents’ failures were firm-wide and involved personnel at
various levels of authority. As a result, BNYMSC and Pershing violated Section 17(a) of the
Exchange Act and Rule 17a-4(b)(4) thereunder.
4. Respondents’ supervisors, who were responsible for supervising junior personnel,
routinely communicated off-channel using their personal devices. In fact, senior personnel
responsible for supervising junior personnel themselves failed to comply with Respondents’
policies by communicating using non-approved methods on their personal devices about
Respondents’ broker-dealer business.
5. Respondents’ widespread failure to implement their policies and procedures that
prohibit such communications led to their failure to reasonably supervise their personnel within
the meaning of Section 15(b)(4)(E) of the Exchange Act.
6. During the time period that BNYMSC failed to maintain and preserve off-channel
communications its personnel sent and received related to its broker-dealer business, BNYMSC
received and responded to Commission subpoenas for documents and records requests in various
Commission investigations. As a result, BNYMSC’s recordkeeping failures likely impacted the
Commission’s ability to carry out its regulatory functions and investigate violations of the
federal securities laws across these investigations.
1
The findings herein are made pursuant to Respondents’ Offers of Settlement and are not
binding on any other person or entity in this or any other proceeding.
3
7. Commission staff uncovered Respondents’ misconduct after commencing a risk-
based initiative to investigate the use of off-channel and unpreserved communications at broker-
dealers. Respondents have initiated a review of their recordkeeping failures and begun a
program of remediation. As set forth in the Undertakings below, Respondents will retain an
independent compliance consultant to review and assess Respondents’ remedial steps relating to
their recordkeeping practices, policies and procedures, related supervisory practices, and
employment actions.
Respondents
8. BNY Mellon Securities Corporation is a New York corporation with its principal
office in New York, New York and is registered with the Commission as a broker-dealer and
investment adviser.
9. Pershing LLC is a Delaware corporation with its principal office in Jersey City,
New Jersey and is registered with the Commission as a broker-dealer.
Recordkeeping Requirements Under the Exchange Act
10. Section 17(a)(1) of the Exchange Act authorizes the Commission to issue rules
requiring broker-dealers to make and keep for prescribed periods, and furnish copies of, such
records as necessary or appropriate in the public interest, for the protection of investors or
otherwise in furtherance of the purposes of the Exchange Act.
11. The Commission adopted Rule 17a-4 under the Exchange Act pursuant to this
authority. Rule 17a-4 specifies the manner and length of time that the records created in
accordance with other Commission rules, and certain other records produced by broker-dealers,
must be maintained and produced promptly to Commission representatives. The rules adopted
under Section 17(a)(1) of the Exchange Act, including Rule 17a-4(b)(4), require that broker-
dealers preserve for at least three years, the first two years in an easily accessible place, originals
of all communications received and copies of all communications sent relating to the broker-
dealer’s business as such. These rules impose minimum recordkeeping requirements that are
based on standards a prudent broker-dealer should follow in the normal course of business.
12. The Commission previously has stated that these and other recordkeeping
requirements “are an integral part of the investor protection function of the Commission, and
other securities regulators, in that the preserved records are the primary means of monitoring
compliance with applicable securities laws, including antifraud provisions and financial
responsibility standards.” Commission Guidance to Broker-Dealers on the Use of Electronic
Storage Media under the Electronic Signatures in Global and National Commerce Act of 2000
with Respect to Rule 17a-4(f), 17 C.F.R. Part 241, Exchange Act Rel. No. 44238 (May 1, 2001).
Respondents’ Policies and Procedures
13. Respondents maintained certain policies and procedures designed to ensure the
retention of business-related records, including electronic communications, in compliance with
the relevant recordkeeping provisions.
4
14. Respondents’ personnel were advised that the use of unapproved electronic
communications methods, including on their personal devices, was not permitted, and they
should not use personal email, chats or text messaging applications for business purposes, or
forward work-related communications to unapproved applications on their personal devices.
15. Messages sent through firm-approved communications methods were monitored,
subject to review, and archived. Messages sent through unapproved communications methods,
such as WhatsApp and other unapproved applications on personal devices, were not monitored,
subject to review or archived.
16. Respondents’ policies were designed to address supervisors’ supervision of
personnel’s training in Respondents’ communications policies and adherence to Respondents’
books and recordkeeping requirements. Supervisory policies notified personnel that electronic
communications were subject to surveillance by Respondents.
17. Respondents, however, failed to implement a system of follow-up and review to
determine that all personnel, including supervisors, were reasonably following Respondents’
policies. While permitting personnel to use approved communications methods, including on
personal phones, for business communications, Respondents failed to implement sufficient
monitoring to ensure that their recordkeeping and communications policies were being followed.
Respondents’ Recordkeeping Failures Across the Brokerage Businesses
18. In September 2021, the Commission staff commenced a risk-based initiative to
investigate whether registrants were properly retaining business-related messages sent and
received on personal devices. Respondents cooperated with the investigation by voluntarily
interviewing a sampling of senior personnel from BNYMSC and Pershing and gathering and
reviewing messages found on the individuals’ personal devices. These personnel included senior
leadership, such as managing directors and desk heads.
19. The Commission staff’s investigation uncovered pervasive off-channel
communications at all seniority levels within BNYMSC and Pershing. The investigation
determined that all broker-dealer personnel sampled had engaged in at least some level of off-
channel communications. Overall, personnel sent and received numerous off-channel
communications, involving other Respondent personnel, BNYMSC’s and Pershing’s broker-
dealer customers and other participants in the securities industry. Within BNYMSC and
Pershing, a significant number of managing directors and heads of desks participated in off-
channel communications.
