The working off-channel communications definition is FINRA's: "business-related communications sent or received on a communication tool that has not been authorized for business use", whether a text message, personal email, a messaging app or a social media inbox (FINRA, 2026 Annual Regulatory Oversight Report). The FCA's version is shorter: communications that "take place outside of monitored, recorded channels a firm has permitted" (FCA, multi-firm review, August 2025). Both put the test on two things, what the message is about and whether the firm keeps it, and neither names an app. That is why the work is hard: a firm cannot see a channel it does not capture, so it has to find the trace of a move, a "call me on my cell" in a captured chat, and prove what followed. Botminds' Electronic Communications Surveillance was built for that check: its agents test every move to another channel against the recorded lines and put the ones with no record in front of a person.
The definition matters because the penalties were large and the beliefs around them are often wrong. Below, five myths are set against what the SEC, CFTC, FINRA and FCA actually wrote. The screens later on show a fictional sample firm, Quillfield Capital, as it runs through the solution.
Five off-channel myths, against what the regulators wrote
The myth: Regulators have outlawed messaging apps for business.
What the rules and orders say: No rule names an app. The FCA says there is no specific restriction on the technologies or apps a firm can use, provided in-scope business on them is recorded and auditable.
The myth: Issue company phones and the risk goes away.
What the rules and orders say: The duty covers equipment the firm provides and equipment it permits. The FCA does not require corporate devices, and the AMF found staff with recorded mobiles calling clients without the recording app.
The myth: This was a Wall Street broker-dealer problem.
What the rules and orders say: Nine of the twelve firms in the SEC’s January 2025 settlement were investment advisers, and the CFTC charged swap dealers and futures commission merchants in parallel.
The myth: Keep the phone and you have nothing to fear.
What the rules and orders say: The violation is failing to keep and produce records the rules require. A message never captured is missing whether or not anyone deleted it.
The myth: We prohibit it in writing; we are covered.
What the rules and orders say: The CFTC’s firms had policies that prohibited it; some of the supervisors meant to enforce them broke them. FINRA faults policies too general to detect or correct a move.
What is the off-channel communications definition regulators use?
Regulators define off-channel communications by the channel's status, not its technology: a business message on a tool the firm has not authorised and does not capture. FINRA's footnote lists the usual suspects, instant messaging applications, text messages, personal email, direct messaging, chat services and the messaging features of third-party apps or social media, and adds the qualifier that does the work: tools "not routinely captured, supervised or retained" by the member firm's systems (FINRA, 2026 report).
The SEC never wrote a rule called "off-channel". The term is shorthand for a failure under two old rules. Broker-dealers keep every business communication they receive and a copy of every one they send (17 CFR 240.17a-4(b)(4)); investment advisers keep written communications about recommendations and advice, funds and securities, orders, and performance (17 CFR 275.204-2(a)(7)). An off-channel message is one of those records sitting somewhere the firm cannot reach. The CFTC used a different phrase, "unapproved communication methods", for the same failure at swap dealers and futures commission merchants (CFTC, September 2022).
In the UK the rule is positive rather than negative. SYSC 10A tells firms to record calls and keep electronic communications about in-scope activity on equipment they provide or permit, and to take reasonable steps to stop staff using privately owned equipment the firm "is unable to record or copy" (FCA Handbook, SYSC 10A.1.6R–10A.1.7R). The UK recording rule has its own guide.
A member firm's obligations to supervise electronic communications are based on the content and audience of the message, rather than the electronic form of the communication.
FINRA, Regulatory Notice 07-59 (December 2007)
What is considered off-channel communication, and what is not?
A message is off-channel when two tests are met: its content falls within a recordkeeping or recording duty, and it travels on a tool the firm does not capture. A text arranging lunch with a client is on an unapproved tool but is not business within the rules; a WhatsApp message saying "buy another 200 at the open" is. FINRA made the content point nearly two decades ago, when a commenter argued that text messages should be outside supervision because surveillance systems could not capture them; FINRA answered that the obligation follows the content and audience of the message (FINRA, Regulatory Notice 07-59).
The FCA draws the same line. Its regime catches communications about regulated activity, such as arranging deals and dealing as agent, and not discussions such as meeting logistics. But the FCA adds that repeated breaches of a firm's own policy, especially by a senior leader, may still warrant supervisory attention even where no rule was broken (FCA, August 2025). In practice, a policy drawn wider than the rule is the only way to be sure the rule is met.
Three edge cases cause most of the argument. Internal messages count: the FCA's recording policy must identify "relevant internal telephone conversations and electronic communications" (SYSC 10A.1.15R), and Rule 17a-4(b)(4) names inter-office communications. Conversations that never lead to a trade count in the UK and EU if they were intended to. And a voice note, an emoji or a GIF is a communication like any other: the FCA saw banks extend their lexicons to all three.
