Don't feel bad. I've been in the industry. I've been fined for failing to log communications properly. I've been in conversations with Katten about this very topic, and you are not correct.
My fine happened to be that we logged every single piece of email communication, but we used a vendor who wasn't Finra approved to do the logging. The idea that the SEC cares about logging communications is most certainly the pitch that they give for why they're doing what they're doing. But it's not reality.
These fines exist for exactly two purposes: (1) so the government can put out PR that they're totally doing their job and regulating the banks, when we all know they are just a revolving door to the banks. And (2) to create 'regulatory capture' for the banks, who will gladly fork over a few hundred million per year so long as it makes it too difficult for their competitors to navigate the regulatory landscape. As we were told, there's mostly nothing you can do to avoid the fines. They invent a new reason to fine you ever year. View it as a tax, and hope they don't raise the taxes next year.
> The SEC is absolutely fine with these communications being encrypted, as long as they are logged by the employer.
From a factual standpoint, this is just wrong. Unless you mean they log the decrypted messages. The SEC has rules about the format you must log in, and encrypted is not one of them.