Complete Channel Coverage in 2027: A practical guide for compliance, risk, and IT teams

Many firms consider off-channel communications a solved problem. Regulatory attention has shifted, they’ve either banned channels or implemented data connectors that broadly capture the channels they need, and their communications data is being archived.

That confidence is often tested at the point of examination, when a request for a complete message thread reveals missing edits, incomplete data or metadata, broken threads, or an entire channel that was never in scope.

This guide addresses the continued need for channel capture over channel bans, the evolving scope of AI channels, questions to ask in vendor assessment, and the internal business case for channel capture.

1. Where does channel capture stand in a landscape of deregulation?

The last two years have seen a gradual movement toward deregulation on a global scale. As governments and regulators worldwide look to boost economic growth — and become attractive to potential new markets, investors, and technologies — most regulators have sought to cut existing “red tape” in favor of promoting growth objectives.

In the U.S., the Securities and Exchange Commission (SEC) has stepped back from headline-grabbing off-channel sweeps, pivoting toward fraud and investor-harm cases. The multimillion-dollar enforcement actions that defined 2021 to early 2025 have come to a halt. In the U.K., the Financial Conduct Authority (FCA) has announced a number of measures aimed at reducing “red tape”, including proposed amendments to the Senior Managers and Certification Regime (SMCR).

But while deregulation may seemingly relieve the pressure on compliance teams, now is not the time for firms to press pause. In conversation with Global Relay, Nekia Hackworth,  former SEC Deputy Director of Enforcement and DOJ Associate Deputy Attorney General, noted that:

“People might be inclined to believe that they can breathe a little easier. I caution against that. You may still receive an inquiry at any time because the work continues, and this is only one period of time. Who knows what we’re going to be talking about in 18 months, 36 months, or eight years from now?”

Compliance teams looking to take their foot off the gas might find themselves in hot water in the future. Looking back over the course of 2026, three key things changed:

1. From sweeps to routine examinations: The Financial Industry Regulatory Authority (FINRA) 2026 Annual Regulatory Oversight Report flags recordkeeping lapses more than 50 times. Electronic communications capture failures, off-channel use, and inadequate supervision all appear explicitly as findings from recent examinations. FINRA recommends firms simulate regulatory examinations, actively monitor for unapproved channel use, and refresh surveillance keyword lists.
2. From firms to individuals: FINRA has also pursued noncompliant brokers and senior staff directly, with outcomes including fines, suspensions, and full industry bars. Personal devices now carry personal liability. Notably, FINRA has also confirmed that communications from all associated persons must be captured and supervised consistently — including part-time, outsourced, and compliance function personnel.
3. From a U.S. priority to a cross-border one: The FCA’s 2025 multi-firm review of off-channel communications at 11 wholesale banks found that 41% of identified breaches involved directors or senior managers. That single figure dismantles the assumption that off-channel risk concentrates in junior or client-facing staff. Under the SMCR, it also puts named individuals in scope for conduct and control failures.

For global institutions, recordkeeping requirements and channel capture obligations are cross-border by nature. One message thread touching regulated business on both sides of the Atlantic can trigger SEC Rule 17a-4, FINRA Rule 4511, Article 16(7) MiFID II, and FCA SYSC 10A simultaneously. Stitched together regional capture solutions produce cross-border coverage gaps, as well as data and audit challenges, which global regulators do not tolerate — despite moves toward deregulation.

For risk functions, inaccurate or incomplete communications records degrade your ability to detect, investigate, and file Suspicious Transaction and Order Reports (STORs). A capture gap isn’t only a recordkeeping exposure, it’s a market abuse or non-financial misconduct detection failure, with their own reporting obligations attached.

In a landscape of deregulation and “red tape” reduction, channel capture and complete communication data sets remain critical to successful compliance, surveillance, and AI functions.

2. The importance of channel capture over channel bans

Global Relay’s Industry Insights Report 2026 found that 66% of firms are opting to ban certain communication channels rather than enabling and capturing their data. For some, this is the easiest option – if a channel is banned, it’s no longer a risk.