Myth 1: messaging apps such as WhatsApp are banned
No regulator has banned an app. The FCA put it plainly in January 2021: "There is no specific restriction on the technologies or apps firms can use for communications", but in-scope business on them must be recorded and auditable (FCA, Market Watch 66). Its 2025 review repeated that the regime does not single out encrypted apps, and that the FCA does not intend to write a rule for every scenario.
What firms ban is a choice their capture forces on them. If a firm can archive a messaging app through an approved capture tool, staff may use it; if it cannot, it must stop them. That is why "whatsapp compliance archiving" is a common search: the question is never whether the app is legal, only whether the firm keeps what is said on it.
Myth 2: personal phones are the whole problem
The rules cover equipment the firm provides and equipment whose use it accepts or permits, so the line runs between captured and uncaptured, not between firm-owned and personal. A personal phone enrolled in a capture tool can be on-channel; a firm phone used through an app the firm does not record is not. The FCA found most banks in its sample giving client-facing staff corporate devices, some in bright colours for trading floors, while noting that its rules do not require them.
The AMF's 2026 inspections of French asset managers show the gap inside a firm-issued device. All five managers recorded mobile calls only when made through an app linked to the firm's phone system; none checked that staff used it, and one internal survey found five employees calling clients and prospects without it (AMF, September 2026). The voice recording guide follows those findings through.
Myth 3: only Wall Street dealers were charged
The sweeps began with the largest dealers and moved down and across. The SEC's first group order, in September 2022, charged sixteen firms with penalties of more than $1.1 billion (SEC 2022-174). By the last group settlement, in January 2025, nine of the twelve firms charged were investment advisers, settling under the Advisers Act's recordkeeping provisions (SEC 2025-6). The CFTC brought its own cases against swap dealers and futures commission merchants, and by August 2023 had imposed "$1.091 billion in civil monetary penalties on 18 financial institutions" (CFTC 8762-23).
Off-channel communications in three regulators' numbers
95
SEC off-channel recordkeeping actions, with $2.3 billion in penalties, fiscal 2022 to early fiscal 2025
18
institutions charged by the CFTC for unapproved communication methods by August 2023, $1.091 billion in penalties
41%
of 178 internal off-channel breaches at UK wholesale banks involved director grade or above
The sums, the firm-by-firm penalties and the SEC's 2026 change of view, under which the current Commission has distanced itself from the campaign while leaving the rules untouched (SEC 2026-34), are set out in off-channel communications fines and what the sweeps cost. The practical point for an adviser is that the recordkeeping rule it is held to has not changed.
Myth 4: deleting messages is the offence
The offence is the record that is not there. The CFTC's orders found that firms "generally did not maintain and preserve these written communications, and therefore could not provide them promptly to the CFTC when requested" (CFTC 8599-22). Nothing in that finding turns on deletion. A message sent on an uncaptured app and still sitting on the trader's phone is just as missing from the firm's books as one wiped the next day.
Deletion does make it worse, which is why recovery is the first step once a move is found: preserve the device, collect what is on it, and bring the messages into the archive with a note of how they were obtained. But a firm that focuses only on deletion misses the commoner case, the conversation that moved to a phone and was never written anywhere the firm controls. Only the trace in the captured channel, the "text me" or "ring my mobile", shows that it happened at all.
Myth 5: an off-channel communications policy is enough
Every firm in the big orders had a policy. The CFTC found that unapproved methods "violated the swap dealers’ and/or FCMs’ internal policies and procedures", and that "some of the same supervisory personnel responsible for ensuring compliance with the firms’ policies and procedures themselves used non-approved methods of communication" (CFTC 8599-22). A rule that the people enforcing it ignore is not a control.
FINRA's 2026 findings name the gap in the written policies themselves: procedures "overly general" that did not specify the permitted and prohibited platforms, the methods for finding out whether people use unapproved ones, or the corrective action when they do (FINRA, 2026 report). The FCA's breach data makes the same point from the other side. Breaches continued at most banks it surveyed, across every grade, and it found no evidence of the most severe penalties firms said they could impose.
What should an off-channel communications policy say?
A policy that works names the channels, tells staff what to do when a client uses another one, and says how the firm will detect and correct a move. The checklist below is assembled from FINRA's guidance and findings, the FCA's review and SYSC 10A; each line is something an examiner can test.
Ten lines an off-channel communications policy needs
- A list of permitted tools, and a statement that every other one is prohibited
FINRA warns that vague language leaves room for individual interpretation.
- Which permitted tools are internal only
A chat tool approved between colleagues may not be approved for clients.
- A register of approved devices and the people who hold them
SYSC 10A.1.15R requires one and its regular update.
- Pre-approval for business use of any personal device
With a written business reason and an annual re-certification, as FINRA suggests.
- What to do when a client messages on an unapproved app
Reply on an approved channel and bring the message into the archive, with a simple self-disclosure route.
