eComms surveillance software that reads your existing archive

eComms surveillance software reviews a firm's electronic communications, email, chat, Teams, mobile messages and call transcripts, for misconduct and records each review. Most firms already own two of its three parts: an archive that keeps communications in the form the rules require, and a lexicon engine that flags messages. What they lack is the review: a reviewer still reads one flagged line at a time, without the conversation around it. Replacing the archive to fix the review is the expensive way round. Botminds' Electronic Communications Surveillance reads the archive and alerts in place, read-only, rebuilds each flagged conversation across channels and proposes a disposition with a written reason for a reviewer to decide, so going live is a connection and a test, not a migration.

The plan below is our planning estimate for a mid-size manager whose archive and lexicons are in good order; no regulator or independent study publishes implementation times, and a firm's own data quality sets the pace. Figures from the solution are from a fictional sample firm.

What is eComms surveillance software, and must it replace the archive?

eComms surveillance software is the part of a communications compliance stack that decides which messages a person must read and records what they decided. The archive is a different system with a different job: keeping the record. For broker-dealers that job is defined by Rule 17a-4(f), which requires electronic records to be kept either in a non-rewriteable, non-erasable format or in a system with an audit trail of every change, when it was made and by whom, able to recreate the original (17 CFR 240.17a-4(f)). In the UK, recordings must be stored so they can be replayed or copied but not altered or deleted (SYSC 10A.1.16R).

Nothing in the rules ties the review to the archive's vendor. A surveillance system can read from the archive and keep only its own decisions, which leaves the record where it is compliant and makes the surveillance system replaceable. A system that copies records into its own store should be able to prove its copy matches the original, message by message.

Why keep the archive and the lexicon engine

Three reasons. The records already meet the format rules, and moving them risks the very gaps examiners look for: among its findings on records converted from one form to another, FINRA's 2026 report lists firms not maintaining "policies and procedures and related controls to protect the integrity of records for the duration of the applicable retention period" (FINRA, 2026 report). The lexicons hold years of tuning in the firm's own jargon and languages. And the review problem, noise, missing context and language, is not solved by a new archive.

Keeping the lexicon engine does not mean keeping its noise. A review layer reads each flag with the conversation around it and proposes a close with a reason, and its records of which phrases closed as false positives become the evidence for tuning the lexicon later, each change back-tested before it goes live.

How to connect surveillance to an email archive

Connect read-only, by service account, with three things proved before anything else: completeness, identity and integrity. Completeness means every source the policy covers is connected and every day's volume reconciles to the archive's own count. Identity means each sender and recipient resolves to a person in the HR directory, including leavers and contractors. Integrity means each item read carries the archive's identifier and a hash that can be checked against the original later.

Completeness is where projects fail quietly. FINRA's 2026 report finds firms "not properly supervising third-party vendors that support firms’ monitoring of their associated persons’ electronic communications, resulting in firms not capturing, retaining or supervising communications" (FINRA, 2026 report). The FCA's 2025 review heard of data reconciliation problems that made it hard for banks to validate that the right communications had been captured (FCA, August 2025). And in trade surveillance the FCA has described a firm that believed all of one part of its trade and order data was being sent daily for surveillance when it was not (FCA, Market Watch 79, May 2024). A daily reconciliation report closes that gap before go-live, not after an exam.

Does eComms surveillance cover WhatsApp?

Only if the firm captures it. Surveillance software reads what the archive holds; a messaging app is covered when the firm runs an approved capture tool for it on enrolled devices, and the messages land in the archive like any other. WhatsApp on a personal phone the firm does not capture is, by FINRA's definition, an off-channel communication, and no surveillance product can see it (FINRA, 2026 report).

What surveillance can do is find the trace in a captured channel and check what followed. In the sample firm, the Off-channel agent found 2,206 moves to another channel from October 1 to 19, matched 2,171 to a recorded follow-up within 30 minutes and put the other 35 in front of a person. The off-channel communications guide explains why the missing record is the finding.

