Off-Channel Communications Are a Coverage Failure Before They Are a Search Problem

Off-channel communication is often described as an employee-conduct problem. A supervised person used a personal text account, an unapproved messaging service or another channel outside the firm’s capture process.

For a CCO, the immediate operational problem is evidence coverage. A communication may have occurred and influenced advice, recorded a client instruction or documented a conflict. Yet it may be absent from the systems used for supervision and production.

The SEC’s January 2025 announcement concerning twelve broker-dealers and investment advisers is a reminder that this is not solved by a better search box. A search cannot recover evidence that was never captured.

If a firm cannot show what channels were in scope, whether capture operated and how exceptions were resolved, the supervisory record is incomplete.

What the record actually shows

On 13 January 2025, the SEC announced settled charges against nine investment advisers and three broker-dealers for failures to maintain and preserve electronic communications.

According to the SEC’s press release, the investigations uncovered pervasive and longstanding use of unapproved communication methods. The firms admitted the facts stated in their respective SEC orders and acknowledged that their conduct violated recordkeeping requirements under the federal securities laws.

The release states that the firms agreed to pay combined civil penalties of $63.1 million. Individual penalties are listed in the release and the underlying orders. One firm received a significantly reduced penalty after self-reporting, according to the Commission.

The remedies went beyond payment. The firms were ordered to cease and desist from future violations and were censured. They also agreed to retain compliance consultants. The consultants’ work included reviewing policies and procedures relating to electronic communications on personal devices, assessing methods used to prevent and detect off-channel communications, and evaluating employee training.

The press release is a summary of multiple settled administrative proceedings. The firm-specific findings and undertakings are contained in the linked orders. A CCO relying on a particular fact should use the relevant order, not the summary alone.

What this means for an RIA compliance programme

The central examination question is not simply: “Does the firm prohibit unapproved messaging?”

It is: “Could the firm prove that permitted communications were captured, that prohibited-channel risks were tested, and that identified failures were remediated?”

A written prohibition is only the design of a control. It does not show that supervised persons followed it. It also does not show that the firm tested whether communication was occurring elsewhere.

The programme should therefore separate three questions:

• Channel governance: Which communication methods are permitted for each role and activity?
• Evidence capture: Did records from those channels reach the archive completely and on time?
• Behavioural detection: What testing could identify business communications occurring outside approved channels?

These questions should be answered for a defined population and period. A general statement that “email and text are archived” is not enough. The firm should be able to reconcile active supervised persons, approved accounts, configured connectors and archive ingestion records.

Could the firm produce, within the examination window, the list of users whose capture failed during a selected month? Could it show when the failure began, when compliance became aware, which communications were recovered and who accepted any remaining gap?

Could it demonstrate that reviews did not treat missing data as a low-risk result? A client interaction referring to an unavailable text thread should create a coverage exception. It should not receive the same status as an interaction reviewed across every expected source.

Failing closed does not mean presuming misconduct. It means refusing to treat absence of evidence as evidence that nothing occurred. The response may be record recovery, an attestation, targeted sampling, lawful device review, additional supervision or documented acceptance of residual risk.

What “good” evidence looks like

An examiner testing off-channel controls could reasonably ask the firm to produce:

• The approved-channel inventory in force during the review period.
• A roster of supervised persons mapped to approved accounts and devices.
• Connector configuration and ingestion logs showing when capture operated.
• Reconciliations between active users, expected channels and archived users.
• Records of outages, missing data, late ingestion and duplicate capture.
• Surveillance criteria used to identify possible unapproved-channel activity.
• Samples showing a communication traced from its source into the archive and supervisory queue.
• Alerts, reviewer timestamps, evidence viewed and the disposition reached.
• Requests for missing records and any recovered communications.
• Employee attestations, training records and policy acknowledgements.
• Exception owners, due dates, escalation decisions and completion evidence.
• Testing that verified remediation rather than recording only that an action was assigned.

The evidence should preserve scope. A review conclusion should identify the client or adviser, date range, repositories searched, channels unavailable and limitations on the result.

“No concerning communication was found” is not reconstructable unless the reviewer can also show where they looked and why that evidence set was sufficiently complete.

ComplyVault implication

Where meetings, email and messages form one interaction chain, the evidence pack should preserve timestamps, participants, topics, source records, missing-channel exceptions, reviewer decisions and follow-up. Sealing the coverage statement with the reviewed evidence prevents a clean summary from obscuring an incomplete source set.

What to do this week

1. By the end of day two, reconcile the current supervised-person roster against every approved communication platform and archive connector. Record unresolved differences.
2. Select one recent week and trace at least five communications per approved channel from origin to archive to supervisory review. Preserve screenshots or exports showing the timestamps.
3. Identify every capture outage from the last quarter. Assign an owner to document the affected users, period, recovery work and residual gap.
4. Review ten closed supervisory items for references to unavailable messages, calls or meetings. Reopen any item whose conclusion assumed that missing evidence meant no issue existed.
5. Produce one bounded test pack containing the population, sample method, records reviewed, exceptions, remediation and reviewer sign-off. Time how long another compliance team member takes to reconstruct it.