In eComms surveillance review, an analyst reads the electronic communications and recorded calls that a firm's surveillance flags, decides whether each shows a risk such as inside information, a complaint, a gift or a move off the recorded channel, and records the decision with a reason. At a broker-dealer the review must be conducted by a registered principal and evidenced in writing under FINRA Rule 3110(b)(4) (FINRA Rule 3110); at a UK firm it is part of the monitoring SYSC 10A requires. The job is hard less because the risks are subtle than because they are rare: most flags are disclaimers, newsletters and market colour, read one line at a time, often in a language the analyst does not speak. Botminds' Electronic Communications Surveillance gives that finding work to agents, so the analyst's time goes on the alerts that need a person.
The hours below are our estimate for one flagged conversation that ends in an escalation, built from the steps a reviewer takes by hand and the same steps with the agents doing the finding. The people and figures in the screens belong to a fictional sample firm, Quillfield Capital.
Where an escalated alert's hours go: most of it is finding, not judging
By hand: 6 hours
- Finding the rest of the conversation · 25%
- Getting the foreign-language lines into English · 17%
- Checking for a recorded follow-up call · 17%
- Pulling orders and registers · 12%
- Writing the reason and memo · 17%
- Supervisor re-reading to countersign · 12%
With agents finding: 0.9 hours
- Conversation, translation, call check, orders (agents) · 44%
- Reviewer reading and writing the reason · 28%
- Supervisor countersigning · 28%
What does a communications surveillance analyst do?
The analyst works a queue. Each alert is a message, or a group of messages, that matched a lexicon term or a model's threshold; the analyst reads it, reads enough around it to understand it, and either closes it with a reason, escalates it to a supervisor, or sends it for coaching. FINRA's guidance lists what reviewers should be looking for: the use of confidential, proprietary and inside information, anti-money laundering issues, gifts and gratuities, private securities transactions, customer complaints, front-running and rumour spreading (FINRA, Regulatory Notice 07-59).
The written decision is the product. FINRA requires evidence that identifies the reviewer, the communication, the date and the action taken on any significant regulatory issue (Rule 3110, Supplementary Material .07), and the guide to what FINRA's email review rule requires shows why a click is not that evidence. In the UK, SYSC 10A tells firms to monitor compliance with the recording rules "by periodically monitoring the records of transactions and orders, including relevant conversations" in a "proportionate and risk-based manner" (SYSC 10A.1.15R(7)).
The role is usually first-line review inside compliance, often unregistered, working under a principal who signs. FINRA lets a supervising principal hand review functions to people who need not be registered, while staying responsible for the reviews and evidencing that the delegated work is done properly (Rule 3110.08). Where review is delegated, the procedures must give the analyst a protocol to escalate regulatory issues to the designated supervisor (RN 07-59).
8:00 a.m. The queue, and the noise in it
The day starts with the overnight queue, and most of it is noise. A lexicon flags words, not meaning, so a firm's own email footer, "past performance does not guarantee future results ... this message is confidential", matches two terms on every research email it sends. FINRA saw this in 2007: disclaimers often contain sensitive words such as "guarantee", which "would 'flag' every such email", and it listed the ability to exclude them as a feature of a good lexicon system (RN 07-59).
Out-of-office replies, newsletters, market colour quoting public headlines, a trader telling a friend "call me later" about dinner: each takes a minute or two to read and close, and each needs its own reason. The analyst's skill here is speed without carelessness, because the one real message looks, on its own line, much like the others.
The noise, grouped by reason, each alert with its own written reason
10:00 a.m. The language problem
A global desk writes in the languages its clients and brokers use, and the rule follows them. FINRA's guidance says firms "must be able to review electronic correspondence in all languages in which they conduct business with the public", and that where the reviewer is not fluent, the firm should require independent interpretation, not by the author or recipient (RN 07-59). In its 2026 oversight report FINRA listed "failing to review electronic communications in non-English languages" among its findings (FINRA, 2026 report).