However, this assumption is largely false – and the industry recognizes that. Of the 66% of firms banning business communication channels such as WhatsApp, only 58% believe bans to be an effective solution. The risk remains, it’s just harder to detect. Out of sight and somewhat out of mind.

However, channel bans don’t remove the conversation. It continues on a channel you can’t see. Communication capture is the foundational control. For firms capturing, enriching, and retaining complete communications data – compliance, surveillance, and AI-driven business insight becomes infinitely simpler and more effective.

What are the benefits of complete channel capture?

• Defensible recordkeeping: Complete records with intact metadata mean that you have a watertight audit trail of the conversations and decisions happening within your business, and any attempts to edit or delete their data.
• Structural reduction in off-channel risk: When the channels your business relies on are approved and captured, the incentive to go “off channel” and work around them largely disappears.
• Communication monitoring that works: Monitoring that is run on a partial, incomplete data set produces false alerts, false narratives, and false confidence. This applies as much to non-financial misconduct (bullying, harassment, etc.) as it does to financial misconduct. Regulators have made it clear that both are a priority.
• Faster investigations: When all communication data is structured and stored in one place, investigations are expedient thanks to targeted search and fast information recall and reconstruction.
• Powerful, accurate AI outcomes: If all business communication channel data is being captured and stored completely, AI outcomes will be markedly improved. Surveillance models are only as accurate as their inputs. Standardized, deduplicated, threaded data means fewer false positives and materially less review time.

3. Emerging risk area: Capturing AI channels and chatbots

As businesses move to integrate AI and generative AI into their workflows, new risk areas are appearing. This is especially true in a number of growth areas which may soon pose tangible recordkeeping and monitoring risks:

a. Where GenAI platforms allow users to collaborate

Many organizations have now integrated GenAI platforms as a means of boosting efficiency and — in some instances — reducing resource spend. While these platforms are generally used to streamline organizations, they may also be used to generate customer communications or advice. Some interfaces, such as ChatGPT and Claude, offer users the ability to work together on projects, which surfaces a recordkeeping consideration.

If GenAI is being used for business communication — whether internal or external — is it then a record that should be captured? And if so, at what point does that record become a business communication, subject to associated recordkeeping obligations?

Away from the recordkeeping risk, there is also a data governance risk. Users may enter material non-public information or other sensitive data into GenAI platforms in order to generate outputs.

b. Where AI notetakers are being used – or worn

AI notetakers are becoming commonplace, used to record meeting outcomes and objectives, and quickly and accurately summarize key takeaways for later circulation.

While useful, these AI notetakers pose potential risk, as they may be used to take note of meetings containing MNPI or sensitive information that could previously have been distributed appropriately with original records being shredded. An even more concerning risk emerges where such notetakers are housed within “wearable” technologies such as watches or glasses, allowing users to transcribe or record meetings covertly.

If AI notetakers are being used, at what point do meeting notes become a business record to retain? How are data governance, confidentiality, and distribution being managed? And how are firms preventing individuals from secretly recording sensitive information which may then be used for purposes amounting to financial misconduct?

It is worth noting that these transcription services are not always accurate, in which case a further risk arises in the potential for misrepresentation of what was said. Firms should consider if, or how, they are validating these transcriptions, or at the very least identifying that such records may be inaccurate.

c. Where AI chatbots are utilized to provide customer advice

Perhaps the most clear-cut area of recordkeeping risk within AI-generated communication is where AI chatbots are routinely used to provide high-level customer advice. “Roboadvisers” are not a new phenomenon, but AI-powered bots are now becoming a common feature within banking. Using key information about an individual, AI can give tailored and accurate advice without the need for human oversight, intervention, or approval.

The risk here is more definable; this is a business communication, and therefore needs to be recorded and retained in accordance with recordkeeping rules.

In all three of the above examples, there is a clear need for firms to consider the importance, if not the requirement, of capturing AI prompts and outputs — whether from external platforms such as Microsoft Copilot, Claude, ChatGPT, or from internally developed AI assistants.

