In re Intesa Sanpaolo IMI

UNITED STATES OF AMERICA 
 Before the 
 SECURITIES AND EXCHANGE COMMISSION 
 
SECURITIES EXCHANGE ACT OF 1934 
Release No. 101139 / September 24, 2024 
 
ADMINISTRATIVE PROCEEDING 
File No. 3-22161 
 
 
In the Matter of 
 
Intesa Sanpaolo IMI 
Securities Corp.,  
 
Respondent. 
ORDER INSTITUTING 
ADMINISTRATIVE AND CEASE-AND-
DESIST PROCEEDINGS, PURSUANT TO 
SECTIONS 15(b) AND 21C OF THE 
SECURITIES EXCHANGE ACT OF 1934, 
MAKING FINDINGS, AND IMPOSING 
REMEDIAL SANCTIONS AND A CEASE-
AND-DESIST ORDER 
 
I. 
 The Securities and Exchange Commission (“Commission”) deems it appropriate and in 
the public interest that public administrative and cease-and-desist proceedings be, and hereby 
are, instituted pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934 
(“Exchange Act”) against Intesa Sanpaolo IMI Securities Corp. (“Respondent” or “Intesa 
Sanpaolo”). 
 
II. 
 In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of Settlement (“Offer”) that the Commission has determined to accept.  Respondent admits the 
facts set forth in Section III below, acknowledges that its conduct violated the federal securities 
laws, admits the Commission’s jurisdiction over it and the subject matter of these proceedings, and 
consents to the entry of this Order Instituting Administrative and Cease-and-Desist Proceedings, 
Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934, Making Findings, 
and Imposing Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below.   
 
III. 
 On the basis of this Order and Respondent’s Offer, the Commission finds
1
 that: 
 
                                                 
1
  The findings herein are made pursuant to Respondent’s Offer of Settlement and are not 
binding on any other person or entity in this or any other proceeding.  

Summary 
1. The federal securities laws impose recordkeeping requirements on broker-dealers 
to ensure that they responsibly discharge their crucial role in our markets. The Commission has 
long said that compliance with these requirements is essential to investor protection and the 
Commission’s efforts to further its mandate of protecting investors, maintaining fair, orderly, and 
efficient markets, and facilitating capital formation. 
2. These proceedings arise out of the widespread and longstanding failure of Intesa 
Sanpaolo personnel, including at senior levels, to adhere to certain of these essential 
requirements and Intesa Sanpaolo’s own policies and procedures. Using their personal devices, 
these personnel communicated by text messages and/or other unapproved written 
communications platforms, such as WhatsApp (“off-channel communications”). 
3. From at least August 2020 (the “Relevant Period”), Intesa Sanpaolo personnel 
sent and received off-channel communications that related to its broker-dealer business.  
Respondent did not maintain or preserve the substantial majority of these written 
communications.  Respondent’s failure was firm-wide and involved personnel at various levels 
of authority.  As a result, Intesa Sanpaolo violated Section 17(a) of the Exchange Act and Rule 
17a-4(b)(4) thereunder. 
4. Intesa Sanpaolo’s supervisors, who were responsible for supervising junior 
personnel, routinely communicated off-channel using their personal devices.  In fact, senior 
personnel responsible for supervising junior personnel themselves failed to comply with Intesa 
Sanpaolo’s policies and procedures by communicating through non-Intesa Sanpaolo approved 
methods, on their personal devices about Intesa Sanpaolo’s broker-dealer business. 
5. Intesa Sanpaolo’s widespread failure to implement its policies and procedures that 
prohibit such communications led to its failure to reasonably supervise its personnel within the 
meaning of Section 15(b)(4)(E) of the Exchange Act.     
6. The Commission staff uncovered Intesa Sanpaolo’s misconduct after commencing 
a risk-based initiative to investigate the use of off-channel and unpreserved communications at 
broker-dealers.  Intesa Sanpaolo has initiated a review of its recordkeeping failures and begun a 
program of remediation.  As set forth in the Undertakings below, Intesa Sanpaolo will retain an 
independent compliance consultant to review and assess Intesa Sanpaolo’s remedial steps 
relating to its recordkeeping practices, policies and procedures, related supervisory practices, and 
employment actions. 
Respondent 
7. Intesa Sanpaolo is a Delaware corporation with its principal office in New York, 
New York.  Intesa Sanpaolo has been registered with the Commission as a broker-dealer since 
April 1987.  It is indirectly controlled by Intesa Sanpaolo S.p.A., the parent company of the 
Italian banking group Intesa Sanpaolo.    

Recordkeeping Requirements Under the Exchange Act 
8. Section 17(a)(1) of the Exchange Act authorizes the Commission to issue rules 
requiring broker-dealers to make and keep for prescribed periods, and furnish copies of, such 
records as necessary or appropriate in the public interest, for the protection of investors or 
otherwise in furtherance of the purposes of the Exchange Act. 
9. The Commission adopted Rule 17a-4 under the Exchange Act pursuant to this 
authority.  Rule 17a-4 specifies the manner and length of time that the records made in 
accordance with other Commission rules, and certain other records made by broker-dealers, must 
be maintained and produced promptly to Commission representatives.   
10. The rules adopted under Section 17(a)(1) of the Exchange Act, including Rule 
17a-4(b)(4), require that broker-dealers preserve for at least three years, the first two years in an 
easily accessible place, originals of all communications received and copies of all 
communications sent relating to the broker-dealer’s business as such.  These rules impose 
minimum recordkeeping requirements that are based on standards a prudent broker-dealer should 
follow in the normal course of business.  
11. The Commission previously has stated that these and other recordkeeping 
requirements “are an integral part of the investor protection function of the Commission, and 
other securities regulators, in that the preserved records are the primary means of monitoring 
compliance with applicable securities laws, including antifraud provisions and financial 
responsibility standards.”  Commission Guidance to Broker-Dealers on the Use of Electronic 
Storage Media under the Electronic Signatures in Global and National Commerce Act of 2000 
with Respect to Rule 17a-4(f), 17 C.F.R. Part 241, Exchange Act Rel. No. 44238 (May 1, 2001). 
Respondent’s Policies and Procedures 
12. Intesa Sanpaolo maintained certain policies and procedures designed to ensure the 
retention of business-related records, including electronic communications, in compliance with 
the relevant recordkeeping provisions.   
13. Intesa Sanpaolo personnel were advised that the use of unapproved electronic 
communications methods, including on their personal devices, was not permitted, and they 
should not use personal email, chats or text messaging applications for business purposes, or 
forward work-related communications to unapproved applications on their personal devices.  
14. Messages sent through firm-approved communications methods were monitored, 
subject to review, and archived.  Messages sent through unapproved communications methods, 
such as WhatsApp and Signal on personal devices, were not monitored, subject to review or 
archived. 
15. Intesa Sanpaolo’s policies and procedures were designed to address supervisors’ 
supervision of personnel’s training in Intesa Sanpaolo’s communications policies and adherence 
to Intesa Sanpaolo’s books and recordkeeping requirements.  Supervisory policies notified 
personnel that electronic communications were subject to surveillance by Intesa Sanpaolo.  

