Electronic communications surveillance is the review of a firm's emails, chats, mobile messages and recorded calls for risks such as inside information, market abuse, collusion, complaints and moves to unrecorded channels, with evidence of each review. Firms do it because the rules require them to keep these communications and supervise them: FINRA Rule 3110 requires broker-dealers to review correspondence and internal communications (FINRA Rule 3110), and the FCA requires UK firms to monitor their recorded conversations (SYSC 10A.1.15R). The hard part is volume: a global manager captures millions of messages a month and almost all of them are harmless. Surveillance has tried three ways to find the few that are not, words, scores and reasons, and Botminds' Electronic Communications Surveillance is built on the third: agents that read each flagged conversation and propose a written reason for a person to decide.
Three generations of electronic communications surveillance
1Words
Lexicons
How it works
A list of sensitive words and phrases, in each language, flags every message that contains one.
What it hands the reviewer
A hit: this term appeared in this message.
The catch
Noise from footers and market colour; blind to images, encryption, slang and anyone avoiding the words.
2Scores
Models
How it works
Statistical and language models score each message or conversation for risk, often alongside the lexicon.
What it hands the reviewer
A ranked queue: this message scores 0.87 for inside information.
The catch
Fewer, better-ordered alerts, but a score is not a reason; a reviewer still rebuilds the context.
3Reasons
Agents
How it works
Agents read the flagged conversation across channels, check records and orders, and draft a disposition.
What it hands the reviewer
A proposed decision with a written reason, each claim cited to a record, for a person to decide.
The catch
Needs controls: a confidence floor, a blind QA sample, versioned prompts and a person on every decision.
What is electronic communications surveillance?
It is the part of a compliance programme that turns kept communications into supervised ones. The recordkeeping rules say what must be kept: broker-dealers keep all business communications for at least three years (17 CFR 240.17a-4(b)(4)), advisers keep written communications about advice, orders, funds and performance (17 CFR 275.204-2(a)(7)), and UK and EU firms record in-scope calls and messages for five years. Surveillance is what the firm does with them: decide which to read, read them, and record what it decided.
The communications surveillance meaning in job titles and product names is the same, sometimes shortened to eComms surveillance. It sits beside trade surveillance, which looks at orders and transactions, and the two meet on cases: a chat that passes on deal information and a trade minutes later tell one story.
How does communications surveillance work?
Every system, of every generation, does five things in order. It captures, reading from the archive, recorders and capture tools. It detects, deciding which messages need a person. It assembles, giving the reviewer what is needed to judge. It records the decision, with the evidence the rules require. And it checks itself, through sampling, testing and reporting. The generations differ mostly in the second and third steps.
The fourth step is fixed by regulation, not technology. FINRA's evidence must show the reviewer, the communication, the date and the action taken on any significant regulatory issue (Rule 3110.07), and the guide to FINRA's email review rule goes through it. A system that detects brilliantly but records only a click has not finished the job.
Generation one: lexicon surveillance
Lexicon surveillance flags messages that contain listed words or phrases, and it remains the base of most programmes. FINRA's 2007 guidance described it in detail: an appropriate lexicon, kept confidential and evaluated for efficacy, with industry jargon and foreign-language terms where branches need them, the ability to read attachments and to exclude the firm's own disclaimers (FINRA, Regulatory Notice 07-59). Lexicon communication surveillance is transparent, cheap to run and easy to explain to an examiner: the term is on the list, and it appeared.
Its weaknesses were known from the start. FINRA noted that lexicons could not read encrypted or password-protected files, that image files could carry information past them, and that a determined representative could simply avoid the trigger words. Research on keyword search in legal document review found the same pattern at scale: a Boolean query negotiated by two lawyers found on average 22% of the relevant documents in one large test (Oard et al., 2010). And a lexicon cannot tell a footer that says "guarantee" from a salesman who promises one, so it produces noise in proportion to its coverage.
Generation two: model scores
The second generation added statistical and language models that score messages, so the queue can be ranked or thinned rather than taken in order. The Financial Stability Board described the idea in 2017: machine learning together with natural language processing "can interpret data inputs such as e-mails, spoken word, instant messaging, documents, and metadata", and it reported that the SEC's own staff, using text analytics on filings, found the techniques "five times better than random at finding language that merits a referral to enforcement", while still producing false positives (FSB, November 2017).
By 2025 the FCA saw banks "integrating natural language processing alongside existing lexicon-based models and exploring AI to filter out false alerts", and two comparing staff's use of approved apps against peers to spot off-channel behaviour (FCA, August 2025). Models help with the first problem, which messages to read. They do less for the second. A score tells the reviewer that a message is probably interesting, not what it means, so the reviewer still finds the rest of the conversation, translates it, checks the call log and writes the reason by hand.
What the research and the regulators measured about detection
22%
average recall of a lawyer-negotiated Boolean query in a large test of legal search
5×
better than random: SEC staff text analytics at finding language meriting enforcement referral
11
banks in the FCA’s 2025 review; some were adding language models to lexicons
Generation three: agents that write the reason
The third generation takes on the assembling and the drafting. Agents read the flagged message with the conversation around it, across email, chat, Teams and calls; put the original beside a translation; check whether a promised call was recorded; link the trades in the window; and propose a disposition with a written reason, every claim cited to the record it rests on. A person reads that and decides.
