By 2009, instant messaging had become the fastest way to get an answer in most financial firms. A trader could confirm a price in four words. A relationship manager could check a client's appetite before picking up the phone. The compliance department, meanwhile, could not tell you what had been said, to whom, or whether any of it had been retained. That gap between how business was actually conducted and what the record showed is one of the most expensive unresolved problems in regulated industries, and the bill has kept arriving for fifteen years.
The Rules Predated the Tools
The recordkeeping obligations were not ambiguous. US broker-dealers were required under Exchange Act Rule 17a-4 to preserve business communications for at least three years in a non-alterable format, and investment advisers faced a five-year retention obligation under the Advisers Act books and records rule. Those rules were written with letters, telexes and eventually email in mind, but they were drafted around the substance of a communication rather than its transport. Regulators said so explicitly as the channels proliferated. FINRA's guidance made clear that the obligation follows the content: text messages, instant messages and chat used for business purposes carry the same supervision and retention requirements as email, and earlier guidance had already extended the same logic to social media and other interactive electronic forums. The practical problem was that the archiving technology of the period was built for email. Instant messaging platforms of 2009 often had no export capability, no server-side logging by default, and no concept of a compliance hold. Firms that wanted to comply faced a choice between deploying a governed messaging platform that staff found inferior, or blocking messaging entirely and watching the traffic move to whatever was left.
Why Prohibition Failed
Most firms chose prohibition, and most prohibitions failed for the same reasons. Speed won. A messaging channel that answers in seconds beats an email that answers in an hour, and in markets where the answer has a price attached, that difference is the job. Counterparties set the channel. A client who prefers to message is not persuaded by your retention policy. Staff followed the client, because the alternative was losing the relationship to a competitor who would. Personal devices made enforcement impossible. Once smartphones were ubiquitous, an employee could conduct business on a personal handset without touching a corporate system. Policy could forbid it; nothing could see it. Supervision was structurally impossible. A supervisor cannot review what is not captured. Firms attested to surveillance programmes that covered email thoroughly and covered the channels people actually used not at all.
The Bill Came Due
The consequences arrived at scale more than a decade later. In September 2022 the SEC announced charges against sixteen Wall Street firms for widespread recordkeeping failures, with combined penalties exceeding $1.1 billion, and the CFTC brought parallel actions the same day. The conduct described in those orders was exactly the 2009 pattern, carried forward: business communications on personal devices and unapproved messaging applications, not captured, not retained, not supervised — including by senior personnel responsible for supervision. The sweep continued. Industry tallies put off-channel communications fines above $3.5 billion since 2021, and the enforcement theme spread beyond the largest institutions. Firms also discovered the collateral effects: SEC settlements carry consequences under self-regulatory organisation rules, affecting membership applications and supervisory obligations well beyond the fine itself. What made these cases notable was not novelty. Nothing about the underlying obligation had changed since 2009. The firms were penalised for a gap they had known about, in some cases documented internally, for over a decade.
Governing Messaging Without Killing It
- Decide the approved channel list, and make it short. Every approved channel needs capture, retention and surveillance. A long list is an unenforceable list.
- Make the approved channel genuinely good. If the compliant tool is slower or clumsier than the alternative, staff will route around it. The compliance case and the user experience case are the same case.
- Capture at the platform, not the device. Server-side or API-level capture survives device loss, personal handsets and employee departure. Device-level solutions do not.
- Cover the client-facing edge explicitly. If clients insist on a channel, either bring it into the approved set with capture, or document the redirection process staff must follow.
- Supervise what you capture. Retention without surveillance satisfies half the rule. Lexicon and risk-based review need to run across messaging with the same rigour applied to email.
- Attest and verify. Periodic attestations matter, but so does testing. Sample staff, check for off-channel patterns, and treat findings as a control failure rather than an individual one.
- Extend to leavers and archives. Messaging history is a business record. Offboarding must preserve it, and retention schedules must outlast employment.
- Apply the same test to new tools. Every new collaboration platform, channel or assistant should be assessed against the capture question before adoption, not after.
The Next Uncaptured Channel
The pattern has an obvious current instance. Business communication is increasingly mediated by collaboration platforms, voice notes, ephemeral messages and now AI assistants that hold substantive conversations about clients, positions and pricing. Some of that is captured. Much of it is not, and the retention properties of an AI conversation — what is stored, for how long, where, and whether it is discoverable — are rarely established before adoption. Regulated firms in the GCC face the same question with additional complexity, since local supervisory expectations and data residency requirements both apply to the archive itself. The 2009 lesson is not that instant messaging was risky. It is that the gap between the channel people use and the channel the firm can produce in an investigation is a liability that compounds quietly for years, and is settled in a single quarter.
Common Questions
Are instant messages subject to the same recordkeeping rules as email?
Yes. Regulators apply obligations to the content of a business communication, not the channel. FINRA guidance has confirmed that texts, instant messages and chat used for business carry the same supervision and retention requirements as email.
How long must business communications be retained?
Under Exchange Act Rule 17a-4, broker-dealers must preserve business communications for at least three years in a non-alterable format; investment advisers face a five-year requirement under the Advisers Act books and records rule.
Why did off-channel communications become an enforcement priority?
Because firms could not produce records regulators requested. The SEC's September 2022 actions against sixteen firms resulted in more than $1.1 billion in combined penalties, and the sweep has continued since.
Does banning messaging solve the problem?
Rarely. Prohibition moves the conversation to personal devices where the firm has no visibility. Capturing an approved channel that staff actually want to use is more effective than forbidding channels you cannot monitor.
Messaging Compliance Review — Outpace maps every channel your people actually use, tests what your archive can produce under request, and closes the capture gaps before a regulator finds them for you.