Off-channel communications compliance is moving beyond which tools firms permit. The deeper challenge is whether firms can evidence control over who is in scope, which channels are approved, how records are captured, how exceptions are escalated and how supervisors reconstruct context when a regulator asks for proof.
That was the central theme of A-Team’s RegTech Insight webinar, Managing Off-Channel Communications Compliance, sponsored by NICE Actimize. The panel featured Sateesh Kumar Challa of Société Générale; Sarah-Rose Perry of BTIG Limited; and Paul Cottee of NICE Actimize.
First Control Scope
The panel’s starting point was scope. A defensible governance model begins with defining which communications, channels, business units, roles and individuals fall within the control environment. One panellist described this as a matrix: firms need to know which channels are in scope, which businesses use them and which individuals require recording or surveillance.That matters because communication risk extends across email, phone, chat, front-office applications, order management systems, embedded messaging tools and client-preferred platforms. A permitted-tools policy is insufficient if the firm cannot show which populations and channels are governed.
The webinar moved beyond the familiar message that firms should ban unapproved channels. A stronger practitioner insight was that firms need to make compliant behaviour easier. One panellist noted that employees are unlikely to consult a long policy every time a communication feature appears on their desktop. Approved channels need to be clear, systematic and accessible.
Another panellist described this as “setting people up for success.” A firm that provides captured, approved channels on business devices is better placed to evidence practical steps to support compliance. Firm-provided devices also reduce ambiguity over which channels staff should use.
Evidence Underpins Governance
The panel drew a useful distinction between policy and evidence. Written supervisory procedures, policies and attestations are necessary, but they do not represent the operational state – policies must be backed up by evidence that they are being implemented across all core functions. One panellist said the hard part is evidencing that procedures exist, are reviewed and operate over time.
Firms need to show how policies are reviewed, how capture is tested, how alerts are triaged, how breaches are escalated and why decisions were made. Disposition data becomes part of the evidential record: what was reviewed, what conclusion was reached, why a report was not filed and how the firm would explain that decision to a regulator.Peer review and sampling also matter. If one salesperson generates similar ticket volume with fewer recorded communications, that gap may indicate that activity has moved elsewhere.
Prioritize Capture and Archive
For firms upgrading their compliance technology stack, the panel gave a clear sequencing message. Capture comes first. Before analytics, artificial intelligence or workflow orchestration can add value, firms need to ensure all required recorded media enter the surveillance environment, are recorded and visible to compliance officers.
Capture also needs a usable data architecture. The panel discussed the importance of standardised ingestion pipelines that bring communications into a central environment and preserve context around the message, including source, business activity, client relationship and relevant market events. Without that context, archived communications may be captured but still difficult to search, reconstruct or explain.
One panellist recommended running AI alongside lexicons, phrase packs and sampling. Established techniques still create evidence: lexicons find initial terms, phrase packs add structure, sampling tests whether channels are working. AI can then reduce false positives and add context.
Completeness Includes What Is Missing
One of the stronger insights was that completeness includes understanding what a firm did not capture. As one panellist put it, firms are “not just obligated to prove what we monitor or what we have captured, but what we haven’t captured also.”
Off-channel risk often appears as absence: missing initiating communications, low message volumes, client-preferred channels or embedded tools outside the original control inventory. Detecting movement to unapproved channels requires captured communications review and gap analysis.
The panel also addressed a difficult scenario: a client or counterparty starts a business conversation on a personal or unapproved channel. The challenge is how to bring the relevant communication back into the recorded environment without over-collecting personal data.
One panellist described a workflow where staff can upload the relevant screenshot or message extract showing the business communication, while excluding unrelated personal content. Staff need to feel safe raising an issue when the other side initiates an off-channel exchange, provided they move the conversation to an approved route and preserve the required evidence.
The AI discussion was strongest where it focused on concrete use cases: false-positive reduction, duplicate suppression in long email chains, filtering of disclaimers, contextual search, translation and transcription. One panellist described AI’s value in understanding colloquial phrasing in another language and linking it back to trade context. Others pointed to faster investigations and standardisation across lexicons, translation, upstream sources and drift.
Culture Closes the Loop
Off-channel compliance depends on behaviour. Tone from the top, hiring, training, supervision and trust determine whether employees use approved channels, raise exceptions and repatriate business communications. Compliance also needs to explain why information is required and collect only the minimum necessary personal information.
That is where policy control becomes evidence control. The firm must show that staff were trained, tools were available, channels were governed, exceptions were escalated and decisions were documented. Where off-channel activity is discovered by the firm rather than raised by staff, consequences form part of the control framework.
Watch the full RegTech Insight webinar, Managing Off-Channel Communications Compliance
Subscribe to our newsletter
