Where to find illicit communications — and what to do about them

While there has been a decrease in the number of regulatory enforcement actions for off-channel communications and recordkeeping infractions in financial services, the bar hasn’t been lowered. Existing recordkeeping regulations haven’t been amended, investigatory powers haven’t been weakened, and firms must still evidence they have complete records of all necessary communications data.

Off-channel communications still pose a challenge, with 37% of financial services firms saying monitoring all their communications channels is their biggest compliance hurdle. Understanding where illicit communications may be hiding, and which populations may exhibit the biggest risk of “going off-channel,” is integral to proactive communications compliance.

Where to find illicit communications

WhatsApp and texts

Illicit communications are often an inevitable consequence of compliance-implemented, company-wide channel bans. The path toward off-channel communication is easily mapped; staff use channels like WhatsApp to speak about business-related matters, the compliance team tells them to stop, this acts as a hurdle to conveniently conducting business, so staff continue to use WhatsApp.  WhatsApp may be the most banned communications channel, with over a third of firms saying they ban it specifically, but it is by no means the only one.

The most striking example of this lies in the now-infamous action taken by the U.S. Securities and Exchange Commission (SEC) in September 2022, in which 15 broker-dealers were found to have “widespread and longstanding failures” surrounding their obligation to maintain and preserve electronic communications.

Following this case, the SEC, Financial Industry Regulatory Authority (FINRA), and Commodity Futures Trading Commission (CFTC) continued to issue a sequence of fines for off-channel communications for several years following this case. In a more recent recordkeeping-related enforcement, the CFTC found that recordkeeping failures went unnoticed by firms for over a decade.

Firms involved in these enforcements had allowed “pervasive off-channel communications” to occur on platforms such as WhatsApp and SMS/text messages. These communications happened below the compliance team radar, meaning they were not captured, retained, or monitored. Recordkeeping remains a regulatory concern despite a shift away from off-channel enforcements.

If your firm is looking to weed out illicit communications, your banned and restricted messaging platforms should be the first place you look. But the question worth asking is: have you evaluated whether those bans are working, or simply pushing communications further out of sight?

Personal phones

Corporate issued devices, once commonplace, are now considered a legacy hangover from the pre-digitization of the workplace. Bring Your Own Device (BYOD) has proliferated in most workplaces, including many financial services firms.

While BYOD policies can save costs, they can also present new risks, – especially when it comes to meeting requisite recordkeeping, capture, and monitoring rules. Without enabling a compliant communications application that keeps business and personal communication separate, the distinction between work and play, personal and private can be easily confused.

In one landmark case, the SEC found that, for at least two years, employees at a major financial institution had “often communicated about securities business matters on their personal devices, using text messages, WhatsApp, and personal email accounts“. Because they were made on personal devices, none of these records were retained.

Despite regulators having slowed the pace of off-channel communications enforcements, personal devices are still a compliance concern. In October 2025, FINRA fined a former broker for sending business-related messages on his personal phone and then trying to delete them to “impede investigations.”

Engaging employees about the necessity of including personal devices in wider compliance efforts can present a challenging conversation. But effectively educating them on the potential enforcement outcomes against the firm and the individual for off-channel breaches is vital, and the conversations non-compliant firms might face from regulatory investigators would be even more challenging.

Senior managers

Sometimes, it is not about where illicit communications may be hiding, but who it is that may be responsible for them. It is often the senior managers or executive team who are the most prolific offenders of off-channel communications — the very people responsible for setting the compliant example.

In the landmark case referenced above, the SEC noted that “supervisors, including managing directors, and other senior supervisors – the very people responsible for implementing and ensuring compliance” were using personal devices to communicate about business activity.

The SEC also found that a firm involved in a 2026 recordkeeping enforcement case had personnel “at multiple levels of authority, including supervisors and senior managers” communicating over off-channel platforms.

In a Financial Conduct Authority (FCA) multi-firm review of major banks conducted in August 2025 found that, of the 178 WhatsApp policy breaches identified, 41% were from senior staff.

How to find illicit communications

Firms need to ask themselves a series of hard questions when it comes to assessing the effectiveness of their communications risk identification. How can a compliance team access an employee WhatsApp chat, for instance? How can you monitor personal devices If required? And how can you tell senior managers to stop using channels that are outside the scope of current compliance efforts?

There are a range of approaches that could be considered:

Individual accountability

Remind staff (including senior ones) that they could face personal enforcement action and possible financial penalties for their use of off-channel communications, or that the regulator could seize their personal phones in an investigation.

Search
Lexicon searches and AI models within communication archives can be used to search for terms like “WhatsApp” or “take this offline” to identify where conversations may have switched to an off-channel platform.

Corporate devices
Firm-issued devices make it more straightforward for firms to restrict access to problematic channels, or to ensure all channels on a device are enabled via compliant monitoring and archiving solutions.

The capture-versus-ban question

Before investing further in risk detection tactics, firms should step back and ask a more fundamental question: are the channels banned the same channels employees and clients need to do business effectively?

Recent reporting on the top channels firms are banning versus capturing reveals is telling. The channels most frequently prohibited, such as WhatsApp, SMS, and other digital messaging apps, are often the very channels where business communication naturally occurs. Additionally, firms are banning social media channels like LinkedIn and Instagram, which are becoming increasingly popular for marketing and client engagement.

Meanwhile, the channels firms are actively capturing tend to be the more “traditional” ones: email, voice, and collaboration apps. The gap between what is banned and what is captured is precisely the space where illicit communications thrive. Firms should ask themselves:

• Have you assessed whether your banned channels are truly unused, or simply unmonitored?
• Have you compared your capture coverage against the channels your employees and clients prefer?

The firms making the most progress on off-channel risk aren’t the ones with the longest list of banned channels — they are the ones who have closed the gap by enabling compliant capture on the channels people use.