- What happens when the recording system is down
A contingency channel, and evidence of the exceptional circumstance kept for the regulator.
- How the firm detects a move
Lexicon terms for channel hopping, and a fall in a person’s use of approved tools against peers.
- No personal numbers in directories or out-of-office replies
One of the framework changes the FCA saw at banks.
- Graded consequences that are actually applied
From a reminder to compensation and promotion effects, reported to the accountable executive.
- Training with real examples, and attestation
Role-specific scenarios drawn from the firm’s own surveillance, and a sign-off at least once a year.
How do firms detect an off-channel move they cannot see?
Firms detect off-channel communication from its traces in the channels they do capture, and from the absence of activity where it should be. The first trace is linguistic: "call me on my cell", "let's take this to my other app", "ring the desk". FINRA lists frequent revision of the key words used to spot off-channel use as an effective practice, tailored to the business model (FINRA, 2026 report). The FCA saw banks add terms for channel hopping and extend lexicons to emojis, GIFs, voice notes and video.
The second trace is behavioural. FINRA suggests watching for "a decrease or absence of activity" on approved tools a person used to use, and two banks in the FCA's sample compared each person's use of approved apps with peers to find unexpectedly low usage. Neither trace proves a move on its own. A lexicon hit on "call me" is closed as noise at most firms, because nobody checks whether a recorded call followed.
That check is the core of off-channel communications compliance. If a recorded call between the same two people follows within minutes, the move stayed on channel and the alert can close with the recording cited. If none follows, the absence is itself evidence, and a person must decide what it means.
How Electronic Communications Surveillance checks every off-channel move
In Electronic Communications Surveillance the check is done by the Off-channel agent, on every move, in every language the firm's lexicons cover. It searches the turret voice recorder, the mobile capture on enrolled phones and the approved messaging apps for a follow-up between the same people inside a window the firm sets, 30 minutes by default. A match is cited and the alert can close; no match puts the alert in front of a reviewer with every system searched listed. The agent never contacts the employee and cannot see a personal device.
Every move to another channel, matched to a record or in front of a person
The sample firm's busiest case shows why the check matters. A trader on an emerging-markets debt desk replies to a broker in Portuguese, "Me liga no celular, não aqui", call me on my cell, not here, after the broker mentions a deal that is not yet public. The agent searched the turret line, the trader's enrolled phone and the approved apps for the rest of the morning. There was nothing, and the order system shows a sale of USD 12.5 million of the issuer's bonds 23 minutes after the chat.
Proving a negative: the record check behind one off-channel alert
A reviewer escalated it with reason codes for an unrecorded move and non-public information, and the Head of Surveillance countersigned with a written reason; the agents carried out only the steps she ticked, including a recordkeeping review and a referral of the sale to trade surveillance. What the solution cannot do is as important: it cannot read the trader's personal phone. When a move has no record, the review asks the person to preserve and produce the messages, and Legal decides how. How a reviewer's day runs around alerts like this one is in a communications surveillance analyst's day.
Questions people ask
What is off-channel communication in simple terms?
It is business talk on a channel the firm does not keep: a text, a WhatsApp message, a personal email or a social media message about a client, a trade or advice. FINRA defines it as business communication on a tool not authorised for business use, and the FCA as communication outside the monitored, recorded channels a firm permits.
Is there an off-channel communications rule?
Not under that name in the US. The SEC's cases rest on the recordkeeping rules, 17a-4 for broker-dealers and 204-2 for advisers, together with the duty to supervise; FINRA adds Rules 3110 and 4511. In the UK, SYSC 10A requires firms to record in-scope communications and to take reasonable steps to stop unrecordable private devices being used.
Does FINRA have its own off-channel communications rule?
FINRA relies on SEC Rule 17a-4(b)(4) and its own Rules 3110.09, 2210(b)(4) and 4511 for keeping business communications, and lists off-channel use among its 2026 findings. Its effective practices include monitoring for a drop in someone's use of approved tools and revising surveillance key words often.
Is it off-channel if a client texts first?
The message is a business communication the firm must keep whoever started it. Most policies tell staff to reply only on an approved channel and to bring the client's message into the archive. The SEC's examiners described advisers whose procedures required exactly that, with instructions on how to do it (SEC risk alert, December 2018).
Do off-channel rules apply to investment advisers?
Yes. Rule 204-2(a)(7) requires advisers to keep written communications about recommendations, advice, orders, funds and performance, on any medium. Nine of the twelve firms in the SEC's January 2025 settlement were advisers.
Can a firm prove a call stayed on a recorded line?
Only by finding the recording. Matching a "call me" to a recorded call between the same people within a short window shows the move stayed on channel; in the sample firm, 2,171 of 2,206 moves matched within 30 minutes. The rest need a person, because the absence of a record is the finding.