Off-channel communications: what counts, and what to do when a client texts

Off-channel communications are business messages sent or received on a channel the firm doesn’t capture: a text from a personal phone, a messaging app, a personal email account. The SEC’s own description is “unapproved communication methods, known as off-channel communications.” Whether a message has to be kept is decided by what it says, whatever device it was sent from. When a client texts about advice, money moving or a trade, that message is a record the firm has to keep. The job is to get it into the firm’s records, move the conversation to a channel the firm captures, and be able to show the policy behind both is being monitored.

This answer runs in eight parts:

• What the rule makes a record: the four subjects, trade instructions and marketing texts.
• What to do when a client texts, in five steps.
• Monitoring is part of the program, on an order against a stand-alone adviser.
• What the SEC’s off-channel actions say, from the 2024 announcements.
• What the staff has seen work.
• Redan’s position: the answer sits upstream of the incident.
• The record it should leave.
• Frequently asked questions, then the sources.

What the rule makes a record

Rule 204-2(a)(7) requires an adviser to keep “originals of all written communications received and copies of all written communications sent” relating to four subjects:

• any recommendation made or proposed to be made, and any advice given or proposed to be given (204-2(a)(7)(i))
• any receipt, disbursement or delivery of funds or securities (204-2(a)(7)(ii))
• the placing or execution of any order to purchase or sell any security (204-2(a)(7)(iii))
• performance or rate of return, including predecessor performance (204-2(a)(7)(iv))

Other paragraphs reach messages too:

• An instruction to buy or sell. 204-2(a)(3) requires a memorandum of “any instruction received by the investment adviser concerning the purchase, sale, receipt or delivery of a particular security.” A client’s text asking to sell is a written communication under (a)(7) and an instruction the adviser must make a memorandum of under (a)(3).
• A message that markets the firm. Under the Marketing Rule, an advertisement includes a communication to more than one person that offers the adviser’s advisory services (206(4)-1(e)(1)(i)), and the adviser keeps a copy of each one (204-2(a)(11)(i)(A)). A text to two prospects can qualify.
• A message to ten or more people. A communication the adviser sends to ten or more persons is kept under 204-2(a)(11)(i)(B).

Most of these records are kept “in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser” (204-2(e)(1)). Advertisements run on their own clock, set in 204-2(e)(3)(i).

The compliance rule reaches it too. Rule 206(4)-7(a) requires policies and procedures reasonably designed to prevent violations of the Act and its rules, and the Commission said those policies should address, where relevant, “the accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction” (as quoted in the staff’s 2018 electronic messaging risk alert).

What to do when a client texts

The steps below are professional practice, not a rule requirement.

1. Move the conversation first. Reply on a captured channel, or in writing, asking the client to continue there. Stop it before investigating it.
2. Get what already exists into the firm’s records. Collect the whole thread as it stands and file it where the firm keeps written communications.
3. Work out whether it’s one person or a pattern. That decides whether the fix is for a person or for the program.
4. Write it down. What was found, what the employee was told, what was collected, and what changed.
5. Close it in proportion. This step is for the employee’s own failures: business on a personal device, or a message not captured and escalated. A first instance normally closes with a documented warning and retraining. A repeat goes to the disciplinary track, and a repeat of the same breach is a question about the policy, the training or the control that let it through twice.

A client’s text is not a violation, by the client or by the employee who received it. The client chose the channel, and the client isn’t a person the firm supervises. The firm controls what happens next. The employee captures the whole thread, files it into the firm’s records as the procedure says, moves the conversation and tells compliance, within a reasonable time. A text that arrives on a Friday evening and is reported on Monday morning meets that. The firm logs it as an incident handled under its policy, and the employee isn’t warned for following the procedure.

The violation belongs to the employee who uses a personal device to conduct business, or who receives a client’s message and doesn’t capture it and escalate it to compliance.

A trade instruction that arrives by text isn’t executed from the text. The firm acts only on instructions received through an approved channel. Because the client is waiting on a trade, the employee promptly captures the text and files it into the firm’s records, the same as any client message, reaches the client on an approved channel to take the instruction there, and tells compliance. The instruction the firm executes is the one received on the approved channel, and the order memorandum records that one.