Intesa Sanpaolo had procedures for all personnel, including supervisors, requiring annual self-
attestations of compliance.  
16. Intesa Sanpaolo failed to implement a system reasonably expected to determine 
whether all personnel, including supervisors, were following Intesa Sanpaolo’s policies and 
procedures.  Intesa Sanpaolo prohibited personnel from using their personal phones for business 
communications, except for one rarely used application.  Intesa Sanpaolo failed to implement 
sufficient monitoring to ensure that its recordkeeping and communications policies were being 
followed.  
Respondent’s Recordkeeping Failures Across Its Brokerage Business 
17. In September 2021, the Commission staff commenced a risk-based initiative to 
investigate whether broker-dealers were properly retaining business-related messages sent and 
received on personal devices.  Intesa Sanpaolo cooperated with the investigation by voluntarily 
interviewing a sampling of senior personnel and gathering and reviewing messages found on the 
individuals’ personal devices.  These personnel included senior leadership, such as a senior 
executive and managing directors.  
18. The Commission staff’s investigation uncovered pervasive off-channel 
communications at all seniority levels within Intesa Sanpaolo.  The investigation determined that 
nearly all broker-dealer personnel sampled had engaged in at least some level of off-channel 
communications.   
19. Overall, personnel sent and received numerous off-channel communications, 
involving other Intesa Sanpaolo personnel.  Within Intesa Sanpaolo, significant numbers of 
senior personnel participated in off-channel communications. 
20. During the Relevant Period, Intesa Sanpaolo personnel sent and received off-
channel messages that concerned the broker-dealer’s business. 
21. For example, a senior executive exchanged numerous off-channel business-related 
messages with at least five other Intesa Sanpaolo colleagues.  These messages related to the 
broker-dealer’s business as such. 
22. In addition, a managing director exchanged numerous off-channel business-
related messages with at least 15 other Intesa Sanpaolo colleagues.  These messages related to 
the broker-dealer’s business as such. 
23. Furthermore, a managing director exchanged numerous off-channel business-
related messages with at least five other Intesa Sanpaolo colleagues.  These messages related to 
the broker-dealer’s business as such. 

Respondent’s Violations and Failure to Supervise 
24. As a result of the conduct described above, Respondent willfully
2
 violated Section 
17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder. 
25. As a result of the conduct described above, Respondent failed reasonably to 
supervise its personnel with a view to preventing or detecting certain of its personnel’s aiding 
and abetting violations of Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder, 
within the meaning of Section 15(b)(4)(E) of the Exchange Act.  
Respondent’s Efforts to Comply 
26. In determining to accept the Offer, the Commission considered steps promptly 
undertaken by Intesa Sanpaolo prior to and after being approached by the Commission staff, and 
cooperation afforded the Commission staff by Intesa Sanpaolo.  Prior to this action, Respondent 
enhanced its policies and procedures, and increased training concerning the use of approved 
communications methods, including on personal devices.  It also began implementing significant 
changes to the technology available to personnel, including providing firm personnel with firm-
issued devices. 
Undertakings 
Respondent has undertaken to: 
27. Independent Compliance Consultant. 
a.  Intesa Sanpaolo shall retain, within thirty (30) days of the entry of this Order, 
the services of an independent compliance consultant (“Compliance Consultant”) that is 
not unacceptable to the Commission staff.  The Compliance Consultant’s compensation 
and expenses shall be borne exclusively by Intesa Sanpaolo. 
 
b.  Intesa Sanpaolo will oversee the work of the Compliance Consultant. 
 
c.  Intesa Sanpaolo shall provide to the Commission staff, within sixty (60) days 
of the entry of this Order, a copy of the engagement letter detailing the Compliance 
Consultant’s responsibilities, which shall include a comprehensive compliance review as 
described below.  Intesa Sanpaolo shall require that, within ninety (90) days of the date of 
the engagement letter, the Compliance Consultant conduct: 
 
i.  A comprehensive review of Intesa Sanpaolo’s supervisory, compliance, 
and other policies and procedures designed to ensure that Intesa Sanpaolo’s 
electronic communications, including those found on personal electronic devices, 
                                                 
2
  “Willfully,” for purposes of imposing relief under Section 15(b) of the Exchange Act, 
“‘means no more than that the person charged with the duty knows what he is doing.’”  
Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir 2000) (quoting Hughes v. SEC, 174 F.2d 969, 
977 (D.C. Cir. 1949)).  

including without limitation, cellular phones (“Personal Devices”), are preserved 
in accordance with the requirements of the federal securities laws. 
 
ii.  A comprehensive review of training conducted by Intesa Sanpaolo to 
ensure personnel are complying with the requirements regarding the preservation 
of electronic communications, including those found on Personal Devices, in 
accordance with the requirements of the federal securities laws, including by 
ensuring that Intesa Sanpaolo personnel certify in writing on a quarterly basis that 
they are complying with preservation requirements.  
 
iii.  An assessment of the surveillance program measures implemented by 
Intesa Sanpaolo to ensure compliance, on an ongoing basis, with the requirements 
found in the federal securities laws to preserve electronic communications, 
including those found on Personal Devices. 
 