In practice the Portuguese line goes to a translation tool in another window, or waits for the one colleague who reads it. Desk slang makes it worse: "me liga no celular" is "call me on my cell" to a fluent speaker and nothing in particular to a translation tool reading one line. A reviewer who reads Portuguese natively is worth a great deal on a Latin American desk, which is why language skills appear in so many surveillance job descriptions.
Noon. The off-channel phrase, and proving a negative
The hardest routine alert is a move to another channel: "call me on my cell, not here". Closing it properly means finding out whether a recorded call followed, which means searching the turret recorder for that line and time, the mobile capture for the trader's enrolled phone, and the approved messaging apps. By hand that can take an hour, so most such alerts close as noise without the check. The off-channel communications definition explains why the missing record is the finding.
In the sample firm's case, the broker had written the evening before that a deal was "ainda não é pública", not yet public, and at 9:41 a.m. described a reopening of the issuer's 2034 bonds. Two minutes later the trader replied "Me liga no celular, não aqui". No recorded call followed on any line, and the trader sold USD 12.5 million of the bonds 23 minutes later. That alert needs a person; the 164 off-channel phrases in the queue that did have a recorded follow-up did not.
One alert as the reviewer reads it: the whole conversation, original and English
3:00 p.m. Escalation, memo and evidence
An escalation is a short piece of writing: what was said, by whom, what followed, why it matters, and what should happen next. By hand, the analyst assembles it from screenshots of several systems; the supervisor then re-reads the thread before countersigning. FINRA's retention rule adds that the records must show who wrote each outgoing message and who reviewed it (Rule 3110.09), so the reviewer's identity has to travel with the decision. When the message points at a trade, the case goes to the trade surveillance team, whose output, if it reports, is a STOR the FCA can use.
A good escalation also says what the analyst could not see. "No recorded call on the turret line, the enrolled phone or the approved apps; a personal phone is outside what we capture" is a finding a lawyer can act on. "Possible off-channel" is not.
A reviewer's day by hand: the alerts that matter get what is left
- Clearing noise, one line at a time4.5 h
- Finding context and translations1.5 h
- Judging the few that matter1 h
- Writing escalations1 h
- Reviewing reasoned batches2 h
- Judging the alerts that need a person4 h
- Writing and checking escalations2 h
The supervisor's countersign, and why the maker cannot check
An escalation goes to a supervisor, who countersigns it or sends it back. FINRA's guidance says no one may review their own communications unless the firm is too small for any alternative, and that all reviewers "must have sufficient knowledge, experience and training to adequately perform the reviews", which the firm must be able to demonstrate (RN 07-59). The same logic runs through a good surveillance team: the person who escalates does not countersign, and the person who closed an alert does not decide whether a quality check was right to reopen it.
Supervisors also own the clock. FINRA expects firms to set "reasonable timeframes" for completing reviews, bearing in mind how far a review's usefulness is "diminished by the passage of time" (RN 07-59). The sample firm sets five business days; an off-channel move followed by a trade is worth reading the same morning.
How many alerts does an eComms reviewer clear a day?
No regulator or independent study publishes alert volumes or clearance rates for communications reviewers, so a firm has to measure its own. The sample persona on this page clears about 140 alerts a day, one flagged line at a time; the real number depends far more on the lexicons than on the people, because a footer that fires on every research email can double a queue overnight.
Measure three things per reviewer and language, monthly: alerts decided per working hour, split by outcome; the share a blind second review would have decided differently; and days from alert to decision. The first tells you capacity, the second quality and the third whether the queue is safe. In the sample firm's September, 9,860 alerts were decided, a blind re-read of 489 closes reopened 7, and the median alert took 1.6 days to a decision.
One month of the sample firm's surveillance, in four numbers
9,860
alerts in September, each closed with a reason or escalated
88
escalated and countersigned; 14 went to Legal
1.4%
of closes reopened by a blind re-read of 489
1.6days
median from alert to decision, against a five-day deadline
The skills an eComms review team needs
A surveillance team needs four things in its reviewers, and the rules explain why. Market knowledge, because a reviewer has to tell market colour from inside information. Languages, because FINRA and the FCA expect review in the languages the business uses. Writing, because the reason is the evidence. And judgment under volume, because the real alert hides among the noise.
