Off-Channel Communications: Texts, WhatsApp and the Recordkeeping Problem

Start with the answer: if your firm is a broker-dealer, an investment adviser or another regulated business, a text message about business is a record the same way an email is. If it is not captured and kept, you may have a recordkeeping violation even if nothing in the message is improper. The fix is not just a rule against texting. It is a set of approved channels that are captured automatically, plus training, supervision and a way to handle the exceptions.

What 'off-channel' means

Off-channel communications are business messages sent outside the systems the firm captures and supervises: personal text messages, iMessage, WhatsApp, Signal, Telegram, WeChat, direct messages on social media and similar tools. Many are convenient and some are end-to-end encrypted by design, which means the firm cannot see them unless a specific archiving tool is used. That is the point of the problem: the message exists, and the firm has no copy.

Why regulators care

For broker-dealers, the SEC's recordkeeping rule requires the preservation of business-related communications. For advisers, the books-and-records rule covers written communications on advice and recommendations. FINRA's Regulatory Notice 17-18 reminded member firms that the rules apply to social media and texting, and that firms must be able to retain and supervise those messages. The SEC has since announced many settled actions against firms and their affiliates, citing widespread use of personal devices for business without capture. The press releases state the findings in detail, and they are worth reading because they show what examiners look for: staff at every level, including senior managers, using unapproved channels, and firms failing to enforce their own policies.

What the enforcement actions have in common

• The firm had a policy that said to use approved channels, and employees did not follow it.
• Supervisors, including managing directors, took part, which made the problem harder to dismiss as a few individuals.
• Messages were about business matters such as client investments, trading and company affairs.
• Firms had no technical way to find out how widespread the practice was until regulators asked.
• Settlements often included a compliance consultant review, improved policies and staff attestations.

Treat the details of any one settlement with care. Terms, amounts and the regulator's current approach vary by case and by year. What stays constant is the rule and the practical risk: an exam, a dispute or a lawsuit that asks for messages you cannot produce.

Building a programme that works

• Decide which channels are approved. Pick a small number of tools that can be captured: business email, an archived chat platform, and a text service built for compliance.
• Capture at the source. Use a vendor that integrates with the app and archives messages into the same searchable store as email, or give staff a business number that is recorded. Do not rely on screenshots or forwarding.
• Write the policy in plain words. Say which tools are allowed, what happens with a message that arrives on a personal app, and how to move that conversation to an approved channel.
• Train people with examples. Show staff what a business message looks like and how to redirect a client who texts their personal number.
• Supervise. Sample captured messages, look for signs of other channels such as 'text me' or 'call me on WhatsApp', and follow up.
• Handle mobile devices. If staff use personal phones, a bring-your-own-device policy with a managed work profile can separate business content from personal.
• Apply the policy evenly. Regulators noted that senior people were often involved, so discipline must not depend on rank.

What about clients who text first

This is the hard case. A client texts an adviser's personal number. Pausing the conversation and asking the client to use an approved channel, with a short prepared reply, is a reasonable approach. Record that you did so. Some firms give each adviser a firm-issued number or a compliant texting app so that the first text already lands in an archive. The policy should say what to do, not rely on judgement in the moment.

Other regulated sectors

The same pattern applies beyond securities. Healthcare organizations have privacy rules for patient messages. Public bodies have public-records laws. Law firms have confidentiality and retention duties. Even where no specific recordkeeping rule exists, a business may face a legal hold in a dispute, and a message on a personal app is still discoverable. The practical steps are the same: approved channels, capture and a clear policy.

A short checklist

Define approved channels. Capture texts and chat into an archive that is searchable and protected from edits. Write and train on a plain policy. Supervise a sample and look for signs of other channels. Handle personal devices with a managed profile. Apply discipline evenly. Review the programme every year with counsel. Our team helps firms set up archived texting and email together. Start with our Email Security, Archiving and Continuity service.

Sources

• SEC, SEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures (press release 2022-174)
• SEC, Enforcement press releases on recordkeeping
• FINRA, Regulatory Notice 17-18, Social Media and Digital Communications
• SEC, 17 CFR 240.17a-4

This article is general information, not legal or compliance advice. Rules and enforcement priorities change; confirm what applies to your firm with qualified counsel and your regulator's current guidance. Last reviewed November 9, 2026.

Keep reading

Next · RegulationBusiness Texting Rules: 10DLC Registration and TCPA ConsentBusiness texts from ordinary local numbers must now be registered with carriers, and many texts need documented consent under US telemarketing law. This guide explains 10DLC, The Campaign Registry and what consent means in practice.7 min read

• SEC Regulation S-P Amendments: A Practical Checklist for Investment Advisers and Broker-Dealers7 min
• The Florida Information Protection Act: A Breach-Response Checklist for Florida Businesses7 min