iv.  An assessment of the technological solutions that Intesa Sanpaolo has 
begun implementing to meet the record retention requirements of the federal 
securities laws, including an assessment of the likelihood that Intesa Sanpaolo 
personnel will use the technological solutions going forward and a review of the 
measures employed by Intesa Sanpaolo to track employee usage of new 
technological solutions.  
 
v.  An assessment of the measures used by Intesa Sanpaolo to prevent the 
use of unauthorized communications methods for business communications by 
personnel.  This assessment should include, but not be limited to, a review of 
Intesa Sanpaolo’s policies and procedures to ascertain if they provide for any 
significant technology and/or behavioral restrictions that help prevent the risk of 
the use of unapproved communications methods on Personal Devices (e.g., 
trading floor restrictions).   
 
vi.  A review of Intesa Sanpaolo’s electronic communications surveillance 
routines to ensure that electronic communications through approved 
communications methods found on Personal Devices are incorporated into Intesa 
Sanpaolo’s overall communications surveillance program.   
 
vii.  A comprehensive review of the framework adopted by Intesa 
Sanpaolo to address instances of non-compliance by Intesa Sanpaolo personnel 
with Intesa Sanpaolo’s policies and procedures concerning the use of Personal 
Devices to communicate about Intesa Sanpaolo business in the past.  This review 
shall include a survey of how Intesa Sanpaolo determined which personnel failed 
to comply with Intesa Sanpaolo policies and procedures, the corrective action 
carried out, an evaluation of who violated the policies and procedures and why, 
what penalties were imposed, and whether penalties were handed out consistently 
across business lines and seniority levels.   
 

d.  Intesa Sanpaolo shall require that, within forty-five (45) days after completion 
of the review set forth in sub-paragraphs 27.c.i. through c.vii. above, the Compliance 
Consultant shall submit a detailed written report of its findings to Intesa Sanpaolo and to 
the Commission staff (the “Report”).  Intesa Sanpaolo shall require that the Report 
include a description of the review performed, the names of the individuals who 
performed the review, the conclusions reached, the Compliance Consultant’s 
recommendations for changes in or improvements to Intesa Sanpaolo’s policies and 
procedures, and a summary of the plan for implementing the recommended changes in or 
improvements to Intesa Sanpaolo’s policies and procedures. 
 
e.  Intesa Sanpaolo shall adopt all recommendations contained in the Report 
within ninety (90) days of the date of the Report; provided, however, that within forty-
five (45) days after the date of the Report, Intesa Sanpaolo shall advise the Compliance 
Consultant and the Commission staff in writing of any recommendations that Intesa 
Sanpaolo considers to be unduly burdensome, impractical, or inappropriate.  With respect 
to any recommendation that Intesa Sanpaolo considers unduly burdensome, impractical, 
or inappropriate, Intesa Sanpaolo need not adopt such recommendation at that time, but 
shall propose in writing an alternative policy, procedure, or disclosure designed to 
achieve the same objective or purpose. 
 
f.  As to any recommendation concerning Intesa Sanpaolo’s policies or procedures 
on which Intesa Sanpaolo and the Compliance Consultant do not agree, Intesa Sanpaolo 
and the Compliance Consultant shall attempt in good faith to reach an agreement within 
sixty (60) days after the date of the Report.  Within fifteen (15) days after the conclusion 
of the discussion and evaluation by Intesa Sanpaolo and the Compliance Consultant, 
Intesa Sanpaolo shall require that the Compliance Consultant inform Intesa Sanpaolo and 
the Commission staff in writing of the Compliance Consultant’s final determination 
concerning any recommendation that Intesa Sanpaolo considers to be unduly 
burdensome, impractical, or inappropriate.  Intesa Sanpaolo shall abide by the 
determinations of the Compliance Consultant and, within sixty (60) days after final 
agreement between Intesa Sanpaolo and the Compliance Consultant or final 
determination by the Compliance Consultant, whichever occurs first, Intesa Sanpaolo 
shall adopt and implement all of the recommendations that the Compliance Consultant 
deems appropriate. 
 
g.  Intesa Sanpaolo shall cooperate fully with the Compliance Consultant and 
shall provide the Compliance Consultant with access to such of Intesa Sanpaolo’s files, 
books, records, and personnel as are reasonably requested by the Compliance Consultant 
for review. 
 
h.  Intesa Sanpaolo shall not have the authority to terminate the Compliance 
Consultant or substitute another compliance consultant for the initial Compliance 
Consultant, without the prior written approval of the Commission staff.  Intesa Sanpaolo 
shall compensate the Compliance Consultant and persons engaged to assist the 
Compliance Consultant for services rendered under this Order at their reasonable and 
customary rates. 

 
i.  For the period of engagement and for a period of two (2) years from 
completion of the engagement, Respondent shall not (i) retain the Compliance Consultant 
for any other professional services outside of the services described in this Order; (ii) 
enter into any other professional relationship with the Compliance Consultant, including 
any employment, consultant, attorney-client, auditing or other professional relationship; 
or (iii) enter, without prior written consent of the Commission staff, into any such 
professional relationship with any of the Compliance Consultant’s present or former 
affiliates, employers, directors, officers, employees, or agents. 
 
j.  The Report by the Compliance Consultant will likely include confidential 
financial, proprietary, competitive business or commercial information.  Public disclosure 
of the Report could discourage cooperation, impede pending or potential government 
investigations or undermine the objectives of the reporting requirement.  For these 
reasons, among others, the Report and the contents thereof are intended to remain and 
shall remain non-public, except (1) pursuant to court order, (2) as agreed to by the parties 
in writing, (3) to the extent that the Commission determines in its sole discretion that 
disclosure would be in furtherance of the Commission’s discharge of its duties and 
responsibilities, or (4) as otherwise required by law. 
 