4. Understanding your vendor’s capture capabilities

Data completeness and complete channel capture are now foundational to key risk functions, but firms can’t build this foundation in isolation. Regulators and government bodies are placing greater focus on third-party capabilities and holding both firms and vendors to account for their outcomes.

The implication is clear — firms can outsource their recordkeeping functions but cannot outsource accountability. When selecting a vendor to assist with communication channel capture, look for the following capabilities:

Capability	What to require	Why it matters
Capture at source	Official vendor APIs, not screen scraping, client-side agents, or manual export.	Determines reliability, continuity, and legal defensibility.
Full fidelity	A full record including edits, deletions, reactions, attachments, threads, participant changes, and metadata.	Partial records don’t tell the whole story.
Proof of completeness	Automated reconciliation reporting confirming every message was received.	This allows you to show the regulator that there’s quality assurance.
Normalization	Data is standardized, grouped, threaded, deduplicated across content event types.	Improves search accuracy, AI performance, review cost.
Channel breadth	Capture every channel used for business communication — email, mobile, voice, chat, financial and trading applications, collaboration tools, social, generative AI.	Gaps in coverage leave room for risk
Population coverage	Retaining messages from all associated persons, including part-time, outsourced, and compliance staff.	Explicit FINRA expectation.
Future-proofing	The option to extend channel capture with flexible APIs and willingness to build bespoke connectors.	Stay up to date with technological advancement and emerging risk.
Active maintenance	Proactive updates as platform APIs change, with 24/7 support.	Prevents broken links between examinations.
Security and residency	End-to-end encryption from capture through transit to archive; jurisdictional controls.	Privacy and data protection obligations.
Single destination	One archive, one vendor, one point of accountability.	Removes integration and third-party risk.

5. How Global Relay delivers comprehensive channel capture

Whether firms are still looking for compliant solution for established channels such as WhatsApp or Apple® Messages or are weighing up options to capture emerging platforms such as Claude or ChatGPT, Global Relay has a data capture solution.

Global Relay Connectors capture communications from:

• Email
• Mobile and carrier-level text
• Chat and collaboration platforms
• Financial messaging and trading systems
• Voice and video
• Social media
• Generative AI tools including ChatGPT Enterprise and Microsoft Copilot

All use official vendor APIs and are actively maintained by dedicated teams tracking platform and API changes, so capture doesn’t quietly degrade when a vendor issues an update.

Global Relay Connectors provide the following critical benefits:

• Proof, not assurance: Data is captured at source, standardized with relevant metadata, deduplicated, threaded, and logically indexed. Reconciliation reports then confirm receipt of every record. That gives you an audit trail to put in front of an examiner or regulator in the event of investigation.

• Security and jurisdictional control: Transport Layer Security (TLS) and end-to-end encryption from point of capture through transit to archive. Global Relay owns and operates its own ISO 27001 certified, SOC 2 Type 2 attested. data centers, purpose-built for regulated organizations, with physical or logical segregation to consolidate multi-jurisdiction data and meeting local requirements.

• One vendor, end to end: Global Relay Connectors feed into Global Relay Archive, which in turn feeds Surveillance and eDiscovery. Global Relay offers a single point of accountability instead of a patchwork of third parties. This is founded on over 25 years of building compliance solutions for the world’s largest regulated institutions.
• Ever-expanding coverage: Global Relay is consistently creating new Connectors to meet emerging channel demands. The Open Connector API supports integration with any communication platform using a standardized format and secure delivery, and Global Relay will build bespoke connectors to your requirements.

6. What this means for your teams

	What complete capture delivers	What to ask a vendor
Compliance	Evidenced completeness, defensible records, examination readiness, credible self-reporting position.	How do you prove nothing was missed? What happens when a platform changes its API?
Risk	Full conversational context for financial and non-financial misconduct, reliable STOR detection, fewer blind spots.	Which channels can you capture today, and what’s the process for the ones you can’t?
IT	Fewer integrations to maintain, no in-house connector development, one vendor to manage.	Who maintains the data connectors? Where does data physically reside? What’s the support model after go-live?

Find out more about our end-to-end communication Channel Capture Solution or get in touch to enable data connectors across any channel.