Why Canadian banks need strong mobile device management

Why is mobile communications compliance becoming a priority for Canadian banks?

Mobile messaging has become an important part of business communications, but it also creates are cordkeeping and supervision challenge when conversations move onto SMS, WhatsApp, Apple Messages, collaboration platforms, or personal devices.

For Canadian financial institutions, the issue is not simply which channel an employee uses. It is whether business-related communications that should form part of the compliance record are captured, retained, and available for supervision, audit, investigation, or regulatory review.

To help, we’ve identified the potential fines and firetraps lurking in mobile business communications and the best practices for mobile device management in 2026. Download the PDF below or learn more about Global Relay’s mobile communications solution.

What do the latest communication capture trends show?

Global Relay data from 12,000 financial institutions shows that mobile communications capture is continuing to expand.

The report highlights:

• A 36% increase in firms capturing WhatsApp
• A 114% increase in firms capturing Apple Messages
• 89% of WhatsApp capture occurring in North America

The trend matters because restricting one platform does not necessarily remove the underlying communications risk. When WhatsApp is restricted, employees may move conversations to Apple Messages, SMS/MMS, or other channels, including on personal devices.

What counts as a missed mobile message?

A missed message is a business-related communication that should have been captured but was not.

The report gives examples such as:

• a trader discussing material non-public information
• an executive discussing pricing, strategy, or profit-sharing information
• a banker sharing client instructions off-channel
• a conversation moving from an approved platform onto a personal device

The compliance risk is therefore broader than deliberate misconduct. A communication can create a recordkeeping gap simply because it takes place outside the channels a firm is able to capture.

Which regulators shape mobile communications expectationsfor Canadian financial institutions?

The report highlights several regulatory bodies that can influence the communications compliance expectations facing Canadian financial institutions:

• Canadian Investment Regulatory Organization (CIRO) requires complete and accurate records of business communications.
• Office of the Superintendent of Financial Institutions (OSFI) sets expectations relating to governance, risk management, and auditability.
• U.S. Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA) may create additional expectations for firms with cross-border operations.

For firms operating across jurisdictions, mobile communications controls therefore need to account not only for domestic requirements but also for the expectations attached to their wider business footprint.

Where can mobile communications create the greatest gaps?

Many firms already capture established channels such as email, Microsoft Teams, and Instant Bloomberg.

The report identifies growing risk around channels and behaviors that are harder to govern consistently, including:

• SMS and MMS
• Apple Messages
• WhatsApp
• Personal devices and BYOD environments
• Employees switching platforms when a preferred channel is restricted

This is why policies that only tell employees where they should communicate may not provide complete protection. Firms also need visibility into the channels employees actually use for business.

What should strong mobile communications controls enable?

The report identifies several practical capabilities that can help close the mobile capture gap.

A mobile communications compliance approach should be able to:

• Capture business communications from SMS/MMS, Apple Messages, WhatsApp, and other supported mobile channels
• Support both BYOD and corporate-issued devices
• Archive captured communications in a compliant repository
• Make communications available for supervision, audits, investigations, and eDiscovery
• Reduce reliance on policy alone by automating capture of business-related communications

Why does this matter for Canadian banks in 2026?

The core risk is not only the misconduct a surveillance system can identify. It is the communications that never enter the compliance record in the first place.

As mobile business communications continue to expand, Canadian banks need to understand where conversations are taking place and whether their capture controls cover those channels consistently.

Strong mobile communications management can help reduce gaps between policy and employee behavior by ensuring relevant business messages remain available for recordkeeping, supervision, and investigation.

Explore the full report

Download the full report to explore the mobile communications trends, regulatory considerations, and practical controls Canadian financial institutions should consider when reviewing their mobile compliance strategy in 2026.