20. From at least January 2020, BNYMSC and Pershing personnel sent and received
off-channel messages that concerned their broker-dealer businesses.
21. For example, before the Commission’s investigation, a senior executive at
BNYMSC enabled an autodelete function on his personal iPhone but retained some messages on
his personal iPad. He exchanged off-channel business-related messages with at least seven
colleagues at BNYMSC and affiliated entities, including five colleagues he supervised. These
5
colleagues included other BNYMSC officers, a senior officer, and a senior vice president. These
messages related to the broker-dealer’s business and were exchanged over iMessage.
22. In addition, a managing director and head of a Pershing segment exchanged
numerous off-channel business-related messages with at least 50 Pershing and BNYMSC
colleagues; about four customers, investors, or other market participants; and with at least four
individuals at other financial firms. Within Pershing and BNYMSC, the managing director
communicated with managing directors, directors, vice presidents, and personnel under his
supervision. These messages related to the broker-dealer’s business and were exchanged over
iMessage.
23. In addition, before the Commission’s investigation, a desk head within BNYMSC
deleted messages from his personal phone. Still-extant records reflect that he exchanged
numerous off-channel business-related text messages with at least 40 colleagues at BNYMSC
and affiliated entities. These iMessage and WhatsApp messages related to the broker-dealer’s
business.
Respondents’ Failure to Preserve Required Records Potentially
Compromised and Delayed Commission Matters
24. During the period relevant to this Order, BNYMSC received and responded to
Commission subpoenas for documents and records requests in various Commission
investigations. By failing to maintain and preserve required records relating to its broker-dealer
business, BNYMSC likely deprived the Commission of these off-channel communications in
various investigations.
Respondents’ Violations and Failure to Supervise
25. As a result of the conduct described above, from at least January 2020 through the
date of this Order, Respondents willfully
2
violated Section 17(a) of the Exchange Act and
Rule 17a-4(b)(4) thereunder.
26. As a result of the conduct described above, from at least January 2020 through the
date of this Order, Respondents failed reasonably to supervise their personnel with a view to
preventing or detecting certain of their supervised persons’ aiding and abetting violations of
Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder, within the meaning of
Section 15(b)(4)(E) of the Exchange Act.
Respondents’ Remedial Efforts
27. In determining to accept the Offers, the Commission considered steps promptly
undertaken and cooperation afforded the Commission staff by Respondents. Prior to and after
2
“Willfully,” for purposes of imposing relief under Section 15(b) of the Exchange Act and
Section 203(e) of the Advisers Act “‘means no more than that the person charged with the duty
knows what he is doing.’” See Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir 2000) (quoting
Hughes v. SEC, 174 F.2d 969, 977 (D.C. Cir. 1949)).
6
being approached by Commission staff, Respondents provided firm-approved messaging
applications to firm personnel to facilitate compliant communications.
Undertakings
28. Prior to this action, Respondents enhanced their policies and procedures, and
increased training concerning the use of approved communications methods, and began
implementing significant changes to the technology available to personnel. In addition,
Respondents have undertaken to:
29. Independent Compliance Consultant.
a. Respondents shall retain, within thirty (30) days of the entry of this Order, the
services of an independent compliance consultant (“Compliance Consultant”) that is not
unacceptable to the Commission staff. The Compliance Consultant’s compensation and
expenses shall be borne exclusively by Respondents.
b. Respondents will oversee the work of the Compliance Consultant.
c. Respondents shall provide to the Commission staff, within sixty (60) days of
the entry of this Order, a copy of the engagement letter detailing the Compliance
Consultant’s responsibilities, which shall include a comprehensive compliance review as
described below. Respondents shall require that, within ninety (90) days of the date of
the engagement letter, the Compliance Consultant conduct:
i. A comprehensive review of Respondents’ supervisory, compliance, and
other policies and procedures designed to ensure that Respondents’ electronic
communications, including those found on personal electronic devices, including
without limitation, cellular phones (“Personal Devices”), are preserved in
accordance with the requirements of the federal securities laws.
ii. A comprehensive review of training conducted by Respondents to
ensure personnel are complying with the requirements regarding the preservation
of electronic communications, including those found on Personal Devices, in
accordance with the requirements of the federal securities laws, including by
ensuring that Respondents’ personnel certify in writing on a quarterly basis that
they are complying with preservation requirements.
iii. An assessment of the surveillance program measures implemented by
Respondents to ensure compliance, on an ongoing basis, with the requirements
found in the federal securities laws to preserve electronic communications,
including those found on Personal Devices.
iv. An assessment of the technological solutions that Respondents have
begun implementing to meet the record retention requirements of the federal
securities laws, including an assessment of the likelihood that Respondents’
personnel will use the technological solutions going forward and a review of the
7
measures employed by Respondents to track employee usage of new
technological solutions.
v. An assessment of the measures used by Respondents to prevent the use
of unauthorized communications methods for business communications by
personnel. This assessment should include, but not be limited to, a review of
Respondents’ policies and procedures to ascertain if they provide for any
significant technology and/or behavioral restrictions that help prevent the risk of
the use of unapproved communications methods on Personal Devices (e.g.,
trading floor restrictions).
vi. A review of Respondents’ electronic communications surveillance
routines to ensure that electronic communications through approved
communications methods found on Personal Devices are incorporated into
Respondents’ overall communications surveillance program.
