Off-Channel Communications: Lessons from Recent Enforcement

In recent years, financial regulators imposed billions of dollars in penalties on firms for a recordkeeping failure that sounds almost mundane: employees conducting business over personal texting and messaging apps that the firm did not capture. These “off-channel” communications offer a sharp lesson far beyond Wall Street.

What happened

Broker-dealers and investment advisers are required to preserve business communications. Regulators found that employees — sometimes including senior staff — were routinely discussing business on personal devices and apps (text messages, WhatsApp, and similar) that fell outside the firms’ capture systems. Because those communications were never preserved, the firms could not produce them and were in breach of their recordkeeping obligations. The penalties were substantial and widespread across the industry.

The general lesson

You do not have to be a regulated financial firm for this to matter. The principle is universal: a communication is a record based on its content, not its channel. If business is conducted on a platform the organization cannot capture and retain, the organization cannot meet its recordkeeping, disclosure, or litigation obligations — and “we didn’t keep it” is not a defense.

Why it is hard

Modern work happens across many channels: corporate email, chat platforms, SMS, mobile apps, and collaboration tools. Each is a potential home for records. The challenge is capturing business communications from all of them while respecting privacy and the line between business and personal use.

What to do about it

Organizations generally respond on two complementary fronts:

• Policy. Define which channels may be used for business communications, prohibit unmonitored ones, and make the rules clear and enforced. A policy that bans a channel without providing a usable approved alternative tends to fail.
• Capture. Deploy technology to capture business messages from approved platforms — preserving content along with participants, timestamps, and threading — and bring them under retention and disposition like any other record.

The takeaway

The off-channel enforcement wave made concrete what records professionals had long argued: messaging is recordkeeping. The Capstone lesson applies — automate capture and schedule by rule, rather than relying on individuals to save their own messages. Ignore the channels where business actually happens, and the records simply will not exist when you need them.