The pace of headline-making United States Securities and Exchange Commission (SEC) enforcement over off-channel communications has slowed. For Financial Industry Regulatory Authority (FINRA)-regulated firms, however, communications recordkeeping and supervision remain a consistent area of examination focus.
FINRA’s examination findings continue to identify weaknesses in firms’ ability to retain electronic communications, detect business conducted through unapproved platforms, and conduct effective supervisory reviews. These are not new requirements. But their continued appearance in FINRA examinations shows that translating established obligations into effective, demonstrable controls remains a challenge for many firms
A Continuing Examination Priority
Under the guidance of SEC Chair Gary Gensler, SEC enforcement consistently made headlines. Since fiscal year 2022, the prior Commission brought 95 actions and $2.3 billion in penalties in total against firms for book-and-record violations, specifically failing to maintain and preserve off-channel communications. These high-profile actions brought unprecedented attention to firms’ communications recordkeeping and supervision practices.
Following the appointment of SEC Chair Paul Atkins, the pace of SEC recordkeeping enforcement declined. The agency has placed greater emphasis on individual accountability, cross-border misconduct and investor protection, marking a shift from the broad, firm-level actions that characterized the preceding period.
While the volume of these large-scale SEC actions slowed, FINRA’s examination program has continued to assess how member firms retain and supervise business communications. Much of this activity takes place outside the headlines, through routine examinations that result in remediation or supervisory action rather than public disciplinary proceedings.
Inside FINRA’s Examination Priorities
One of the clearest indicators of FINRA’s priorities is its Annual Regulatory Oversight Report. The 2026 report reflects findings from FINRA’s regulatory operations and identifies recurring weaknesses in firms’ communications practices:
- Failure to retain, archive, and review business-related electronic communications.
- Inadequate supervision to detect business communications conducted through off-channel platforms.
- Written supervisory procedures that failed to specify permitted communication channels, detection methods, or corrective actions.
- Inadequate reviews of electronic communications, including limited sampling, ineffective keyword searches, and limited multilingual review.
Taken together, these findings point to gaps across the communications control environment. Firms may have policies and systems in place yet still lack complete coverage across communications channels or sufficient evidence that their controls are operating as intended.
The challenge is becoming more complex as the range of channels employees use to communicate continues to expand.
Legacy Systems Meet Modern Communication
Business conversations do not always occur within a single communications channel. For example, a conversation may begin over Slack, continue via email, and ultimately lead to a virtual Microsoft Teams meeting where documents are shared. Where the conversation relates to firm business, relevant Slack messages, emails, meeting content and shared documents may all be subject to the firm’s recordkeeping and supervisory requirements.
Legacy communications surveillance systems were designed to monitor traditional communication channels, such as corporate email, rather than the wide range of messaging and collaboration platforms employees can use for business today. As business communications have shifted beyond those traditional channels, many firms have developed gaps in their ability to monitor, capture, and retain them with the necessary context. Addressing those gaps remains critical as FINRA continues to scrutinize firms’ recordkeeping and communications supervision practices.
From Policy to Proof
For compliance leaders, the question is not whether the firm has a communications policy. It is whether the firm can demonstrate that its policies, systems, and supervisory processes work together effectively. Key elements include:
- Governance and prevention. Establish clear policies for approved communications channels, supported by regular training and employee attestations.
- Detection and surveillance. Maintain controls capable of identifying business activity conducted outside approved channels, alongside risk-based surveillance that reflects the firm’s business, workforce, and communication practices.
- Recordkeeping. Retain communications in a defensible archive where they remain readily accessible for examinations, investigations and internal reviews.
- Escalation and remediation. Document how potential issues are investigated, escalated and addressed, providing evidence that controls operate effectively in practice.
Capture, surveillance, and retention cannot be treated as separate exercises. Firms also need to consider how communications data relates to other areas of compliance oversight. A message may be only one part of a broader review involving employee trading, outside business activities, disclosures, or an internal investigation.
A weakness in any part of the process can undermine the effectiveness of the wider supervisory program.
An Enduring Supervisory Challenge
Communications compliance may no longer generate the volume of SEC enforcement headlines seen in previous years, but it remains an active area of FINRA examination scrutiny.
The requirements themselves are well established. The continuing challenge for firms is ensuring that their controls keep pace with the expanding range of communications channels, detect business conducted outside approved platforms and account for new ways of communicating—while demonstrating effective oversight across the full employee communications lifecycle and ensuring communications controls operate as part of the firm’s wider compliance framework.
ABOUT THE AUTHOR:
Sean Sullivan is VP of Product, eComms, at MCO (MyComplianceOffice).
Photo credit: Ajay Suresh/Wikimedia Commons
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
