The channel doesn't determine the obligation.

Most firms fined in the SEC and FINRA off-channel sweep had policies. Many had explicit prohibitions on WhatsApp, iMessage, and Signal. The policies didn’t protect them. The missing record did the damage.

Off-channel communications are business messages that occur outside a firm’s supervised archive — any channel employees use for client communication that the compliance system can’t see. If a message involves investment advice, order instructions, or client relationships, it is a regulated record under SEC Rule 17a-4 and FINRA Rules 3110 and 4511. That obligation doesn’t care whether the firm had a policy against it.

The enforcement record

The SEC and FINRA off-channel sweep that began in 2021 produced the largest coordinated recordkeeping enforcement action in history. Over $2 billion in penalties — across firms ranging from tier-one investment banks to mid-size broker-dealers — for a single category of failure: business communications on consumer messaging apps that were never archived.

Named enforcement actions include:

• JPMorgan Chase — $125 million (SEC, December 2021) for widespread use of WhatsApp, iMessage, and personal email among employees including senior management
• Multiple firms — $1.1 billion (SEC, 2022) in a single coordinated action covering off-channel messaging failures across the industry
• 26 firms — $392 million (SEC, 2024) in a follow-on sweep targeting broker-dealers and investment advisers
• Network 1 Financial — $400,000 (FINRA, March 2025) for failures that included having “no mechanism” to monitor or retain text and third-party app messaging

Every case traces to the same gap: employees used consumer apps for client communication, and the firm’s archive couldn’t reach them.

The senior management trap

The JPMorgan fine wasn’t just about junior traders. “Including senior management” appears in the enforcement language for a reason. Examiners specifically look for whether a supervision failure went up the org chart — because if the CCO or a managing director was using WhatsApp, the WSP defense collapses. A firm can’t claim it had adequate supervisory procedures if the people responsible for those procedures were bypassing them.

Compliance officers need to understand that their exposure isn’t only about supervising employees below them. If a senior partner or executive was communicating off-channel, that failure runs upward. The supervision gap and the compliance gap are the same gap.

What firms get cited for

Enforcement patterns are consistent across firm size and type.

App bans without capture. Prohibiting WhatsApp or iMessage doesn’t satisfy the SEC or FINRA if the firm has no way to detect violations or capture communications when they occur anyway. Regulators cite the missing record, not the broken policy.

Email-only archives. Legacy compliance systems built for email leave every mobile and chat channel unmonitored. FINRA exams now ask specifically about non-email channels. “We don’t permit that” is not an acceptable answer if records show employees used those channels anyway.

WSPs that don’t name platforms. Written Supervisory Procedures that reference “electronic communications” without naming specific platforms or devices fail Rule 3110’s specificity requirement. Examiners look for platform-by-platform coverage.

Backup-based capture. Archiving that depends on device backups misses messages deleted before the backup runs, sent while offline, or on devices never backed up. Capture at point of delivery is the architecture that reliably satisfies the requirement.

Social media platforms. Off-channel is not limited to WhatsApp, iMessage, and Signal. In a March 2025 action, FINRA suspended a registered representative for being included on more than 4,000 messages through a social media application about firm business — including customers’ trading, trade surveillance, compliance concerns, and regulatory requests. Any unapproved platform used for firm business generates required records that must be captured and retained. (FINRA Disciplinary Actions, May 2025)

What compliance requires

Capture at point of delivery. The message must be captured when it’s sent or received — before any device dependency, backup cycle, or employee action can affect the record.

WORM-compliant storage. SEC Rule 17a-4(f) requires non-erasable, non-rewritable storage. Records cannot be altered or deleted after archival.

Six-year retention minimum. Broker-dealers must retain records for at least six years. Records from the first two years must be immediately accessible — producible within hours of an examiner request.

Possession, custody, or control. The production obligation extends to every business record within the firm’s possession, custody, or control — including messages sent on personal devices or consumer apps. The device doesn’t change the obligation; the business content does. Custodians who use prohibited apps are still generating records the firm must be able to produce.

Supervisory review capability. FINRA Rule 3110 requires ongoing review of business communications. The archive must be searchable, filterable, and auditable by compliance staff.

