Sending a message has never been easier. A relationship manager can answer a client from a phone in seconds, on whatever app the client happens to prefer. Supervising that same message is a different engineering problem altogether, and in regulated financial services the distance between those two capabilities has become one of the most expensive gaps in the industry.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Two Different Engineering Problems
Consumer messaging apps are built around speed, reach, and privacy. End-to-end encryption, disappearing messages, and personal accounts tied to a phone number are features, not flaws, for the people who designed them. They make the product feel immediate and personal, which is exactly why clients like using them.
Supervision needs almost the opposite. A compliance team has to capture every business conversation, keep it unaltered for years, attribute it to a specific employee, and search it quickly when a regulator or a court asks. It needs context too: who else was in the thread, what attachments were shared, and whether a message was edited or deleted. None of that comes built into an app designed for friends and family.
What the Rulebook Actually Asks For
For US broker-dealers, the starting point for anything a firm says to investors is FINRA’s content standard. A FINRA Rule 2210 communications with the public summary usually begins with its three categories: correspondence, retail communications, and institutional communications. Each carries different approval and review expectations. Retail communications generally need sign-off from a registered principal before they go out, while one-to-one correspondence is usually reviewed under the firm’s written supervisory procedures. The content standards themselves apply across the board, requiring messages to be fair, balanced, and free of misleading claims, whether they arrive as a brochure or a text.
That rule does not stand alone. Supervision obligations sit in FINRA Rule 3110, recordkeeping in Rule 4511, and the SEC’s Rule 17a-4 sets the technical requirements for how business records must be retained. Taken together, they mean a chat about an account is treated much like an email about the same account. It has to be captured, preserved, and available for review.
Where the Gap Opened
The pandemic accelerated a habit that was already forming. As remote work spread, conversations moved onto personal devices and consumer apps, and firms that had archived email reliably for two decades found themselves blind to a growing share of client contact.
Regulators noticed. Reporting from the International Bar Association describes how authorities have stepped up their scrutiny of off-channel communications. The SEC has brought actions against more than 40 broker-dealers and levied over $1.7 billion in penalties, then in April 2024 took its first such case against a registered investment adviser, where some messages had even been set to delete automatically. In August 2024 it fined 26 more firms a combined total of more than $390 million. The same pressure has spread beyond securities regulators: in the UK, energy regulator Ofgem fined Morgan Stanley £5.41 million in 2023 over unrecorded WhatsApp messages about energy trades, despite a policy banning the app for trading.
That last detail is the heart of the problem. Most firms caught in these sweeps did not lack rules. They lacked a way to make the rules stick. Canadian firms face similar expectations, with dealer members required to keep records for seven years and to supervise how staff communicate. The same analysis notes that many settling institutions had policies in place but were not following them, and that app use extended to senior staff, including people responsible for compliance.
Closing It Without Banning the Apps
Outright bans have a poor track record because they fight client behavior rather than working with it. A wealth client who has always texted an adviser will keep texting, and an adviser who replies from a personal phone creates a record nobody controls. The more durable approach is to capture conversations at the point where they happen, so a message on a familiar consumer app is also stored, attributed, and searchable inside the firm’s own systems.
That shifts the design question from "which apps are allowed" to "which conversations can we see." Firms that approach it this way tend to focus on a few practical capabilities. Messages should be recorded in full thread context, including edits and deletions. Employee identity should be tied to a managed business line rather than a personal number. Records should flow into the same archive and review queue as email, so supervisors are not juggling separate systems.
Review itself also needs to scale. No compliance team can read every message, so surveillance depends on risk-based sampling, keyword and pattern flags, and escalation paths that route unusual activity to a human quickly. The goal is not to monitor everything equally but to make sure nothing important is invisible.
Clients are part of the equation as well. Lawyers quoted in the IBA piece point out that customers picked up the same informal habits as employees, so even an adviser who writes from an approved channel may receive a reply on a personal device. Firms therefore need a simple, repeatable way to pull those replies back into the record, along with training that explains to staff, in concrete terms, which conversations count as business and which do not. A policy that names approved channels, gives examples of off-channel risk, and states the consequences of ignoring it is far easier to enforce than one that simply says "use company systems." It also gives supervisors something specific to test when they sample conversations each month.
When the Archive Knows as Much as the Chat
The firms that avoid enforcement headlines are rarely the ones with the longest policy documents. They are the ones whose supervision tools see the same conversations their employees are having, in the same channels, at the same time. When the archive holds the full thread and the reviewer can reconstruct what was promised to a client and when, the gap between sending and supervising disappears.
Getting there is less about new rules than about honest inventory. Map where client conversations really happen today, not where the policy says they should happen, and then build capture around that reality. Regulators have made clear that a written prohibition is not a control. A record that exists, and can be produced, is.
Related articles
- Vite 8 vs Rspack vs Turbopack: 20x npm Download Gap [2026]
- OpenCode vs Codex CLI vs Gemini CLI: 103K Star Gap [2026]
- How the Best Workforce Management Software Boosts Team Output
- Build a VS Code Language Server Extension: 13 Steps [2026]