vii. A comprehensive review of the framework adopted by Respondents
to address instances of non-compliance by Respondents’ personnel with
Respondents’ policies and procedures concerning the use of Personal Devices to
communicate about firm business in the past. This review shall include a survey
of how Respondents determined which personnel failed to comply with
Respondents’ policies and procedures, the corrective action carried out, an
evaluation of who violated policies and why, what penalties were imposed, and
whether penalties were handed out consistently across business lines and seniority
levels.
d. Respondents shall require that, within forty-five (45) days after completion of
the review set forth in sub-paragraphs 29.c.i through c.vii above, the Compliance
Consultant shall submit a detailed written report of its findings to Respondents and to the
Commission staff (the “Report”). Respondents shall require that the Report include a
description of the review performed, the names of the individuals who performed the
review, the conclusions reached, the Compliance Consultant’s recommendations for
changes in or improvements to Respondents’ policies and procedures, and a summary of
the plan for implementing the recommended changes in or improvements to
Respondents’ policies and procedures.
e. Respondents shall adopt all recommendations contained in the Report within
ninety (90) days of the date of the Report; provided, however, that within forty-five (45)
days after the date of the Report, Respondents shall advise the Compliance Consultant
and the Commission staff in writing of any recommendations that Respondents consider
to be unduly burdensome, impractical, or inappropriate. With respect to any
recommendation that Respondents consider unduly burdensome, impractical, or
inappropriate, Respondents need not adopt such recommendation at that time, but shall
propose in writing an alternative policy, procedure, or disclosure designed to achieve the
same objective or purpose.
8
f. As to any recommendation concerning Respondents’ policies or procedures on
which Respondents and the Compliance Consultant do not agree, Respondents and the
Compliance Consultant shall attempt in good faith to reach an agreement within sixty
(60) days after the date of the Report. Within fifteen (15) days after the conclusion of the
discussion and evaluation by Respondents and the Compliance Consultant, Respondents
shall require that the Compliance Consultant inform Respondents and the Commission
staff in writing of the Compliance Consultant’s final determination concerning any
recommendation that Respondents consider to be unduly burdensome, impractical, or
inappropriate. Respondents shall abide by the determinations of the Compliance
Consultant and, within sixty (60) days after final agreement between Respondents and the
Compliance Consultant or final determination by the Compliance Consultant, whichever
occurs first, Respondents shall adopt and implement all of the recommendations that the
Compliance Consultant deems appropriate.
g. Respondents shall cooperate fully with the Compliance Consultant and shall
provide the Compliance Consultant with access to such of Respondents’ files, books,
records, and personnel as are reasonably requested by the Compliance Consultant for
review.
h. Respondents shall not have the authority to terminate the Compliance
Consultant or substitute another compliance consultant for the initial Compliance
Consultant, without the prior written approval of the Commission staff. Respondents
shall compensate the Compliance Consultant and persons engaged to assist the
Compliance Consultant for services rendered under this Order at their reasonable and
customary rates.
i. For the period of engagement and for a period of two (2) years from
completion of the engagement, Respondents shall not (i) retain the Compliance
Consultant for any other professional services outside of the services described in this
Order; (ii) enter into any other professional relationship with the Compliance Consultant,
including any employment, consultant, attorney-client, auditing or other professional
relationship; or (iii) enter, without prior written consent of the Commission staff, into any
such professional relationship with any of the Compliance Consultant’s present or former
affiliates, employers, directors, officers, employees, or agents acting in their capacity as
such.
j. The Report by the Compliance Consultant will likely include confidential
financial, proprietary, competitive business or commercial information. Public disclosure
of the Report could discourage cooperation, impede pending or potential government
investigations or undermine the objectives of the reporting requirement. For these
reasons, among others, the Report and the contents thereof are intended to remain and
shall remain non-public, except (1) pursuant to court order, (2) as agreed to by the parties
in writing, (3) to the extent that the Commission determines in its sole discretion that
disclosure would be in furtherance of the Commission’s discharge of its duties and
responsibilities, or (4) as otherwise required by law.
9
30. One-Year Evaluation. Respondents shall each require the Compliance Consultant
to assess Respondents’ respective programs for the preservation, as required under the federal
securities laws, of electronic communications, including those found on Personal Devices,
commencing one year after submitting the Report required by sub-paragraph 29.d above.
Respondents shall require this review to evaluate Respondents’ progress in the areas described in
sub-paragraph 29.c.i-vii above. After this review, Respondents shall require the Compliance
Consultant to submit a report (the “One Year Report”) to Respondents and the Commission staff
and shall ensure that the One Year Report includes an updated assessment of Respondents’
respective policies and procedures with regard to the preservation of electronic communications
(including those found on Personal Devices), training, surveillance programs, and technological
solutions implemented in the prior year period.
31. Reporting Discipline Imposed. For two (2) years following the entry of this Order,
Respondents shall notify the Commission staff as follows upon the imposition of any discipline
imposed by Respondents, including, but not limited to: written warnings; loss of any pay, bonus,
or incentive compensation; or the termination of employment; with respect to any employee found
to have violated Respondents’ respective policies and procedures concerning the preservation of
electronic communications, including those found on Personal Devices: at least forty-eight (48)
hours before the filing of a Form U-5, or within ten (10) days of the imposition of other discipline.
32. Internal Audit. In addition to the Compliance Consultant’s review and issuance of
the One Year Report, Respondents will also have their Internal Audit function conduct a separate
audit(s) to assess Respondents’ progress in the areas described in sub-paragraphs 29.c.i-vii above.
After completion of this audit(s), Respondents shall ensure that Internal Audit submits a report to
Respondents and to the Commission staff.
