SEC Charges 6 Credit Rating Agencies with significant recordkeeping failures. The Firms admit to wrongdoing and agree to pay penalties totaling more than $49 million to settle SEC charges.

The Securities and Exchange Commission (SEC) announced charges against six nationally recognized statistical rating organizations (NRSROs) for failing to maintain and preserve electronic communications as required by federal securities laws. The firms admitted to the violations, agreed to pay over $49 million in combined civil penalties, and have begun implementing improvements to their compliance policies.

• SEC Order - Moody's Investors Service, Inc
• SEC Order - S&P Global Ratings
• SEC Order - Fitch Ratings, Inc.
• SEC Order - HR Ratings de México, S.A. de C.V.
• SEC Order - A.M. Best Rating Services, Inc.
• SEC Order - Demotech, Inc.

Penalties Imposed:

• Moody’s Investors Service, Inc.: $20 million civil penalty
• S&P Global Ratings: $20 million civil penalty
• Fitch Ratings, Inc.: $8 million civil penalty
• HR Ratings de México, S.A. de C.V.: $250,000 civil penalty
• A.M. Best Rating Services, Inc.: $1 million civil penalty
• Demotech, Inc.: $100,000 civil penalty

SEC Order - Moody's Investors Service, Inc

The SEC investigation revealed significant failures in Moody's retention of business-related electronic communications, particularly those conducted through off-channel platforms like text messages and WhatsApp. Despite having policies in place since at least 2020 prohibiting the use of non-email communication methods for business purposes, Moody’s Ratings employees, including senior staff, frequently used these platforms for credit rating activities without retaining the records as required by law.

• Moody’s Ratings had policies prohibiting the use of text messages and instant messaging apps for business communications, mandating the use of official email systems instead.
• Specific incidents include senior staff exchanging off-channel messages about credit rating committee meetings and client-related discussions.
• From at least January 2020, employees, including those at senior levels, used off-channel communication methods for discussions related to credit rating activities, which were not retained or monitored.
  • Between at least December 2020 and March 2022, an Associate Managing Director exchanged numerous off-channel communications relating to Credit Rating Activities for various credit rating clients with multiple other Moody’s Ratings employees, including communications regarding their reactions to comments made by other Moody’s Ratings employees during credit rating committee meetings and other internal meetings involving Credit Rating Activities.
• In March 2023, an SEC investigation found widespread use of off-channel communications among Moody’s Ratings employees, including discussions on rating decisions and client meetings.
  • For example, in March 2023, an Associate Managing Director who serves as the Head of Relationship Management for a line of business in Moody’s Ratings Commercial Group exchanged off-channel communications with a Managing Director in the Commercial Group in which they discussed a meeting with a credit rating client regarding whether Moody’s Ratings could rate a new product developed by the credit rating client.

SEC Order - S&P Global Ratings

S&P Ratings had policies in place to ensure the retention of business-related communications, requiring employees to use approved digital platforms for such exchanges. However, until August 2023, S&P failed to specify which platforms were approved, leading to widespread use of unmonitored and unretained messaging platforms like WhatsApp.

The SEC's investiaation revealed that many S&P employees, including senior executives, used these off-channel methods for internal and external communications related to credit rating activities. These communications, which should have been retained and monitored as per regulatory requirements, included critical discussions on credit rating decisions, criteria, and client interactions.

The SEC’s probe uncovered extensive use of these off-channel communications, which likely hampered the Commission's ability to assess compliance and investigate potential violations of federal securities laws. The failure to preserve these records raises concerns about the integrity of S&P’s credit rating processes and their adherence to regulatory standards.

For example, between at least March and June 2022, a managing director and an associate director exchanged numerous off-channel communications relating to credit rating clients, including their reactions to comments made by other S&P Ratings employees during credit rating committee meetings and other internal meetings discussing Credit Rating Activities.

In addition, between at least July 2021 and November 2021, a senior director exchanged numerous off-channel communications with multiple credit rating clients, which communications included discussions relating to Credit Rating Activities, such as credit rating committee meetings, S&P Ratings credit rating criteria, and comments made in meetings between S&P Ratings employees and the credit rating clients.

As another example, in November 2021, two associate analysts discussed, through off-channel communications, presenting the quantitative testing results for a transaction involving a particular credit rating client at a credit rating committee meeting.

SEC Order - Fitch Ratings, Inc.

Despite having policies in place since at least 2020 to ensure the retention of business-related communications, many Fitch employees, including senior executives, have been found to use unapproved messaging platforms like WhatsApp and WeChat for credit rating activities. These off-channel communications were not monitored, reviewed, or archived, contrary to regulatory requirements.

The SEC launched an investigation in August 2022 to assess whether Fitch Ratings was properly retaining communications related to credit rating activities. The investigation uncovered widespread use of these unmonitored channels, with multiple instances of critical discussions about credit ratings taking place outside approved communication methods. These lapses likely hindered the SEC’s ability to detect potential compliance issues and violations of federal securities laws during their examinations.

