Communication Capture Obligation

Regulated firms must preserve business communications and produce them on request. The control most organisations implement is a policy: use the approved, archived channel, and do not conduct business on personal messaging applications.

On 27 September 2022 the SEC and CFTC announced settlements with 15 broker-dealers and one investment adviser totalling over $1.1bn, with SEC penalties per firm ranging from $10M to $125M, for failing to preserve business communications conducted on WhatsApp, iMessage and Signal — often on personal devices, and including by senior staff. Every one of those firms had the policy.

The obligation had been placed on the person rather than on the channel, which is a policy repeated indefinitely against a convenience gradient. The gradient wins.

Why it matters

The sanction attaches to the failure to preserve, not to any underlying misconduct, and this surprises people. The reason is structural: the records regime exists so that supervision is possible at all. Losing the records removes the regulator's ability to examine anything, so the recordkeeping failure is the harm.

It has an unusual detection property. A capture failure produces no symptom until records are requested, at which point "we do not have them" is itself the violation. The control is therefore one of the few where the absence of any feedback signal is the defining design problem, and where discovery coincides with the most expensive possible moment.

Implementation patterns

• Make the compliant channel the most convenient one. On the devices people actually use, with the features they need, able to reach external counterparties. This is product work, and it is the intervention that works where prohibition does not.
• Provide a compliant path for the awkward case — the counterparty who will use only one application — through a captured connector or a documented exception, because an unacknowledged exception silently becomes the norm.
• Instrument the gap. Correlate business activity with captured communication volume per person. Material deal activity alongside almost no captured messages is the signal, and it needs no access to anyone's personal device.
• Attest and sample. Attestation alone measures willingness to sign a form; sampling is what gives it meaning, and it must include senior staff or it measures the wrong population.
• Capture at the server, not the client, so coverage does not depend on device configuration or on an agent that can be removed.
• Scope to the obligation. Define which roles and subject matter are in scope and capture those completely, rather than capturing everything.
• Make production a tested capability. Search, export, legal hold and format should be exercised on a schedule, not discovered during a request.

Industry example

The 2022 sweep is the definitive one because the penalties, the mechanism and the remediation are all public. The pattern that separated outcomes was self-reporting and remediation: firms that identified the gap and addressed it were treated differently from those examined into it. The remediations that worked were changes to tooling and channel availability — not stricter bans, which were already in place and had already failed.

Failure scenarios

• Policy without capability. The approved channel cannot reach the counterparty, so the conversation moves and the policy is simply not followed.
• Seniority inversion. The people with the most material conversations accept the least friction, so the gap is widest where the risk is highest.
• Personal devices. Outside the estate, outside device management, and outside any technical control the firm can apply.
• Silent failure of the archive itself — a connector that stops ingesting, discovered during a production request rather than by a completeness check.
• Over-capture in an unregulated context, creating a large sensitive discoverable corpus with its own privacy obligations and breach exposure.
• Retention misconfiguration, where messages are captured and then deleted before the required period, which fails in exactly the same way as never capturing them.

Trade-offs

Capture costs privacy and storage, and the privacy cost is genuine rather than nominal: an archive of employee communications is one of the most sensitive datasets an organisation holds, with its own access control, retention and breach consequences. Scoping to the obligation is what keeps that proportionate.

It also costs product effort on internal tooling that no customer sees, competing for engineering time against revenue work. That competition is the actual reason these programmes fail, and naming it is more useful than another policy reminder.

When not to use it

Do not import this machinery where no obligation exists. An unregulated business that archives all employee communication has created a liability rather than a control, and the sensible posture is retention limited to what the business needs plus a defensible legal-hold capability.

Within a regulated firm, do not apply the widest scope by default either. Capture should match the obligation — a narrow set of roles and subject matter in most firms — because over-collection increases the breach surface without improving supervision.

Interview question

Q: Your firm has an archived approved messaging channel, a policy banning business use of personal apps, and annual attestations. A regulator asks you to demonstrate that business communications are being preserved. What evidence can you produce, and what would you build to make the answer better next year?

What a strong answer covers: recognising that attestation and policy are not evidence of capture; instrumenting the gap by correlating business activity with captured message volume per person, including senior staff; completeness monitoring on the archive's own ingestion, since a stopped connector fails silently; sampling to give attestation meaning; the channel-design argument that the compliant path must be the convenient one, with a compliant route for the counterparty who will use only one app; rehearsed production including search, export and hold; and scoping capture to the obligation to avoid creating an unnecessary sensitive corpus.

Quick check

Quiz: Why did banning personal messaging apps not prevent the 2022 enforcement outcomes? — The bans were in place. The approved channel was less convenient than the alternative, and a policy against a convenience gradient loses; the remediations that worked changed the tooling.

Flashcard: What signal detects a communication capture gap without touching personal devices? — Correlating business activity with captured message volume per person: material deal activity alongside almost no captured messages is the finding.