28. One-Year Evaluation.  Intesa Sanpaolo shall require the Compliance Consultant 
to assess Intesa Sanpaolo’s program for the preservation, as required under the federal securities 
laws, of electronic communications, including those found on Personal Devices, commencing 
one year after submitting the Report required by Paragraph 27.d above.  Intesa Sanpaolo shall 
require this review to evaluate Intesa Sanpaolo’s progress in the areas described in Paragraphs 
27.c.i-vii above.  After this review, Intesa Sanpaolo shall require the Compliance Consultant to 
submit a report (the “One Year Report”) to Intesa Sanpaolo and the Commission staff and shall 
ensure that the One Year Report includes an updated assessment of Intesa Sanpaolo’s policies 
and procedures with regard to the preservation of electronic communications (including those 
found on Personal Devices), training, surveillance programs, and technological solutions 
implemented in the prior year period.  
29. Reporting Discipline Imposed.  For two (2) years following the entry of this Order, 
Intesa Sanpaolo shall notify the Commission staff as follows upon the imposition of any discipline 
imposed by Intesa Sanpaolo, including, but not limited to: written warnings; loss of any pay, 
bonus, or incentive compensation; or the termination of personnel; with respect to any employee 
found to have violated Intesa Sanpaolo’s policies and procedures concerning the preservation of 
electronic communications, including those found on Personal Devices: at least forty-eight (48) 
hours before the filing of a Form U5, or within ten (10) days of the imposition of other discipline.   
30. Internal Audit.  In addition to the Compliance Consultant’s review and issuance of 
the One Year Report, Intesa Sanpaolo will also have its Internal Audit function conduct a separate 
audit(s) to assess Intesa Sanpaolo’s progress in the areas described in Paragraphs 27.c.i-vii above.  
After completion of this audit(s), Intesa Sanpaolo shall ensure that Internal Audit submits a report 
to Intesa Sanpaolo and to the Commission staff. 

31. Recordkeeping.  Intesa Sanpaolo shall preserve, for a period of not less than six 
(6) years from the end of the fiscal year last used, the first two (2) years in an easily accessible 
place, any record of compliance with these undertakings. 
32. Deadlines.  For good cause shown, the Commission staff may extend any of the 
procedural dates relating to the undertakings.  Deadlines for procedural dates shall be counted in 
calendar days, except that if the last day falls on a weekend or federal holiday, the next business 
day shall be considered to be the last day. 
33. Certification.  Intesa Sanpaolo shall certify, in writing, compliance with the 
undertakings set forth above.  The certification shall identify the undertakings, provide written 
evidence of compliance in the form of a narrative, and be supported by exhibits sufficient to 
demonstrate compliance.  The Commission staff may make reasonable requests for further 
evidence of compliance, and Respondent agrees to provide such evidence.  The certification and 
supporting material shall be submitted to Alison R. Levine, Assistant Regional Director, 
Division of Enforcement, New York Regional Office, Securities and Exchange Commission, 100 
Pearl Street, Suite 20-100, New York, NY, 10004-2616, or such other person as the Commission 
staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division, no 
later than sixty (60) days from the date of the completion of the undertakings. 
IV. 
 In view of the foregoing, the Commission deems it appropriate and in the public interest 
to impose the sanctions agreed to in Respondent’s Offer. 
 
 Accordingly, pursuant to Sections 15(b) and 21C of the Exchange Act, it is hereby 
ORDERED that: 
 
 A. Respondent cease and desist from committing or causing any violations and any 
future violations of Section 17(a) of the Exchange Act and Rule 17a-4 thereunder. 
 
B. Respondent is censured.  
 
C. Respondent shall comply with the undertakings enumerated in paragraphs 27 to 
33 above. 
  
 D. Respondent shall, within 14 days of the entry of this Order, pay a civil money 
penalty in the amount of $1,500,000 to the Securities and Exchange Commission for transfer to 
the general fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3).  If 
timely payment is not made, additional interest shall accrue pursuant to 31 U.S.C. § 3717.   
 
 Payment must be made in one of the following ways:   
 
(1) Respondent may transmit payment electronically to the Commission, 
which will provide detailed ACH transfer/Fedwire instructions upon 
request;  
 

(2) Respondent may make direct payment from a bank account via Pay.gov 
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or  
 
(3) Respondent may pay by certified check, bank cashier’s check, or United 
States postal money order, made payable to the Securities and Exchange 
Commission and hand-delivered or mailed to:  
 
Enterprise Services Center 
Accounts Receivable Branch 
HQ Bldg., Room 181, AMZ-341 
6500 South MacArthur Boulevard 
Oklahoma City, OK 73169 
 
Payments by check or money order must be accompanied by a cover letter identifying 
Intesa Sanpaolo as the Respondent in these proceedings, and the file number of these 
proceedings; a copy of the cover letter and check or money order must be sent to Thomas P. 
Smith, Jr., Associate Regional Director, Securities and Exchange Commission, 100 Pearl Street, 
Suite 20-100, New York, New York 10004-2616.   
 
 E. The amount ordered to be paid as a civil money penalty pursuant to this Order 
shall be treated as a penalty paid to the government for all purposes, including all tax purposes.  
To preserve the deterrent effect of the civil penalty, Respondent agrees that in any Related 
Investor Action, it shall not argue that it is entitled to, nor shall it benefit by, offset or reduction 
of any award of compensatory damages by the amount of any part of Respondent’s payment of a 
civil penalty in this action (“Penalty Offset”).  If the court in any Related Investor Action grants 
such a Penalty Offset, Respondent agrees that it shall, within 30 days after entry of a final order 
granting the Penalty Offset, notify the Commission’s counsel in this action and pay the amount 
of the Penalty Offset to the Securities and Exchange Commission.  Such a payment shall not be 
deemed an additional civil penalty and shall not be deemed to change the amount of the civil 
penalty imposed in this proceeding.  For purposes of this paragraph, a “Related Investor Action” 
means a private damages action brought against Respondent by or on behalf of one or more 
investors based on substantially the same facts as alleged in the Order instituted by the 
Commission in this proceeding. 
 
 
 By the Commission. 
 
 
 
Vanessa A. Countryman 
       Secretary 
 

UNITED STATES OF AMERICA 

 Before the 

 SECURITIES AND EXCHANGE COMMISSION 

 

SECURITIES EXCHANGE ACT OF 1934 

Release No. 101139 / September 24, 2024 

 

ADMINISTRATIVE PROCEEDING 

File No. 3-22161 

 

 

In the Matter of 

 

Intesa Sanpaolo IMI 

Securities Corp.,  

 

Respondent. 