Written Supervisory Procedures that name specific channels. WSPs must identify every permitted platform, describe how communications on each are captured, and assign supervision responsibilities.

No IT Deployment Required

Closing the off-channel gap does not require an IT project. WhatsApp, Signal, and iMessage are captured at point of delivery — off-device, with no app modifications, no MDM enrollment, and no software installed on employee phones. There is no device footprint to manage for those channels and no employee opt-in workflow to coordinate.

For firms with 100, 500, or 1,000 registered representatives spread across multiple offices or operating on personal devices, this matters operationally. A deployment that requires MDM policy changes, device enrollment, or IT coordination at each branch location takes months and generates employee friction at every step. Comma deploys across the full user population from a centralized admin console — no branch-by-branch IT engagement required.

What examiners check

During an off-channel communications examination, expect:

• “What channels do your employees use to communicate with clients?” Expect follow-up if the answer doesn’t include consumer messaging apps.
• “How are communications on those channels captured and archived?” You must describe the mechanism, not just the policy.
• “Can you produce all communications between [custodian] and [client] over the past 18 months?” “Same-day production for records within two years” sounds manageable until you’re in the room. Examiners ask for a specific thread — a named custodian, a named client, 18 months of WhatsApp. The production must also demonstrate chain of custody — records must be producible in a form that establishes they haven’t been altered since capture. Firms that have an archive but can’t search it granularly fail this just as badly as firms with no archive.
• “Do your WSPs specifically address WhatsApp, iMessage, and Signal?” Generic language doesn’t satisfy Rule 3110.
• “Show us your supervision logs for mobile messaging.” Evidence of ongoing review is required — not just an archive that exists.

Examiners often arrive with prior context. The SEC’s whistleblower program pays awards on sanctions over $1 million — which means former employees have a direct financial incentive to report off-channel messaging gaps before your next exam cycle.

The self-reporting decision

When a firm discovers an off-channel gap internally, it faces an immediate choice: self-report to FINRA or the SEC, or remediate quietly. Most compliance officers don’t know that self-reporting typically results in significantly lower penalties — and that examiners can usually tell when a firm knew about a gap and chose not to disclose it.

The SEC’s cooperation framework explicitly rewards voluntary disclosure. Firms that self-report before an exam begins, cooperate fully, and remediate promptly have received substantially reduced penalties compared to firms where the gap was discovered by regulators. The firms that fare worst are those where internal records show the gap was known and not disclosed.

This is a decision your legal counsel needs to be part of. But it’s a decision compliance officers should know exists.

The remediation timing problem

Firms that remediate after an exam starts get less credit than firms that remediated before. But firms that remediate suspiciously close to an exam date — particularly if that date was signaled by an incoming request letter — sometimes receive more scrutiny, not less. Examiners are experienced enough to notice when remediation activity spikes right before their arrival.

The timing of when you fix something is part of the record. An off-channel capture solution implemented three years ago looks different from one implemented the week before an exam. Proactive remediation has to be proactive to count.

What happens after the exam

A passed exam doesn’t close the file. Examiners flag firms for follow-up cycles if answers feel incomplete — vague WSP language, production that took longer than expected, or channels that weren’t fully accounted for. There’s a difference between closing an exam and being off their radar. Firms that leave an examiner with open questions tend to see that exam team again sooner than firms that answered cleanly and produced records without friction.

How It Works for Large Firms

Comma supports multi-entity and multi-branch deployments from a single admin console. Compliance leads at the firm level have visibility across all entities and branches; supervision can be scoped per branch, per team, or per registered representative depending on the firm’s supervisory structure. Admin controls include role-based access, per-user channel configuration, and centralized policy management — so a compliance officer overseeing a 12-branch broker-dealer is not managing 12 separate deployments.

Captured communications flow into a single searchable archive regardless of which office, device, or channel they originated from. Examiner production requests — for a specific custodian, a specific client, a specific date range — are fulfilled from that central archive without requiring coordination across branch-level IT or operations teams. Supervision reporting can be filtered and exported at the branch level for firms where examiners review office-by-office.