In December 2021, a known financial leader paid $125 million to settle charges with the SEC and CFTC. The firm had not lost client money. Its traders had not manipulated markets. The violation was simpler and, for the compliance world, more unsettling: employees had been using WhatsApp to conduct business, and those conversations were gone.

The fine was the opening shot of an enforcement campaign that has since collected more than $2 billion from over 100 firms. Every action followed the same pattern. Employees moved conversations to personal devices. Records disappeared. Regulators arrived and found gaps. Then came the penalties.

What makes this pattern difficult to break is that most of those firms had policies. They told employees not to use personal apps for business. Employees used them anyway. And when examiners asked for the records, the records did not exist.

This guide explains what off-channel communications are, why the compliance gap persists, what regulators actually look for when they examine a firm, and what a program that passes that examination requires.

What Are Off-Channel Communications?

Off-channel communications are business-related conversations that occur on platforms outside the firm’s approved, monitored, and archived channels.

In practice, this means:

• Text messages sent from a personal iPhone
• WhatsApp conversations with clients or counterparties
• Signal thread between a portfolio manager and an analyst
• Telegram group where traders share deal updates

The platforms differ. The regulatory obligation does not.

The SEC, FINRA, and CFTC have been consistent on this point: the content of a communication determines its status as a business record, not the device it was sent from or the platform it ran on.

A broker who commits to a trade via iMessage has created a business record. A financial adviser who discusses a client’s portfolio on WhatsApp has created a business record. Those records must be retained, stored in an immutable format, and produced on demand, regardless of how they were originally sent.

The key distinction regulators draw is between channels the firm controls and channels employees reach for on their own.

• Corporate email, Bloomberg messaging, and archived Microsoft Teams channels sit on the compliant side.
• Personal iMessage, consumer WhatsApp, Signal, and Telegram sit on the other.

The compliance gap is everything that falls into that second category.

Why Off-Channel Communications Keep Happening

Understanding the problem requires understanding why employees reach for personal apps in the first place.

The answer is not malice. In most enforcement cases, employees were not trying to evade surveillance. They were trying to respond quickly, use familiar tools, and stay in contact with clients who preferred WhatsApp or iMessage over email. The behavior is nearly universal outside the firm’s walls. Inside the firm, it becomes a compliance violation.

There are three structural reasons this gap persists:

• Friction in approved channels: Corporate communication tools are often slower, harder to use on mobile, and less feature-rich than consumer apps. When a client sends a WhatsApp message at 7 PM asking about a trade, the path of least resistance is to reply in WhatsApp.
• Senior management participation: A pattern that appears repeatedly in enforcement orders is that off-channel behavior was not limited to junior staff. The SEC has specifically cited “supervisors, including senior and executive-level supervisors” as participants in the very messaging that went unretained. When senior leadership uses the same unapproved channels, the policy signal from the top collapses.
• The perception that policy equals compliance: Many firms believe that having a written prohibition on personal device use satisfied their recordkeeping obligation. It does not. The SEC has stated explicitly that a policy against off-channel communication does not relieve a firm of its obligation to capture and preserve business communications wherever they occur. Firms that enforced the policy imperfectly — which is most firms — were still liable for the records they failed to preserve.

The Regulatory Framework: Which Rules Apply

Three primary regulatory frameworks govern recordkeeping requirements for business communications in the US. Understanding which rule applies to which firm type is the foundation of any compliant program.

All of these rules share a common requirement: communications must be stored in a format that is tamper-evident, non-rewritable, and retrievable within a reasonable time. This is what is commonly called WORM compliance (write once, read many), and it applies equally to a Bloomberg terminal message and a WhatsApp chat.

The obligation does not change because the channel was unauthorized. Firms cannot avoid a production obligation by pointing to a policy violation. The rule requires that business records exist. If they do not, the firm has a recordkeeping failure, regardless of whether the communication violated internal policy.

The Off-Channel Enforcement Record

The SEC’s off-channel enforcement campaign began in December 2021. What followed was the most sustained recordkeeping sweep in the agency’s history.

Here is the timeline of major actions:

December 2021: The financial leader pays $125 million to settle charges with both the SEC and CFTC. The settlement covers recordkeeping failures connected to widespread use of WhatsApp and personal email. This was the opening action.

September 2022: The SEC settles with 16 firms simultaneously, collecting $1.1 billion in a single announcement. The CFTC brings parallel actions against several of the same institutions.

2023: The SEC charges additional rounds of firms, expanding from large broker-dealers to smaller registered investment advisers. The enforcement pattern extends to alternative investment managers and standalone advisory firms.