ORDER INSTITUTING 

ADMINISTRATIVE AND CEASE-AND-

DESIST PROCEEDINGS, PURSUANT TO 

SECTIONS 15(b) AND 21C OF THE 

SECURITIES EXCHANGE ACT OF 1934, 

MAKING FINDINGS, AND IMPOSING 

REMEDIAL SANCTIONS AND A CEASE-

AND-DESIST ORDER 

 

I. 

 The Securities and Exchange Commission (“Commission”) deems it appropriate and in 

the public interest that public administrative and cease-and-desist proceedings be, and hereby 

are, instituted pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934 

(“Exchange Act”) against Intesa Sanpaolo IMI Securities Corp. (“Respondent” or “Intesa 

Sanpaolo”). 

 

II. 

 In anticipation of the institution of these proceedings, Respondent has submitted an Offer 

of Settlement (“Offer”) that the Commission has determined to accept.  Respondent admits the 

facts set forth in Section III below, acknowledges that its conduct violated the federal securities 

laws, admits the Commission’s jurisdiction over it and the subject matter of these proceedings, and 

consents to the entry of this Order Instituting Administrative and Cease-and-Desist Proceedings, 

Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934, Making Findings, 

and Imposing Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below.   

 

III. 

 On the basis of this Order and Respondent’s Offer, the Commission finds1 that: 

 

                                                 
1  The findings herein are made pursuant to Respondent’s Offer of Settlement and are not 

binding on any other person or entity in this or any other proceeding.  



Summary 

1. The federal securities laws impose recordkeeping requirements on broker-dealers 

to ensure that they responsibly discharge their crucial role in our markets. The Commission has 

long said that compliance with these requirements is essential to investor protection and the 

Commission’s efforts to further its mandate of protecting investors, maintaining fair, orderly, and 

efficient markets, and facilitating capital formation. 

2. These proceedings arise out of the widespread and longstanding failure of Intesa 

Sanpaolo personnel, including at senior levels, to adhere to certain of these essential 

requirements and Intesa Sanpaolo’s own policies and procedures. Using their personal devices, 

these personnel communicated by text messages and/or other unapproved written 

communications platforms, such as WhatsApp (“off-channel communications”). 

3. From at least August 2020 (the “Relevant Period”), Intesa Sanpaolo personnel 

sent and received off-channel communications that related to its broker-dealer business.  

Respondent did not maintain or preserve the substantial majority of these written 

communications.  Respondent’s failure was firm-wide and involved personnel at various levels 

of authority.  As a result, Intesa Sanpaolo violated Section 17(a) of the Exchange Act and Rule 

17a-4(b)(4) thereunder. 

4. Intesa Sanpaolo’s supervisors, who were responsible for supervising junior 

personnel, routinely communicated off-channel using their personal devices.  In fact, senior 

personnel responsible for supervising junior personnel themselves failed to comply with Intesa 

Sanpaolo’s policies and procedures by communicating through non-Intesa Sanpaolo approved 

methods, on their personal devices about Intesa Sanpaolo’s broker-dealer business. 

5. Intesa Sanpaolo’s widespread failure to implement its policies and procedures that 

prohibit such communications led to its failure to reasonably supervise its personnel within the 

meaning of Section 15(b)(4)(E) of the Exchange Act.     

6. The Commission staff uncovered Intesa Sanpaolo’s misconduct after commencing 

a risk-based initiative to investigate the use of off-channel and unpreserved communications at 

broker-dealers.  Intesa Sanpaolo has initiated a review of its recordkeeping failures and begun a 

program of remediation.  As set forth in the Undertakings below, Intesa Sanpaolo will retain an 

independent compliance consultant to review and assess Intesa Sanpaolo’s remedial steps 

relating to its recordkeeping practices, policies and procedures, related supervisory practices, and 

employment actions. 

Respondent 

7. Intesa Sanpaolo is a Delaware corporation with its principal office in New York, 

New York.  Intesa Sanpaolo has been registered with the Commission as a broker-dealer since 

April 1987.  It is indirectly controlled by Intesa Sanpaolo S.p.A., the parent company of the 

Italian banking group Intesa Sanpaolo.    



Recordkeeping Requirements Under the Exchange Act 

8. Section 17(a)(1) of the Exchange Act authorizes the Commission to issue rules 

requiring broker-dealers to make and keep for prescribed periods, and furnish copies of, such 

records as necessary or appropriate in the public interest, for the protection of investors or 

otherwise in furtherance of the purposes of the Exchange Act. 

9. The Commission adopted Rule 17a-4 under the Exchange Act pursuant to this 

authority.  Rule 17a-4 specifies the manner and length of time that the records made in 

accordance with other Commission rules, and certain other records made by broker-dealers, must 

be maintained and produced promptly to Commission representatives.   

10. The rules adopted under Section 17(a)(1) of the Exchange Act, including Rule 

17a-4(b)(4), require that broker-dealers preserve for at least three years, the first two years in an 

easily accessible place, originals of all communications received and copies of all 

communications sent relating to the broker-dealer’s business as such.  These rules impose 

minimum recordkeeping requirements that are based on standards a prudent broker-dealer should 

follow in the normal course of business.  

11. The Commission previously has stated that these and other recordkeeping 

requirements “are an integral part of the investor protection function of the Commission, and 

other securities regulators, in that the preserved records are the primary means of monitoring 

compliance with applicable securities laws, including antifraud provisions and financial 

responsibility standards.”  Commission Guidance to Broker-Dealers on the Use of Electronic 

Storage Media under the Electronic Signatures in Global and National Commerce Act of 2000 

with Respect to Rule 17a-4(f), 17 C.F.R. Part 241, Exchange Act Rel. No. 44238 (May 1, 2001). 

Respondent’s Policies and Procedures 

12. Intesa Sanpaolo maintained certain policies and procedures designed to ensure the 

retention of business-related records, including electronic communications, in compliance with 

the relevant recordkeeping provisions.   