For example, on May 24, 2020, a Fitch Ratings senior director and associate director exchanged multiple off-channel communications, via WhatsApp, relating to Credit Rating Activities, including recommendations regarding a rating to be considered at an upcoming rating committee meeting.

In addition, between October and December 2022, a Fitch Ratings associate director and a representative of a credit rating client exchanged numerous off-channel communications, via WhatsApp, relating to Credit Rating Activities, including communications regarding the terms of a proposal for a rating engagement.

Fitch Ratings has cooperated with the investigation, but the findings raise serious concerns about the integrity of the company’s compliance with regulatory standards and the transparency of its credit rating processes...

SEC Order - HR Ratings de México, S.A. de C.V.

Despite having policies in place since 2020 to retain business-related communications, HR Ratings failed to monitor or archive critical communications conducted through unapproved platforms like WhatsApp.

The SEC's investigation revealed that HR Ratings employees, including senior executives, frequently used WhatsApp for communications related to credit rating activities. These off-channel communications were not retained or monitored, violating regulatory requirements. Although HR Ratings approved the use of Slack for internal messaging in October 2022, the company did not implement a policy for preserving communications on mobile devices until August 2023.

The SEC’s probe uncovered widespread use of these unmonitored channels, with numerous instances of critical discussions about credit ratings taking place outside approved systems. This failure likely impeded the SEC’s ability to identify compliance deficiencies and potential violations of federal securities laws during their examinations of HR Ratings.

For example, on September 28, 2022, a senior executive director exchanged numerous off-channel communications via WhatsApp relating to Credit Rating Activities with a ratings analyst. Some of these messages attached snapshots of internal draft reports.

HR Ratings has cooperated with the investigation, but like with Fitch and the others, the findings raise concerns about the company’s adherence to regulatory standards and the integrity of its credit rating processes.

SEC Order - A.M. Best Rating Services, Inc.

A.M. Best Rating Services, despite having policies in place since at least 2020 aimed at preserving electronic communications, many employees, including senior executives, used personal devices for critical communications related to credit rating activities, which were not retained or monitored.

A.M. Best Rating Services had implemented mobile device management technology on firm-issued devices as early as 2014 to ensure the retention of electronic communications. However, this technology did not extend to personal devices, leading to significant gaps in recordkeeping.

The SEC's investigation found that a majority of the employees sampled had engaged in off-channel communications on their personal devices. These communications, which involved discussions related to credit rating decisions and interactions with clients, were not archived as required by regulatory standards.

For example, from December 2, 2022 to December 15, 2022, a managing director exchanged numerous off-channel communications, on his personal device, relating to Credit Rating Activities with a representative of a potential client...

SEC Order - Demotech, Inc.

Before July 2023, Demotech had no clear guidelines on which communication methods were approved for discussions about credit rating activities. This gap allowed employees, including senior executives, to engage in off-channel communications that were not preserved, undermining regulatory compliance. It wasn't until July 2023 that Demotech implemented a policy explicitly prohibiting the use of unapproved email or messaging systems for business-related communications without board approval.

The SEC’s investigation uncovered widespread use of off-channel communications across all levels of the company, involving both internal discussions and interactions with clients. Notably, in the weeks following Demotech's registration as an NRSRO, a senior executive engaged in numerous unmonitored exchanges with both the CEO of a credit rating client and Demotech's ratings analysts. These communications included discussions on credit rating decisions and sensitive internal templates.

For example, in the weeks immediately after Demotech registered as an NRSRO, a senior executive exchanged numerous off-channel communications with the Chief Executive Officer of a credit rating client relating to Credit Rating Activities. That same senior executive also exchanged multiple off-channel communications with Demotech ratings analysts, including a credit analyst supervisor, relating to Credit Rating Activities with respect to the same client.

Demotech has cooperated with the SEC's investigation, but the findings raise serious concerns about the agency’s compliance with federal regulations and the integrity of its credit rating processes.

TLDRS:

The Securities and Exchange Commission (SEC) announced charges against six nationally recognized statistical rating organizations (NRSROs) for failing to maintain and preserve electronic communications, particularly those conducted through off-channel platforms like text messages and WhatsApp. as required by federal securities laws. The firms admitted to the violations, agreed to pay over $49 million in combined civil penalties, and have begun implementing improvements to their compliance policies.

Penalties Imposed:

• Moody’s Investors Service, Inc.: $20 million civil penalty
• S&P Global Ratings: $20 million civil penalty
• Fitch Ratings, Inc.: $8 million civil penalty
• HR Ratings de México, S.A. de C.V.: $250,000 civil penalty
• A.M. Best Rating Services, Inc.: $1 million civil penalty
• Demotech, Inc.: $100,000 civil penalty