Off-Channel Communications: What They Are and Why They Matter

What they are · Why they matter · Which rules they breach · The highest-risk channels · Why they keep happening · Has enforcement slowed? · How to tackle them · FAQ

What are off-channel communications?

Off-channel communications are business communications that take place on a channel a firm does not capture and retain. In practice, that usually means employees discussing business on personal devices or unapproved messaging apps such as: WhatsApp, iMessage, Signal, WeChat, personal text and email, instead of the monitored, archived channels the firm has approved.

The term describes a gap, not a specific technology. What makes a communication “off-channel” is not the app itself but the fact that it falls outside the firm’s recordkeeping and supervision perimeter. The same WhatsApp message is compliant if the firm captures it and a violation if it does not. This is why off-channel communication is fundamentally a recordkeeping problem: a firm cannot preserve what it never captured, and cannot supervise what it cannot see.

This guide explains why off-channel communications have become the defining recordkeeping risk in financial services, which rules they breach, which channels carry the most risk, why they keep happening despite firm policies, and how firms can bring them under control.

Why are off-channel communications such a big deal?

Because without complete records, regulators are flying blind. When business is conducted on channels the firm did not capture, those records simply do not exist, leaving the regulator unable to do its job. That is why off-channel failures are treated as serious violations in their own right, even where no underlying misconduct is ever proven.

The financial consequences have been severe. The enforcement sweep began with a $125 million SEC penalty against JPMorgan in December 2021, and it did not stop there. Since 2021, the SEC and CFTC have charged more than 100 firms and imposed over $3 billion in combined penalties for failures to capture and preserve off-channel communications. Regulators have repeatedly stressed that recordkeeping and supervision requirements are fundamental, and that firms failing to meet them do so at their own peril.

A recurring and telling detail runs through these cases: the firms generally had policies in place restricting business communications to approved channels, and often required employees to self-certify compliance, yet staff used unapproved channels anyway. In many actions, the conduct reached supervisors and senior managers, the very people responsible for setting the example. For a closer look at how these cases unfold, see our coverage of a $1.3 million SEC action against 12 municipal advisors.

Which rules do off-channel communications breach?

Off-channel communication is not a standalone offense. It breaches the recordkeeping and supervision rules that require firms to capture, retain, and oversee their business communications. The most relevant are:

SEC Rules 17a-4 and 17a-3 (US broker-dealers). Broker-dealers must make and preserve their business records, including communications. See our guide to SEC Rules 17a-4 and 17a-3.

Advisers Act Rule 204-2 (US investment advisers). The recordkeeping rule for registered investment advisers, covering communications including recommendations and advice.

FINRA Rules 4511 and 3110. Rule 4511 requires firms to preserve books and records; Rule 3110 requires supervision, including the review of electronic communications. See our guide to FINRA Rule 4511.

MiFID II and FCA SYSC 10A (EU/UK). European and UK rules require firms to record communications relating to transactions and investment services. See our guide to SYSC 10A recording requirements.

The common thread is that these regimes are technology-neutral. They do not care which app a communication happened on; they require that business communications be captured, preserved immutably, and produced on request. An uncaptured WhatsApp message fails that test regardless of jurisdiction.

Which channels and apps carry the most risk?

The governing test is whether a communication relates to the firm’s business, if it does, it must be captured, wherever it happens. The channels most often at the center of off-channel enforcement and examination findings are:

• Consumer messaging apps: WhatsApp, iMessage, Signal, and WeChat, used on personal or business devices.
• Personal devices (BYOD): where business and personal communications mix, and business messages can go uncaptured.
• SMS and personal text: simple, ubiquitous, and easy to overlook.
• Ephemeral messaging: disappearing messages that are especially problematic, because deletion can be treated as impeding an investigation.
• Voice notes and calls: including voice features inside messaging and social apps, and requests to “contact me on WhatsApp” or “discuss offline” that move a conversation off-channel.
• Collaboration tools: chat and call functions in platforms such as Slack and Microsoft Teams that can slip past legacy archiving.
• Social media: direct messages and business conversations conducted on social platforms.

The practical answer is to capture business communications on these channels compliantly rather than pretend they are not being used. See our guidance on voice recordkeeping requirements and capturing social media communications.

Why do off-channel communications keep happening?

Enforcement has been intense and well-publicized, yet firms keep getting caught. The reasons are behavioral as much as technical:

• Convenience and responsiveness. Clients and colleagues live on messaging apps, and staff feel pressure to reply where the conversation already is.
• Hybrid and mobile work. Remote working blurred the line between corporate and personal channels, and personal devices became business tools.
• Policies without capture. A policy banning WhatsApp does not stop WhatsApp; it just moves the conversation somewhere the firm cannot see. Bans alone have repeatedly failed.
• Tone at the top. Where senior staff use unapproved channels, others follow, which is exactly why regulators have highlighted supervisor involvement.

