On January 16, 2024, the Securities and Exchange Commission announced a settled enforcement action against JP Morgan Securities, LLC (“JPMS”) for violating Rule 21F-17(a) of the Securities Exchange Act of 1934. Like other recent 21F-17(a) cases brought by the SEC, the case involved a claim that certain confidentiality language in an agreement with individuals would impede those individuals from reporting potential securities law violations to the SEC in violation of Rule 21F-17(a), which, in relevant part, states, “[n]o person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications.” Of note, this whistleblower protection action is the first that the SEC has brought in relation to a firm’s standard settlement agreements with retail investors, as opposed to employees.

According to the SEC’s order, from 2020 to July 2023, JPMS regularly sent a confidential release agreement to retail clients to whom it had issued a credit or settlement over $1,000 (the “Release”). A section of the Release required that clients keep not only the credit or settlement arrangement confidential, but also required that the clients not disclose “the allegations, facts, contentions, liability, damages, or any other information relating in any way to the” account involved in the credit or settlement arrangement. The Release also included a provision by which the clients “promised not to sue or solicit others to institute any action or proceeding against JPMS arising out of events concerning” their accounts.

The SEC acknowledged that the Release expressly permitted JPMS clients to respond to inquiries made by the SEC or any other government or self-regulatory entity. However, the agreement did not include a provision that expressly permitted clients to voluntarily report information to SEC staff without risking legal action. Absent such an explicit carve out, the SEC found in the order that “the terms of the Release prohibited clients from affirmatively reporting to the Commission staff in violation of Rule 21F-17(a).” Notably, the SEC recognized that JPMS reported several of the underlying client disputes to FINRA, but found that such steps did not mitigate the language that potentially impeded clients from affirmatively reporting to the SEC.

As with other recent settlements, the SEC order recognized prompt remedial actions taken by JPMS with respect to the contractual provisions in question. The order notes that after the SEC informed JPMS about the violation, the firm revised the paragraph at issue to include language advising clients that they were not prohibited from affirmatively disclosing information to any government or regulatory authority. JPMS also notified clients who had received the earlier version of the Release that they were not prohibited from voluntarily communicating with government or regulatory authorities about their accounts, the Release, any underlying facts, circumstances, disputes or concerns.

In resolving the matter, the SEC censured JPMS and ordered the firm to pay a civil monetary penalty of $18 million. This penalty is the largest that the SEC has enforced for a standalone 21F-17(a) violation, nearly doubling the next largest penalty of $10 million. This unprecedented penalty likely reflects SEC Director of Enforcement Gurbir Grewal’s efforts to “re-calibrate penalties to more effectively promote deterrence, and get away from the idea that penalties are just another business expense” including at large institutions. The SEC’s order against JPMS marks an escalation in both the size of penalties that the SEC is willing to impose and the scope of agreements the Commission is scrutinizing for whistleblower-related actions.