How closely should financial services firms monitor their employees for use of unauthorized electronic communication channels to conduct company business? What are some of the technology options available? Is it possible to have honest conversations with employees about this topic?

For compliance professionals at these firms, establishing a set of policies and procedures to prevent employee use of nonauthorized electronic communications to conduct business is relatively straightforward.

A firm should decide which communication channels are approved for employees to conduct business. Employees should be trained to understand their communications will be monitored, supervised, recorded, and archived, and they should attest in writing, at least once a year, they understand the policy and pledge not to violate it. The consequences of noncompliance should be clear.

The hard part, as detailed in the 40-plus enforcement actions related to off-channel communications handed down by the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) since December 2021, has been how to enforce those policies. Regulators have found the use of unauthorized electronic communication channels by employees to conduct business to be rampant in the financial services industry for years. They’ve shown they are determined to halt the trend through significant penalties.