13. Intesa Sanpaolo personnel were advised that the use of unapproved electronic 

communications methods, including on their personal devices, was not permitted, and they 

should not use personal email, chats or text messaging applications for business purposes, or 

forward work-related communications to unapproved applications on their personal devices.  

14. Messages sent through firm-approved communications methods were monitored, 

subject to review, and archived.  Messages sent through unapproved communications methods, 

such as WhatsApp and Signal on personal devices, were not monitored, subject to review or 

archived. 

15. Intesa Sanpaolo’s policies and procedures were designed to address supervisors’ 

supervision of personnel’s training in Intesa Sanpaolo’s communications policies and adherence 

to Intesa Sanpaolo’s books and recordkeeping requirements.  Supervisory policies notified 

personnel that electronic communications were subject to surveillance by Intesa Sanpaolo.  



Intesa Sanpaolo had procedures for all personnel, including supervisors, requiring annual self-

attestations of compliance.  

16. Intesa Sanpaolo failed to implement a system reasonably expected to determine 

whether all personnel, including supervisors, were following Intesa Sanpaolo’s policies and 

procedures.  Intesa Sanpaolo prohibited personnel from using their personal phones for business 

communications, except for one rarely used application.  Intesa Sanpaolo failed to implement 

sufficient monitoring to ensure that its recordkeeping and communications policies were being 

followed.  

Respondent’s Recordkeeping Failures Across Its Brokerage Business 

17. In September 2021, the Commission staff commenced a risk-based initiative to 

investigate whether broker-dealers were properly retaining business-related messages sent and 

received on personal devices.  Intesa Sanpaolo cooperated with the investigation by voluntarily 

interviewing a sampling of senior personnel and gathering and reviewing messages found on the 

individuals’ personal devices.  These personnel included senior leadership, such as a senior 

executive and managing directors.  

18. The Commission staff’s investigation uncovered pervasive off-channel 

communications at all seniority levels within Intesa Sanpaolo.  The investigation determined that 

nearly all broker-dealer personnel sampled had engaged in at least some level of off-channel 

communications.   

19. Overall, personnel sent and received numerous off-channel communications, 

involving other Intesa Sanpaolo personnel.  Within Intesa Sanpaolo, significant numbers of 

senior personnel participated in off-channel communications. 

20. During the Relevant Period, Intesa Sanpaolo personnel sent and received off-

channel messages that concerned the broker-dealer’s business. 

21. For example, a senior executive exchanged numerous off-channel business-related 

messages with at least five other Intesa Sanpaolo colleagues.  These messages related to the 

broker-dealer’s business as such. 

22. In addition, a managing director exchanged numerous off-channel business-

related messages with at least 15 other Intesa Sanpaolo colleagues.  These messages related to 

the broker-dealer’s business as such. 

23. Furthermore, a managing director exchanged numerous off-channel business-

related messages with at least five other Intesa Sanpaolo colleagues.  These messages related to 

the broker-dealer’s business as such. 



Respondent’s Violations and Failure to Supervise 

24. As a result of the conduct described above, Respondent willfully2 violated Section 

17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder. 

25. As a result of the conduct described above, Respondent failed reasonably to 

supervise its personnel with a view to preventing or detecting certain of its personnel’s aiding 

and abetting violations of Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder, 

within the meaning of Section 15(b)(4)(E) of the Exchange Act.  

Respondent’s Efforts to Comply 

26. In determining to accept the Offer, the Commission considered steps promptly 

undertaken by Intesa Sanpaolo prior to and after being approached by the Commission staff, and 

cooperation afforded the Commission staff by Intesa Sanpaolo.  Prior to this action, Respondent 

enhanced its policies and procedures, and increased training concerning the use of approved 

communications methods, including on personal devices.  It also began implementing significant 

changes to the technology available to personnel, including providing firm personnel with firm-

issued devices. 

Undertakings 

Respondent has undertaken to: 

27. Independent Compliance Consultant. 

a.  Intesa Sanpaolo shall retain, within thirty (30) days of the entry of this Order, 

the services of an independent compliance consultant (“Compliance Consultant”) that is 

not unacceptable to the Commission staff.  The Compliance Consultant’s compensation 

and expenses shall be borne exclusively by Intesa Sanpaolo. 

 

b.  Intesa Sanpaolo will oversee the work of the Compliance Consultant. 

 

c.  Intesa Sanpaolo shall provide to the Commission staff, within sixty (60) days 

of the entry of this Order, a copy of the engagement letter detailing the Compliance 

Consultant’s responsibilities, which shall include a comprehensive compliance review as 

described below.  Intesa Sanpaolo shall require that, within ninety (90) days of the date of 

the engagement letter, the Compliance Consultant conduct: 

 

i.  A comprehensive review of Intesa Sanpaolo’s supervisory, compliance, 

and other policies and procedures designed to ensure that Intesa Sanpaolo’s 

electronic communications, including those found on personal electronic devices, 

                                                 
2  “Willfully,” for purposes of imposing relief under Section 15(b) of the Exchange Act, 

“‘means no more than that the person charged with the duty knows what he is doing.’”  

Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir 2000) (quoting Hughes v. SEC, 174 F.2d 969, 

977 (D.C. Cir. 1949)).  



including without limitation, cellular phones (“Personal Devices”), are preserved 

in accordance with the requirements of the federal securities laws. 

 

ii.  A comprehensive review of training conducted by Intesa Sanpaolo to 

ensure personnel are complying with the requirements regarding the preservation 

of electronic communications, including those found on Personal Devices, in 

accordance with the requirements of the federal securities laws, including by 

ensuring that Intesa Sanpaolo personnel certify in writing on a quarterly basis that 

they are complying with preservation requirements.  

 

iii.  An assessment of the surveillance program measures implemented by 

Intesa Sanpaolo to ensure compliance, on an ongoing basis, with the requirements 

found in the federal securities laws to preserve electronic communications, 

including those found on Personal Devices. 

 

iv.  An assessment of the technological solutions that Intesa Sanpaolo has 

begun implementing to meet the record retention requirements of the federal 

securities laws, including an assessment of the likelihood that Intesa Sanpaolo 

personnel will use the technological solutions going forward and a review of the 

measures employed by Intesa Sanpaolo to track employee usage of new 

technological solutions.  