February 2024: Another 16 broker-dealers and registered investment advisers settle for $81 million combined.

August 2024: Twenty-six investment advisers and broker-dealers settle for $393 million, the largest single-announcement collection since 2022.

January 2025: Twelve firms including several private equity and hedge fund managers settle for $63 million under the last major round of actions under SEC Chair Gensler. Civil penalties in this round range from $600,000 to $12 million per firm, depending on the severity and duration of violations found.

The total from 2021 through early 2025: more than $2 billion in combined penalties from over 100 firms. Source: Kirkland & Ellis, January 2025 client alert

2025–2026: FINRA Takes the Lead

With a change in administration and new leadership at the SEC, the agency has slowed its formal sweep. But the obligations have not changed, and FINRA has continued.

In June 2025, Velox Clearing settled with both FINRA ($1.3 million) and the SEC ($500,000) for off-channel failures discovered during a routine examination. Thousands of WeChat messages between the CEO and senior staff had gone unretained despite existing compliance flags.

In October 2025, a financial Advisors broker was suspended individually for off-channel messaging with evidence deletion.

FINRA’s 2026 Annual Regulatory Oversight Report references recordkeeping lapses explicitly more than 50 times and identifies electronic communications capture failures, off-channel use, and inadequate supervision procedures as active examination findings. Individual accountability — the barring of individual brokers, not just institutional fines — has become a feature of the post-2025 enforcement landscape.

The lesson from this record: the cost of non-compliance is not theoretical. It is quantified, firm-specific, and in several cases has extended to individual employees whose licenses were revoked.

What Examiners Actually Check

Knowing what regulators look for in an examination is more useful than knowing the rules in the abstract.

When FINRA or SEC examiners arrive to review a firm’s communications compliance, they are not primarily checking whether a policy exists. They are checking whether the policy works. Here is what that looks like in practice:

Production requests

The examiner will ask the firm to produce all communications between specific employees and specific clients or counterparties over a defined period. “All” means email, SMS, Teams, Slack, WhatsApp, and any other channel those parties may have used.

If the firm returns email and nothing else, the examiner will ask why. “We don’t know if they used other channels” is not an acceptable answer. “We have no evidence of other channels because our supervision procedures monitor all approved channels” is the beginning of an acceptable answer.

Device audits

Examiners may request access to firm-issued devices to verify that approved channels were used, and that records are complete.

Where BYOD (bring your own device) programs exist, examiners will ask how the firm captures and monitors communications from personal devices used for business purposes.

Supervision procedures review

FINRA Rule 3110 requires written procedures for supervising communications. Examiners look for procedures that name specific channels, specify review frequencies, identify who is responsible for reviewing flagged communications, and document how exceptions are escalated. A generic policy is not a procedure.

Training records

Firms must demonstrate that employees were informed of the policy, understood the prohibited channels, and acknowledged the requirement.

Examiners have specifically cited cases where training existed but did not cover the channels that were later used for off-channel communications.

Remediation timeline

One pattern that draws additional scrutiny: remediation that happens immediately before or during an examination. Examiners are trained to distinguish genuine compliance improvements from pre-exam cleanups.

Firms that migrate to compliant archiving solutions in the weeks before a scheduled examination face more questions, not fewer.

The practical implication is clear. Compliance is a documentation discipline, not just a policy discipline.

The firm that can produce records quickly, demonstrate chain of custody, show a complete supervision log, and walk an examiner through its retention schedule is in a fundamentally different position than the firm that produces a policy and hopes for the best.

The BYOD Gap: Why Personal Devices Are the Hardest Part

Bring your own device (BYOD) programs create a structural compliance challenge that policy alone cannot resolve.

When an employee uses a personal iPhone for work calls and messages, the firm has three fundamental problems:

1. First, capture is technically difficult. Personal devices do not connect to the firm’s email journaling or message archiving infrastructure by default. Capturing SMS and iMessage requires either a managed endpoint solution installed on the device, a mobile device management (MDM) profile, or a governed overlay that routes communications through a compliance-monitored path before delivery.
2. Second, employee consent creates friction. Installing monitoring software on a personal device requires consent. In many jurisdictions, that consent must be specific and documented. Some employees refuse, creating a situation where the firm cannot fully capture BYOD communications from individuals who have not opted in. A firm that permits BYOD without a clear capture mechanism is creating the conditions for a production gap.
3. Third, deletion is a risk. Personal devices are personal. Employees change phones, reset devices, and delete message threads. Without a capture-at-point-of-creation architecture, the record is lost the moment the employee deletes the message or changes their device. One of the most serious FINRA cases in 2025 involved an individual who deleted off-channel messages after learning of an investigation, a behavior that transformed a recordkeeping matter into a potential obstruction issue.

