Off-channel communications: What they are, why they're still a compliance risk, and how to manage them

Off-channel communications are business-related messages sent outside a firm’s approved, captured channels, e.g. a trade discussed over WhatsApp, a client instruction sent by personal text, or a deal term shared on Signal. Since regulators require firms to capture, retain, and supervise business communications, an off-channel message that is never recorded is a compliance failure. Off-channel communications compliance has become one of the most closely watched areas of recordkeeping governance on both sides of the Atlantic.

Between December 2021 and early 2025, U.S. regulators charged more than 100 firms and collected over $3 billion in penalties for exactly this failure. In 2026, the picture looks different on the surface. Since the second half of 2025, the U.S. Securities and Exchange Commission (SEC) has largely stepped back from new off-channel sweeps, while the Financial Industry Regulatory Authority (FINRA) and the U.K.’s Financial Conduct Authority (FCA) have kept the pressure on. These regulators have increasingly implemented enforcement against named individuals rather than just firms. The headline has changed but importantly, the underlying obligation hasn’t.

This guide covers what off-channel communications are, why they remain a compliance risk, and which rules govern them in the U.S. and U.K., and it will also show how the enforcement story has actually unfolded and what firms are doing to bring off-channel activity back onto the record.

Key takeaways:

• Off-channel communications remain a significant compliance risk in today’s tech-driven business space. New channels continue to surface, combined with growing consumer demand for business matters to be communicated via the apps we use in our personal lives.
• Record-keeping failures tied to personal devices and messaging-app use may not be hitting the headlines like they once were, but the rules haven’t changed.
• Capturing, archiving, and monitoring communications across all channels enables firms to bring off-channel activity back on the record and avoid supervision failures in routine examinations.

What are off-channel communications?

Off-channel communications are business-related messages (like texts, chats, calls, or emails) that are sent or received on a platform that a firm hasn’t approved, doesn’t capture, and can’t supervise. Off-channel communications become a compliance issue the moment business content crosses onto an unrecorded channel, regardless of which app is used.

Firms sometimes call these pathways unapproved communication channels, and the resulting failures are typically charged as recordkeeping violations. In practice, off-channel use covers a wide range of everyday tools:

• Business messages sent over WhatsApp, Signal, Telegram, or iMessage
• Personal email accounts used for firm business
• Personal mobile devices used outside a firm’s monitored infrastructure
• Unapproved collaboration or chat features bundled into other apps

The key principle is often misunderstood. It’s not the app itself that creates the violation, because WhatsApp and Signal are typically not banned technologies. The violation is business content passing through a channel that the firm can’t capture, retain, or supervise.

A firm that captures WhatsApp through an approved connector has no off-channel problem, while a firm that captures nothing does, even if every message technically happened on a firm-issued phone. Personal texts and business records get treated the same way in the eyes of a regulator the moment the content is business-related, regardless of which device or account is used.

Among other impacts, recordkeeping failures directly sabotage a firm’s ability to accurately detect, investigate, and file Suspicious Transaction and Order Reports.

Why off-channel communications are a compliance problem

Two obligations sit at the heart of the off-channel communications issue. First, firms must capture and retain business communications in a complete, accurate, and readily producible record. Second, firms must supervise those communications for conduct risk and market abuse.

In practice, this means running eComms surveillance against a documented off-channel communications policy so that captured messages are actually reviewed, not just stored. A message that never enters the firm’s systems can’t be retained, and it can’t be supervised. This is why regulators treat off-channel use as a books-and-records failure and a supervisory failure simultaneously, not just one or the other.

The exact rule that applies depends on the firm type and jurisdiction, but the requirement is consistent: business communications are records, and records must be kept and overseen.

Obligations by regulator

Regulator	Rule	Core requirement
SEC	Rule 17a-4 (broker-dealers); Advisers Act Rule 204-2	Preserve and promptly produce business records, including electronic communications.
FINRA	Rule 4511 (books & records); Rule 3110 (supervision)	Retain required records and supervise business communications.
CFTC	Rule 1.31 (recordkeeping)	Keep and produce full, accurate records of business activity, including communications.
FCA	SYSC 10A recording rules; MiFID II Article 16(7), onshored via SYSC 10A.1; Senior Managers and Certification Regime (SM&CR)	Record and retain relevant communications; hold senior managers accountable for conduct and controls. Expectations are also set out in Market Watch 66 newsletter.

The enforcement story

The scale of off-channel communications SEC fines is easiest to understand as a single sweep, one that began with a case that made the off-channel messaging risks impossible to ignore.

In December 2021, the SEC fined a broker-dealer $125 million for widespread use of unmonitored personal devices and WhatsApp, part of a $200 million combined resolution with the Commodity Futures Trading Commission (CFTC). Many believed that this was a one-off enforcement blitz, and so WhatsApp compliance for financial services took center stage. In fact, this was to become the opening move in a multi-year campaign that would touch multiple communications channels and even personal device compliance.

What changed in 2026 (and what didn’t)

The core message for compliance teams heading into 2026 is simple:

SEC recordkeeping enforcement in 2026 may have slowed, but the rules remain the same.

In short, firms cannot take their foot off the pedal when it comes to bringing off-channel communications onto the record.

Three developments illustrate this shift:

Development	What’s happening
FINRA broadens its focus	Off-channel and recordkeeping findings now run throughout FINRA’s 2026 Annual Regulatory Oversight Report, factoring into broader examinations, suitability reviews, and arbitrations — not just standalone violations.
FINRA targets individuals	Brokers who conducted client business over unapproved apps like WeChat have been fined, suspended, or barred, shifting accountability from firms alone to the individuals involved.
FCA confirms technology neutrality	Recordkeeping obligations under SYSC 10A and MiFID II apply regardless of channel. The FCA’s 2025 review of wholesale banks found senior leaders disproportionately represented among breaches, undercutting the assumption that off-channel risk sits mainly with junior staff.

