FINRA disciplined a chief compliance officer (CCO) in April 2019 through an AWC for failing to ensure that his firm captured, retained, and reviewed business-related emails. The firm’s written supervisory procedures (WSPs) delegated the CCO as “responsible for [the firm’s] supervision (including compliance with the [email review and retention] rules identified above), the review of emails, and the maintenance of the firm’s books and records.” The CCO, however, did not take any steps to review or retain on behalf of the firm representatives’ emails. Specifically, the CCO failed to ensure that the firm captured, reviewed, or retained emails sent and received by one representative, as well as certain business-related emails sent and received by the CCO himself through his outside email address.

The CCO failed to fulfill these retention and review requirements concerning an investment banking representative associated with the firm through a d/b/a entity. The CCO knew of the representative’s use of a third-party email address associated with the d/b/a. However, the CCO failed to take any steps to review or capture the representative’s use of email through the d/b/a email domain until January 2015. Even then, although he took steps to capture the emails, they could still have been permanently deleted through June 2015.

With regard to his own emails, the CCO almost exclusively used a third-party email account instead of his firm account to conduct firm business. FINRA found that he sent only three electronic communications, which were calendar invitations, using the firm’s email address during the relevant period. During the investigation, the CCO was unable to produce all of his business-related emails sent via his third-party account. Thus, the CCO failed to adequately retain his own email.

As a result of these violations and other conduct, the CCO was fined $5,000 and suspended for 30 days from associating with any FINRA member in any capacity.