S&P Global Ratings SEC Settlement: 2024 Terms and $20M Penalty

S&P Global Ratings agreed in September 2024 to pay a $20 million civil penalty to resolve U.S. Securities and Exchange Commission charges that it failed to preserve employees’ business-related electronic communications sent through personal text messages and WhatsApp. The S&P Global Ratings SEC settlement also imposed a censure, a cease-and-desist order, and a multi-year program of independent compliance review. S&P admitted the underlying facts and acknowledged that its conduct violated federal recordkeeping rules.1SEC. SEC Charges Six Credit Rating Agencies With Significant Recordkeeping Failures

What the SEC Found

According to the SEC’s administrative order, S&P employees had been using personal text messages and WhatsApp to discuss credit rating activities — initiating, determining, maintaining, and monitoring ratings — since at least January 2020. S&P did not capture or retain those messages, so they were unavailable to regulators.2SEC. Administrative Proceeding File No. 3-22055

The SEC charged S&P with violating Section 17(a)(1) of the Securities Exchange Act of 1934 and Rule 17g-2(b)(7). That rule applies specifically to nationally recognized statistical rating organizations and requires them to retain all internal and external electronic communications related to credit rating activities. The records must be kept for at least three years and made readily accessible to the SEC.3Cornell Law Institute. 17 CFR § 240.17g-2

The Commission found the failures “widespread and longstanding” and said they “likely impacted the Commission’s ability to carry out its regulatory functions and investigate compliance deficiencies.”2SEC. Administrative Proceeding File No. 3-22055 Sanjay Wadhwa, then the SEC’s Deputy Director of Enforcement, said the agency had “seen repeatedly that failures to maintain and preserve required records can hinder the staff’s ability to ensure that firms are complying with their obligations,” often “at the expense of investors.”1SEC. SEC Charges Six Credit Rating Agencies With Significant Recordkeeping Failures

Terms of the 2024 Settlement

S&P admitted the facts in the SEC’s order and consented to the following:1SEC. SEC Charges Six Credit Rating Agencies With Significant Recordkeeping Failures

  • A civil penalty of $20 million.
  • A censure.
  • A cease-and-desist order barring further violations of the cited recordkeeping provisions.
  • Retention of an independent compliance consultant to review S&P’s policies and procedures for preserving electronic communications on personal devices, including how it disciplines employees who violate those policies.
  • A follow-up assessment one year after the consultant’s initial report to gauge progress.
  • A separate review by S&P’s internal audit function of compliance with the consultant’s recommendations.
  • For two years, notification to the SEC within ten days of any discipline imposed on employees for violating communication-retention policies tied to credit rating work.
  • Preservation of records showing compliance with these undertakings for six years.2SEC. Administrative Proceeding File No. 3-22055

S&P said it was “pleased to have concluded this matter” and that it “takes compliance with regulatory obligations very seriously and is committed to the integrity of its ratings process and high-quality independent credit ratings.” The SEC acknowledged the firm’s remedial efforts and cooperation.4S&P Global. S&P Global Ratings Reaches Settlement With SEC The company recorded the full $20 million as a legal settlement cost in its 2024 annual financial statements.5S&P Global. S&P Global 2024 Annual Report

How S&P’s Penalty Compared to the Other Rating Agencies

The SEC charged six credit rating agencies on the same day, September 3, 2024. All six admitted the facts and acknowledged violating the same recordkeeping provisions. The penalties were:1SEC. SEC Charges Six Credit Rating Agencies With Significant Recordkeeping Failures

  • Moody’s Investors Service — $20 million
  • S&P Global Ratings — $20 million
  • Fitch Ratings — $8 million
  • A.M. Best Rating Services — $1 million
  • HR Ratings de México — $250,000
  • Demotech — $100,000

The combined total exceeded $49 million.6CNBC. SEC Charges Moody’s, S&P Global Ratings, Fitch and Others With Recordkeeping Failures Moody’s, S&P, Fitch, and HR Ratings were each required to retain an independent compliance consultant. A.M. Best and Demotech were not, because they had begun compliance efforts earlier and cooperated with the investigation.1SEC. SEC Charges Six Credit Rating Agencies With Significant Recordkeeping Failures

Part of a Larger SEC Sweep

The rating agency cases were part of a broader SEC enforcement campaign that began in December 2021, when JPMorgan Chase paid $125 million to settle the first such charges. In September 2022, sixteen Wall Street firms paid a combined $1.1 billion, and further rounds followed through 2023 and 2024 across broker-dealers and investment advisers before reaching the credit rating agencies.7IQ-EQ. Roundup: SEC’s Off-Channel Communication Enforcement Continues The platforms at issue across the sweep included text messaging, WhatsApp, WeChat, LinkedIn messaging, personal email, and Facebook Messenger. By the end of fiscal year 2024, the SEC had assessed more than $600 million in penalties against over 70 firms in that year alone.8Carlton Fields. SEC Penalties for Off-Channel Communications

The reason the SEC treats these lapses as serious is straightforward. Federal securities law requires regulated firms to retain business-related communications so regulators can review them during examinations and investigations. When employees conduct business on unmonitored personal channels, those records vanish and the SEC loses its ability to detect misconduct. For credit rating agencies, Rule 17g-2(b)(7) is written specifically to preserve messages about how ratings are initiated, determined, maintained, monitored, changed, or withdrawn.3Cornell Law Institute. 17 CFR § 240.17g-2

S&P’s Earlier SEC Settlement in 2022

The 2024 recordkeeping case was not S&P’s only recent matter with the SEC. In November 2022, the SEC charged S&P Global Ratings with violating conflict-of-interest rules over a 2017 jumbo residential mortgage-backed security transaction. The Commission found that S&P commercial employees had attempted to pressure the firm’s analytical staff to issue a rating consistent with preliminary feedback that contained a calculation error, effectively drawing sales-side personnel into the rating process. S&P self-reported the conduct, cooperated, and strengthened its conflict-of-interest policies. It settled without admitting or denying the findings, paying a $2.5 million penalty and accepting a censure.9SEC. SEC Charges S&P Global Ratings for Failures Relating to Conflicts of Interest

Where SEC Enforcement Stands Now

The off-channel communications campaign was driven primarily under SEC Chair Gary Gensler, who left office in January 2025. His successor, Chair Paul Atkins, has said the off-channel investigations “consumed excessive Commission resources not commensurate with any measure of investor harm” and has characterized the underlying violations as “foot faults.” Standalone enforcement actions fell roughly 30 percent in fiscal year 2025 compared to the prior year, with resources redirected toward traditional fraud cases, Ponzi schemes, and individual accountability.10FTI Consulting. SEC FY 2025 Results: New Priorities, Fewer Enforcement Actions

S&P’s obligations under the 2024 order remain in force. The independent consultant review, the two-year discipline-reporting requirement, and the six-year record preservation mandate all continue on the terms the Commission set.