33. Recordkeeping. Respondents shall preserve, for a period of not less than six (6)
years from the end of the fiscal year last used, the first two (2) years in an easily accessible place,
any record of compliance with these undertakings.
34. Deadlines. For good cause shown, the Commission staff may extend any of the
procedural dates relating to the undertakings. Deadlines for procedural dates shall be counted in
calendar days, except that if the last day falls on a weekend or federal holiday, the next business
day shall be considered to be the last day.
35. Certification. Respondents shall certify, in writing, compliance with the
undertakings set forth above. The certification shall identify the undertakings, provide written
evidence of compliance in the form of a narrative, and be supported by exhibits sufficient to
demonstrate compliance. The Commission staff may make reasonable requests for further
evidence of compliance, and Respondents agree to provide such evidence. The certification and
supporting material shall be submitted to Alison R. Levine, Assistant Regional Director,
Division of Enforcement, New York Regional Office, Securities and Exchange Commission, 100
Pearl Street, Suite 20-100, New York, NY, 10004-2616, or such other person as the Commission
staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division, no
later than sixty (60) days from the date of the completion of the undertakings.
10
IV.
In view of the foregoing, the Commission deems it appropriate and in the public interest
to impose the sanctions agreed to in Respondents’ Offers.
Accordingly, pursuant to Sections 15(b) and 21C of the Exchange Act as to BNYMSC
and Pershing, and pursuant to Section 203(e) of the Advisers Act as to BNYMSC, it is hereby
ORDERED that:
A. Respondents cease and desist from committing or causing any violations and any
future violations of Section 17(a) of the Exchange Act and Rule 17a-4 thereunder.
B. Respondents are censured.
C. Respondents shall comply with the undertakings enumerated in paragraphs 30 to
36 above.
D. Respondents, jointly and severally, shall, within 14 days of the entry of this
Order, pay a civil money penalty in the amount of $40,000,000 to the Securities and Exchange
Commission for transfer to the general fund of the United States Treasury, subject to Exchange
Act Section 21F(g)(3). If timely payment is not made, additional interest shall accrue pursuant
to 31 U.S.C. § 3717.
Payment must be made in one of the following ways:
(1) Respondents may transmit payment electronically to the Commission,
which will provide detailed ACH transfer/Fedwire instructions upon
request;
(2) Respondents may make direct payment from a bank account via Pay.gov
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or
(3) Respondents may pay by certified check, bank cashier’s check, or United
States postal money order, made payable to the Securities and Exchange
Commission and hand-delivered or mailed to:
Enterprise Services Center
Accounts Receivable Branch
HQ Bldg., Room 181, AMZ-341
6500 South MacArthur Boulevard
Oklahoma City, OK 73169
Payments by check or money order must be accompanied by cover letters identifying
BNYMSC and Pershing as the Respondents in these proceedings, and the file number of these
proceedings; a copy of the cover letter and check or money order must be sent to Thomas P.
11
Smith, Jr., Associate Regional Director, Securities and Exchange Commission, 100 Pearl Street,
Suite 20-100, New York, New York 10004-2616.
E. Amounts ordered to be paid as civil money penalties pursuant to this Order shall
be treated as penalties paid to the government for all purposes, including all tax purposes. To
preserve the deterrent effect of the civil penalty, Respondents agree that in any Related Investor
Action, they shall not argue that they are entitled to, nor shall they benefit by, offset or reduction
of any award of compensatory damages by the amount of any part of Respondents’ payment of a
civil penalty in this action (“Penalty Offset”). If the court in any Related Investor Action grants
such a Penalty Offset, Respondents agree that they shall, within 30 days after entry of a final
order granting the Penalty Offset, notify the Commission’s counsel in this action and pay the
amount of the Penalty Offset to the Securities and Exchange Commission. Such a payment shall
not be deemed an additional civil penalty and shall not be deemed to change the amount of the
civil penalty imposed in this proceeding. For purposes of this paragraph, a “Related Investor
Action” means a private damages action brought against Respondents by or on behalf of one or
more investors based on substantially the same facts as alleged in the Order instituted by the
Commission in this proceeding.
By the Commission.
Vanessa A. Countryman
Secretary
UNITED STATES OF AMERICA
before the
SECURITIES AND EXCHANGE COMMISSION
SECURITIES EXCHANGE ACT OF 1934
Release No. 100712 / August 14, 2024
INVESTMENT ADVISERS ACT OF 1940
Release No. 6661 / August 14, 2024
ADMINISTRATIVE PROCEEDING
File No. 3-22009
In the Matter of
BNY Mellon Securities
Corporation and
Pershing LLC,
Respondents.
ORDER INSTITUTING
ADMINISTRATIVE AND CEASE-
AND-DESIST PROCEEDINGS,
PURSUANT TO SECTIONS 15(b) AND
21C OF THE SECURITIES
EXCHANGE ACT OF 1934 AND
SECTION 203(e) OF THE
INVESTMENT ADVISERS ACT OF
1940, MAKING FINDINGS, AND
IMPOSING REMEDIAL SANCTIONS
AND A CEASE-AND-DESIST ORDER
I.
The Securities and Exchange Commission (“Commission”) deems it appropriate and in
the public interest that public administrative and cease-and-desist proceedings be, and hereby
are, instituted pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934
(“Exchange Act”) against BNY Mellon Securities Corporation (“BNYMSC”) and Pershing LLC
(“Pershing,” with BNYMSC, “Respondents”) and pursuant to Section 203(e) of the Investment
Advisers Act of 1940 (“Advisers Act”) as to BNYMSC.
II.