 

v.  An assessment of the measures used by Intesa Sanpaolo to prevent the 

use of unauthorized communications methods for business communications by 

personnel.  This assessment should include, but not be limited to, a review of 

Intesa Sanpaolo’s policies and procedures to ascertain if they provide for any 

significant technology and/or behavioral restrictions that help prevent the risk of 

the use of unapproved communications methods on Personal Devices (e.g., 

trading floor restrictions).   

 

vi.  A review of Intesa Sanpaolo’s electronic communications surveillance 

routines to ensure that electronic communications through approved 

communications methods found on Personal Devices are incorporated into Intesa 

Sanpaolo’s overall communications surveillance program.   

 

vii.  A comprehensive review of the framework adopted by Intesa 

Sanpaolo to address instances of non-compliance by Intesa Sanpaolo personnel 

with Intesa Sanpaolo’s policies and procedures concerning the use of Personal 

Devices to communicate about Intesa Sanpaolo business in the past.  This review 

shall include a survey of how Intesa Sanpaolo determined which personnel failed 

to comply with Intesa Sanpaolo policies and procedures, the corrective action 

carried out, an evaluation of who violated the policies and procedures and why, 

what penalties were imposed, and whether penalties were handed out consistently 

across business lines and seniority levels.   

 



d.  Intesa Sanpaolo shall require that, within forty-five (45) days after completion 

of the review set forth in sub-paragraphs 27.c.i. through c.vii. above, the Compliance 

Consultant shall submit a detailed written report of its findings to Intesa Sanpaolo and to 

the Commission staff (the “Report”).  Intesa Sanpaolo shall require that the Report 

include a description of the review performed, the names of the individuals who 

performed the review, the conclusions reached, the Compliance Consultant’s 

recommendations for changes in or improvements to Intesa Sanpaolo’s policies and 

procedures, and a summary of the plan for implementing the recommended changes in or 

improvements to Intesa Sanpaolo’s policies and procedures. 

 

e.  Intesa Sanpaolo shall adopt all recommendations contained in the Report 

within ninety (90) days of the date of the Report; provided, however, that within forty-

five (45) days after the date of the Report, Intesa Sanpaolo shall advise the Compliance 

Consultant and the Commission staff in writing of any recommendations that Intesa 

Sanpaolo considers to be unduly burdensome, impractical, or inappropriate.  With respect 

to any recommendation that Intesa Sanpaolo considers unduly burdensome, impractical, 

or inappropriate, Intesa Sanpaolo need not adopt such recommendation at that time, but 

shall propose in writing an alternative policy, procedure, or disclosure designed to 

achieve the same objective or purpose. 

 

f.  As to any recommendation concerning Intesa Sanpaolo’s policies or procedures 

on which Intesa Sanpaolo and the Compliance Consultant do not agree, Intesa Sanpaolo 

and the Compliance Consultant shall attempt in good faith to reach an agreement within 

sixty (60) days after the date of the Report.  Within fifteen (15) days after the conclusion 

of the discussion and evaluation by Intesa Sanpaolo and the Compliance Consultant, 

Intesa Sanpaolo shall require that the Compliance Consultant inform Intesa Sanpaolo and 

the Commission staff in writing of the Compliance Consultant’s final determination 

concerning any recommendation that Intesa Sanpaolo considers to be unduly 

burdensome, impractical, or inappropriate.  Intesa Sanpaolo shall abide by the 

determinations of the Compliance Consultant and, within sixty (60) days after final 

agreement between Intesa Sanpaolo and the Compliance Consultant or final 

determination by the Compliance Consultant, whichever occurs first, Intesa Sanpaolo 

shall adopt and implement all of the recommendations that the Compliance Consultant 

deems appropriate. 

 

g.  Intesa Sanpaolo shall cooperate fully with the Compliance Consultant and 

shall provide the Compliance Consultant with access to such of Intesa Sanpaolo’s files, 

books, records, and personnel as are reasonably requested by the Compliance Consultant 

for review. 

 

h.  Intesa Sanpaolo shall not have the authority to terminate the Compliance 

Consultant or substitute another compliance consultant for the initial Compliance 

Consultant, without the prior written approval of the Commission staff.  Intesa Sanpaolo 

shall compensate the Compliance Consultant and persons engaged to assist the 

Compliance Consultant for services rendered under this Order at their reasonable and 

customary rates. 



 

i.  For the period of engagement and for a period of two (2) years from 

completion of the engagement, Respondent shall not (i) retain the Compliance Consultant 

for any other professional services outside of the services described in this Order; (ii) 

enter into any other professional relationship with the Compliance Consultant, including 

any employment, consultant, attorney-client, auditing or other professional relationship; 

or (iii) enter, without prior written consent of the Commission staff, into any such 

professional relationship with any of the Compliance Consultant’s present or former 

affiliates, employers, directors, officers, employees, or agents. 

 

j.  The Report by the Compliance Consultant will likely include confidential 

financial, proprietary, competitive business or commercial information.  Public disclosure 

of the Report could discourage cooperation, impede pending or potential government 

investigations or undermine the objectives of the reporting requirement.  For these 

reasons, among others, the Report and the contents thereof are intended to remain and 

shall remain non-public, except (1) pursuant to court order, (2) as agreed to by the parties 

in writing, (3) to the extent that the Commission determines in its sole discretion that 

disclosure would be in furtherance of the Commission’s discharge of its duties and 

responsibilities, or (4) as otherwise required by law. 

 

28. One-Year Evaluation.  Intesa Sanpaolo shall require the Compliance Consultant 

to assess Intesa Sanpaolo’s program for the preservation, as required under the federal securities 

laws, of electronic communications, including those found on Personal Devices, commencing 

one year after submitting the Report required by Paragraph 27.d above.  Intesa Sanpaolo shall 

require this review to evaluate Intesa Sanpaolo’s progress in the areas described in Paragraphs 

27.c.i-vii above.  After this review, Intesa Sanpaolo shall require the Compliance Consultant to 

submit a report (the “One Year Report”) to Intesa Sanpaolo and the Commission staff and shall 

ensure that the One Year Report includes an updated assessment of Intesa Sanpaolo’s policies 

and procedures with regard to the preservation of electronic communications (including those 

found on Personal Devices), training, surveillance programs, and technological solutions 

implemented in the prior year period.  

