# Compliance Resources | SEC & FINRA Guides

Regulatory guides, technical resources, vendor comparisons, and insights. Everything your compliance team needs to understand for SEC and FINRA reqs.

Source: https://commacompliance.com/resources
Last updated: 2026-08-25

---

# Compliance Resources

Regulatory guides, technical deep-dives, enforcement coverage, vendor comparisons, and help docs — built for compliance teams at regulated firms.

Regulatory Guides

## Rules Your Firm Needs to Know

### [SEC Rule 17a-4](/regulations/sec-17a-4)

Retention periods, WORM storage, and what the rule actually requires in practice. The foundation of books-and-records compliance.

SEC · Books & Records

Read guide →

### [SEC Rule 17a-3](/regulations/sec-17a-3)

17a-3 is where the capture obligation comes from. Most firms focus on storage and skip this rule. Here's what broker-dealers need to know.

SEC · Books & Records

Read guide →

### [FINRA Rule 4511: Books and Records](/regulations/finra-rule-4511)

What broker-dealers must create and preserve, and how FINRA examines for recordkeeping failures.

FINRA · Books & Records

Read guide →

### [FINRA Off-Channel Enforcement](/regulations/finra-off-channel-communications)

Over $3.2 billion in penalties since 2021. What FINRA examiners look for and what firms that got fined had in common.

FINRA · Enforcement

Read guide →

### [Complete Regulatory Reference](/regulations)

The full index of regulations that govern communications compliance — SEC, FINRA, MiFID II, IIROC, and more.

All Regulations

Browse all guides →

Compliance Guides

## Practical Guides for Your Team

### [Off-Channel Communications Compliance](/off-channel-communications-compliance)

What off-channel means, why regulators care, and how to build a defensible program — personal devices, WhatsApp, Signal, and iMessage.

Off-Channel · Policy

Read guide →

### [BYOD Messaging Compliance](/byod-messaging-compliance)

How to handle personal device use in regulated environments — policies, capture strategies, and what firms get wrong.

BYOD · Policy

Read guide →

### [Off-Channel Compliance for RIAs](/guides/off-channel-compliance-for-rias)

Investment advisers face the same off-channel obligations as broker-dealers. What RIAs must capture, retain, and produce under SEC Rule 204-2.

RIA · SEC Rule 204-2

Read guide →

### [Key Compliance Terms](/key-compliance-terms)

A plain-English glossary of the terminology that comes up most in SEC and FINRA compliance conversations — WORM, books-and-records, off-channel, and more.

Reference · SEC & FINRA

Browse terms →

### [Exam-Ready Checklist](/regulations/exam-ready-checklist)

A practical checklist for RIAs and broker-dealers preparing for SEC or FINRA examination — archive readiness, WSPs, supervision documentation.

Exam Prep · SEC · FINRA

View checklist →

AI

## When AI Use Becomes a Business Record

### [Are LLM tool calls business records?](/ai/are-llm-tool-calls-business-records)

What a tool call is, why it is the strongest signal of regulated activity in an AI session, and what an examiner is likely to ask for.

AI · Books & Records

Read guide →

### [Are ChatGPT conversations business records?](/ai/are-chatgpt-conversations-business-records)

When a ChatGPT session is a business record, what current vendor capture covers, and what is missing.

AI · Books & Records

Read guide →

How Comma Works

## Technical & Architecture Resources

### [WORM Storage & SEC Rule 17a-4](/resources/worm-storage)

What WORM actually means, why it matters, and how Comma's archive is designed against the immutable storage requirements of SEC Rule 17a-4.

Architecture · Compliance

Read deep-dive →

### [Open-Source Capture Architecture](/resources/open-source-capture)

Why Comma published its WhatsApp and Signal connectors on GitHub — and what that means for trust, auditability, and compliance.

Open Source · Architecture

Read deep-dive →

Insights

## Recent Analysis & Enforcement Coverage

### [FINRA May 2025 Enforcement Actions](/post/finra-fine-may-2025)

A breakdown of FINRA's May 2025 disciplinary actions — false attestations, social media violations, and what they signal for exam priorities.

FINRA · Enforcement · 2025

Read post →

### [SEC 2026 Examination Priorities](/post/sec-2026-examination-priorities-key-changes)

What the SEC's 2026 exam priorities mean for your firm's communications compliance program.

SEC · Exam Priorities

Read post →

### [The TeleMessage Breach Timeline](/post/telemessage-signal-timeline)

What happened when TeleMessage was breached — and what it reveals about the risks of modified-app capture architecture.

Security · Architecture

Read post →

### [Off-Channel Compliance Crisis](/post/off-channel-compliance-crisis)

How the SEC and FINRA off-channel enforcement wave changed what firms must do to stay compliant.

Off-Channel · Enforcement

Read post →

### [FINRA Regulatory Notice 25-07](/post/finras-25-07)

FINRA's latest regulatory notice and what it means for your supervision and recordkeeping obligations.

FINRA · Regulatory Notice

Read post →

### [Why We Open-Sourced Our Capture Code](/post/open-sourcing-whatsapp-signal-capture-code-for-true-compliance)

The case for transparency in compliance infrastructure — and why auditability matters more than promises.

Open Source · Architecture

Read post →

Vendor Comparisons

## How Comma Stacks Up

### [Smarsh Alternative](/compare/smarsh-alternative)

Per-connector pricing adds up fast, and iMessage isn't captured off-device. Comma covers 40+ channels at a flat fee.

Enterprise · Legacy

See comparison →

### [Global Relay Alternative](/compare/global-relay-alternative)

Built for email-first firms. WhatsApp, Signal, and iMessage rely on third-party connectors. Comma captures all three at the point of delivery.

Enterprise · Legacy

See comparison →

### [Microsoft Purview Alternative](/compare/microsoft-purview-alternative)

No iMessage connector. WhatsApp and Signal sync once per day. Comma captures all three in real time.

M365-native · Enterprise

See comparison →

### [View All Comparisons](/compare)

TeleMessage, LeapXpert, Theta Lake, Proofpoint, SteelEye, and more — the full vendor comparison library.

All Vendors

View all →

Documentation

## Inside Comma

### [What's New](/resources/whats-new)

New channels, features, and improvements to your Comma account — so your team is never caught off guard.

Product Updates

See updates →

### [Getting Started](https://docs.commacompliance.com/getting-started/)

Connect WhatsApp, Signal, iMessage, Microsoft Teams, and other channels. Step-by-step setup guides for admins and individual users.

Setup · Integrations

View docs →

### [API Reference](https://docs.commacompliance.com/api/)

REST API documentation for integrating Comma Compliance into your existing systems — authentication, endpoints, and request examples.

API · Developer

View docs →

## See Comma in action.

A 20-minute walkthrough — real capture, real-time flagging, real transparency.

[Get in Touch](/get-in-touch)[Pricing](/pricing)

Last updated: 2026-08-25