Some firms have responded with “dummy” or phishing-style messages to catch staff using unapproved apps. Whether that is an effective or proportionate answer is debated, we explore it in this Regulatory Wrap discussion. The more durable fix is to remove the reason people go off-channel in the first place.

Has off-channel enforcement slowed down?

The enforcement picture has shifted, but the obligation has not. The SEC has signaled a shift in enforcement priorities, with less appetite for standalone technical recordkeeping cases, and the pace of headline standalone actions eased, with recordkeeping charges more likely to appear folded into broader enforcement matters going forward.

That is not the same as the risk going away. The rules are unchanged, and other regulators have kept the pressure on: FINRA’s 2026 Annual Regulatory Oversight Report references recordkeeping lapses more than 50 times, with electronic-communications capture, off-channel use, and inadequate supervision all appearing as examination findings. For most firms, particularly mid-market broker-dealers examined by FINRA rather than pursued directly by the SEC, off-channel remains a live examination priority. A quieter enforcement cycle is not a changed obligation.

How can firms tackle off-channel communications?

The most effective programs share a philosophy: enable compliant use of the channels people want to use, rather than trying to ban them out of existence. A practical approach:

1. Inventory every channel employees use for business approved and unapproved, and find where capture gaps exist.
2. Enable compliant capture at source for the channels people actually use, including messaging apps and mobile, so business conversations are archived automatically.
3. Set clear, realistic policies defining approved channels and make the approved option convenient enough that staff have no reason to go elsewhere.
4. Lead from the top, with senior managers modeling approved-channel use, since regulators scrutinize tone at the top.
5. Train for the real world, using authentic scenarios, for example, how to move a client who messages on WhatsApp back onto a captured channel.
6. Supervise for off-channel signals, using surveillance to flag phrases such as “text me” or “let’s take this offline” that indicate a conversation is moving off-channel.
7. Consider self-reporting where historical gaps exist cooperation and remediation have consistently reduced penalties.

Frequently asked questions

What are off-channel communications?

Business communications that take place on a channel the firm does not capture or retain, typically personal devices and unapproved apps such as WhatsApp, iMessage, Signal, or WeChat. They are a compliance risk because the firm cannot preserve or supervise what it did not capture.

Why are off-channel communications a problem if no misconduct occurred?

Because recordkeeping is an obligation in its own right. Regulators need complete records to supervise firms and investigate; missing records are a violation regardless of whether any underlying wrongdoing is found.

Is using WhatsApp for business against the rules?

Not inherently. The issue is capture, not the app. If business communications on WhatsApp are captured and retained through a compliant solution, they can be used; if they are not captured, they are off-channel and a violation.

How much have firms been fined for off-channel communications?

Since 2021, the SEC and CFTC have imposed more than $3 billion in combined penalties across over 100 firms, beginning with a $125 million SEC penalty against JPMorgan in December 2021.

Which rules do off-channel communications breach?

Recordkeeping and supervision rules: SEC Rules 17a-4 and 17a-3 and Advisers Act Rule 204-2, plus FINRA Rules 4511 and 3110 in the US, and MiFID II and FCA SYSC 10A in the EU and UK.

Has the SEC stopped bringing off-channel cases?

The pace of standalone SEC actions eased under a new administration, with recordkeeping more likely to feature within broader cases. But the rules are unchanged and FINRA continues to treat off-channel and recordkeeping as examination priorities.

How should firms prevent off-channel communications?

By enabling compliant capture on the channels employees actually use, backed by clear policies, tone from the top, realistic training, and surveillance for signals that a conversation is moving off-channel, rather than relying on bans alone.

How Global Relay helps

The durable answer to off-channel risk is to capture business communications on the channels people actually use. As a WhatsApp Business Solution Provider, Global Relay captures WhatsApp and other messaging, mobile, and voice channels directly from source into a compliant archive, and compliant communications capture closes the gaps across every channel, so business conversations are preserved, not driven into the dark. Explore Global Relay’s recordkeeping compliance solution.

Related reading:

• SEC Rules 17a-4 and 17a-3 explained
• FINRA Rule 4511
• SYSC 10A: FCA communication recording requirements
• Digital communication compliance: from email to AI
• SEC fines 12 municipal advisors $1.3M for off-channel communications
• Voice recordkeeping requirements
• An essential guide to capturing social media communications