What staff send back: “Thanks for your message. I’m not able to act on requests sent by text. Please send it to me at [approved email] or call me on [office line], and I’ll take care of it right away.”

How it’s trained: the reply is part of the off-channel course, with the capture-and-escalate steps above. The employee attests to the procedure when they complete the course and at each annual attestation.

A client who keeps texting. Each message is handled as above: captured, filed, escalated to compliance, and answered with the standard reply. The employee isn’t at fault for a client who keeps texting, as long as each message is captured and escalated. When the pattern repeats, compliance or the relationship owner writes to the client to confirm which channels the firm uses and why. From there it’s a client-relationship conversation, not a matter for the employee’s file.

Monitoring is part of the program

A written ban and signed acknowledgments aren’t enough on their own. The clearest example is an order against a stand-alone investment adviser in August 2024 (Release IA-6652). The firm’s manual prohibited business communications on unapproved channels, and its “employees acknowledged … in writing that they read, understood, and abided by” it. Messages on approved channels were monitored and archived. Messages on unapproved apps on personal devices were not. The Commission found that the firm “failed to implement a system of monitoring reasonably expected to determine whether personnel were following its policies,” and charged it with failure to supervise as well as the records violation. In the order’s example, “a PSAM employee exchanged text messages on an unapproved platform with a client concerning investment strategy.” Staff found the conduct “after an examination.” The firm was censured, ordered to cease and desist, and paid a $1.25 million civil penalty (Press Release 2024-98).

The staff’s 2018 alert lists the supervisory practices it observed, including monitoring and archiving where a firm permits a channel, regular reviews for use the policy doesn’t permit, and a confidential way for employees to report a colleague’s messaging. It also noted advisers “that did not conduct any testing or monitoring to ensure compliance with firm policies and procedures.”

Monitoring starts with a governance document. It lists the approved channels, why each one is approved, what it may be used for, how its messages are captured, and what happens when a conversation goes off channel. Every approved channel is archived. Text messaging on firm devices runs through an archiving service, and a messaging app is approved only in its enterprise version, connected to the same archive. The firm then reviews the archived messages the same way, and on the same schedule, as its email review, and records each review: what was checked, what was found and who checked it.

What the SEC’s off-channel actions say

Two Commission announcements from 2024 include investment advisers, and the second of them includes the adviser order above:

• February 2024. Sixteen firms, among them seven dually registered broker-dealers and advisers and four affiliated advisers, agreed to pay combined civil penalties of more than $81 million. “The investment adviser firms admitted that their employees sent and received off-channel communications related to recommendations made or proposed to be made and advice given or proposed to be given.” The adviser entities were charged with violating Advisers Act recordkeeping provisions and with failing to reasonably supervise. The one firm that self-reported paid a lower penalty (Press Release 2024-18).
• August 2024. Twenty-six broker-dealers, advisers and dual registrants, among them the adviser in the order described above, agreed to pay combined civil penalties of $392.75 million. Three self-reported and, in the Commission’s words, “will pay significantly lower civil penalties than they would have otherwise” (Press Release 2024-98).

In both announcements the failures “involved employees at multiple levels of authority, including supervisors and senior managers,” and every firm was censured and ordered to cease and desist, whatever it paid (Press Releases 2024-18 and 2024-98). The February firms also agreed to have independent compliance consultants review their policies on “the retention of electronic communications found on personal devices” and “their respective frameworks for addressing non-compliance by their employees.”

What the staff has seen work

The SEC’s examination staff reviewed how advisers handle electronic messaging and published the practices it observed in December 2018. Among them:

• Permit only what can be kept. “Permitting only those forms of electronic communication for business purposes that the adviser determines can be used in compliance with the books and records requirements.”
• Ban the apps that can’t be kept. Prohibiting business use of apps that allow anonymous messages, automatic destruction of messages, or that prohibit third-party viewing or back-up.
• A procedure for the message nobody asked for. Where an employee receives a message on a prohibited channel, “requiring in firm procedures that the employee move those messages to another electronic system that the adviser determines can be used in compliance with its books and records obligations, and including specific instructions to employees on how to do so.”
• Training and attestations. Training on what’s permitted and prohibited and the disciplinary consequences, and attestations at the start of employment and regularly after that the person completed the training and complied.
• Control over devices. Prior approval before a personal device can reach firm systems, and software that can monitor for prohibited apps.