Routine examinations continue to surface supervision failures tied to off-channel use, even where it’s not the headline finding. A decrease in activity on approved channels, unreviewed keyword lists, or vendors that can’t prove their recordkeeping capability are now standard examiner questions.

Who is affected?

Off-channel communications policy obligations affect broker-dealers, investment advisers, banks, and swap dealers in the U.S., and firms in scope of MiFID (including wholesale banks) under the FCA in the U.K.. Increasingly, it also reaches individual employees and senior managers directly, through personal fines, suspensions, and industry bars rather than firm-level penalties alone.

For global institutions, the obligation is cross-border by nature. A firm supervised by both the SEC or FINRA and the FCA cannot treat off-channel communications as a U.S.-only or U.K.-only problem. The same message thread can trigger obligations under SEC Rule 17a-4, FINRA Rule 4511, and SYSC 10A simultaneously if it touches regulated business on both sides of the Atlantic.

How firms manage off-channel communications risk

Banning messaging apps hasn’t and won’t solve the problem of recordkeeping violations. Clients and employees have simply moved the conversation to wherever it’s convenient, off the record.

Adopting a robust strategy to managing off-channel communications is critical. The most practical response to managing off-channel communications risks, and one that regulators actually reward, should include all of these four areas:

1. Capture business communications across every channel employees actually use, including mobile and messaging apps, rather than trying to prohibit them. Capturing mobile communications for compliance means treating phones and WhatsApp as first-class channels, not exceptions to be worked around.
2. Archive everything in a complete, tamper-evident, readily retrievable record that can withstand a regulator’s request on short notice.
3. Supervise and monitor captured communications for conduct and market-abuse risk, not just store them passively. Knowing how to monitor WhatsApp for compliance involves this critical surveillance layer, not just a capture step alone. This is how misconduct can be flagged.
4. Back it with policy, attestations, and training and test regularly to ensure that the stated policy matches how people actually communicate.

From a practical standpoint, using a tool that achieves three of these steps in a single platform offers a streamlined and compliant solution to off-channel communications recordkeeping.  This is where systemized communications capture, archiving, and eComms surveillance that captures communications across multiple channels using connectors becomes an invaluable firm asset. And importantly, it helps firms to safeguard against the potentially catastrophic consequences of regulatory violations.

The next frontier: New channels and AI

Collaboration platforms and AI assistants are the next off-channel surface if firms don’t capture them. Unsurprisingly, FINRA off-channel communications feature in its 2026 report, detailing how the regulator already treats GenAI chatbot communications with investors as records that are subject to retention. Plus, it also flags AI agents [link to my other article on assistants vs. agents] acting without human validation as a supervisory blind spot. 

The same logic that applied to WhatsApp in 2021 applies to internal AI copilots and collaboration tools in 2026. If a business communication happens there, it needs to be captured, retained, and supervised, before the regulator comes knocking.

FAQs

What are off-channel communications?

Off-channel communications are business-related messages sent or received on a platform that a firm hasn’t approved, captured, or supervised. Common examples include WhatsApp, Signal, personal email, and personal mobile devices used for business.

Why are off-channel communications a compliance risk?

They are a compliance risk because they defeat a firm’s core recordkeeping and supervision obligations at once. A message that isn’t captured can’t be retained or reviewed, leaving the firm unable to reconstruct events or evidence compliance if a regulator asks.

Which regulations govern off-channel communications?

In the U.S., SEC Rule 17a-4, Advisers Act Rule 204-2, FINRA Rules 4511 and 3110, and CFTC Rule 1.31 govern the obligation. In the U.K., SYSC 10A and MiFID II recording requirements apply, backed by SM&CR accountability.

How much have firms been fined for off-channel communications?

U.S. regulators have collected over $3 billion in combined SEC and CFTC penalties from more than 100 firms since the sweep began in December 2021, with individual settlements ranging from six figures to well over $100 million.

Is the SEC still enforcing off-channel communications?

The SEC has pulled back from launching new large-scale off-channel sweeps since early 2025 and shifted its focus towards fraud and investor-harm cases. But the recordkeeping and supervision rules it enforced remain fully in force and can still be applied.

Can employees be personally fined for off-channel messaging?

Yes ­— FINRA has increasingly pursued individual brokers and senior staff directly, with penalties including fines, suspensions, industry bars. The FCA’s 2025 review found senior leaders were disproportionately represented in breaches.

Does banning messaging apps solve the off-channel communications problem?

No — bans tend to push business conversations further off the record rather than eliminate them, because clients and staff still expect to communicate on the channels they already use. The more sustainable fix is capturing and supervising those channels, not prohibiting them.

How can firms capture and supervise off-channel communications?

Firms need a capture strategy covering every channel actually in use, a tamper-evident archive, ongoing surveillance of captured content for conduct risk, and policies and training that are tested against real practice rather than assumed.

Final thoughts

It’s not enough to know how to monitor WhatsApp for compliance, since there are countless channels that employees bring into a business setting, with new ones emerging all the time.

No matter where regulators look next, the fundamental obligation to archive and supervise your business data remains the same, and as such, firms must take action to address compliance gaps. Firms still relying on bans, informal policy, or reduced SEC enforcement activity as their off-channel strategy are carrying a huge risk, and one that can surface at any time.

Ready to capture and store all your communications in one unified platform? Learn more about Global Relay’s compliant communications solution specifically designed for the finance sector, or contact one of our specialists for a demo.