The five firms, indirect subsidiaries of ING Groep N.V., are Directed Services, LLC; ING America Equities, Inc.; ING Financial Advisers, LLC; ING Financial Partners, Inc.; and ING Investment Advisors, LLC.

Brad Bennett, Executive Vice President and Chief of Enforcement, said, "As a result of broad systemic failures, these firms failed to capture and retain emails from hundreds of representatives and other associated persons, and failed to take adequate steps to ensure that their principals were fulfilling their responsibilities to review emails. Email retention and review continues to be an important regulatory responsibility and an issue of concern for FINRA."

FINRA found that the firms failed to properly configure hundreds of employee email accounts to ensure that the emails sent to and from those accounts were retained and reviewed at various times between 2004 and 2012. In addition, four of the firms failed to set up systems to retain certain types of emails, such as emails using alternative email addresses, emails sent to distribution lists, emails received as blind carbon copies, encrypted emails and "cloud" email (emails sent through third-party systems). As a result of these failures, emails sent to and from hundreds of employees and associated persons were not retained; and because the emails were not retained, they were not subject to supervisory review.

In addition, four of the firms failed to review millions of emails that the firms' email review software had flagged for supervisory review. At various times between January 2005 and May 2011, nearly six million emails flagged for review went unreviewed by supervisory principals because the email review software was not properly configured.

In concluding the settlement, the firms neither admitted nor denied the charges, but consented to the entry of FINRA's findings. FINRA found that the firms violated the recordkeeping provisions of the federal securities laws and FINRA rules, and supervisory requirements under FINRA rules.

FINRA also ordered the firms to conduct a comprehensive review of their systems for the capture, retention and review of email, and to subsequently certify that they have established procedures reasonably designed to address and correct the violations.

FINRA's investigation was conducted by the Departments of Enforcement and Member Regulation.