On September 24, 2024, the U.S. Commodity Futures Trading Commission (CFTC) ordered the Canadian Imperial Bank of Commerce to pay a $30 million civil penalty. The regulator found that CIBC had failed to stop employees from using unapproved methods such as personal text messages to discuss business. Those messages were required to be kept, and they generally were not.
The case comes from banking, where record-keeping rules are strict and specific. A similar risk exists in any organization where staff settle business decisions over personal messaging, because the record of how those decisions were made can leave with the phone.
Unapproved communication took place from at least September 2018 until the date of the order.
Employees at all levels used unapproved channels, including senior staff and some of the supervisors responsible for enforcing compliance.
CIBC admitted the facts, agreed to cease and desist and committed to specific remedial steps. The order credited its cooperation.
Source: CFTC Release 8975-24
What the Regulator Found
CIBC is registered with the CFTC as a swap dealer, which means it must keep written business communications related to that work. According to the CFTC release, CIBC's own policies generally prohibited the use of unapproved channels.
The order also states that some supervisory staff who were responsible for making sure employees followed the rules were using unapproved methods themselves. Because the messages were not preserved, the bank likely could not have produced them promptly if the regulator had asked.
Some of the people responsible for enforcing the policy were using unapproved channels too.
On the same day, the U.S. Securities and Exchange Commission announced a separate US$12 million penalty against two CIBC affiliates for related record-keeping failures.
Part of a Wider Enforcement Pattern
CIBC was one of many institutions charged over the same issue. The CFTC reports that since December 2021 it has imposed a combined $1.237 billion in penalties on 27 financial institutions for unapproved communication methods. The SEC settled with 12 firms on the same day as the CIBC order, with 11 of them paying penalties that totalled US$88.2 million.
Self-reporting made a visible difference. Investment Executive reported that Canaccord Genuity paid US$1.25 million after it came forward on its own, and one firm in the SEC group paid no penalty because it self-reported and showed substantial compliance efforts.
A communications audit maps where your team actually communicates and where decisions are recorded, so gaps surface before an access request or a dispute.
Explore Communications AuditsWhy This Matters Outside Banking
Public bodies in Alberta work under their own record-keeping rules. The Access to Information Act came into force on June 11, 2025, and applies to municipalities, police services, school boards, post-secondary institutions and provincial agencies, among others.
Text messages are part of that picture. A Government of Alberta directive approved in 2021 states that instant or text message exchanges capturing a government business decision or transaction are official records. It also states that staff should not treat a message as transitory if there is any doubt about its status.
For project teams, this can include the text that confirms a schedule change or the chat thread where a design decision was settled. If those exchanges matter to the project record, they need a place to live beyond one person's phone. Our guide to communications audits for Alberta public organizations covers how to review this.
Lessons for Internal Communication
A written policy is the starting point. CIBC had a policy that prohibited unapproved channels. Changing daily habits takes training and regular checks.
Make the approved tools easy to use. An approved platform that works well on a phone in the field gives staff fewer reasons to switch to personal messaging.
Leaders need to use the approved tools too. At CIBC, senior staff and some supervisors were among those using unapproved channels.
Decide in advance what counts as a record. Give staff a simple test for when a message needs to be saved and where it goes. The Alberta directive uses the presence of a business decision or transaction as that test.
Come forward early when something goes wrong. In the 2024 SEC group, firms that self-reported received lower penalties. Our post on communication mistakes that damage credibility looks at what happens when organizations wait.
- Which channels do our staff actually use to make decisions day to day?
- Could we produce the messages behind a key project decision if asked?
- Do our leaders use the same approved tools they ask staff to use?
- Do staff know which messages count as records and where to save them?
- Who do staff tell when they realize a record was not kept?
Do you know where your team's decisions are being made?
We help Alberta organizations review how their teams communicate and build internal communication practices people will follow.
