Email surveillance software, priced per closed alert

Email surveillance software reviews a firm's emails and chats for misconduct, flags messages that match lexicons or models, and records each reviewer's decision. Its price is usually quoted per monitored person or per message volume, but vendors do not publish prices, and the licence is rarely the largest cost. The largest cost is people reading alerts, and most alerts are noise: research footers, newsletters, market colour, out-of-office replies. So the useful unit is the closed alert, everything spent in a month divided by the alerts decided, and the lever is the number of alerts a reviewer must read for each one that matters. Botminds' Electronic Communications Surveillance lowers that cost by having agents read each flagged conversation and propose a reason, which reviewers check in batches.

The figures from the solution on this page come from a fictional sample firm, Quillfield Capital, monitoring 2,140 people across New York, London and Singapore. They show how to measure, not what any customer achieved.

How much does email surveillance cost?

Vendors do not publish prices, and no regulator or independent study publishes what firms spend, so the only reliable number is one a firm builds from its own books. Build it per closed alert. Add the month's licence and run costs, the reviewer hours at a loaded rate, the cost of translation and native-language review, and the cost of second review and quality checks; divide by the alerts decided that month.

The structure shows why per-seat comparisons mislead. Two products at the same licence price can differ widely in cost per closed alert if one sends twice the noise to reviewers. A product with a higher licence that closes noise with reasons a reviewer can approve in batches can cost less overall. Price the term that moves.

What share of surveillance alerts are false positives?

No regulator or independent study publishes a false-positive rate for communications surveillance at asset managers, and vendors' figures are not comparable because each counts differently. What is published is the direction of travel: the FCA saw banks "exploring AI to filter out false alerts" alongside their lexicons (FCA, August 2025), and the Financial Stability Board noted in 2017 that investigating suspicious transactions "often suffers from a high rate of false positives" in the anti-money-laundering field (FSB, November 2017).

Measure your own in one month. For each lexicon or model, count alerts by disposition: closed as false positive, closed with a coaching note, escalated. Then count again after a blind re-review of a sample, because a false positive that a second reader would have escalated was not false. In the sample firm's September, 9,104 of 9,860 alerts closed as false positives, 668 with coaching notes and 88 were escalated.

How many emails does a surveillance system flag?

It depends on the lexicons more than on the email. FINRA's guidance asks for a lexicon "comprehensive enough to yield a meaningful sample of 'flagged' communications", sized to the firm, its business, customers and locations, including foreign-language terms for branches that need them (FINRA, Regulatory Notice 07-59). A lexicon that flags too little is blind; one that flags too much buries the real alerts.

Three ratios are worth tracking every month: flagged messages per thousand captured, alerts per flagged message, and escalations per thousand alerts. The first is set by the lexicons, the second by how well the system groups messages into conversations, and the third is the signal. When the first rises and the third does not, the extra hits are noise.

Where the reviewer's minutes go

Most of a reviewer's time on a real alert goes on finding things, not judging them. Our estimate for one multilingual alert that ends in an escalation is six hours by hand: an hour and a half finding the rest of the conversation, an hour each on translation, the call check and the reason, and the rest on orders, registers and the supervisor's re-read. With agents doing the finding, the same alert takes under an hour of people's time, nearly all of it reading and writing. That is our estimate on the sample firm's workflow, not a measured result.

Noise alerts cost minutes each, but there are thousands of them. The saving there comes from grouping by reason and approving in batches, with a reason on each alert, rather than opening each one. A reviewer who checks 412 footer alerts with the same reason, sends back any whose body carries risk and approves the rest has reviewed each, and has spent a fraction of the time.

Assigning foreign-language alerts to a native reader, in plain words

Noise is a lexicon problem first

The cheapest alert is the one that should never have fired. FINRA asked for lexicon systems able to exclude "any trailers or disclaimers used by the member", because such text "would 'flag' every such email", and for periodic review of the word list, adding and deleting terms (RN 07-59). A suppression is still a risk: a rule that hides a phrase in a footer must not hide it in a message body.

So test every suppression before it goes live. In the sample firm, a proposed suppression of the standard research distribution footer was run against September: it would have removed 1,140 of 9,860 alerts, missed none of the 88 escalations and affected none of the QA reopens, and every message was still captured and archived. It waits for the head of surveillance to approve it; the person who submitted it cannot.

