Security News > 2023 > June > JP Morgan accidentally deletes evidence in multi-million record retention screwup

JP Morgan has been fined $4 million by the US Securities and Exchange Commission for deleting millions of email records dating from 2018 relating to its Chase Bank subsidiary.

The Financial services outfit apparently deleted somewhere in the region of 47 million electronic communications records from about 8,700 electronic mailboxes covering the period January 1 through to April 23, 2018.

The trouble for JP Morgan can be traced to a project where the company aimed to delete from its systems any older communications and documents that were no longer required to be retained.

For its part, JP Morgan places the blame squarely on an unnamed archiving vendor that it hired to handle the storage for its communications.

The vendor had apparently assured both JP Morgan and the Financial Industry Regulatory Authority on multiple occasions that its media storage complied with the relevant Exchange Act rules regarding the 36 month retention period, and therefore documents falling within that period were protected from deletion.

The SEC found that JP Morgan had "Wilfully violated Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder" which require broker-dealers to preserve for at least three years all communications received and copies of all communications sent relating to its business.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/06/26/jp_morgan_fined_for_deleting/