Social media as a risk for financial services

Why is social media becoming a compliance risk for financial services?

Social media has become an important channel for financial institutions to communicate with customers, prospects, employees, and the wider market. That creates new compliance challenges when business communications, financial promotions, investment advice, or sensitive information move onto platforms that may sit outside traditional monitoring and recordkeeping controls.

Global Relay research cited in this paper found that 55% of compliance executives considered social media to be an emerging compliance risk. The paper identifies four connected areas of concern: market risk, marketing and advertising risk, recordkeeping risk, and consumer harm.

What are the main social media compliance risks?

1. Market and economy risk

Social media can spread information, opinion, and misinformation at significant speed and scale. Posts from high-profile individuals, employees, or market participants can influence investor sentiment and, in some cases, contribute to rapid market movements.
The paper highlights how social media can amplify market-sensitive information and accelerate reactions to emerging events.

2. Marketing and advertising risk

Financial firms increasingly use social platforms to promote products and services, but existing financial-promotion and advertising obligations continue to apply when marketing moves onto new channels.

This includes risks created by misleading claims, hypothetical performance, endorsements, and the growing use of financial influencers or “finfluencers”.

The challenge is made harder by the speed and informality of social media. Content can be published, shared, or amplified quickly, while personal and professional activity can become difficult to separate.

3. Recordkeeping and off-channel communication risk

Social media can also become a business communications channel. Direct messages, posts, comments, and other interactions may therefore create recordkeeping obligations when they relate to regulated business activity.

The paper notes that 33% of financial institutions were already capturing LinkedIn data, while 27% reported struggling to capture communications data from all channels in 2024, up from 23.1% in 2023.

This illustrates the growing gap firms can face as employees and customers adopt more communications platforms.

4. Consumer harm

Social media creates a large and accessible audience for financial information and advice. Where content is unclear, misleading, poorly targeted, or promoted by individuals without appropriate controls, consumers can be exposed to unsuitable products, inaccurate information, or poor financial decisions.

This means social media compliance is not only a recordkeeping problem. Firms also need to consider how financial promotions, advice, and customer communications are governed across public and private social channels.

Which regulations can apply to social media communications?

The paper shows that regulators are applying both existing rules and newer guidance to social media activity rather than treating it as a separate communications category.

Depending on the firm, jurisdiction, and communication, relevant requirements can include:

• SEC Rule 17a-4 recordkeeping requirements for applicable broker-dealers, including business-related social media communications.
• The SEC Marketing Rule, which governs investment adviser advertising and can apply to promotions distributed through social media.
• Regulation Best Interest (Reg BI) , including record-making and recordkeeping requirements connected to retail customer interactions.
• MiFID II requirements where social media communications constitute business communications or investment advice.
• Other jurisdiction-specific financial-promotion, consumer-protection, conduct, and recordkeeping requirements.

The important principle is that the communication channel does not remove the underlying regulatory obligation. If regulated business activity takes place through social media, firms need to understand how the relevant rules apply to that activity.

What does the enforcement landscape show?

The paper describes an increasingly active enforcement environment around electronic communications and recordkeeping.
It notes that in September 2024 alone, the SEC charged 29 firms over recordkeeping failures, adding to more than
US$3 billion in penalties issued over the preceding four years.

For compliance teams, the message is that expanding communications channels need to be reflected in capture, retention, supervision, and investigation processes rather than treated as an exception to established controls.

Four steps firms can take to mitigate social media compliance risk

1. Create clear policies and communicate them effectively

Social media policies should clearly explain what employees can and cannot do, using language that is easy to understand.

The paper recommends tailoring policies by role and, where appropriate, by platform, because the risks faced by traders, marketers, advisers, and other employees can differ significantly.

Regular training and employee attestations can help reinforce those expectations.

2. Capture and archive communications from critical social media platforms

Where social media is permitted for business use, firms should consider technology that captures relevant communications at source and preserves them in a compliant archive.

Structured capture can help retain posts, messages, and associated context in a form that supports search, supervision, eDiscovery, legal hold, audit, and regulatory response.

3. Monitor social media communications for relevant risks

Monitoring should reflect the different risks created by different social media use cases.

For example, language associated with misleading promotions may look very different from language associated with the sharing of material non-public information.

The paper also notes that AI-enabled surveillance can help generate alerts where potentially risky communications are identified.

4. Review policies, technology, and workflows regularly

Social media platforms and communications behaviour evolve quickly.

Firms should therefore review policies, monitoring approaches, and technology coverage regularly, horizon-scan for regulatory change, and assess whether new channels are creating gaps in the existing compliance framework.

Why does complete social media capture matter?

A social media message can be relevant to marketing compliance, consumer protection, recordkeeping, market conduct, or an investigation at the same time.

Capturing communications in a complete and structured format helps compliance teams preserve that context and understand what happened if the communication later becomes relevant.

The objective is not simply to block new communications channels. It is to build a defensible approach that allows the organization to use modern communication tools while maintaining appropriate oversight and preserving the records it may need.

Explore the full paper

Read the full paper by Global Relay Director of Regulatory Intelligence Robert Mason and Head of Content Jennifer Clarke to explore the four social media compliance risks in detail, how regulators are adapting existing rules to new communications channels, and the practical steps firms can take to reduce market, marketing, recordkeeping, and consumer risk.