A suppression back-tested on last month before anyone approves it

What does SEC guidance on email surveillance expect?

The SEC sets the recordkeeping duty and leaves the method to the firm. Advisers must keep written communications about recommendations and advice, funds and securities, orders and performance (17 CFR 275.204-2(a)(7)), whatever the medium. In a December 2018 risk alert on electronic messaging, the SEC's examiners described practices they had observed, among them, where advisers allowed social media or personal email for business, contracting with software vendors to monitor and archive those communications and compare them against "a lexicon of key words and phrases"; they also noted advisers that did no testing or monitoring of their own policies (SEC risk alert, December 2018).

For fiscal 2027 the SEC's examiners say generative "super intelligence (SI)" tools now do surveillance work at some firms, and that they judge the results by the standards that applied before those tools arrived (SEC, FY2027 examination priorities). Buying surveillance software that uses AI is therefore not itself a compliance answer; showing that its closes are reviewed and right is.

The cost of the alert that was not closed well

The other side of the account is a miss. Off-channel recordkeeping cases alone cost firms $2.3 billion in SEC penalties across 95 actions to early fiscal 2025, by the SEC's own count (SEC 2026-34), and the full history is in what the SEC's off-channel sweeps cost firms. Most of those cases began with a message that existed somewhere and was not kept, not with a lexicon miss, but the pattern is the same: the expensive event is the one nobody looked at properly.

The FCA puts the business case in plainer terms. Without effective recording and monitoring, it says, there is "a real risk of loss of monitoring and surveillance capability", and of losing the evidence that settles disputes between a firm and its clients over transaction terms (FCA, Market Watch 66). A cheap surveillance system that cannot show why it closed an alert has not saved that money.

How to compare email surveillance tools on cost

Where Electronic Communications Surveillance changes the cost

Electronic Communications Surveillance changes the reviewer-time term. Its agents rebuild each flagged conversation across channels, put English beside the original, check off-channel moves for a recorded follow-up and propose a disposition with a written, cited reason, so the reviewer reads and decides rather than hunts. Noise arrives grouped by reason for batch approval; alerts below the confidence threshold go to a person as needing judgment; and the QA agent re-reads a sample of closes blind. The design target is every alert closed with a written reason and a named reviewer, which is what the cost per closed alert should buy.

It does not change the licence of the archive or the recorder the firm already runs; it reads them. Going live on that archive is set out in eComms surveillance software on your existing archive, and what the agents may and may not decide is in who may close an alert.

Questions people ask

Is email surveillance software priced per user or per message?

Both models exist, and some vendors price by channel or language as well; prices are not published. Ask for the total for your people, channels and languages over three years, then convert it to a cost per closed alert using your own alert volumes.

How do you reduce false positives in email surveillance?

Exclude your own disclaimers and footers, group flagged messages into conversations, and review lexicon terms against their dispositions regularly, as FINRA's guidance suggests. Back-test every suppression on a past month to show it would not have hidden an escalation, and keep a blind re-review to catch false negatives.

Do small advisers need email surveillance software?

The rules require keeping and supervising communications, not buying software. FINRA's 2007 guidance noted that some small firms could not afford lexicon or sampling programs and allowed manual or combined methods suited to the business. The method must still be reasonable and evidenced.

What does the SEC say about email surveillance?

The SEC requires advisers and broker-dealers to keep business communications, and its examiners have described vendor monitoring and archiving against a lexicon of key words as a practice they observed, and faulted advisers that did no testing or monitoring of their policies. Its fiscal 2027 priorities say the same of surveillance done with what the SEC calls "super intelligence".

How many alerts can one reviewer handle?

No regulator publishes a benchmark. Measure alerts decided per reviewer-hour by alert type, with the blind re-review disagreement rate beside it; a reviewer clearing more alerts with a rising disagreement rate is not more productive. The sample persona in Electronic Communications Surveillance reviews about 140 alerts a day by hand.

Is surveillance software cheaper than outsourcing review?

Compare both on cost per closed alert, including what the outsourcer's reviewers read, how they record reasons and how their quality is checked. FINRA keeps the supervising principal responsible however the work is done, so the firm pays for oversight either way.