The Blubber

The SEC has charged six credit rating agencies with "significant recordkeeping failures."

The Securities and Exchange Commission (SEC) announced today that it has charged six nationally recognized statistical rating organizations (NRSROs) for significant failures in maintaining and preserving electronic communications. These firms admitted to the facts in the SEC's orders, acknowledged that their actions violated the recordkeeping provisions of federal securities laws, and agreed to pay a total of more than $49 million in civil penalties. Additionally, they have started implementing improvements to their compliance policies to address these issues.

The penalties for each firm are as follows:

• Moody’s Investors Service, Inc.: $20 million
• S&P Global Ratings: $20 million
• Fitch Ratings, Inc.: $8 million
• HR Ratings de México, S.A. de C.V.: $250,000
• A.M. Best Rating Services, Inc.: $1 million
• Demotech, Inc.: $100,000

Except for A.M. Best and Demotech, the other credit rating agencies are required to hire a compliance consultant. A.M. Best and Demotech were not required to do so because they made significant early efforts to comply with the recordkeeping rules and cooperated with the SEC's investigation.

"We have repeatedly seen that failures in maintaining required records can impede the staff's ability to ensure firms are meeting their obligations, often to the detriment of investors," said Sanjay Wadhwa, Deputy Director of the SEC’s Division of Enforcement. "Today’s actions reinforce the Commission’s message that firms benefit from making serious efforts to comply and cooperate with investigations."

All six firms were charged with violating Section 17(a)(1) of the Securities Exchange Act of 1934 and Rule 17g-2(b)(7). In addition to financial penalties, each firm was ordered to cease and desist from future violations and was censured. The four firms that must retain compliance consultants have also agreed to conduct thorough reviews of their policies regarding the retention of electronic communications on personal devices and the measures taken when employees fail to comply with those policies.