In anticipation of the institution of these proceedings, Respondents have submitted Offers
of Settlement (“Offers”) that the Commission has determined to accept. Respondents admit the
facts set forth in Section III below, acknowledge that their conduct violated the federal securities
laws, admit the Commission’s jurisdiction over them and the subject matter of these proceedings,
and consent to the entry of this Order Instituting Administrative and Cease-and-Desist
Proceedings, Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934 and
Sections 203(e) of the Investment Advisers Act of 1940, Making Findings, and Imposing
Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below.
2
III.
On the basis of this Order and Respondents’ Offers, the Commission finds1 that:
Summary
1. The federal securities laws impose recordkeeping requirements on broker-dealers
to ensure that they responsibly discharge their crucial role in our markets. The Commission has
long said that compliance with these requirements is essential to investor protection and the
Commission’s efforts to further its mandate of protecting investors, maintaining fair, orderly, and
efficient markets, and facilitating capital formation.
2. These proceedings arise out of the widespread and longstanding failure of
Respondents’ personnel, including at senior levels, to adhere to certain of these essential
requirements and Respondents’ own policies. Using their personal devices, these personnel
communicated both internally and externally by text messages, and/or other unapproved written
communications platforms, such as WhatsApp (“off-channel communications”).
3. From at least January 2020 through the date of this Order, BNYMSC and
Pershing personnel sent and received off-channel communications that related to the business of
the broker-dealers. Respondents did not maintain or preserve the substantial majority of these
written communications. Respondents’ failures were firm-wide and involved personnel at
various levels of authority. As a result, BNYMSC and Pershing violated Section 17(a) of the
Exchange Act and Rule 17a-4(b)(4) thereunder.
4. Respondents’ supervisors, who were responsible for supervising junior personnel,
routinely communicated off-channel using their personal devices. In fact, senior personnel
responsible for supervising junior personnel themselves failed to comply with Respondents’
policies by communicating using non-approved methods on their personal devices about
Respondents’ broker-dealer business.
5. Respondents’ widespread failure to implement their policies and procedures that
prohibit such communications led to their failure to reasonably supervise their personnel within
the meaning of Section 15(b)(4)(E) of the Exchange Act.
6. During the time period that BNYMSC failed to maintain and preserve off-channel
communications its personnel sent and received related to its broker-dealer business, BNYMSC
received and responded to Commission subpoenas for documents and records requests in various
Commission investigations. As a result, BNYMSC’s recordkeeping failures likely impacted the
Commission’s ability to carry out its regulatory functions and investigate violations of the
federal securities laws across these investigations.
1 The findings herein are made pursuant to Respondents’ Offers of Settlement and are not
binding on any other person or entity in this or any other proceeding.
3
7. Commission staff uncovered Respondents’ misconduct after commencing a risk-
based initiative to investigate the use of off-channel and unpreserved communications at broker-
dealers. Respondents have initiated a review of their recordkeeping failures and begun a
program of remediation. As set forth in the Undertakings below, Respondents will retain an
independent compliance consultant to review and assess Respondents’ remedial steps relating to
their recordkeeping practices, policies and procedures, related supervisory practices, and
employment actions.
Respondents
8. BNY Mellon Securities Corporation is a New York corporation with its principal
office in New York, New York and is registered with the Commission as a broker-dealer and
investment adviser.
9. Pershing LLC is a Delaware corporation with its principal office in Jersey City,
New Jersey and is registered with the Commission as a broker-dealer.
Recordkeeping Requirements Under the Exchange Act
10. Section 17(a)(1) of the Exchange Act authorizes the Commission to issue rules
requiring broker-dealers to make and keep for prescribed periods, and furnish copies of, such
records as necessary or appropriate in the public interest, for the protection of investors or
otherwise in furtherance of the purposes of the Exchange Act.
11. The Commission adopted Rule 17a-4 under the Exchange Act pursuant to this
authority. Rule 17a-4 specifies the manner and length of time that the records created in
accordance with other Commission rules, and certain other records produced by broker-dealers,
must be maintained and produced promptly to Commission representatives. The rules adopted
under Section 17(a)(1) of the Exchange Act, including Rule 17a-4(b)(4), require that broker-
dealers preserve for at least three years, the first two years in an easily accessible place, originals
of all communications received and copies of all communications sent relating to the broker-
dealer’s business as such. These rules impose minimum recordkeeping requirements that are
based on standards a prudent broker-dealer should follow in the normal course of business.
12. The Commission previously has stated that these and other recordkeeping
requirements “are an integral part of the investor protection function of the Commission, and
other securities regulators, in that the preserved records are the primary means of monitoring
compliance with applicable securities laws, including antifraud provisions and financial
responsibility standards.” Commission Guidance to Broker-Dealers on the Use of Electronic
Storage Media under the Electronic Signatures in Global and National Commerce Act of 2000
with Respect to Rule 17a-4(f), 17 C.F.R. Part 241, Exchange Act Rel. No. 44238 (May 1, 2001).
Respondents’ Policies and Procedures
13. Respondents maintained certain policies and procedures designed to ensure the
retention of business-related records, including electronic communications, in compliance with
the relevant recordkeeping provisions.
4
14. Respondents’ personnel were advised that the use of unapproved electronic
communications methods, including on their personal devices, was not permitted, and they
should not use personal email, chats or text messaging applications for business purposes, or
forward work-related communications to unapproved applications on their personal devices.
15. Messages sent through firm-approved communications methods were monitored,
subject to review, and archived. Messages sent through unapproved communications methods,
such as WhatsApp and other unapproved applications on personal devices, were not monitored,
subject to review or archived.