The reason is what earlier generations could not produce, and it is what the rules ask for. FINRA's evidence must show the action taken on any significant issue. Under the UK's market abuse rules as they currently apply, firms that arrange or execute transactions must keep for five years the analysis of each order or transaction they examined and their reasons for reporting it as suspicious or not (Delegated Regulation 2016/957, Article 3(8), UK version). A trade alert closed because of what a chat showed needs that chat's reading written down. A lexicon hit is not a reason, and neither is a score.
Members should incorporate ongoing evaluation procedures to identify and address any "loopholes" or other issues that may arise as the means of transmitting sensitive information "under the regulatory radar" become more sophisticated and difficult to capture.
FINRA, Regulatory Notice 07-59 (December 2007)
Agents bring new risks, and they need controls an older system did not. A language model can write a fluent reason that is wrong, so every statement must cite its source and a person must decide. A blind re-read of a sample of closes measures how often the agents and reviewers are right; versioned prompts and thresholds, with changes back-tested and approved, keep the system explainable a year later. The page on who may close an alert sets out where the line between agent and person sits.
A third-generation alert: the conversation, the translation, the record check, the reason
What each generation leaves the examiner
An examiner reviewing surveillance does not see the technology; they see the record it leaves. The table compares what each generation leaves behind for one alert, and what the reviewer still had to do by hand.
What an examiner can see for one alert, by generation of surveillance
| Question an examiner asks | Lexicon | Model score | Agents and a reviewer |
|---|---|---|---|
| Why was this message flagged? | The term it matched | A score, sometimes with the words that drove it | The term or score, and the rebuilt conversation |
| What did the reviewer read? | Usually one line | Usually one message | The thread across channels, with what was left out and why |
| Was it understood in its language? | If the reviewer read it | If the reviewer read it | Original kept, English beside it, a confidence per message |
| Why was it closed? | A pick-list code | A pick-list code | A written reason citing the records it rests on |
| Who decided, and when? | Reviewer and date | Reviewer and date | Reviewer and date, and the countersigning supervisor |
| How do we know closes are right? | If someone sampled | If someone sampled | A blind re-read of a share of closes every month |
Electronic communications monitoring and surveillance: the same thing?
Mostly, but the words lean differently. Electronic communications monitoring often means checking that communications are captured and kept as the rules require, and sometimes means general employee monitoring outside finance. Surveillance in financial services means reviewing communications for misconduct and evidencing the review. The FCA uses "monitor" for both halves: firms must monitor compliance with the recording rules by periodically monitoring records of orders and transactions, including conversations (SYSC 10A.1.15R(7)).
The distinction matters when buying. A product that monitors capture, completeness, feed health and retention does not review content, and a product that reviews content depends on capture being complete. A firm needs both, and the off-channel question sits across them: off-channel communications are a capture failure that only content review can detect.
What does not change from one generation to the next
The people. Each generation has moved work from reviewers to machines, and none has moved responsibility. FINRA keeps the supervising principal responsible for every review whatever is delegated (Rule 3110.08). The SEC's fiscal 2027 priorities record that generative "super intelligence (SI)" tools have reached compliance monitoring, without lifting any duty from the people who supervise (SEC, FY2027 examination priorities). The FCA requires recording arrangements that are technology-neutral.
So the measure of a generation is not how much it automates but how much better the record of each human decision becomes. In Electronic Communications Surveillance the design target is every alert closed with a written reason and a named reviewer, every escalation countersigned by someone other than its maker, and a blind sample of closes re-read each month.
Questions people ask
What is lexicon surveillance?
Lexicon surveillance flags communications that contain words or phrases on a list the firm maintains, often in several languages. FINRA's guidance expects the list to fit the firm's business, be kept confidential and be tested for efficacy, and allows a firm to decide it need not review every hit if the rationale is documented.
What is the difference between lexicon and AI surveillance?
A lexicon flags a message because a listed word appeared; a model flags or ranks it because its content resembles risky messages. Agents go further and read the conversation, check records and draft a reason. All three still need a person to decide and a record of the decision.
Is lexicon surveillance still acceptable to regulators?
Yes. No rule requires a particular method; FINRA's guidance describes lexicon, random and combined review, and asks firms to understand their tools' limits and evaluate them. Its 2026 findings fault inadequate samples and missing targeted keyword searches, not lexicons as such.
Does communications surveillance include voice?
It should, where calls are recorded. In the UK and EU, in-scope calls must be recorded and monitored; in the US, firms that record calls can review the transcripts with the written messages around them. Electronic Communications Surveillance reads turret and mobile call transcripts alongside email, chat and Teams.
Who uses electronic communications surveillance?
Broker-dealers, investment advisers, asset managers, banks and trading firms whose staff communicate about orders, advice and deals. Compliance teams run it; surveillance analysts review the alerts; supervisors countersign escalations; the chief compliance officer answers for the programme.
Will agents replace lexicons?
Not soon, and not necessarily. Lexicons are transparent and cheap, and a firm can keep them as the first filter while agents read and reason about what they flag. The dispositions agents and reviewers record then show which terms only make noise, so the lexicon improves on evidence.