29. Reporting Discipline Imposed.  For two (2) years following the entry of this Order, 

Intesa Sanpaolo shall notify the Commission staff as follows upon the imposition of any discipline 

imposed by Intesa Sanpaolo, including, but not limited to: written warnings; loss of any pay, 

bonus, or incentive compensation; or the termination of personnel; with respect to any employee 

found to have violated Intesa Sanpaolo’s policies and procedures concerning the preservation of 

electronic communications, including those found on Personal Devices: at least forty-eight (48) 

hours before the filing of a Form U5, or within ten (10) days of the imposition of other discipline.   

30. Internal Audit.  In addition to the Compliance Consultant’s review and issuance of 

the One Year Report, Intesa Sanpaolo will also have its Internal Audit function conduct a separate 

audit(s) to assess Intesa Sanpaolo’s progress in the areas described in Paragraphs 27.c.i-vii above.  

After completion of this audit(s), Intesa Sanpaolo shall ensure that Internal Audit submits a report 

to Intesa Sanpaolo and to the Commission staff. 



31. Recordkeeping.  Intesa Sanpaolo shall preserve, for a period of not less than six 

(6) years from the end of the fiscal year last used, the first two (2) years in an easily accessible 

place, any record of compliance with these undertakings. 

32. Deadlines.  For good cause shown, the Commission staff may extend any of the 

procedural dates relating to the undertakings.  Deadlines for procedural dates shall be counted in 

calendar days, except that if the last day falls on a weekend or federal holiday, the next business 

day shall be considered to be the last day. 

33. Certification.  Intesa Sanpaolo shall certify, in writing, compliance with the 

undertakings set forth above.  The certification shall identify the undertakings, provide written 

evidence of compliance in the form of a narrative, and be supported by exhibits sufficient to 

demonstrate compliance.  The Commission staff may make reasonable requests for further 

evidence of compliance, and Respondent agrees to provide such evidence.  The certification and 

supporting material shall be submitted to Alison R. Levine, Assistant Regional Director, 

Division of Enforcement, New York Regional Office, Securities and Exchange Commission, 100 

Pearl Street, Suite 20-100, New York, NY, 10004-2616, or such other person as the Commission 

staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division, no 

later than sixty (60) days from the date of the completion of the undertakings. 

IV. 

 In view of the foregoing, the Commission deems it appropriate and in the public interest 

to impose the sanctions agreed to in Respondent’s Offer. 

 

 Accordingly, pursuant to Sections 15(b) and 21C of the Exchange Act, it is hereby 

ORDERED that: 

 

 A. Respondent cease and desist from committing or causing any violations and any 

future violations of Section 17(a) of the Exchange Act and Rule 17a-4 thereunder. 

 

B. Respondent is censured.  

 

C. Respondent shall comply with the undertakings enumerated in paragraphs 27 to 

33 above. 

  

 D. Respondent shall, within 14 days of the entry of this Order, pay a civil money 

penalty in the amount of $1,500,000 to the Securities and Exchange Commission for transfer to 

the general fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3).  If 

timely payment is not made, additional interest shall accrue pursuant to 31 U.S.C. § 3717.   

 

 Payment must be made in one of the following ways:   

 

(1) Respondent may transmit payment electronically to the Commission, 

which will provide detailed ACH transfer/Fedwire instructions upon 

request;  

 



(2) Respondent may make direct payment from a bank account via Pay.gov 

through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or  

 

(3) Respondent may pay by certified check, bank cashier’s check, or United 

States postal money order, made payable to the Securities and Exchange 

Commission and hand-delivered or mailed to:  

 

Enterprise Services Center 

Accounts Receivable Branch 

HQ Bldg., Room 181, AMZ-341 

6500 South MacArthur Boulevard 

Oklahoma City, OK 73169 

 

Payments by check or money order must be accompanied by a cover letter identifying 

Intesa Sanpaolo as the Respondent in these proceedings, and the file number of these 

proceedings; a copy of the cover letter and check or money order must be sent to Thomas P. 

Smith, Jr., Associate Regional Director, Securities and Exchange Commission, 100 Pearl Street, 

Suite 20-100, New York, New York 10004-2616.   

 

 E. The amount ordered to be paid as a civil money penalty pursuant to this Order 

shall be treated as a penalty paid to the government for all purposes, including all tax purposes.  

To preserve the deterrent effect of the civil penalty, Respondent agrees that in any Related 

Investor Action, it shall not argue that it is entitled to, nor shall it benefit by, offset or reduction 

of any award of compensatory damages by the amount of any part of Respondent’s payment of a 

civil penalty in this action (“Penalty Offset”).  If the court in any Related Investor Action grants 

such a Penalty Offset, Respondent agrees that it shall, within 30 days after entry of a final order 

granting the Penalty Offset, notify the Commission’s counsel in this action and pay the amount 

of the Penalty Offset to the Securities and Exchange Commission.  Such a payment shall not be 

deemed an additional civil penalty and shall not be deemed to change the amount of the civil 

penalty imposed in this proceeding.  For purposes of this paragraph, a “Related Investor Action” 

means a private damages action brought against Respondent by or on behalf of one or more 

investors based on substantially the same facts as alleged in the Order instituted by the 

Commission in this proceeding. 

 

 

 By the Commission. 

 

 

 

Vanessa A. Countryman 

       Secretary 

 


	UNITED STATES OF AMERICA
	I.
	II.
	III.
	Summary
	Respondent
	Recordkeeping Requirements Under the Exchange Act
	Respondent’s Policies and Procedures
	17. In September 2021, the Commission staff commenced a risk-based initiative to investigate whether broker-dealers were properly retaining business-related messages sent and received on personal devices.  Intesa Sanpaolo cooperated with the investiga...
	Respondent’s Violations and Failure to Supervise
	Respondent’s Efforts to Comply
	Undertakings

	IV.