These are observed practices, not requirements. Taken with the IA-6652 order, they’re the closest thing to a checklist the staff has published.

Redan’s position: the answer sits upstream of the incident

A firm-issued phone is the most direct way to control where business messages happen. Employees can also use their own phones if two things are true. The firm controls which apps carry business, through device management or a separate work space on the phone. And every approved app is captured into the firm’s archive. That can be a separate business number on the employee’s phone, a service that captures their existing messaging apps, or enterprise versions of messaging apps connected to the archive.

Device management decides which apps hold business data, but it doesn’t record what they send. Whichever route a firm takes, the governance document names it, along with what stays outside it. The capture-and-escalate procedure covers whatever is left. And the capture vendor is diligenced as a critical vendor, because it holds every client conversation the firm has.

Every employee has a trained protocol for the unprompted case, a client messaging them on a channel that isn’t captured, so what follows is a known set of steps. The employee is the first detection point, and has to know the steps before it happens.

Two further parts of Redan’s position:

• An uncaptured business communication is a violation and is recorded as one. Documenting it doesn’t reduce what happened. The documentation shows a program that works by design, with a policy the firm can test, people it can train and a failure it can remediate.
• Where a platform can’t be captured, take screenshots of the conversation. A screenshot is a salvage step, and it has to capture the whole thread legibly and be kept like any other record under 204-2(g), which requires safeguards against “loss, alteration, or destruction.” It doesn’t make the platform an approved channel.

An employee who is determined to conceal messages is a separate problem, handled on a separate track. A firm can’t break into a personal phone, so its remedy is the control it holds: the device, the platform, the training and the monitoring.

The record it should leave

Five records show an off-channel program working:

• The approved-channel list, as part of the written policies the firm keeps while they’re in effect and for five years after (204-2(a)(17)(i)).
• Training and attestations per person, dated, and reassigned when the approved-channel list changes.
• The captured messages themselves, kept for the period 204-2(e)(1) sets.
• The monitoring, with a dated record of each review: what was checked, what was found, and who checked it.
• An incident log in which each event carries its remediation: what happened, when, who, what was done, and whether the policy or the training changed as a result.

Frequently asked questions

What counts as off-channel communications? A business communication sent or received on a channel the firm doesn’t capture and retain, such as a personal text, a messaging app or personal email. For an adviser, the messages that must be kept include the ones 204-2(a)(7) lists (advice and recommendations, funds and securities moving, orders, and performance) and advertisements under 204-2(a)(11). An instruction to buy or sell also has to be recorded in a memorandum under 204-2(a)(3).

A client texted my personal phone. Is that a violation? The rule doesn’t turn on who started the conversation. If the message concerns one of those subjects, it’s a record the firm has to keep. A message that’s never captured is a records failure. One the employee captured, filed into the firm’s records and reported to compliance within a reasonable time isn’t a violation. The violation is a failure to do that, or using the phone for business.

Can staff use WhatsApp or iMessage with clients? Only if the firm has determined it can capture and keep those messages. The staff has observed firms permitting only the channels they can use in compliance with the books-and-records rule, and prohibiting apps that allow automatic deletion.

Do the off-channel fines apply to small advisers? The rule applies regardless of size: 204-2(a)(7) covers every registered adviser. In August 2024 a stand-alone adviser was charged after an examination found staff texting a client about investment strategy on an unapproved app (Release IA-6652). That firm had a written ban and signed acknowledgments, and was charged for not monitoring whether staff followed them.

Is a written policy and an annual attestation enough? Not on the IA-6652 facts. The firm had both, and was charged with failure to supervise because it had no system of monitoring reasonably expected to show whether personnel were following the policy.

Does documenting an off-channel message fix it? Redan’s position is no: an uncaptured message is recorded as a violation. What the documentation shows is that the firm found it, dealt with it, and can show the program working.

Sources

Rule text, the order, the 2018 risk alert and the Commission press releases below are quoted from the source documents. The off-channel announcements cited here run through August 2024. This answer describes nothing after that date. IA-6652 is quoted from the order itself. The other orders behind the press releases are described only as the releases describe them. Redan’s positions and the professional practice described above are labeled as such in the text.