A fifth is now appearing: working with automated tools. The SEC's examination priorities for fiscal 2027 note that firms have begun giving "compliance monitoring and surveillance" to what the SEC calls "super intelligence (SI)" tools, and the analyst's output from such a tool is tested against the same rules as a person's (SEC Division of Examinations, FY2027 priorities). The FCA saw banks adding natural language processing to lexicons and exploring AI to filter false alerts (FCA, August 2025). An analyst who can check a machine's reason, rather than retype it, is the analyst those firms will need.
What changes for each person when agents do the finding
In Electronic Communications Surveillance seven agents take the finding work: rebuilding the conversation across channels, putting English beside the original, checking for a recorded follow-up, linking orders and registers, proposing a reason, re-reading a sample of closes and drafting memos. They propose; they never close, escalate or contact anyone. The people keep every decision.
The people around one alert, before and after the agents take the finding
Today
Reads about 140 alerts a day, one flagged line at a time, with translations in another window.
With agents
Reads each flagged conversation rebuilt across channels with English beside the original, approves noise in reviewed batches, escalates with reason codes.
Still theirs: Every close and escalation, with a written reason
Today
A queue where a newsletter footer and a broker passing deal news wait side by side.
With agents
Sees the escalations to countersign and the alerts near deadline first, instructs the agents in plain words, approves rule changes after a back-test.
Still theirs: Countersigns, rule approvals
Today
Re-reads every thread before countersigning.
With agents
Countersigns escalations made by someone else, with the reason and the record in front of them, and decides quality reopens.
Still theirs: The second pair of eyes
Today
Answers exam requests from the archive, the review tool and inboxes, by hand.
With agents
Signs a monthly report whose every number opens the alerts behind it.
Still theirs: The signature on the report
The day changes shape rather than length. Noise arrives grouped by reason, each alert with its own reason already written, and the reviewer's job is to check those reasons and send back any that are wrong. The alerts that need judgment arrive with the conversation, the translation, the call check and the order already in front of them. What the reviewer writes is still theirs. The page on who may close an alert sets out where that line sits.
Questions people ask
Is a communications surveillance analyst the same as a trade surveillance analyst?
No. A communications analyst reviews emails, chats and calls; a trade surveillance analyst reviews orders and trades for patterns such as insider dealing or manipulation. They meet on cases, when a message and a trade tell the same story, which is why good surveillance links the two.
Do communications surveillance analysts need to be registered?
Not necessarily. FINRA requires reviews of correspondence to be conducted by a registered principal, but lets the principal delegate functions to people who need not be registered, provided the principal stays responsible and evidences supervision under Rule 3110.08.
Do communications surveillance analysts need languages?
Firms need review in every language in which they do business with the public, FINRA says, with independent interpretation where the reviewer is not fluent. FINRA's 2026 findings include firms failing to review non-English communications. Native speakers of the desk's languages are therefore in demand, and translation tools need checking.
What does an alert's written reason need to say?
Enough for someone else to see why the decision was right: what the message meant, what was checked, and why it is or is not a concern. FINRA's evidence standard asks for the reviewer, the communication, the date and the action taken on any significant issue; a pick-list code alone records an outcome, not a review.
What is a reasonable review deadline for surveillance alerts?
FINRA asks firms to set reasonable timeframes based on the business and on how quickly a review loses its value, and fixes no number. The sample firm sets five business days and auto-escalates to the person's supervisor at the deadline; a firm with a retail customer base may need faster reviews, FINRA notes.
Can AI take over the review of surveillance alerts?
The rules keep a person accountable: FINRA keeps the supervising principal responsible for every review, and the SEC says it will examine whether firms using "super intelligence" still meet their obligations. Agents can take the finding, translating and drafting; deciding and signing remain human work.