16. Respondents’ policies were designed to address supervisors’ supervision of
personnel’s training in Respondents’ communications policies and adherence to Respondents’
books and recordkeeping requirements. Supervisory policies notified personnel that electronic
communications were subject to surveillance by Respondents.
17. Respondents, however, failed to implement a system of follow-up and review to
determine that all personnel, including supervisors, were reasonably following Respondents’
policies. While permitting personnel to use approved communications methods, including on
personal phones, for business communications, Respondents failed to implement sufficient
monitoring to ensure that their recordkeeping and communications policies were being followed.
Respondents’ Recordkeeping Failures Across the Brokerage Businesses
18. In September 2021, the Commission staff commenced a risk-based initiative to
investigate whether registrants were properly retaining business-related messages sent and
received on personal devices. Respondents cooperated with the investigation by voluntarily
interviewing a sampling of senior personnel from BNYMSC and Pershing and gathering and
reviewing messages found on the individuals’ personal devices. These personnel included senior
leadership, such as managing directors and desk heads.
19. The Commission staff’s investigation uncovered pervasive off-channel
communications at all seniority levels within BNYMSC and Pershing. The investigation
determined that all broker-dealer personnel sampled had engaged in at least some level of off-
channel communications. Overall, personnel sent and received numerous off-channel
communications, involving other Respondent personnel, BNYMSC’s and Pershing’s broker-
dealer customers and other participants in the securities industry. Within BNYMSC and
Pershing, a significant number of managing directors and heads of desks participated in off-
channel communications.
20. From at least January 2020, BNYMSC and Pershing personnel sent and received
off-channel messages that concerned their broker-dealer businesses.
21. For example, before the Commission’s investigation, a senior executive at
BNYMSC enabled an autodelete function on his personal iPhone but retained some messages on
his personal iPad. He exchanged off-channel business-related messages with at least seven
colleagues at BNYMSC and affiliated entities, including five colleagues he supervised. These
5
colleagues included other BNYMSC officers, a senior officer, and a senior vice president. These
messages related to the broker-dealer’s business and were exchanged over iMessage.
22. In addition, a managing director and head of a Pershing segment exchanged
numerous off-channel business-related messages with at least 50 Pershing and BNYMSC
colleagues; about four customers, investors, or other market participants; and with at least four
individuals at other financial firms. Within Pershing and BNYMSC, the managing director
communicated with managing directors, directors, vice presidents, and personnel under his
supervision. These messages related to the broker-dealer’s business and were exchanged over
iMessage.
23. In addition, before the Commission’s investigation, a desk head within BNYMSC
deleted messages from his personal phone. Still-extant records reflect that he exchanged
numerous off-channel business-related text messages with at least 40 colleagues at BNYMSC
and affiliated entities. These iMessage and WhatsApp messages related to the broker-dealer’s
business.
Respondents’ Failure to Preserve Required Records Potentially
Compromised and Delayed Commission Matters
24. During the period relevant to this Order, BNYMSC received and responded to
Commission subpoenas for documents and records requests in various Commission
investigations. By failing to maintain and preserve required records relating to its broker-dealer
business, BNYMSC likely deprived the Commission of these off-channel communications in
various investigations.
Respondents’ Violations and Failure to Supervise
25. As a result of the conduct described above, from at least January 2020 through the
date of this Order, Respondents willfully2 violated Section 17(a) of the Exchange Act and
Rule 17a-4(b)(4) thereunder.
26. As a result of the conduct described above, from at least January 2020 through the
date of this Order, Respondents failed reasonably to supervise their personnel with a view to
preventing or detecting certain of their supervised persons’ aiding and abetting violations of
Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder, within the meaning of
Section 15(b)(4)(E) of the Exchange Act.
Respondents’ Remedial Efforts
27. In determining to accept the Offers, the Commission considered steps promptly
undertaken and cooperation afforded the Commission staff by Respondents. Prior to and after
2 “Willfully,” for purposes of imposing relief under Section 15(b) of the Exchange Act and
Section 203(e) of the Advisers Act “‘means no more than that the person charged with the duty
knows what he is doing.’” See Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir 2000) (quoting
Hughes v. SEC, 174 F.2d 969, 977 (D.C. Cir. 1949)).
6
being approached by Commission staff, Respondents provided firm-approved messaging
applications to firm personnel to facilitate compliant communications.
Undertakings
28. Prior to this action, Respondents enhanced their policies and procedures, and
increased training concerning the use of approved communications methods, and began
implementing significant changes to the technology available to personnel. In addition,
Respondents have undertaken to:
29. Independent Compliance Consultant.
a. Respondents shall retain, within thirty (30) days of the entry of this Order, the
services of an independent compliance consultant (“Compliance Consultant”) that is not
unacceptable to the Commission staff. The Compliance Consultant’s compensation and
expenses shall be borne exclusively by Respondents.
b. Respondents will oversee the work of the Compliance Consultant.
c. Respondents shall provide to the Commission staff, within sixty (60) days of
the entry of this Order, a copy of the engagement letter detailing the Compliance
Consultant’s responsibilities, which shall include a comprehensive compliance review as
described below. Respondents shall require that, within ninety (90) days of the date of
the engagement letter, the Compliance Consultant conduct:
i. A comprehensive review of Respondents’ supervisory, compliance, and
other policies and procedures designed to ensure that Respondents’ electronic
communications, including those found on personal electronic devices, including
without limitation, cellular phones (“Personal Devices”), are preserved in
accordance with the requirements of the federal securities laws.