The solution is not to prohibit BYOD. For many firms, that is not operationally realistic. The solution is to capture compliantly within a BYOD program, using governed communication overlays or mobile comminications archiving connectors that separate personal and business communication at the capture layer.

Building a Compliant Off-Channel Communications Program

A compliant program has four components. Each one solves a different part of the problem.

1. Approved Channel Governance

Define explicitly which channels employees may use for business communications. The list should include every approved platform with its specific configuration requirements.

A channel is not “approved” because it is widely used. It is approved because the firm can capture, archive, and produce records from it.

Every approved channel needs a technical capture path: journaling for email, a connector for Teams or Slack, an overlay or endpoint solution for mobile messaging. Channels without a verified capture path should not appear on the approved list.

For a closer look at enterprise email archiving and retention, explore our guide to email archiving solutions.

2. Supervision Procedures That Name Specific Channels

A supervision procedure that says “we monitor all electronic communications” is not sufficient. FINRA examiners want to see procedures that name the channels under review, specify how often supervisors review communications in each channel, identify who reviews what, and describe the escalation path when a flagged message requires action.

The supervision program should also include periodic testing not just policy attestations. Random sampling of communications, keyword surveillance, and exception reporting are the controls that demonstrate an active program, not a paper one.

3. An Archive That Meets Production Standards

Capturing communications is necessary but not sufficient. The archive must meet SEC Rule 17a-4’s technical requirements: non-rewritable, non-erasable storage that preserves the original record and its metadata. An email archive that allows administrators to delete records does not satisfy Rule 17a-4, regardless of how many emails it holds.

Beyond the technical storage requirement, the archive must support legal holds. When a regulatory inquiry, litigation, or internal investigation requires that specific records be preserved beyond their standard retention period, the archive must be able to apply a hold that prevents disposition across all channels simultaneously.

A hold that covers email but not SMS creates a partial preservation and partial preservation is treated as non-preservation for the channels it missed.

4. Cross-Channel Search and Production

When an examiner requests all communications between a client relationship manager and a specific counterparty from 2022 to 2024, the response must be complete. If email comes from one system, SMS from another, and Teams from a third, the production process involves three separate queries with three different metadata formats, three different export workflows, and three different opportunities for a record to be missed.

A cross-channel archive — one system that holds email, SMS, Teams, Slack, and WhatsApp under a single retention policy — produces a complete record from a single search. That is not just an operational efficiency argument. It is an examination risk argument.

Fragmented archives produce fragmented records, and fragmented records in a production context look like gaps.

How Archon Addresses Off-Channel Communications Risk

Archon Data Store is an enterprise archive built for firms that need to consolidate communications across channels into a single, compliance-grade record.

The core architecture works like this. Each communication channel — email, SMS, Microsoft Teams, Slack, WhatsApp — connects to Archon through a dedicated connector. Once captured, every message is stored in an immutable, WORM-compliant format with full metadata preservation. The record cannot be altered. The chain of custody is intact.

From there, three capabilities matter most for off-channel compliance.

• Unified retention policy: Rather than managing a different retention schedule per channel, Archon applies a single retention policy across all connected channels. A record from WhatsApp follows the same 6-year FINRA Rule 4511 retention clock as the corresponding email thread. When the retention period expires, Archon’s data disposition workflow handles deletion defensibly, with an audit log that proves the record was held for its full required period before being removed.
• Single legal hold: When a regulatory inquiry or litigation requires preserving all communications involving a specific custodian, Archon applies the hold across every connected channel simultaneously. Email, SMS, WhatsApp, and Teams records are all frozen in a single operation. Nothing is missed because a hold was applied in the email system but not carried across to mobile.
• Cross-channel search and production: A production request in Archon returns results from all channels in a single query, with consistent metadata and a full audit trail. There is no reassembly of records from multiple systems. The output is examination-ready: timestamped, authenticated, and produced with the chain-of-custody documentation that regulators require.

Archon also stores data in open Apache Parquet format, which means records are accessible without proprietary software. If a firm needs to migrate to a different archive, export records for external review, or provide data to outside counsel, the data is accessible without vendor lock-in.

Financial services firms dealing with communications compliance challenges that extend to structured data and application-level records will also find Archon’s broader financial data compliance and compliance archiving capabilities relevant.