How long does it take to implement eComms surveillance?

On an existing archive, weeks for the connection and a month or two of testing; with a migration, longer, because the records must move and be proved complete first. No regulator or independent study publishes implementation times, so ask vendors for references at firms of your size and channel mix, and plan on your own data. The slow steps are rarely software: access approvals, identity resolution across systems, and agreeing reason codes and thresholds with the people who will sign them off.

The replay is the step that earns trust. Run last month's flags through the new review layer with your reviewers' decisions held back, and compare: the alerts it would have closed that your team escalated, the ones it would have escalated that your team closed, and the reasons on both. Then a parallel run, both processes live, with a quality sample on the new one, before the old queue is switched off.

The QA sample that proves go-live

A go-live decision needs a measure of the review's quality, not only its speed. FINRA's guidance says firms using a vendor's lexicon system should "periodically inquire as to the effectiveness of the system", that the firm is responsible "for ensuring that the system utilized is functioning properly", and that a firm without confidence in its lexicon should consider supplemental random review (FINRA, Regulatory Notice 07-59). The same logic applies to a review layer.

In practice: a blind re-read of a random share of closes, stratified so every reviewer and language is sampled, with a different reviewer deciding each disagreement; seeded messages for each risk type sent through the real channels; and the reopen rate reported weekly during the parallel run. The sample firm re-reads 5% of closes a month, at least two per reviewer and language; in September that meant 489 closes and 7 reopens.

The first screen of the day: what needs a person, and which feed is late

What the first month should show

By the end of the first live month, a head of surveillance should be able to answer five questions from the system rather than from spreadsheets: what was captured and from which sources, with any gaps; how many alerts were decided, by outcome and reviewer; how long they took against the deadline; what the quality sample found; and which lexicon changes were proposed and what their back-tests showed. If the system cannot answer them, the go-live is not done.

The last test is an examiner's request. Pick twelve people and a quarter, and ask for every communication reviewed with its decision. The answer should come as one export with the original records and their hashes, the decisions with reviewer, reason and time, and the audit trail, so an examiner can check that nothing was altered between the archive and the file.

An examiner's request answered from the archive, with hashes checked

A go-live checklist for eComms surveillance on an existing archive

Where the cost of this review layer comes from, and how to compare it with a full replacement, is set out in email surveillance software, priced per closed alert.

Questions people ask

What is the difference between eComms surveillance and eComms monitoring?

The terms overlap. Monitoring often means checking that communications are captured and recorded as the rules require; surveillance means reviewing them for misconduct and evidencing each review. The FCA's SYSC 10A asks for both: record, and periodically monitor the records, including conversations, on a risk basis.

Can eComms surveillance run on an archive from a different vendor?

Yes, if the archive exposes read access to messages and their metadata. Ask to see the connector on your own archive, the daily reconciliation it produces and how it proves an item it shows matches the original.

Do we need to move historical data to a new surveillance system?

Not for surveillance going forward. Historical messages stay in the archive under retention; a review layer reads them when it needs context or when an investigation reaches back. Migrating them adds risk to records the rules require you to keep intact.

Does eComms surveillance replace our lexicons?

It need not. The lexicon engine can keep flagging while a review layer reads each flag in context and proposes a reasoned close. The dispositions then show which terms produce noise, so lexicon changes can be made on evidence and back-tested before approval.

Who is responsible if the surveillance vendor misses messages?

The firm. FINRA keeps the supervising principal responsible for every review and finds firms that did not supervise their monitoring vendors; the FCA says SYSC 10A responsibilities cannot be transferred to third parties. Contracts and daily reconciliations are how a firm shows oversight.

How long is a parallel run?

Long enough to cover a full review cycle and a quality sample of every reviewer and language; our planning estimate is about two weeks after a replay of the previous month. The test is the reopen rate and the explanations of disagreements, not the calendar.