ii. A comprehensive review of training conducted by Respondents to
ensure personnel are complying with the requirements regarding the preservation
of electronic communications, including those found on Personal Devices, in
accordance with the requirements of the federal securities laws, including by
ensuring that Respondents’ personnel certify in writing on a quarterly basis that
they are complying with preservation requirements.
iii. An assessment of the surveillance program measures implemented by
Respondents to ensure compliance, on an ongoing basis, with the requirements
found in the federal securities laws to preserve electronic communications,
including those found on Personal Devices.
iv. An assessment of the technological solutions that Respondents have
begun implementing to meet the record retention requirements of the federal
securities laws, including an assessment of the likelihood that Respondents’
personnel will use the technological solutions going forward and a review of the
7
measures employed by Respondents to track employee usage of new
technological solutions.
v. An assessment of the measures used by Respondents to prevent the use
of unauthorized communications methods for business communications by
personnel. This assessment should include, but not be limited to, a review of
Respondents’ policies and procedures to ascertain if they provide for any
significant technology and/or behavioral restrictions that help prevent the risk of
the use of unapproved communications methods on Personal Devices (e.g.,
trading floor restrictions).
vi. A review of Respondents’ electronic communications surveillance
routines to ensure that electronic communications through approved
communications methods found on Personal Devices are incorporated into
Respondents’ overall communications surveillance program.
vii. A comprehensive review of the framework adopted by Respondents
to address instances of non-compliance by Respondents’ personnel with
Respondents’ policies and procedures concerning the use of Personal Devices to
communicate about firm business in the past. This review shall include a survey
of how Respondents determined which personnel failed to comply with
Respondents’ policies and procedures, the corrective action carried out, an
evaluation of who violated policies and why, what penalties were imposed, and
whether penalties were handed out consistently across business lines and seniority
levels.
d. Respondents shall require that, within forty-five (45) days after completion of
the review set forth in sub-paragraphs 29.c.i through c.vii above, the Compliance
Consultant shall submit a detailed written report of its findings to Respondents and to the
Commission staff (the “Report”). Respondents shall require that the Report include a
description of the review performed, the names of the individuals who performed the
review, the conclusions reached, the Compliance Consultant’s recommendations for
changes in or improvements to Respondents’ policies and procedures, and a summary of
the plan for implementing the recommended changes in or improvements to
Respondents’ policies and procedures.
e. Respondents shall adopt all recommendations contained in the Report within
ninety (90) days of the date of the Report; provided, however, that within forty-five (45)
days after the date of the Report, Respondents shall advise the Compliance Consultant
and the Commission staff in writing of any recommendations that Respondents consider
to be unduly burdensome, impractical, or inappropriate. With respect to any
recommendation that Respondents consider unduly burdensome, impractical, or
inappropriate, Respondents need not adopt such recommendation at that time, but shall
propose in writing an alternative policy, procedure, or disclosure designed to achieve the
same objective or purpose.
8
f. As to any recommendation concerning Respondents’ policies or procedures on
which Respondents and the Compliance Consultant do not agree, Respondents and the
Compliance Consultant shall attempt in good faith to reach an agreement within sixty
(60) days after the date of the Report. Within fifteen (15) days after the conclusion of the
discussion and evaluation by Respondents and the Compliance Consultant, Respondents
shall require that the Compliance Consultant inform Respondents and the Commission
staff in writing of the Compliance Consultant’s final determination concerning any
recommendation that Respondents consider to be unduly burdensome, impractical, or
inappropriate. Respondents shall abide by the determinations of the Compliance
Consultant and, within sixty (60) days after final agreement between Respondents and the
Compliance Consultant or final determination by the Compliance Consultant, whichever
occurs first, Respondents shall adopt and implement all of the recommendations that the
Compliance Consultant deems appropriate.
g. Respondents shall cooperate fully with the Compliance Consultant and shall
provide the Compliance Consultant with access to such of Respondents’ files, books,
records, and personnel as are reasonably requested by the Compliance Consultant for
review.
h. Respondents shall not have the authority to terminate the Compliance
Consultant or substitute another compliance consultant for the initial Compliance
Consultant, without the prior written approval of the Commission staff. Respondents
shall compensate the Compliance Consultant and persons engaged to assist the
Compliance Consultant for services rendered under this Order at their reasonable and
customary rates.
i. For the period of engagement and for a period of two (2) years from
completion of the engagement, Respondents shall not (i) retain the Compliance
Consultant for any other professional services outside of the services described in this
Order; (ii) enter into any other professional relationship with the Compliance Consultant,
including any employment, consultant, attorney-client, auditing or other professional
relationship; or (iii) enter, without prior written consent of the Commission staff, into any
such professional relationship with any of the Compliance Consultant’s present or former
affiliates, employers, directors, officers, employees, or agents acting in their capacity as
such.
j. The Report by the Compliance Consultant will likely include confidential
financial, proprietary, competitive business or commercial information. Public disclosure
of the Report could discourage cooperation, impede pending or potential government
investigations or undermine the objectives of the reporting requirement. For these
reasons, among others, the Report and the contents thereof are intended to remain and
shall remain non-public, except (1) pursuant to court order, (2) as agreed to by the parties
in writing, (3) to the extent that the Commission determines in its sole discretion that
disclosure would be in furtherance of the Commission’s discharge of its duties and
responsibilities, or (4) as otherwise required by law.
9
30. One-Year Evaluation. Respondents shall each require the Compliance Consultant
to assess Respondents’ respective programs for the preservation, as required under the federal
securities laws, of electronic communications, including those found on Personal Devices,
commencing one year after submitting the Report required by sub-paragraph 29.d above.
Respondents shall require this review to evaluate Respondents’ progress in the areas described in
sub-paragraph 29.c.i-vii above. After this review, Respondents shall require the Compliance
Consultant to submit a report (the “One Year Report”) to Respondents and the Commission staff
and shall ensure that the One Year Report includes an updated assessment of Respondents’
respective policies and procedures with regard to the preservation of electronic communications
(including those found on Personal Devices), training, surveillance programs, and technological
solutions implemented in the prior year period.
31. Reporting Discipline Imposed. For two (2) years following the entry of this Order,
Respondents shall notify the Commission staff as follows upon the imposition of any discipline
imposed by Respondents, including, but not limited to: written warnings; loss of any pay, bonus,
or incentive compensation; or the termination of employment; with respect to any employee found
to have violated Respondents’ respective policies and procedures concerning the preservation of
electronic communications, including those found on Personal Devices: at least forty-eight (48)
hours before the filing of a Form U-5, or within ten (10) days of the imposition of other discipline.
32. Internal Audit. In addition to the Compliance Consultant’s review and issuance of
the One Year Report, Respondents will also have their Internal Audit function conduct a separate
audit(s) to assess Respondents’ progress in the areas described in sub-paragraphs 29.c.i-vii above.
After completion of this audit(s), Respondents shall ensure that Internal Audit submits a report to
Respondents and to the Commission staff.
33. Recordkeeping. Respondents shall preserve, for a period of not less than six (6)
years from the end of the fiscal year last used, the first two (2) years in an easily accessible place,
any record of compliance with these undertakings.
34. Deadlines. For good cause shown, the Commission staff may extend any of the
procedural dates relating to the undertakings. Deadlines for procedural dates shall be counted in
calendar days, except that if the last day falls on a weekend or federal holiday, the next business
day shall be considered to be the last day.
35. Certification. Respondents shall certify, in writing, compliance with the
undertakings set forth above. The certification shall identify the undertakings, provide written
evidence of compliance in the form of a narrative, and be supported by exhibits sufficient to
demonstrate compliance. The Commission staff may make reasonable requests for further
evidence of compliance, and Respondents agree to provide such evidence. The certification and
supporting material shall be submitted to Alison R. Levine, Assistant Regional Director,
Division of Enforcement, New York Regional Office, Securities and Exchange Commission, 100
Pearl Street, Suite 20-100, New York, NY, 10004-2616, or such other person as the Commission
staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division, no
later than sixty (60) days from the date of the completion of the undertakings.
10
IV.
In view of the foregoing, the Commission deems it appropriate and in the public interest
to impose the sanctions agreed to in Respondents’ Offers.
Accordingly, pursuant to Sections 15(b) and 21C of the Exchange Act as to BNYMSC
and Pershing, and pursuant to Section 203(e) of the Advisers Act as to BNYMSC, it is hereby
ORDERED that:
A. Respondents cease and desist from committing or causing any violations and any
future violations of Section 17(a) of the Exchange Act and Rule 17a-4 thereunder.
B. Respondents are censured.
C. Respondents shall comply with the undertakings enumerated in paragraphs 30 to
36 above.
D. Respondents, jointly and severally, shall, within 14 days of the entry of this
Order, pay a civil money penalty in the amount of $40,000,000 to the Securities and Exchange
Commission for transfer to the general fund of the United States Treasury, subject to Exchange
Act Section 21F(g)(3). If timely payment is not made, additional interest shall accrue pursuant
to 31 U.S.C. § 3717.
Payment must be made in one of the following ways:
(1) Respondents may transmit payment electronically to the Commission,
which will provide detailed ACH transfer/Fedwire instructions upon
request;
(2) Respondents may make direct payment from a bank account via Pay.gov
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or
(3) Respondents may pay by certified check, bank cashier’s check, or United
States postal money order, made payable to the Securities and Exchange
Commission and hand-delivered or mailed to:
Enterprise Services Center
Accounts Receivable Branch
HQ Bldg., Room 181, AMZ-341
6500 South MacArthur Boulevard
Oklahoma City, OK 73169
Payments by check or money order must be accompanied by cover letters identifying
BNYMSC and Pershing as the Respondents in these proceedings, and the file number of these
proceedings; a copy of the cover letter and check or money order must be sent to Thomas P.
11
Smith, Jr., Associate Regional Director, Securities and Exchange Commission, 100 Pearl Street,
Suite 20-100, New York, New York 10004-2616.
E. Amounts ordered to be paid as civil money penalties pursuant to this Order shall
be treated as penalties paid to the government for all purposes, including all tax purposes. To
preserve the deterrent effect of the civil penalty, Respondents agree that in any Related Investor
Action, they shall not argue that they are entitled to, nor shall they benefit by, offset or reduction
of any award of compensatory damages by the amount of any part of Respondents’ payment of a
civil penalty in this action (“Penalty Offset”). If the court in any Related Investor Action grants
such a Penalty Offset, Respondents agree that they shall, within 30 days after entry of a final
order granting the Penalty Offset, notify the Commission’s counsel in this action and pay the
amount of the Penalty Offset to the Securities and Exchange Commission. Such a payment shall
not be deemed an additional civil penalty and shall not be deemed to change the amount of the
civil penalty imposed in this proceeding. For purposes of this paragraph, a “Related Investor
Action” means a private damages action brought against Respondents by or on behalf of one or
more investors based on substantially the same facts as alleged in the Order instituted by the
Commission in this proceeding.
By the Commission.
Vanessa A. Countryman
Secretary